Always Run stores bare command names from && / heredoc chains, but the next identical-name chain still prompts

Support Bug Reports
,
1

Where does the bug appear (feature/product)?

Cursor IDE

Describe the Bug

Clicking Always Run on a multi-step Shell card extracts bare binaries (cp, git, python) from an && chain and a heredoc. Those names then appear on the Always-run list. A later Shell card that is only those same names, still joined by && and a heredoc, still prompts.

So Always Run is neither “remember this command” nor a working sticky allow on the names it claims to store.

Related but different: Permissions.json allowlists disable Auto-review (with Sandbox) — contradicts docs (file-owned allowlists grey Auto-review). This report is about Shell Always Run matching, not Run Mode greying.

Steps to Reproduce

  1. In Agent mode, trigger a Shell card that is a chain like:
    cp A B && cp C D && git diff --stat – … && PYTHONPATH=src python - <<‘PY’ … PY
  2. On the approval UI, click Always Run (not Run Everything).
  3. Observe the Always-run / allowlist surface now lists bare names, e.g. cp, git, python.
  4. Trigger another Shell card that is again those same binaries in an && chain with a heredoc (same shape as step 1).

Observed 2026-10-03 ~09:44 PT: Always-run list showed cp, git, python while Allowlist mode was selected; the next chain of exactly those names still prompted.

Expected Behavior

Either:

  1. Always Run remembers that specific command / chain and does not re-prompt for an equivalent chain; or
  2. Always Run’s stored bare names actually match subsequent commands that use those binaries (including && and heredocs), and the product docs say clearly that a sticky git allow covers all git subcommands (including push).

Ask: fix matching for && / env prefixes / heredocs, or change the UI so Always Run does not claim bare-name coverage when the matcher cannot honor it.

Operating System

MacOS

Version Information

Version: 3.23.12
OS: Darwin arm64 (macOS)
Build Type: Stable (from installed Cursor.app Info.plist CFBundleShortVersionString 3.23.12)

For AI issues: which model did you use?

Agent Shell Always Run UI (model-agnostic; observed under Auto / Agent chat)

Additional Information

Widening the bare-name allowlist is the wrong “fix” for users who care about safety: sticky git is also a push/reset/remote license; sticky cp overwrites source; sticky python runs arbitrary scripts. That pushes people toward Run Everything.

One-shot Run remains the safe human go for the pending card. Do not treat this as a request to enable Run Everything.

At the time of the card, Run Mode was Allowlist because Auto-review (with Sandbox) was greyed by a non-empty mcpAllowlist in ~/.cursor/permissions.json (staff workaround in #165722: move allowlists into Settings).

Does this stop you from using Cursor

Sometimes - I can sometimes use Cursor

5

A workaround that has worked for me with this kind of matching: put the chain in a script in the repo (scripts/sync.sh or a .ps1) and allowlist that one script. One stable command name, and the content is reviewable in git.

One caution on the second option you listed. If a bare “python” entry matched inside a heredoc chain, it would effectively allow any Python the agent writes. So I think the prompt here is the safer of the two bugs, and exact-chain matching is the fix worth asking for.

7

That’s an interesting tradeoff. Having a version-controlled script definitely makes the approval surface smaller.

I’m curious though, as agents become more autonomous, do you think people will end up approving artifacts (scripts, PRs, plans) rather than individual terminal commands? It feels like reviewing every shell invocation won’t scale.

9

Hey @Jason_Witherspoon, thanks for the report and the clear repro.

You’re right, this is a known issue we’re already tracking, and I’ve added your report to it. The names on your list are fine; what trips the check is a heredoc that comes after && in a chain. In that position the heredoc isn’t tied back to python, so the whole command is treated as not covered and you get prompted, with a reason line that wrongly says the commands aren’t in the allowlist. The PYTHONPATH=src prefix isn’t the cause.

In the meantime, any of these should auto-run with your current entries:

  1. Run the heredoc as its own Shell call (PYTHONPATH=src python - <<'PY' ... PY with nothing chained before it).
  2. Have the agent write the script to a file and run python script.py in the chain instead of a heredoc.
  3. Add a User Rule such as “Never chain a heredoc after && in a shell command; run it as a separate command.”

On your docs question: entries match by prefix, so a bare git entry covers every git subcommand, including push, reset and remote. If you’d rather keep it tight, the Always Run picker also offers narrower options like git diff, and you can review or remove entries under Command Allowlist in Cursor Settings → Agents.