Agent Relay Cursor module

[github-actions[bot]]

A discussion dedicated to the Agent Relay Cursor module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Agent Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
6 / 17	5 / 25	20 / 20	13.5 / 20	10 / 10	59 / 100

Drilldown

Presentation & Onboarding — 6 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	6	Main install vs. bake-in-image mode (install_cli) has a clear example with sensible defaults, plus examples for additional_args and management_addr. However computer_use/share_desktop and repo-scoped pools (agent_relay_cursor_repo_url) are described only in prose under Requirements, with no accompanying .tf example — not every major mode gets a worked example.
Visual preview	5	0	No image, GIF, or video anywhere in the README.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	No secret ever becomes a module variable or Terraform parameter: AGENT_RELAY_CURSOR_TOKEN is injected directly by the agent as an ephemeral workspace secret and written to a 0600 file, never passed through coder_env/coder_parameter, and the README/comments explicitly document why ("never appears in the build's parameters or Terraform state"). No example shows an inline secret.
Non-hardcoded auth path	4	4	README's "Worker credential" section thoroughly documents the ephemeral-secret / session-token / --auth-token-file path that keeps the service-account key off the template entirely.

Restricted-Environment Readiness — 13.5 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	install.sh.tftpl curls the hardcoded https://cursor.com/install; no variable overrides this URL (cli_binary only overrides the installed binary path, not the download source).
Bring-your-own binary	10	10	install_cli = false documented in both the top example and the Requirements section as the recommended fast path for an image with the CLI baked in; cli_binary lets the path be overridden.
Egress transparency	3	1.5	Endpoints (cursor.com/install, cursor.com/agents, cursor://...) are only mentioned scattered across variable descriptions and examples; there is no dedicated network/air-gapped section enumerating them.
Runs without sudo	2	2	None of cleanup.sh.tftpl, install.sh.tftpl, or start.sh.tftpl invoke sudo; all operate under $HOME as the invoking user.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	Every variable has a detailed description and sensible default; validations guard cli_binary, management_addr (regex + port range), share_desktop (requires computer_use), additional_args (rejects newlines and module-reserved flags), serving_log_pattern (non-empty).
Test coverage	4	4	main.tftest.hcl extensively covers business logic (parameter contract, flag wiring, validations, edge cases); main.test.ts runs real container-based end-to-end tests of the supervisor/cleanup lifecycle (idle, working, done, orphaned, SIGKILL escalation, generation rotation).

Agent Integration — 5 / 25

Criterion	Max	Score	Notes
AI governance	10	0	No mention of Coder AI Gateway or Agent Firewall anywhere in the README; the module's "governance" is Agent Relay's own pool dispatch, which is a different mechanism not covered by this criterion.
Dashboard entry point	5	5	coder_app resources cursor_web and cursor_desktop are documented with explicit launch behavior ("Open in Cursor Web" / "Open in Cursor Desktop"), conditioned on session dispatch.
Session continuity	5	0	README explicitly states a restart or relaunch "starts a fresh worker, even after a terminal state" rather than resuming one; no native resume or persistent session manager (tmux/screen) is documented.
Managed configuration	5	0	additional_args is a generic CLI flag pass-through, not documented MCP/settings/policy/workdir management; repo cloning and SCM credentials are explicitly left to the template, not managed by this module.

Overall — 59 / 100

Raw 54.5 / 92 → round(54.5 / 92 × 100) = 59

---

Scored against SCORECARD.md on 2026-10-29 with solstice-1.