I can put “Use pnpm, not npm!” all over my rules, but Cursor will still occasionally forget. Then Cursor bumps into the Denylist and waits, looking up at me with sad, confused puppy-dog eyes until I redirect its focus.
What if we renamed “Denylist” to “Asklist” (since it doesn’t forbid, it just asks the user for confirmation), and had a new Denylist that straight-up refused certain commands, along with an automated response to the agent? With the npm example, every time the agent tried to run npm, it would get the response “Use pnpm, not npm!” instead of running the command.