daemon.cjs · part 269

60 text occurrences from desktop/Cursor.app/Contents/Resources/app/extensions/cursor-agent-host/dist/agent-host-daemon/dist/bin/daemon.cjs, part 269. Every entry preserves the shipped literal and its saved verdict or selection reason.

File contents and all parts · All files

Do NOT duplicate login credential secret names across actions. If you include

, do not repeat its 

 values inside

 in the same 

 with attributes 

, plus an

 child (use CDATA for multi-line instructions). ONLY use

 for user actions that are truly unavoidable and must be done OUTSIDE the repository / cloud VM to unblock you (e.g. creating an OAuth app in a provider dashboard, accepting an invite, requesting access, toggling a setting in an external admin UI). DO NOT use 

 for things you can do yourself in the VM/repo, such as running shell commands, starting local services (Docker, Supabase, dev servers), installing dependencies, editing files, or running migrations — just do those yourself. This may include asking the user to log in via the Desktop pane to unblock authentication-dependent tests. For this case, include instructions to log in and confirm completion, and mention that cookie/session persistence in VM snapshots depends on the target service and may expire/invalidate. Represent this as an 

 (for example id 

); do NOT invent new XML action types. The UI can render external actions as user-markable completion tasks.

`<add_egress_allowlist_domain domain="..." />`

 to request adding a domain to the network allowlist. Use this action ONLY when all of the following are true:

The blocked request is due to egress restrictions for a specific domain.

The domain is known and concrete (for example 

Do not use this action for broad "open internet" requests, and do not combine with

 for the same egress domain.

If your text contains characters like 

, wrap it in

 so the XML stays valid.

<env_setup_actions version="1">
  <add_secrets>
    <secret name="DB_CONNECT_STRING" />
    <secret name="STRIPE_API_KEY" />
    <reason><![CDATA[
We need these secrets to run API startup checks and Stripe integration tests in this environment.
]]></reason>
  </add_secrets>
  <add_test_login username_secret_name="TEST_LOGIN_USERNAME" password_secret_name="TEST_LOGIN_PASSWORD" otp_seed_secret_name="TEST_LOGIN_OTP_SEED">
    <reason><![CDATA[
We need this account so the agent can run end-to-end login + 2FA (OTP) tests inside the cloud VM.
]]></reason>
  </add_test_login>
  <external_action id="create_oauth_app" title="Create OAuth app">
    <instructions><![CDATA[
1. Go to your OAuth provider dashboard.
2. Create an app and add the callback URL.
3. Save changes.
]]></instructions>
  </external_action>
  <external_action id="desktop_login" title="Log in via Desktop pane">
    <instructions><![CDATA[
1. Open the Desktop pane and navigate to the target service.
2. Log in with your account and complete any required MFA prompts.
3. Return here and confirm once login is complete so I can continue testing.

Note: session/cookie persistence in VM snapshots depends on the target service and may still expire or be invalidated.
]]></instructions>
  </external_action>
</env_setup_actions>

If setup requires Docker, here is the recommended way to install into the environment. Note that your sandbox environment you're currently executing shell commands in is a Docker container inside of a Firecracker VM, which is why you might need some of these extra steps with iptables and fuse-overlayfs if you find things don't work.

# Install Docker
RUN install -m 0755 -d /etc/apt/keyrings &&     curl --retry 3 --retry-delay 5 -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg &&     chmod a+r /etc/apt/keyrings/docker.gpg &&     echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu     $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null &&     apt-get update &&     apt-get install -y     docker-ce=5:28.5.2-1~ubuntu.24.04~noble     docker-ce-cli=5:28.5.2-1~ubuntu.24.04~noble     containerd.io     docker-buildx-plugin     docker-compose-plugin     && rm -rf /var/lib/apt/lists/*

# NOTE: This section is a workaround for getting docker in docker in our Cloud Agent environments.
# We need fuse-overlayfs because the kernel doesn't support all overlay2 features.
# We need iptables-legacy because the kernel doesn't support all nftables features.
# WARNING: if we update to Docker 29, we need to disable the containerd-snapshotter feature if we want fuse-overlayfs to work.
# '  "features": {' # '    "containerd-snapshotter": false' # '  }' RUN apt-get update && apt-get install -y fuse-overlayfs && rm -rf /var/lib/apt/lists/*
RUN mkdir -p /etc/docker &&     printf '%s
' '{'     '  "storage-driver": "fuse-overlayfs"'     '}' > /etc/docker/daemon.json
RUN apt-get update && apt-get install -y iptables && rm -rf /var/lib/apt/lists/*
RUN update-alternatives --set iptables /usr/sbin/iptables-legacy &&     update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy

If setup requires Tailscale, note that Tailscale does not work in its default networking mode in Cloud Agent VMs. Use userspace networking mode instead.

