Agent Relay Cursor module

[github-actions[bot]]

A discussion dedicated to the Agent Relay Cursor module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Agent Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
6 / 17	5 / 25	20 / 20	12 / 20	10 / 10	58 / 100

Drilldown

Presentation & Onboarding — 6 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	6	The README shows one primary example (install_cli = true). The "Requirements" section describes computer_use, share_desktop, and cli_binary modes in prose but provides no separate Terraform code blocks demonstrating each major mode with sensible defaults. Half credit for documenting the modes without full per-mode examples.
Visual preview	5	0	No image, GIF, or video is embedded in the README. The frontmatter icon field is a registry listing icon, not a visual preview of the module in action.

Agent Integration — 5 / 25

Criterion	Max	Score	Notes
AI governance	10	0	No mention of Coder AI Gateway or Agent Firewall anywhere in the README or Terraform code. The credential flow is Agent Relay → ephemeral token, but no AI Gateway routing or Agent Firewall policy enforcement is documented.
Dashboard entry point	5	5	Two coder_app resources (cursor_web, cursor_desktop) are declared with count gated on agent_relay_session_id. The README explicitly documents: "When Agent Relay stamps agent_relay_session_id, the module adds two external apps."
Session continuity	5	0	No documentation of resuming an existing agent session across reconnects or relaunches. No mention of tmux, screen, boo, or native session-resume support. The idle-release timeout keeps the worker alive but does not constitute documented session continuity.
Managed configuration	5	0	No documentation of managed MCP servers, settings files, policies, or workdir configuration. The module's scope is limited to running the Cursor CLI worker.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	agent_relay_credential parameter uses mask_input = true in its styling and is marked ephemeral = true. The README example contains no inline secrets—only agent_id = coder_agent.main.id. The token is passed via coder_env and never written to disk.
Non-hardcoded auth path	4	4	The "Worker credential" section explicitly documents: "The pool's service-account API key never leaves Agent Relay. At dispatch the relay exchanges it for a Cursor sub-token scoped to the requesting user." No raw keys are pasted into templates.

Restricted-Environment Readiness — 12 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	The install URL https://cursor.com/install is hardcoded in install.sh.tftpl. No module input variable overrides this download URL. cli_binary overrides the binary path, not the download source; install_cli is a boolean toggle, not a URL override.
Bring-your-own binary	10	10	install_cli = false (documented in README: "Bake the CLI into the image and set this to false for faster workspaces") disables the download entirely. The install script checks command -v and skips if the binary is present. The start script adds ~/.local/bin to PATH unconditionally.
Egress transparency	3	0	No dedicated README section enumerates external endpoints contacted at install and runtime. cursor.com/install appears in the install_cli variable description and cursor.com/agents/<id> in the app description, but these are scattered incidental mentions, not a proper enumeration with air-gapped notes.
Runs without sudo	2	2	All scripts (install.sh.tftpl, start.sh.tftpl, status.sh.tftpl) operate exclusively under $HOME and ~/.local/bin. No sudo invocation appears in any script.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All 8 variables have clear descriptions and sensible defaults. cli_binary has a regex validation rejecting shell metacharacters; share_desktop validates the computer_use dependency; serving_log_pattern rejects empty strings.
Test coverage	4	4	main.tftest.hcl (12 test runs) covers the parameter contract, script rendering, validation failures, and mode toggles. main.test.ts (14 test cases) exercises the full worker lifecycle in real containers with stub binaries: idle/working/done/failed/orphaned states, restart idempotency, shell-injection resistance, credential handling, and file layout.

Overall — 58 / 100

Raw 53 / 92 → round(53 / 92 × 100) = 58

---

Scored against SCORECARD.md on 2026-10-08 with solstice-1.