[coder]

Description

Starts the Cursor worker with --auth-token-file instead of --auth-token, and corrects the docs that still described the old one-hour token.

Token handoff

• The start step writes AGENT_RELAY_CURSOR_TOKEN to $HOME/.coder-modules/coder/agent-relay-cursor/worker-token (umask 077, renamed into place) and the supervisor passes --auth-token-file.
• The supervisor unsets AGENT_RELAY_CURSOR_TOKEN before launching the worker, so neither the worker nor the agent commands it spawns inherit it.
• The supervisor deletes the file when the worker exits. The claim is over by then, so the token is useless.
• Result: the token is no longer in the worker's /proc/<pid>/cmdline, the CLI re-reads the file when it reconnects (so a replacement token written to the same path works without a restart), and the CLI stops logging Auth tokens cannot be refreshed automatically....

Docs

The README's "Worker credential" section and the agent_relay_credential description said the token "expires after an hour" and "is not refreshed". That described the user-scoped sub-token Agent Relay used before 0.11.0. Since then the relay stamps a per-claim Cursor session token. It ends with the claim and has only a 7-day backstop expiry. The README now says so.

No parameter, output, or contract change, so any Agent Relay version works with it.

Type of Change

• New module
• New template
• Bug fix
• Feature/enhancement
• Documentation
• Other

Module Information

Path: registry/coder/modules/agent-relay-cursor
New version: v0.5.0 (agent-relay-cursor is tagged at v0.4.0, so the unreleased 0.5.0 on main ships with this change)
Breaking change: [ ] Yes [x] No

Testing & Validation

• Tests pass (bun test): 19 pass, plus terraform test: 12 pass
• Code formatted (bun fmt)
• Changes tested locally

New and updated assertions: the worker gets --auth-token-file <module dir>/worker-token and never --auth-token or the token value; the file holds the token with mode 600; the worker's environment has no AGENT_RELAY_CURSOR_TOKEN; the file is gone after the worker exits.

Also checked against the real CLI (2026.10.14-941492e): agent worker --help lists --auth-token-file, and with --auth-token-file the worker skips the "cannot be refreshed" warning that --auth-token prints.

Related Issues

Touches start.sh.tftpl and README.md, like #1173 (credentials as workspace secrets) and #1145 (drain on stop). The overlap is small; whichever merges second needs a trivial rebase.

[linear-code]

RELAY-55

[github-actions]

Module Scorecard Check

coder/agent-relay-cursor: 58 → 58

✅ Score unchanged at 58 / 100. This PR does not affect the module's scorecard; the results are still good.

Theme	Before	After
Presentation & Onboarding	6 / 17	6 / 17
Integration	5 / 25	5 / 25
Credential Hygiene	20 / 20	20 / 20
Restricted-Environment	12 / 20	12 / 20
Engineering Quality	10 / 10	10 / 10
Overall	58 / 100	58 / 100

Full scorecard for this PR

Presentation & Onboarding	Agent Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
6 / 17	5 / 25	20 / 20	12 / 20	10 / 10	58 / 100

Drilldown

Presentation & Onboarding — 6 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	6	The README shows one main module block (default install_cli = true). The install_cli = false path is noted in a comment within that same block. computer_use and share_desktop are described in the "Requirements" prose section but lack their own code examples. No separate configuration blocks are provided for each major mode.
Visual preview	5	0	No image, GIF, or video is embedded in the README. The frontmatter icon field references a registry icon SVG, which does not count.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	agent_relay_credential uses mask_input = true in its coder_parameter styling. The README states "the credential is masked." No inline secrets appear in any README example. The token is written to a 0600 file, passed via --auth-token-file, and unset from the worker's environment.
Non-hardcoded auth path	4	4	The "Worker credential" section documents that the pool's service-account key never leaves Agent Relay; Cursor mints a per-claim session token that is stamped as the ephemeral agent_relay_credential parameter. No raw key is pasted into any template.

Restricted-Environment Readiness — 12 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	The install URL https://cursor.com/install is hardcoded in install.sh.tftpl. No module input variable overrides this download URL. cli_binary changes the binary path, not the source URL; install_cli is a boolean toggle. No mirror/artifact-store variable exists.
Bring-your-own binary	10	10	install_cli = false disables the download entirely. The README states: "Bake the CLI into the image and set this to false for faster workspaces." The install script checks command -v ${cli_binary} and skips when present. cli_binary allows pointing to a custom path. Fully documented.
Egress transparency	3	0	No dedicated README section enumerates external endpoints (cursor.com/install, Cursor API, cursor.com/agents). The install_cli variable description mentions "outbound access to cursor.com," but this is scattered in a variable description, not a dedicated network/offline/air-gapped section.
Runs without sudo	2	2	install.sh.tftpl installs to ~/.local/bin via curl | bash with no sudo. start.sh.tftpl writes under $HOME/.coder-modules/… and uses setsid nohup—no sudo. status.sh.tftpl only reads files and checks /proc. No script invokes sudo.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All 8 variables have clear descriptions and sensible defaults. cli_binary has a regex validation rejecting shell metacharacters. share_desktop has a cross-field validation requiring computer_use. serving_log_pattern rejects empty strings.
Test coverage	4	4	main.tftest.hcl (12 test runs) covers the parameter contract, env-var wiring, script content, and validation failures. main.test.ts (14+ test cases) runs real containers with a stub agent binary, exercising the full lifecycle (idle, working, serving, done, failed, orphaned), restart idempotency, shell-injection resistance, token-file permissions, and flag passthrough. Clear separation: HCL tests = business logic; TS tests = end-to-end behavior.

Agent Integration — 5 / 25

Criterion	Max	Score	Notes
AI governance	10	0	No mention of Coder AI Gateway or Agent Firewall in the README or code. The module integrates with Agent Relay (a dispatch mechanism) but does not document AI Gateway routing or Agent Firewall policy enforcement.
Dashboard entry point	5	5	Two coder_app resources are declared: cursor_web ("Open in Cursor Web") and cursor_desktop ("Open in Cursor Desktop"), both external, created conditionally when agent_relay_session_id is set. Documented in the README under the session-id paragraph.
Session continuity	5	0	No documentation of resuming an existing Cursor agent session across reconnects or relaunches. The module handles worker-process restarts (idempotent start step) but does not document session resumption, a persistent session manager, or session-ID-based continuity.
Managed configuration	5	0	No documentation of managed MCP servers, agent settings, policies, or workdir configuration. The module runs the CLI worker but does not expose or document any managed-configuration surface.

Overall — 58 / 100

Raw 53 / 92 → round(53 / 92 × 100) = 58

Tip

You can run this locally by telling your agent: "review this module against .github/scorecard/SCORECARD.md".

---

Scored against SCORECARD.md with solstice-1. Language-model scores are advisory.