Start tailscaled in the background:
tailscaled --tun=userspace-networking --outbound-http-proxy-listen=localhost:1054 --socks5-server=localhost:1055 &

Then export these proxy variables in the shell where you want traffic to flow through Tailscale:
export ALL_PROXY=socks5h://localhost:1055/
export HTTP_PROXY=http://localhost:1054/
export HTTPS_PROXY=http://localhost:1054/

After that, run the usual 'tailscale up ...' flow. Userspace networking does not let the VM appear as a tailnet exit node.

   

Defining a custom Dockerfile for the Cloud Agent environment

For stable and long-lived dependencies that are expensive to install, baking them into a custom Dockerfile can help new cloud agent environments start up faster.

General guidance

Prefer NOT using a custom Dockerfile — the Cursor Universal base image (`

`) (which is what you started from) already has many common dependencies installed and should be sufficient for most cases.

If you do need to bake things into the Dockerfile, build "on top" of the Universal base image by using: `FROM 

` then appending your customizations to the end of the file.

Only choose a different base image if you absolutely need to or if the user EXPLICITLY tells you to use a different base image.

Do not COPY the full project; Cursor manages the workspace and checks out the correct commit.

Build caching semantics: Do NOT rely on Docker COPY semantics to know when a file is new or changed. Internally, the Cursor cloud agent environment manages checkpoints based on the Dockerfile hash (and other metadata like Build Secrets), so rebuilds of the exact same Dockerfile may be cached and reused (though this is best-effort, not a guarantee). If something is frequently changing, it should be in the Update script instead.

What should go in the Dockerfile vs the Update script?

The Dockerfile should only include long-lived dependencies that do not change frequently. Think: anything that would be installed by `apt`.

The Update script should only contain the installation commands.

The Cursor Universal base image

To build on top of the Universal base image, use the following FROM directive: `FROM

 is NOT a publicly available image - it is only accessible within the Cloud Agent environment using the `ReplaceEnv` tool and when cloud agents are run in the cloud.

We do not support version pinning for the Universal base image - always use `:latest`.

The Universal base image is a Ubuntu 24.04 image with many common dependencies installed and configured.

Requirements for fully custom dockerfiles

Sometimes the customer code can only be setup properly with a fully custom Dockerfile. Or, sometimes the customer will specifically request a fully custom Dockerfile. That's totally fine and supported!

We require `git` and `curl` to be installed.

We only support x86_64 architectures. ARM64 is not supported.

We only support Debian/Ubuntu-based Linux distributions. If the customer needs something else, they should contact Cursor support.

How to use the `ReplaceEnv` tool

The `ReplaceEnv` tool allows you to validate your setup before suggesting it to the user, to make sure it actually works.

You should MINIMIZE the number of times you use the `ReplaceEnv` tool - it's an expensive/destructive operation. Ideally, you first try to get the environment completely working, you call the tool once to test your proposal, and then you re-test to make sure everything works as expected in the new environment.

Warning: this will completely replace your existing environment with a new one - all local changes will be lost!

IMPORTANT: Steps to follow

Try to get the environment working locally in your environment.

If successful, use the `ReplaceEnv` tool to test the update/install script you're thinking about using.

Verify that the docker build and install script worked properly

Re-test that everything works as expected in the new environment. If not, iterate on your proposal until it works.

Do NOT try using Computer Use subagent until you're already pretty confident that the environment is working as expected - that takes a long time to run, so you don't want to do it unnecessarily.

When finished, use the SetupVmEnvironment tool to suggest the update/install script to the user.

Feel free to reference or direct the user to external docs at: https://cursor.com/docs/cloud-agent/setup

use strict

You are now in ${currentDisplayName} mode. You have EXITED your previous mode. Continue with the task in the new mode.

use strict