Follow up Cursor upstream updates: .cursor/permissions.json (IDE auto-run surface) and .cursor/BUGBOT.md checks

[dyoshikawa]

Summary

Cursor's IDE/Agent auto-run permission surface (.cursor/permissions.json) was materially expanded during 2026-05/06 by the Auto-review run mode and the SDK's local.autoReview routing, and Bugbot's .cursor/BUGBOT.md code-review instruction files remain an actively developed surface. rulesync supports neither: permissions covers only the CLI's .cursor/cli.json, and cursor is absent from the checks feature.

Recent Releases

Source: cursor.com/changelog (paginated at /changelog/page/N) plus the official docs.

• Cursor Router — 2026-07-22 — changelog — model routing; dashboard-controlled, no repo config file.
• v3.11 Side Chats & Conversation Search — 2026-07-10 — changelog — announces conversation-level hooks (beforeSubmitPrompt, afterAgentResponse, afterAgentThought, stop, subagentStart) for cloud agents.
• v3.10 Team Marketplaces & MCPs — 2026-06-30 — changelog — team MCP servers distributed from the dashboard, not a repo file.
• Bugbot update — 2026-06-10 — changelog page 2 — 3× faster reviews, /review, GitHub/GitLab sync. Bugbot remains actively developed.
• SDK update — 2026-06-04 — changelog page 3 — local.autoReview routing configured through permissions.json with autoRun.allow_instructions / autoRun.block_instructions.
• v3.6 Auto-review run mode — 2026-05-29 — changelog page 3 — new approval mode driven by a classifier, with custom classifier instructions.

Gaps

1. permissions — .cursor/permissions.json (IDE / Agent auto-run surface) unsupported

• Upstream: ~/.cursor/permissions.json and <workspace>/.cursor/permissions.json with mcpAllowlist: string[], terminalAllowlist: string[], and autoRun: { allow_instructions: string[], block_instructions: string[] }. JSONC is supported; a key present in the file "replaces the corresponding IDE allowlist entirely", and per-user and per-repo arrays are concatenated. — permissions reference. Materially expanded in this research window by Auto-review run mode (v3.6, 2026-05-29) and the SDK update routing local.autoReview through permissions.json (2026-06-04).
• rulesync: project + global for the CLI surface only. src/features/permissions/cursor-permissions.ts writes .cursor/cli.json / .cursor/cli-config.json with permissions.{allow,deny} Type(pattern) tokens plus a cursor override carrying approvalMode / sandbox. unsupported for .cursor/permissions.json — grep -rn "permissions.json|autoRun|mcpAllowlist|terminalAllowlist" src/ returns no Cursor adapter, and the dry-run emits only .cursor/cli.json (project) and .cursor/cli-config.json (global).
• History: Follow up Cursor upstream updates: IDE .cursor/permissions.json (mcpAllowlist, terminalAllowlist, autoRun) #1743 filed this and was closed on 2026-06-08 without implementation, explicitly noting it "can be refiled as a focused feature issue once the canonical shape for autoRun (and the allowlist mapping) is decided". Still absent from src/**; the upstream surface has grown since.

2. checks — .cursor/BUGBOT.md code-review instruction files unsupported

• Upstream: "Create .cursor/BUGBOT.md files to provide project-specific context for reviews. Bugbot always includes the root .cursor/BUGBOT.md file and any additional files found while traversing upward from changed files." Nested per-directory BUGBOT.md files are supported. — Bugbot docs.
• rulesync: unsupported. The checks feature registry toolCheckFactories (src/features/checks/checks-processor.ts) contains only amp and hermesagent, and getToolTargets derives from that map, so cursor is absent from the checks column. No occurrence of BUGBOT anywhere under src/.

Proposed Follow-up

1. Add a CursorIdePermissions adapter emitting .cursor/permissions.json at project and global scope. Derive mcpAllowlist from canonical mcp allow rules and terminalAllowlist from canonical bash/shell allow rules; expose autoRun.allow_instructions / autoRun.block_instructions through a cursor-scoped override block in .rulesync/permissions.jsonc, since they are free-form natural-language hints with no canonical category → pattern → action equivalent. Because upstream treats a present key as fully replacing the IDE allowlist, the merge semantics need an explicit decision. This is a public-schema decision that needs maintainer sign-off before implementation.
2. Add a CursorCheck adapter rendering .rulesync/checks/*.md into a project-scoped .cursor/BUGBOT.md, concatenating the checks since Bugbot takes one aggregated instruction file per directory rather than per-check files. Global scope does not apply — Bugbot reads repository files only. Canonical severity / tools frontmatter has no Bugbot equivalent and would be rendered as prose or dropped.

