`cd` and allowlist

[rahilsondhi]

Where does the bug appear (feature/product)?

Cursor IDE

Describe the Bug

I have docker compose in my allowlist, but sometimes Cursor wants to do this:

$ cd /Users/rahil/Sites/music && docker compose exec web npm install 'openai@^4.72.0'

Since cd isn’t in the allowlist, it waits for human approval. However, that dir is my current working dir. So why is it trying to cd? I don’t really want to allow cd in my allowlist because that increases the blast radius. I’d prefer if Cursor just stayed within this work dir

Steps to Reproduce

Try asking Cursor to add run a docker compose command, and it might try to cd first

Expected Behavior

It should not cd

Screenshots / Screen Recordings

Operating System

MacOS

Current Cursor Version (Menu → About Cursor → Copy)

Version: 1.6.45
VSCode Version: 1.99.3
Commit: 3ccce8f55d8cca49f6d28b491a844c699b8719a0
Date: 2025-09-22T18:22:38.013Z
Electron: 34.5.8
Chromium: 132.0.6834.210
Node.js: 20.19.1
V8: 13.2.152.41-electron.0
OS: Darwin arm64 24.5.0

For AI issues: which model did you use?

gpt-5-codex

For AI issues: add Request ID with privacy disabled

e590a8c7-3748-4653-9364-23bba675fa7a

Does this stop you from using Cursor

No - Cursor works, but with this issue

[condor (Condor (Tee))]

hi @rahilsondhi and thank you for the report. I will share it with the team to look into it.

In my opinion you should not add cd to your allowlist.

If you use auto-run and would prefer more autonomous handling, I suggest using a virtual machine with no folders shared with your Mac. In this way, by running macOS inside an VM it can work with very little overhead or performance effect but much more secure.