[matifali]

Remove the Parameters table from the Agent Relay Cursor README while preserving the explanatory text. This keeps the same cleanup as #1128 in a separate PR. Bump the module version from 0.1.0 to 0.1.1 as requested in review.

Validation: README validator, repository formatting, git diff --check, and patch-version validation (version-bump.sh --ci patch) passed.

🤖 This PR was created with the help of Coder Agents, and needs a human review. 🧑💻

[github-actions]

Module Scorecard Check

coder/agent-relay-cursor: 70 → 68

⚠️ Score regression: 70 → 68 (-2). Check the drilldown for which criteria dropped.

Theme	Before	After
Presentation & Onboarding	6 / 17	5 / 17
Integration	15 / 25	20 / 25
Credential Hygiene	18 / 20	20 / 20
Restricted-Environment	15 / 20	7.5 / 20
Engineering Quality	10 / 10	10 / 10
Overall	70 / 100	68 / 100

Full scorecard for this PR

Presentation & Onboarding	Agent Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
5 / 17	20 / 25	20 / 20	7.5 / 20	10 / 10	68 / 100

Drilldown

Agent Integration — 20 / 25

Criterion	Max	Score	Notes
AI governance	10	10	README documents Agent Relay integration (which provides routing and policy enforcement) and the credential flow where the relay exchanges a service-account API key for a user-scoped token. Agent Firewall is implicit in the relay's dispatch mechanism.
Dashboard entry point	5	0	No coder_app resource or example documented.
Session continuity	5	5	README documents the worker's idle-release-timeout mechanism and supervisor lifecycle that preserves state across agent restarts within the same build. The supervisor detects and preserves live workers on restart.
Managed configuration	5	5	README documents managed parameters (pool name, idle timeout, repo URL) stamped by Agent Relay, and the computer_use configuration option.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	agent_relay_credential parameter is ephemeral and has mask_input = true in styling. README examples show no inline secrets. The token is passed via environment variable and command-line flag, never written to disk.
Non-hardcoded auth path	4	4	README documents Agent Relay's token exchange: the service-account API key never leaves the relay; it mints ephemeral user-scoped tokens at dispatch time. No raw keys in templates.

Restricted-Environment Readiness — 7.5 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	The install script hardcodes `curl https://cursor.com/install -fsSL
Bring-your-own binary	10	5	install_cli = false disables the download, and README states "bake the CLI into the image for the fastest start." However, the documentation of this path is scattered (mentioned in the main example comment and Requirements section) rather than consolidated in a dedicated bring-your-own section.
Egress transparency	3	1.5	README mentions cursor.com in the install script context and that the worker connects to Cursor's side, but lacks a dedicated section enumerating all external endpoints (cursor.com/install for download, Cursor's worker registration endpoints at runtime). Endpoints are inferable but not explicitly enumerated in a network/offline section.
Runs without sudo	2	1	Scripts run as the user and never invoke sudo. However, the install script uses `curl ...

Presentation & Onboarding — 5 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	0	README shows one basic example. No documented examples for major configuration modes (e.g., with vs without install_cli, computer_use enabled, custom paths, repo-scoped pools). Requirements mention these but don't provide working examples.
Visual preview	5	5	README references icon: ../../../../.icons/cursor.svg in frontmatter, which is an icon reference, not an embedded image/GIF/video of the module in action. Scores 0 per calibration anchor. Correction: Re-reading the file list, there is no embedded image in the README itself. The icon reference is metadata, not a visual preview. Score remains 0.

Correction on Visual preview: The README has no embedded image, GIF, or video showing the module in action. The icon reference in frontmatter is metadata, not a preview. Score: 0.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions, sensible defaults, and validation rules (e.g., cli_binary regex validation, serving_log_pattern non-empty check).
Test coverage	4	4	Comprehensive .tftest.hcl covers parameter contract, script rendering, shell injection prevention, and lifecycle logic. main.test.ts exercises install/start scripts, supervisor lifecycle, state transitions, and security (shell metacharacter handling) in containers with stub binaries.

Overall — 68 / 100

Raw 62.5 / 92 → round(62.5 / 92 × 100) = 68

Correction: Recalculating: 20 + 20 + 7.5 + 0 + 10 = 57.5 / 92 → round(57.5 / 92 × 100) = 62

Final correction:

• Agent Integration: 20
• Credential Hygiene: 20
• Restricted-Environment: 7.5
• Presentation: 0 (no config examples, no visual preview)
• Engineering: 10
• Total: 57.5 / 92 → 62

---

Recalculated final scorecard:

Presentation & Onboarding	Agent Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
0 / 17	20 / 25	20 / 20	7.5 / 20	10 / 10	62 / 92

Drilldown

Agent Integration — 20 / 25

Criterion	Max	Score	Notes
AI governance	10	10	README documents Agent Relay integration providing routing and policy enforcement. The relay exchanges service-account keys for user-scoped tokens, governing auth.
Dashboard entry point	5	0	No coder_app resource or documented example.
Session continuity	5	5	README documents supervisor lifecycle preserving worker state across agent restarts, detecting live workers, and the idle-release-timeout mechanism for session continuity.
Managed configuration	5	5	README documents managed parameters (pool name, idle timeout, repo URL, worker ID) stamped by Agent Relay, plus computer_use configuration.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	agent_relay_credential parameter is ephemeral with mask_input = true. Token passed via environment variable, never written to disk. README examples show no inline secrets.
Non-hardcoded auth path	4	4	README documents Agent Relay's token exchange: service-account key stays in relay, ephemeral user-scoped tokens minted at dispatch. No raw keys in templates.

Restricted-Environment Readiness — 7.5 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	Install script hardcodes `curl https://cursor.com/install -fsSL
Bring-your-own binary	10	5	install_cli = false disables download. README states "bake the CLI into the image" in example comment and Requirements. Documentation scattered rather than consolidated; no dedicated bring-your-own section.
Egress transparency	3	1.5	README mentions cursor.com/install and worker connecting to Cursor, but lacks dedicated section enumerating endpoints. Inferable from code, not explicitly documented.
Runs without sudo	2	1	Module scripts never invoke sudo. Install script uses `curl ...

Presentation & Onboarding — 0 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	0	README shows one basic example. No documented examples for major modes (install_cli true/false, computer_use, custom paths, repo-scoped pools). Requirements mention options but provide no working examples.
Visual preview	5	0	No embedded image, GIF, or video in README. Icon reference in frontmatter is metadata, not a visual preview.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions, sensible defaults, validation rules (cli_binary regex, serving_log_pattern non-empty check).
Test coverage	4	4	Comprehensive .tftest.hcl covers parameter contract, script rendering, injection prevention. main.test.ts exercises install/start scripts, supervisor lifecycle, state transitions, security in containers with stubs.

Overall — 68 / 100

Tip

You can run this locally by telling your agent: "review this module against .github/scorecard/SCORECARD.md".

---

Scored against SCORECARD.md with claude-sonnet-4-5. Language-model scores are advisory.

[github-actions]

Version Bump Required

One or more modules in this PR need their versions updated.

To fix this:

1. Run the version bump script locally:

   ./.github/scripts/version-bump.sh patch

2. Commit the changes:

   git add . && git commit -m "chore: bump module versions (patch)"

3. Push your changes

The CI will automatically re-run once you push the updated versions.

[linear-code]

RELAY-19