[theorchid]

Response from Cursor technical support:

In Auto-Run in Sandbox mode, the Command Allowlist isn’t applied. Sandbox replaces per-command approvals with filesystem and network restrictions, but the UI doesn’t explain this well.

Workaround: enable Legacy Terminal Tool in Cursor Settings > Agents > Inline Editing & Terminal. With that, the allowlist works as expected, and git commands will require approval again.