feat(agent-relay-cursor): add the Agent Relay Cursor module - #1112
Open
Emyrk wants to merge 5 commits into
Open
Conversation
Template module that declares the parameter contract Agent Relay stamps on a build and runs the Cursor CLI worker detached, publishing its lifecycle through the agent_relay_status agent metadata item. Moved from coder/agent-relay, where it was developed against the daemon.
Contributor
Module Scorecard Check
|
| Presentation & Onboarding | Agent Integration | Credential Hygiene | Restricted-Environment Readiness | Engineering Quality | Overall |
|---|---|---|---|---|---|
| 6 / 17 | 20 / 25 | 18 / 20 | 10 / 20 | 10 / 10 | 70 / 100 |
Drilldown
Agent Integration — 20 / 25
| Criterion | Max | Score | Notes |
|---|---|---|---|
| AI governance | 10 | 10 | README documents Agent Relay integration (which provides routing and policy enforcement) and credential management through service-account API keys. The module is explicitly designed for Agent Relay's governance model. |
| Dashboard entry point | 5 | 0 | No coder_app support documented or present in the module. This is a worker module that runs the Cursor CLI in the background. |
| Session continuity | 5 | 5 | README documents the --idle-release-timeout mechanism where workers persist after a session ends to handle follow-up requests. The worker continues across reconnects within the timeout window. |
| Managed configuration | 5 | 5 | README documents managed configuration through Agent Relay parameters: agent_relay_cursor_pool_name, agent_relay_cursor_idle_release_timeout, agent_relay_cursor_repo_url, and computer_use variable for managed worker settings. |
Credential Hygiene — 18 / 20
| Criterion | Max | Score | Notes |
|---|---|---|---|
| Secrets marked sensitive | 16 | 16 | The agent_relay_credential parameter has mask_input = true in its styling (main.tf line 177). README examples avoid inline secrets, showing only placeholder text "Set by Agent Relay on dispatch". README section "Credential exposure" explicitly discusses the credential lifecycle. |
| Non-hardcoded auth path | 4 | 2 | The credential is provided through Agent Relay's parameter stamping mechanism (service-account API key), but this still involves pasting keys into the relay configuration. Not a fully external auth path like IAM/OAuth. Earns half for the indirection through Agent Relay rather than direct template exposure. |
Presentation & Onboarding — 6 / 17
| Criterion | Max | Score | Notes |
|---|---|---|---|
| Configuration-mode examples | 12 | 6 | README shows one basic example with install_cli toggle. Documents computer_use = true mode and repo-scoped vs repo-less pools in Requirements section. Missing comprehensive examples for major configuration variations (e.g., custom binary paths, state file locations). Earns half. |
| Visual preview | 5 | 0 | No image, GIF, or video in README. Only an icon reference in frontmatter. |
Restricted-Environment Readiness — 10 / 20
| Criterion | Max | Score | Notes |
|---|---|---|---|
| Mirrorable artifact source | 5 | 0 | The installer uses hardcoded `curl https://cursor.com/install -fsSL |
| Bring-your-own binary | 10 | 10 | README Requirements section states "bake it into the image for the fastest start" and documents that install_cli = false disables download when the CLI is already present. The cli_binary variable allows pointing to a pre-installed binary. Fully documented and implemented. |
| Egress transparency | 3 | 0 | No dedicated README section enumerating external endpoints. The cursor.com/install URL appears only in code comments and scattered mentions. Requirements mention "outbound access to cursor.com" but this is not a dedicated network/endpoints section. |
| Runs without sudo | 2 | 0 | The installer script uses `curl ... |
Engineering Quality — 10 / 10
| Criterion | Max | Score | Notes |
|---|---|---|---|
| Input quality | 6 | 6 | All variables have clear descriptions. Sensible defaults: install_cli = true, cli_binary = "agent", state_file and log_file with reasonable paths, computer_use = false. The agent_id is properly typed as required. No validation blocks needed for these inputs. |
| Test coverage | 4 | 4 | Comprehensive .tftest.hcl covers parameter contract, worker wiring, computer_use modes, install_cli modes, and path overrides (7 test runs). TypeScript main.test.ts covers end-to-end behavior with container-based integration tests: idle state, missing binary, CLI presence detection, worker lifecycle, exit codes, and configuration overrides. Clear separation of concerns. |
Overall — 70 / 100
Raw 64 / 92 → round(64 / 92 × 100) = 70
Tip
You can run this locally by telling your agent: "review this module against .github/scorecard/SCORECARD.md".
Scored against SCORECARD.md with claude-sonnet-4-5. Language-model scores are advisory.
Emyrk
marked this pull request as ready for review
September 11, 2026 13:14
Stacked on #1112. Adds `main.test.ts` for `coder/agent-relay-cursor`. Each case renders the module with `runTerraformApply`, runs the `coder_script` body in a `lorello/alpine-bash` container, and reads back `/tmp/agent-relay/worker-state`. A stub `agent` script stands in for the Cursor CLI so the supervisor lifecycle is observed, not grepped for: | case | asserts | |---|---| | no `CURSOR_API_KEY` | exit 0, `idle` | | no CLI, `install_cli = false` | exit 1, `failed runner-agent-missing` | | CLI on PATH, `install_cli` default | "already present; skipping the install", no download, `working <pid>` | | worker start | argv is `worker --pool ... --idle-release-timeout 600 ... start`, no `--computer-use`; worker env carries `CURSOR_API_KEY` / `CURSOR_AGENT_WORKER_ID` | | `computer_use = true` | `--computer-use` in argv | | worker exits 3 | `done 3` | | `cli_binary` + `state_file` overrides | binary at the override path runs, state lands at the override path | Plus the standard `testRequiredVariables` for `agent_id`. Not covered: the real `curl https://cursor.com/install | bash` and the real worker; both need the network and Cursor's side. 9 pass locally in ~15s. If this merges, the "No `main.test.ts` yet" line in the #1112 body should be dropped. --- _Opened by Coder Agents on behalf of @Emyrk._
9 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Adds
coder/agent-relay-cursor, the template module for Agent Relay Cursor pools. It declares theagent_relay_*parameter contract the relay stamps on every build and verifies at startup, exports the Cursor CLI'sCURSOR_API_KEY/CURSOR_AGENT_WORKER_ID, and runsagent worker ... startdetached, publishing the worker lifecycle through anagent_relay_statusagent metadata item that the template must declare on itscoder_agent.Moved from coder/agent-relay, where it was developed and tested against the daemon; that copy is retired in favor of this one.
install_clidefaults totrueand only downloads when the CLI is not already on PATH.main.tftest.hclcovers the parameter contract and the rendered scripts. Nomain.test.tsyet; the scripts are exercised end to end by the relay's dogfood deployment.Type of Change
Module Information
Path:
registry/coder/modules/agent-relay-cursorNew version:
v0.1.0Breaking change: [ ] Yes [x] No
Testing & Validation
terraform test, 7 runs)bun fmt)readmevalidation,terraform validate)Related Issues
None
Opened by Coder Agents on behalf of @Emyrk.