Dimensions verified as already current

• hooks — CURSOR_HOOK_EVENTS (src/types/hooks.ts) contains all 21 documented events (18 agent + 2 tab + workspaceOpen), matching the hooks docs exactly. Per-entry command / type / prompt / timeout / loop_limit / failClosed / matcher are all mapped in src/features/hooks/cursor-hooks.ts; project and global both emit .cursor/hooks.json.
• rules — docs still document only description, globs, alwaysApply; src/features/rules/cursor-rule.ts matches. User/Team rules are dashboard-stored, not files.
• skills — docs list name, description, paths, disable-model-invocation, metadata; src/features/skills/cursor-skill.ts matches.
• subagents — docs list name, description, model, readonly, is_background; src/features/subagents/cursor-subagent.ts matches, both scopes.
• mcp — .cursor/mcp.json project + global; McpServerSchema is a looseObject and CursorMcp writes servers verbatim, so newer keys (envFile, auth) pass through. ${env:NAME} interpolation is handled.
• permissions (CLI) — the approvalMode enum (src/types/permissions.ts) already includes the v3.6 auto-review value, plus sandbox passthrough.
• ignore — .cursorignore emitted; .cursorindexingignore is a recorded intentional non-goal (Follow up Cursor upstream updates: .cursorindexingignore (indexing-only ignore file) #1923).
• plugins/marketplace — closed as out-of-scope wontfix by maintainer decision (Follow up Cursor upstream updates: Plugins/Marketplace packaging surface (Cursor 2.5) #1813, closed 2026-06-11).

Open questions / unconfirmed

• https://cursor.com/changelog is SPA-rendered but WebFetch returned usable content, and paginated history is reachable at /changelog/page/N. Per-version slugs such as /changelog/3-11 return 404, so a few point-release pages could not be opened individually; the paginated index was used instead.
• https://cursor.com/docs/rules.md, /docs/skills.md, /docs/bugbot.md, /docs/reference/permissions.md return 404; the HTML pages were used and are consistent where both were reachable.
• Global ~/.cursor/commands support: no official docs page for custom slash commands could be retrieved, yet CursorCommand.getSettablePaths ignores global. This would be an over-claim in the support matrix rather than an upstream gap — worth a separate check.

References

• https://cursor.com/docs/reference/permissions — the .cursor/permissions.json shape: mcpAllowlist, terminalAllowlist, autoRun.* (gap 1).
• https://cursor.com/changelog/page/3 — Auto-review run mode (v3.6, 2026-05-29) and the SDK update routing local.autoReview through permissions.json (2026-06-04), which is why gap 1 grew.
• https://cursor.com/docs/bugbot — the .cursor/BUGBOT.md instruction-file surface (gap 2).
• https://cursor.com/changelog/page/2 — the 2026-06-10 Bugbot update, evidence the surface is actively developed.
• https://cursor.com/docs/hooks — the 21-event list used to confirm hooks are current.
• https://cursor.com/docs/cli/reference/permissions — the CLI .cursor/cli.json surface rulesync already covers, for contrast with gap 1.

[dyoshikawa]

Processed in the 2026-07-29 scrap-issue batch. Validated both gaps against the Cursor docs; one is implemented, one still needs a maintainer decision.

Gap 2 — .cursor/BUGBOT.md checks: fixed by #2469.

Confirmed against the Bugbot docs: the root .cursor/BUGBOT.md is always included, additional files are picked up while traversing upward from changed files, and there is no user-level instruction file. CursorCheck now emits it at project scope, collapsing every check that targets Cursor into that one file (one marked-up section per check, the same fromRulesyncChecks hook TaktCheck uses) and splitting it back on import. severity and tools have no Bugbot equivalent and are dropped, as they are for Takt. Only the root file is generated — rulesync check sources carry no directory-placement semantics, so the nested per-directory files are out of reach, the same v1 limitation already recorded for Amp's subtree-scoped checks.

One correction to the issue text: the checks registry already held takt as well as amp and hermesagent at the time of writing.

