An agent run installs dependencies and then runs your integration tests. The install dies on a network error and one test fails writing a cache file into your home directory, yet Cursor asked you to approve neither command and both ran to completion in your terminal. Your Run Mode put both into the sandbox. What best explains the two failures?

The principle — The sandbox is an execution environment, not a prompting preference. When your Run Mode routes a terminal command into it, that command runs in a restricted environment that blocks unauthorised file access and network activity. Whether Cursor asks first and what the command may touch once it is running are two separate questions, and only the second one explains a failure that happens mid-command.

Why the key is correct — Both failures are the restriction doing its job. The dependency install needed to reach a registry over the network and was refused; the test wanted to write a cache file outside the project and was refused. Neither was stopped before it started, which is why no prompt appeared, and both surfaced ordinary-looking errors from the tool rather than from Cursor. That is what makes this confusing in practice: the error text points at the registry or the test, so you go and debug those, when what actually changed is the policy the command ran under.

Why the others are wrong — Reading the sandbox as a question of whether Cursor asks first predicts that any command which starts behaves exactly as it would in your own shell; the restricted environment exists precisely so that it does not. A stalled approval queue is worth ruling out, but it produces silence — no registry error, no test output — because the command was never handed to the shell. And the sandbox does not stand up a throwaway copy of your tree: it denies the access rather than diverting it, and nothing recorded during indexing could serve a package download.

Remember this — When a command that works by hand fails under an agent run, ask what the command needed rather than what it did. Network egress and writes outside the project are the first two capabilities the sandbox takes away, and installs, integration tests and code generators routinely want both. If the command genuinely needs them, the fix is the sandbox configuration or running it outside the sandbox, not rewriting a command that was already correct.

Sources — Cursor's Terminal tool documentation.