Agent Relay Cursor module

[github-actions[bot]]

A discussion dedicated to the Agent Relay Cursor module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Agent Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
6 / 17	5 / 25	20 / 20	12 / 20	10 / 10	58 / 100

Drilldown

Presentation & Onboarding — 6 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	6	The main example shows install_cli = true (default) and the additional_args section has a dedicated example. However, computer_use = true and share_desktop = true are only described in the Requirements section with image prerequisites—no standalone module-call example is provided for those modes. install_cli = false is mentioned in a comment but lacks its own example block. Half credit for partial coverage of major modes.
Visual preview	5	0	No image, GIF, or video is embedded in the README. The frontmatter references an SVG icon (icon: ../../../../.icons/cursor.svg), but that is not a visual preview of the module in action.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	agent_relay_credential is declared ephemeral = true with mask_input = true in styling. The token is written to a file with umask 077 (mode 0600), passed via --auth-token-file (never on the command line), and the supervisor unsets AGENT_RELAY_CURSOR_TOKEN so child processes don't inherit it. README examples contain no inline secrets—the credential is always set by Agent Relay.
Non-hardcoded auth path	4	4	The "Worker credential" section documents that the pool's service-account API key never leaves Agent Relay; Cursor mints a per-claim session token that the relay stamps as the ephemeral parameter. No raw keys are pasted into templates.

Restricted-Environment Readiness — 12 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	The install URL https://cursor.com/install is hardcoded in install.sh.tftpl. No module input variable overrides this URL. cli_binary overrides the binary path, not the download source; install_cli is a boolean toggle. No variable exists to point the installer at an internal mirror.
Bring-your-own binary	10	10	install_cli = false (documented in README: "Bake the CLI into the image and set this to false for faster workspaces") disables the download entirely. The install script checks command -v and skips if the binary is already on PATH. The start script adds ~/.local/bin to PATH unconditionally so a baked-in CLI is found. Fully documented.
Egress transparency	3	0	No dedicated README section enumerates external endpoints contacted at install and runtime. cursor.com/install appears in the install_cli description and cursor.com/agents/<id> in the app section, but these are incidental mentions within feature descriptions, not a consolidated egress/network section with air-gapped guidance.
Runs without sudo	2	2	All scripts (install.sh.tftpl, start.sh.tftpl, status.sh.tftpl) operate entirely within $HOME and never invoke sudo. The installer writes to ~/.local/bin; the start script writes to $HOME/.coder-modules/.... No root required.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All 9 variables have clear descriptions, sensible defaults, and type constraints. cli_binary has a regex validation rejecting shell metacharacters. share_desktop validates that computer_use is true. serving_log_pattern rejects empty strings. additional_args rejects empty elements, newlines, and reserved flags (--pool, --auth-token-file, etc.).
Test coverage	4	4	main.tftest.hcl (14 test runs) covers the parameter contract, script rendering, flag wiring, validation failures, and path overrides. main.test.ts (15+ test cases) runs actual containers with stub agent binaries, exercising the full supervisor lifecycle (idle, working, serving, orphaned, done, failed), shell-injection resistance, token file permissions, argument ordering, and restart idempotency. Clear separation: HCL tests for business logic, TS tests for end-to-end behavior.

Agent Integration — 5 / 25

Criterion	Max	Score	Notes
AI governance	10	0	No mention of Coder AI Gateway or Agent Firewall in the README or code. The credential path is Agent Relay's session-token mechanism, which is distinct from AI Gateway/Agent Firewall governance. No documentation of how Coder governs auth, routing, or policy enforcement for this agent.
Dashboard entry point	5	5	Two coder_app resources are declared: cursor_web ("Open in Cursor Web" → https://cursor.com/agents/<id>) and cursor_desktop ("Open in Cursor Desktop" → cursor://anysphere.cursor-deeplink/...). Both are conditional on agent_relay_session_id being set and are documented in the README.
Session continuity	5	0	No documentation of resuming an existing agent session across reconnects or relaunches. The worker is single-use: it exits when its idle-release timer fires, and Agent Relay reaps the workspace. No mention of session ID persistence, native resume, or a persistent session manager (tmux, screen, boo).
Managed configuration	5	0	No documentation of managed MCP, settings, policies, or workdir configuration. The module's scope is running the Cursor CLI worker; no managed config surface is exposed or documented.

Overall — 58 / 100

Raw 53 / 92 → round(53 / 92 × 100) = 58

---

Scored against SCORECARD.md on 2026-10-23 with solstice-1.