fix(installer): never create Cursor's permissions.json (it turns off Run Everything)

[filip131311]

The bug

Reported by Magda: with Cursor's run mode set to Run Everything (unsandboxed), running argent init silently reverts it to Allowlist.

Her diagnosis was exactly right. argent init creates ~/.cursor/permissions.json as { "mcpAllowlist": ["argent:*"] } when the user has no such file, and Cursor derives its Run Mode from that file (verified in the Cursor 3.15.6 bundle):

shouldPermissionsFileConstrainUnrestrictedMode(){
  …
  if (t === "unrestricted") return false;
  if (t === "allowlist" || t === "manual") return true;
  return mcpAllowlist.length > 0 || terminalAllowlist.length > 0;   // ← our write
}

The UI then reads Run Mode (Enforced by ~/.cursor/permissions.json). It doesn't matter what we write — the file merely being non-empty is enough.

Second effect, same write: once the file has an mcpAllowlist, it supersedes the in-IDE MCP allowlist — getEffectiveMcpAllowlist returns the file's list and ignores composerState.mcpAllowedTools, and canAddToAllowlistFromIde("mcp") goes false (editor read-only). A user who had "Always allow"-ed other MCP servers silently stops getting them.

Not to be confused with the older clobbering bug (argent rewriting the file and dropping the user's rules) — that one was fixed by the JSONC append path and is covered by existing tests.

The fix

addAllowlist becomes append-only, never create:

~/.cursor/permissions.json	before	after
absent	created → run mode demoted	left alone
exists, no mcpAllowlist	key added → in-IDE allowlist taken over	left alone
exists with mcpAllowlist	argent:* appended	argent:* appended (unchanged)

Skipping costs those users nothing: under Run Everything the allowlist is never consulted, so the rule we were adding was already a no-op. Where the user already keeps a file-based allowlist, both effects are their own doing and argent:* changes no state — so we still append there.

Existing files are never deleted, argent-only shape included. A file an earlier argent created is indistinguishable from one the user keeps on purpose, and if they like that allowlist it should stay. Removing it is a manual step (or argent uninstall, whose removeAllowlist already prunes the entry and drops the file when nothing else is left).

init now reports the skip instead of claiming it added the rule:

- Cursor (skipped - creating ~/.cursor/permissions.json would turn off Cursor's "Run Everything" mode)

Rejected alternative

Writing "approvalMode": "unrestricted" alongside the allowlist does silence the constraint — but Cursor treats a permissions-file approvalMode as authoritative, not permissive:

getModeFullAutoRun(e){ switch(…){ case "unrestricted": return true;   // forces it ON

That would push users who deliberately chose "Ask every time" into Run Everything. Disqualified.

Scope

IDE only. The cursor-agent CLI is unaffected — its permissions-file provider reports approvalMode: "unrestricted" and only a provider reporting "allowlist" downgrades the merge.

Already-demoted machines are not repaired by this PR: those users delete ~/.cursor/permissions.json (or drop the argent:* rule) once, and Run Everything returns — Cursor evaluates the constraint on read and never writes the demotion back, so nothing needs reconfiguring.

Test plan

• 4 new cases in mcp-configs.test.ts: no file created (+ note), file without mcpAllowlist untouched, existing argent-only file left in place, user-owned file with argent:* left byte-intact
• Existing Cursor allowlist tests (comment/foreign-rule preservation, remove round-trip, argent-only detection) unchanged and green
• packages/argent-installer suite: 558 passed; tsc --build, eslint --max-warnings 0, both knip gates (215/215) clean

🤖 Generated with Claude Code

---

Adopted from #742, generalized

Two ideas from #742 land here in reworked form (credit @softwarebyze):

• --no-allowlist on init and update skips the editor auto-approve allowlist step entirely — a scriptable opt-out for CI images and provisioning, where the prompt never runs. Documented in both --help outputs (the flags-sync test keeps them honest); allowlist_decision telemetry gains decided_by: flag | default | prompt so an automated skip is distinguishable from a user declining.

• Update's allowlist refresh never changes the approval state the user has. addAllowlist takes refresh: true on update's re-run; every adapter now declines (with a note) to re-impose its opted-in value when it is absent or was changed since init:

  • Cursor: argent:* missing from an existing list is not re-appended
  • Zed: a tool_permissions.default the user reset from "allow" stays (the guard honors Zed's project-over-global settings merge)
  • Codex: opt-in derives from entry values (≥1 "approve"), a restricted entry keeps its mode, an all-deny or removed table stays; the one refresh write left anywhere is backfilling tool ids a new version added, for opted-in tables
  • Claude Code: the permissions rule is not re-added (and settings.json not created) on refresh
  • Windsurf/Kiro: a narrowed alwaysAllow/autoApprove stays narrowed
  • Gemini/opencode: an unset/falsified trust/tools toggle stays

  Unlike fix(installer): stop Cursor updates from forcing a partial MCP allowlist #742's createIfMissing:false (which silently made update read-only), the option says what it means, and each skip prints a note (- Cursor: skipped - argent:* is not on this allowlist; opt in via argent init) so a missing auto-approve entry after an update is explainable from the output. argent init remains the explicit (re-)opt-in path.

Known limitations (follow-up material)

• No consent bit is persisted anywhere, so refresh infers intent from file shape — it cannot tell "removed on purpose" from "never added" and errs toward not writing.
• The agent-triggered auto-update (update-argent tool) spawns argent update --yes detached with stdio: "ignore", so the skip notes are not visible on that path and --no-allowlist cannot be passed there. The refresh guards themselves do apply, which removes the harmful overrides; durable observability there needs a log file or telemetry from update.

