Cursor: Auto mode should use Auto-review without the sandbox

[cassiostp]

Problem

In T3, Cursor's runtime modes don't match Cursor's own modes. In Auto, T3 turns Cursor's Auto-review off and runs commands in Cursor's sandbox (cursorRuntimeAgentPolicy). Only Supervised turns Auto-review on.

Mode	Auto-review	Sandbox
Supervised	on	on
Auto-accept edits	off	on
Auto	off	on
Full access	off	off

This has two effects:

• Nothing reviews actions in Auto. Anything the sandbox doesn't allow is refused instead of reviewed. That doesn't match how the mode picker describes Auto ("Supported providers approve routine actions"), and it's the opposite of Cursor's own Auto-review mode.
• Auto has no network access. With the sandbox on and no ~/.cursor/sandbox.json, the SDK blocks all network traffic, so npm install, curl and similar fail in Auto. I've seen this on macOS with T3 0.0.46-nightly.20261006.2752. The default allowlist that Cursor's CLI uses can't be turned on through the SDK ([Bug]: Cursor provider sandbox never includes Cursor's default network allowlist (CLI "sandbox.json + Defaults" mode is ignored) #15775).

Proposal

Run Auto with Auto-review on and the sandbox off. The other modes stay the same, and explicit approvalPolicy / sandboxPolicy overrides still take precedence. Auto threads would get network access again, with Auto-review deciding which commands run.

Mode	Auto-review	Sandbox
Supervised	on	on
Auto-accept edits	off	on
Auto	on	off
Full access	off	off

This matches the Cursor CLI's "Auto-review" approval mode combined with "No Sandbox".

Why only Auto

Ideally every restricted mode would match Cursor's CLI and leave the sandbox optional: Supervised asks, Auto-accept uses the allowlist, Auto uses Auto-review. The local SDK (@cursor/sdk 1.0.35) only offers two on/off switches, local.autoReview and local.sandboxOptions.enabled, and:

• It can't ask the user. Local runs refuse any action that would need approval ("Local SDK runs cannot request interactive approval…").
• The allowlist only works with the sandbox on. With the sandbox off and Auto-review off, everything runs.

So in Supervised and Auto-accept, the sandbox is the only guardrail and has to stay on. Auto is the one mode that has another guardrail (Auto-review), so it can be fixed now.

Trade-offs

• Auto-review becomes Auto's only guardrail. The SDK only turns it on "whenever the connected backend has the Auto-review classifier feature enabled". On an account without that feature, Auto would behave like Full access.
• Auto threads lose the sandbox. Users who want both can use Supervised.
• A smaller alternative is to only turn Auto-review on in Auto and keep the sandbox. That fixes the first problem, but Auto would still have no network access.

Implementation

The change is small: two conditions in cursorRuntimeAgentPolicy, a focused test case for the new mapping, and an updated mode description in docs/user/cursor.md. I have it ready locally and can open a PR if this direction (or the smaller alternative) sounds right.

Related: #15775