Agent access and safety

Where the agent’s file edits land depends on the Agent access setting.

Setting	Where edits land
Work on a copy	Drafted in a git worktree under .sparse/runs/<id>/. Your checkout stays untouched until you accept them.
Ask first	In place, on your real files. The default for new installs. Commands outside an allowlist are refused rather than run automatically.
Full access	In place, on your real files.

In every setting you still get a diff, validator results and a report.

Shell commands are not isolated

None of these settings is an OS sandbox. Shell commands the agent runs execute as your user, with full filesystem and network access. The worktree is a review boundary for file edits only.

• The Ask first allowlist is a best-effort guardrail, not a boundary. It can be worked around, and it doesn’t block network access.
• Full access is remembered with an HMAC seal in the Sparse home. The seal is best-effort too: settings-seal.key is readable by the same user, so it stops a casual rewrite of the settings file but not a process that can read the key.
• Sparse won’t git init or mirror protected locations such as your home directory.
• An upgraded install keeps its current mode.

Folder trust

Repo instruction files (AGENTS.md, CLAUDE.md, .cursorrules, .cursor/rules, and project .sparse rules, skills and subagents) load only after you trust that folder.

sparse trust          # trust this folder
sparse trust list     # trusted folders
sparse trust status   # this folder's status
sparse untrust        # stop trusting this folder

Headless runs (sparse run, sparse agent and the other mode commands) treat the repo as untrusted unless you pass --trust.

Trust decisions live in ~/.sparse/trust.json. On Linux, when user namespaces are allowed, the agent’s shell runs in a mount namespace where that file is read-only. On macOS and elsewhere, commands that name the trust store are refused and file tools can’t write it, but the shell isn’t mount-protected.