perhaps cvs.pm should be doing pushd/popd in case the caller expects its working directory to be left alone.