You typed “clean up this section” or “make the style consistent” into Composer. git status now shows 14 files changed, 500+ lines moved, naming conventions rewritten, three tests broken. The model wasn’t being greedy. Composer in Agent mode treats any ambiguous instruction as “do what you think is right,” reads across the whole repo, and edits everything it considers related.
Fastest fix: revert first, debug later. If the over-edit came from Agent mode, click the Restore Checkpoint button on the message before the bad turn in the chat timeline. If you had manual edits mixed in, or the changes predate the checkpoint, use git checkout HEAD -- . instead. Then re-issue the request with a bounded prompt in Manual mode or Cmd+K, not Agent.
Revert first: checkpoint vs git
As of June 2026 (Cursor 3.5 / Composer 2.5) you have two undo paths. Pick by what made the edits.
| Situation | Use this | Why |
|---|---|---|
| All bad edits came from one Agent turn | Restore Checkpoint in chat timeline | Cursor snapshots files before each significant Agent change; one click rolls them all back |
| You also hand-edited files in between | git checkout / source control panel | Checkpoints track Agent edits only, not your manual changes |
| Edits span several Agent turns + your edits | git diff then selective git checkout | Git sees everything; checkpoints don’t capture manual work |
| You never committed before starting | git diff > patch first, then revert | Preserve evidence before you discard |
Checkpoints are stored locally, separate from your git history, so restoring one won’t touch your commits. They are a fast in-editor “oh no” button, not version control. Keep committing to git for anything you care about. See Cursor’s checkpoints docs.
Common causes
1. Unbounded verbs in the prompt
“Clean up,” “refactor,” “improve,” “polish,” “modernize” carry no implicit limit. The model reads them as “do everything you’d consider good,” so renames, extractions, reordered params and added comments all happen at once.
How to judge: lift the first verb in your prompt. “Clean up” is unbounded; “rename foo to bar in login.ts” is not.
2. Agent mode has multi-file + shell power by default
In Agent mode Composer can chain read_file then grep then edit_file across the whole repo and run terminal commands. You asked one thing; it “also fixed” eight more it considered related.
How to judge: the mode pill at the bottom of the chat input reads Agent; one reply expanded into a dozen tool calls.
3. No “do not touch” list
The model doesn’t know which files are sacred. migrations/, generated/, vendor/, schema.prisma, vendored SDK wrappers are all high-risk and silently edited if you don’t say “off limits.” A .cursorignore file at repo root keeps paths out of context entirely.
How to judge: run git diff --stat and look for changes in directories you’d never have asked it to touch.
4. No commit between multiple prompts
Prompt, edits, unhappy, next prompt, more edits. After three rounds the diffs are tangled and you can’t separate what came from where. Checkpoints help here too, but only for Agent turns.
How to judge: git log --oneline. If the last commit is from this morning or days ago, you’re in tangled territory.
5. Wrong model picked for the task
In Agent mode, heavy reasoning models lean toward sweeping rewrites; faster models stay closer to surgical patches. As of June 2026 Cursor’s picker includes Claude Opus 4.7 and Sonnet 4.6, GPT-5.5, Gemini 3.1 Pro, and Cursor’s in-house Composer 2.5, plus Auto. For a one-line surgical fix, a top reasoning model like Opus 4.7 tends to over-edit; Sonnet 4.6 or Composer 2.5 usually patch tighter.
How to judge: check the model name in the picker next to the input box. A top-tier reasoning model on a one-line task is a mismatch.
6. Rules don’t enforce “minimal diff”
Without project rules the model defaults to “good-engineer style” learned in training, which includes refactoring code it considers ugly. You must explicitly say “don’t refactor unless asked.”
How to judge: check for .cursor/rules/*.mdc (current format) or a legacy .cursorrules at repo root. No “minimal edits” / “don’t refactor” clause means you need one.
Before you start
- Identify which entry point misbehaved: Composer /
Cmd+K/ chat.Cmd+Kis local to the selection; Composer is repo-wide. Very different blast radius. - The moment you see misedits, stop prompting. If it was an Agent turn, the checkpoint is your fastest undo. Otherwise run
git diff > /tmp/diff.patchfirst, then decide whether to revert. - Note Cursor version (Help → About), active model, and mode. The same prompt on a different model or mode often behaves very differently.
Info to collect
- The exact prompt that triggered the misedit.
git diff --statshowing which files changed by how many lines.- Current model + mode (Agent / Ask / Manual) and whether Max mode is on.
- Whether
.cursor/rules/or.cursorrulesexists, and whether.cursorignoreexists.
Shortest fix path
In “stop bleeding first, fix workflow second” order.
