Workspace restriction still has obvious holes

Support Bug Reports
, , ,
12

Hi @gschelotto, understood. There’s no setting today that takes the option away from the agent, but you can make it a hard stop yourself with a hook. Cursor runs it before every agent command, and it can refuse the command outright, with no approval card.

  1. Make sure the agent’s auto-run mode is set to run in the sandbox. The hook allows only sandboxed commands, so with the sandbox off it blocks everything.

  2. Save this as ~/.cursor/hooks/stay-in-sandbox.py:

import json, sys
req = json.load(sys.stdin)
if req.get("sandbox"):
    print(json.dumps({"permission": "allow"}))
else:
    print(json.dumps({
        "permission": "deny",
        "user_message": "Blocked: this command would run outside the sandbox.",
        "agent_message": "Commands outside the sandbox are not allowed. Work inside the open folder, or stop and say you can't."
    }))
  1. Add the hook to ~/.cursor/hooks.json. If you don’t have that file yet, create it with this:
{
  "version": 1,
  "hooks": {
    "beforeShellExecution": [
      { "command": "python3 hooks/stay-in-sandbox.py", "failClosed": true }
    ]
  }
}

If the file already exists, add the { "command": ... } line to its beforeShellExecution list instead of replacing the file.

Cursor picks up the change as soon as you save, so you don’t need to restart. From then on, any command the agent tries to run outside the sandbox is refused, and that includes requests for wider network access. Because of failClosed, if the script can’t run (for example, python3 isn’t installed), commands are blocked rather than allowed.