Test plan (additions)

• 571 installer tests (13 new: per-adapter refresh guards incl. Zed scope-merge and Codex all-deny, --no-allowlist parsing), 295 telemetry, 80 argent (flags-sync green)
• Live from a packed tgz in a sandboxed HOME: --help shows the flag; init -y --no-allowlist writes nothing and says so; removed argent:* / reverted Zed default / deleted opencode entry all survive argent update with notes printed; fully opted-in update prints zero notes and keeps state; update --no-allowlist prints its trace line

[latekvo]

[Diplomat, Deepseek V4 Flash 0731]: Ran the full sweep across the changed lines and their call sites: claims vs code, nearest twin (add vs remove vs sibling adapters), non-happy paths, inputs, reachability both ways, lifetime, plus the absence pass (sibling / prose / symmetry / mutation). Replayed configureAllowlist end-to-end through a sandboxed HOME with only the Cursor adapter; replayed the package suite (558 tests pass, eslint --max-warnings 0 clean; tsc --build is blocked by type-drift from a cross-branch symlinked node_modules, not this PR). Returned one medium and three low findings below.

[latekvo]

[Diplomat, Deepseek V4 Flash 0731]: enabled is set before this loop from adaptersWithAllowlist.length > 0 plus the confirm/nonInteractive decision, so when Cursor is the only allowlist-capable adapter and its addAllowlist returns the new skip note (permissions.json absent, or a missing/empty mcpAllowlist), this line's note renders but no write happens while enabled stays true. Replayed end-to-end: with a fresh HOME, only the Cursor adapter, and nonInteractive=true, configureAllowlist returns enabled: true, prints the - Cursor (skipped ...) line, and creates nothing. That false enabled is what init.ts:253 records via track('installation:allowlist_decision', { is_enabled: true }), and the nonInteractive path (init-allowlist.ts:33-34) sets it true unconditionally with no human to catch the mismatch - so the analytics log the allowlist as enabled for an outcome that did not happen and, under Run Everything, never could.

[filip131311]

Accurate chain, but not new semantics from this PR: the event is named allowlist_decision and records the user's choice (or the nonInteractive default), not per-adapter write outcomes. enabled: true alongside a skipped adapter was already possible before this change via the (no config for this scope) branch a few lines up — decision ≠ outcome has always been the contract here. If we want outcome-level analytics, that's a separate per-adapter event, out of scope for this fix. Not changing.

[latekvo]

[Diplomat, Deepseek V4 Flash 0731]: The new string | void return is documented as 'so init can say so', but update.ts:750 calls addAllowlist and discards the value. On an argent update where Cursor's permissions.json is absent or empty - a machine that a pre-change build would have created the file for - the never-create skip is completely silent; a user refreshing allowlists (the stated intent at update.ts:744) gets no signal that the Cursor rule was not (re)added, even though the SKIP is now the default outcome for exactly this population.

[filip131311]

True, but consistent with update's existing reporting: the allowlist-refresh loop in update.ts has never surfaced per-adapter results — successes print nothing and errors are swallowed with catch { /* non-fatal */ }. The skip is exactly as silent as a success always was there. Surfacing allowlist outcomes on argent update would be a reasonable enhancement to that loop as a whole (all eight adapters, success and error included), but it's a separate change to update's reporting pattern, not a gap this PR introduces. Not changing here.

[filip131311]

@latekvo i need actuall review

[Copilot]

Pull request overview

This PR adjusts the installer’s editor allowlist behavior to avoid unintended changes to users’ IDE security/run-mode settings—most notably Cursor’s “Run Everything”—by making allowlist updates append-only and non-creating, and by making update refreshes non-overriding.

Changes:

• Cursor: prevent creating or expanding ~/.cursor/permissions.json in ways that would demote “Run Everything” or override the in-app MCP allowlist; only append when an existing non-empty MCP allowlist is already present.
• Add --no-allowlist to init and update, and implement “refresh” semantics so periodic updates don’t re-impose user-removed/narrowed opt-ins (with explanatory notes).
• Extend telemetry for allowlist decisions with decided_by to distinguish flag/default/prompt paths.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
packages/telemetry/src/sanitize.ts	Allows new decided_by field for installation:allowlist_decision telemetry validation.
packages/telemetry/src/events.ts	Adds decided_by to the typed telemetry props for allowlist decisions.
packages/argent/src/installer-help.ts	Documents --no-allowlist on init and update help output.
packages/argent-installer/src/init-args.ts	Adds parsing for --no-allowlist on init.
packages/argent-installer/test/init-args.test.ts	Tests --no-allowlist parsing behavior.
packages/argent-installer/src/init-allowlist.ts	Implements skip behavior for --no-allowlist, tracks decidedBy, and surfaces adapter “skip notes”.
packages/argent-installer/src/init.ts	Wires noAllowlist into allowlist configuration and emits telemetry with decided_by.
packages/argent-installer/src/update.ts	Adds --no-allowlist support and refresh-mode allowlist updates with non-overriding notes.
packages/argent-installer/src/mcp-configs.ts	Updates adapter allowlist APIs (notes + refresh mode), adds Cursor “never create permissions.json” rule, and preserves entry-scoped opt-in keys on rewrites.
packages/argent-installer/test/mcp-configs.test.ts	Adds/updates test coverage for Cursor’s permissions behavior and per-adapter refresh guard semantics.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.