Skip trust and approval prompts in automation

permissions & sandbox

// what it does

--trust marks the workspace as trusted without prompting, and only works in headless mode. To set the standing gate, cli-config.json's approvalMode takes allowlist (only permitted tokens auto-run), auto-review, or unrestricted. Together they let a CI job proceed without interactive trust or approval dialogs.

// shell

$ cursor-agent -p "deploy the preview" --trust
$ { "approvalMode": "allowlist" }

// gotcha

approvalMode: unrestricted plus --force effectively removes every guardrail except permissions.deny — reserve it for throwaway sandboxes, not repos with secrets or deploy access.

// resources