Repository navigation
feat(coder/agent-relay-cursor): remove the shared service-account credential path - #1169
Merged
Merged
Conversation
…dential path Drop the agent_relay_cursor_credential_kind parameter, its AGENT_RELAY_CURSOR_CREDENTIAL_KIND export, and the CURSOR_API_KEY branch in the supervisor. Agent Relay no longer supports insecure_shared_token and always mints a per-claim session token, so the worker credential is passed only as --auth-token. Refs RELAY-43
matifali
approved these changes
Oct 7, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Closes RELAY-43. Companion: coder/agent-relay#94
Agent Relay no longer supports
insecure_shared_token(coder/agent-relay#90). Every claim mints a per-claim session token (coder/agent-relay#84), so theapi_keypath added in #1141 is dead. This removes it:agent_relay_cursor_credential_kindparameter and itsAGENT_RELAY_CURSOR_CREDENTIAL_KINDcoder_env.agent_relay_credentialmoves back toorder = 1006.--auth-token "$AGENT_RELAY_CURSOR_TOKEN"and never exportsCURSOR_API_KEY, even if a staleAGENT_RELAY_CURSOR_CREDENTIAL_KIND=api_keyis in the environment.insecure_shared_tokentable.CURSOR_API_KEYcontainer test is replaced by one that sets a staleAGENT_RELAY_CURSOR_CREDENTIAL_KIND=api_keyand checks that the worker still gets--auth-tokenand noCURSOR_API_KEY. The tftest assertions for the parameter and both auth branches are back to the single--auth-tokencheck.Compatibility: coderd ignores build parameters that a template does not declare, so a relay that still stamps
agent_relay_cursor_credential_kind=worker_token(before coder/agent-relay#94) works with this version. Module 0.2.0 to 0.4.0 default the parameter toworker_token, so they keep working with a relay that stops stamping it. Either repo can merge first.Rebase note for #1145: edits are limited to the credential lines in
main.tf,start.sh.tftpl,main.tftest.hcl,main.test.ts, the README "Worker credential" section, and the README version.Type of Change
Module Information
Path:
registry/coder/modules/agent-relay-cursorNew version:
v0.5.0Breaking change: [ ] Yes [x] No (the removed
api_keypath is already rejected by Agent Relay; pre-1.0 minor bump)Testing & Validation
terraform test: 12 passed;bun test registry/coder/modules/agent-relay-cursor: 19 pass)bun x prettier --check,terraform fmt -check -recursive)terraform validate,.github/scripts/version-bump.sh --ci minor origin/mainpassRelated Issues
RELAY-43, coder/agent-relay#94, coder/agent-relay#90, #1141
Generated by Coder Agents on behalf of @matifali.