Gap 1 — .cursor/permissions.json: still open, needs a design decision.

Verified as a real gap: the permissions reference documents ~/.cursor/permissions.json and <workspace>/.cursor/permissions.json with mcpAllowlist, terminalAllowlist and autoRun.{allow_instructions,block_instructions}, and rulesync's permissions support for Cursor still covers only the CLI's .cursor/cli.json / .cursor/cli-config.json. This is the same blocker #1743 was closed on, and it has not moved: autoRun.* is free-form natural language with no canonical category → pattern → action equivalent, and the merge semantics need to be settled deliberately — the docs state that per-user and per-repo arrays are concatenated with each other, while the precedence chain is team admin (dashboard) > permissions.json > IDE settings UI. Deciding the canonical shape and how an override may or may not widen a canonical deny is a public-schema call, so this stays open for a maintainer.

On the "global ~/.cursor/commands over-claim" open question: not an over-claim.

CursorCommand.getSettablePaths ignores global because the relative directory is the same in both scopes — in global mode the output root is the home directory, so it writes ~/.cursor/commands/, which is the correct global path. This is covered by the existing e2e global matrix (src/e2e/e2e-commands.spec.ts). No action needed.

Leaving this issue open for gap 1.

[dyoshikawa]

Upstream update (re-check on 2026-08-06)

Additional or changed gaps

One new permissions gap, adjacent to but distinct from the .cursor/permissions.json surface already tracked here — it concerns the CLI file rulesync does emit:

• permissions (project) — rulesync writes global-only cli.json keys into the project-scope file. The CLI configuration reference states "Only permissions can be configured at the project level. All other CLI settings must be set globally" (project file <project>/.cursor/cli.json, global file ~/.cursor/cli-config.json). version, editor.vimMode, approvalMode, and sandbox.* are global-only settings. rulesync's src/features/permissions/cursor-permissions.ts builds one identical object regardless of scope — it unconditionally stamps version: 1 and editor.vimMode: false and merges the cursor tool-scoped override (approvalMode, sandbox) into the top level, while getSettablePaths only switches the filename. A user authoring cursor.approvalMode / cursor.sandbox and generating without --global gets those settings written to a file Cursor ignores, with no warning. Proposed fix: thread the global flag into fromRulesyncPermissions; in project scope emit only permissions, and warn+skip when global-only override keys are supplied for a project-scope generate.

Verified unchanged (for the record)

• Hooks: CURSOR_HOOK_EVENTS still matches the full documented set at cursor.com/docs/hooks, including the Cursor 3.0 additions (beforeSubmitPrompt, afterAgentResponse, afterAgentThought, stop, subagentStart, preCompact).
• Cursor 2.4+ steers slash commands toward Skills (/migrate-to-skills converts commands into SKILL.md with disable-model-invocation: true), and skills discovery now also includes .agents/skills/ and ~/.agents/skills/. Both .cursor/commands and .cursor/skills remain valid, so no rulesync change is needed today — noting it here so a future removal of .cursor/commands is caught.

References

• https://cursor.com/docs/cli/reference/configuration — project vs global CLI settings scoping (basis of the new gap)
• https://cursor.com/docs/hooks — hook event table re-verified

[dyoshikawa]

The project-scope slice is fixed in #2623 (merged).

fromRulesyncPermissions built one object regardless of scope, so version, editor.vimMode and the cursor override's approvalMode/sandbox were written into .cursor/cli.json too. Cursor documents that "Only permissions can be configured at the project level. All other CLI settings must be set globally", so an authored cursor.approvalMode without --global silently never took effect. Project scope now contributes only permissions, and global-only override keys are skipped with a warning naming each one and pointing at --global.

Two refinements that came out of review and are worth recording:

• The warning deliberately does not name version, editor or permissions even though they are override keys. rulesync re-applies its own managed value over those in global scope too, so telling the user --global would help them is a false promise - the override never reaches the file either way.
• Import stays scope-blind: a project cli.json carrying approvalMode (hand-written, or left by an older rulesync) still has it lifted into the cursor override rather than dropped. Losing data on import would be worse, and the next project generate is the right place to say the setting has no effect.

Existing content in a project cli.json is passed through untouched, including a version an earlier rulesync stamped there - rulesync cannot tell its own key from a hand-written one, so deleting it would be destructive.

The BUGBOT.md and permissions.json checks items are untouched and still design-gated.