Step 1: Revert and preserve evidence
If the bad edits were a single Agent turn, restore the checkpoint in the chat timeline. Otherwise:
git diff > /tmp/composer-misedit.patch # keep the patch as evidence
git stash # set it aside, don't drop
# Or revert outright:
git checkout HEAD -- . # discards all uncommitted changesStep 2: Cherry-pick what to keep
If 5 of 14 files are worth keeping:
git stash pop # bring the patch back
# Use Cursor's source control panel to discard per-file,
# or via CLI:
git checkout HEAD -- path/to/unwanted-fileOr git add -p for interactive hunk staging.
Step 3: Rewrite the prompt with explicit scope
Swap unbounded verbs for surgical ones, and state forbidden actions:
Before: refactor the auth module
After: In src/auth/login.ts only:
1. Replace the magic string "DEFAULT_TIMEOUT" with the constant from config.
2. Do NOT change function signatures.
3. Do NOT touch any other file.
4. Do NOT add or remove comments.
Output a unified diff, at most 30 lines.Step 4: Drop to Manual mode or Cmd+K
In the chat input, cycle the mode pill with Cmd+. (macOS) / Ctrl+. (Windows/Linux), or Shift+Tab, to switch among Agent / Ask / Manual. Pick Manual: it edits only the files you @ and won’t autonomously iterate across the repo. (Ask is read-only, useful when you just want analysis.)
For the tightest scope, use Cmd+K: select the lines first, then trigger. Power is limited to the selection.
Step 5: Bake “stay conservative” into project rules
Prefer the current format: create .cursor/rules/minimal-diff.mdc with alwaysApply: true so it’s injected into every session. (The single-file .cursorrules at repo root still works but is deprecated as of 2026; you can also use AGENTS.md.)
---
description: Keep edits minimal and scoped
alwaysApply: true
---
- Make the minimum change required to satisfy the prompt.
- Do NOT refactor, rename, or reformat code that is not explicitly mentioned.
- Do NOT touch files in: migrations/, generated/, vendor/, schema.prisma.
- If the task seems to require changes outside the listed files, STOP and ask first.
- Preserve existing comments and import order unless asked to change them.Confirm the rule is active: open the chat input, and the rule should appear in the context/rules indicator. A rule without frontmatter or with alwaysApply: false will be silently skipped unless a glob or the model picks it up.
Step 6: Commit before dangerous tasks
Make git commit -m "wip: before composer" a habit before any big Composer task. Reverting then costs seconds, and you have a clean baseline that checkpoints alone don’t guarantee.
How to confirm it’s fixed
- Rerun the same request in Manual mode; confirm
git diff --statlists only the files you@ed. - Have a teammate open the same workspace and run the same prompt. If the rule is doing the work, the diff should match.
- Run your tests + lint to confirm no style or behavior drift slipped through.
If it still fails
- Reduce the prompt to its smallest: single verb + single file + single target line.
- Confirm the rule is actually loading. A known gotcha (Cursor 3.x): an
alwaysApply: truerule can be treated as “requestable” instead of auto-injected; check the chat’s rules indicator and roll back the last.mdcedit to isolate which clause failed. - Search forum.cursor.com for “composer over-edits”; include version + model + prompt + diff.
- Grab View → Output → “Cursor” logs and post to the forum’s Bug Reports.
FAQ
Can I undo Composer edits without git?
Yes, if they came from Agent mode. Click Restore Checkpoint on the message before the bad turn in the chat timeline. Checkpoints snapshot files before each significant Agent change. They do not capture edits you typed by hand, so for mixed changes use git.
What’s the difference between Agent, Ask, and Manual mode?
Agent is autonomous: it reads the repo, edits multiple files, and runs commands. Manual edits only the files you @ and won’t iterate across the repo. Ask is read-only (analysis, no edits). Cycle them with Cmd+. / Ctrl+. or Shift+Tab.
Which model over-edits the least?
For a surgical, one-file change as of June 2026, Sonnet 4.6 or Cursor’s in-house Composer 2.5 tend to patch tightest. Top reasoning models like Opus 4.7 are better for genuinely large multi-file work but lean toward sweeping rewrites on small tasks.
My .cursorrules is ignored. Why?
Two common reasons. First, the file is deprecated in favor of .cursor/rules/*.mdc; migrate it. Second, an .mdc rule only auto-applies when it has frontmatter with alwaysApply: true (or a matching globs pattern). A plain .md file or alwaysApply: false is treated as on-demand and silently skipped.
How do I stop it touching generated or vendored files?
Add those paths to .cursorignore at repo root so they’re excluded from context entirely, and also list them under a “do NOT touch” clause in your alwaysApply rule as a belt-and-suspenders defense.
Prevention
- Commit before every Composer session so you start clean and checkpoints have a known floor.
- Standardize a prompt template with a “Constraints” section: allowed files / forbidden files / max diff lines.
- Default to Manual mode or
Cmd+K; only flip to Agent when you genuinely need multi-step work. - Lock in a
.cursor/rules/*.mdc“minimum diff” rule plus a.cursorignoresacred-paths list. - Drop loud comments in critical files:
// DO NOT MODIFY without ticket #1234. Models usually skip them.