[Emyrk]

The agent-relay-claude-code and agent-relay-cursor modules now take their credential from a workspace build secret instead of the agent_relay_credential parameter. Pairs with coder/agent-relay#100 and the coder/coder workspace secrets stack (coder/coder#30459).

Warning

Breaking change: both modules move to 1.0.0. An Agent Relay that still sends the credential as a parameter (older relays, or any relay against a coderd without build secrets) refuses templates on 1.0 because the parameter is gone. Stay on agent-relay-claude-code 0.2.0 / agent-relay-cursor 0.5.0 until both are upgraded.

• Removed the agent_relay_credential parameter and the coder_env that copied it into the workspace.
• Agent Relay now sends it as an ephemeral secret, which the agent injects as SELF_HOSTED_RUNNER_ENVIRONMENT_SECRET (Claude Code) or AGENT_RELAY_CURSOR_TOKEN (Cursor).
• The dispatched output checks agent_relay_delivery_id, since Terraform can no longer see the credential.
• The start scripts and the READMEs no longer mention setting the parameter by hand.

---

_{Coder Agents on behalf of @Emyrk.}

[github-actions]

Module Scorecard Check

coder/agent-relay-claude-code: 52 → 52

✅ Score unchanged at 52 / 100. This PR does not affect the module's scorecard; the results are still good.

Theme	Before	After
Presentation & Onboarding	6 / 17	6 / 17
Integration	0 / 25	0 / 25
Credential Hygiene	20 / 20	20 / 20
Restricted-Environment	12 / 20	12 / 20
Engineering Quality	10 / 10	10 / 10
Overall	52 / 100	52 / 100

Full scorecard for this PR

Presentation & Onboarding	Agent Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
6 / 17	0 / 25	20 / 20	12 / 20	10 / 10	52 / 100

Drilldown

Presentation & Onboarding — 6 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	6	Two major modes exist: install_cli = true (download at start) and install_cli = false (CLI baked into image). The README's single code example shows install_cli = true with a comment noting the false path. The Parameters and Requirements sections describe both modes in prose, but no separate code example demonstrates the "bake into image" configuration. Half credit for partial documentation of the second mode.
Visual preview	5	0	No image, GIF, or video is embedded in the README. The frontmatter icon field references a registry listing icon, which does not count.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	The work-order JWT is passed exclusively as a Coder workspace secret (SELF_HOSTED_RUNNER_ENVIRONMENT_SECRET), never as a Terraform variable, so no sensitive = true annotation is needed on module inputs. The README explicitly states it "never appears in the build's parameters or Terraform state." No inline secrets appear in any README example.
Non-hardcoded auth path	4	4	The README documents that the credential is injected by the Coder agent from the workspace secret, not pasted into templates: "The work order reaches the runner as the SELF_HOSTED_RUNNER_ENVIRONMENT_SECRET workspace secret, never as a build parameter." This is a platform-injected auth path.

Restricted-Environment Readiness — 12 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	The install URL https://claude.ai/install.sh is hardcoded in install.sh.tftpl. No module input variable overrides this download URL. cli_binary overrides the binary path, not the source URL; install_cli is a boolean toggle. No variable exists whose value replaces the download URL.
Bring-your-own binary	10	10	install_cli = false disables the download entirely. The install script's presence check (command -v ${cli_binary}) short-circuits when the CLI is already on PATH. The README documents this: "Bake the CLI into the image and set this to false for faster workspaces." cli_binary allows specifying a custom path. Fully implemented and documented.
Egress transparency	3	0	No dedicated README section enumerates external endpoints. The install URL (claude.ai/install.sh, redirecting to downloads.claude.ai) and Anthropic's runner API are only visible in source code comments and the install script. No "Network," "Egress," or "Air-gapped" section exists in the README.
Runs without sudo	2	2	Neither install.sh.tftpl nor start.sh.tftpl nor status.sh.tftpl invokes sudo. The installer places the binary in ~/.local/bin; the start script creates directories under $HOME. All operations work as an unprivileged user.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All eight variables have clear descriptions and sensible defaults. cli_binary has a regex validation rejecting shell metacharacters; exit_if_unused_min has a whole-number ≥ 0 validation. Descriptions explain the operational impact of each value.
Test coverage	4	4	main.tftest.hcl (7 test runs) covers the parameter contract, ephemeral vs. persistent semantics, script rendering, and security invariants (shell injection via cli_binary, serving_log_pattern as data). main.test.ts (9 tests) executes the actual install/start scripts in a container with stub binaries, verifying the full supervisor lifecycle (idle, working, done, failed, orphaned), the permissions wrapper, PATH handling, and state-file persistence across restarts.

Agent Integration — 0 / 25

Criterion	Max	Score	Notes
AI governance	10	0	No mention of Coder AI Gateway or Agent Firewall in the README or source. The module relies on Agent Relay's work-order JWT and account-lock mechanism, but does not document how Coder governs auth, routing, or policy enforcement via AI Gateway or Agent Firewall.
Dashboard entry point	5	0	No coder_app resource is declared or documented. The module is a headless self-hosted runner with no user-facing UI. No example or built-in dashboard entry point is provided.
Session continuity	5	0	No documentation of resuming an existing agent session across reconnects or relaunches. No mention of tmux, screen, boo, or a persistent session manager. The runner is stateless across workspace rebuilds; agent_relay_session_id is an identifier for Agent Relay's deduplication, not a resume mechanism.
Managed configuration	5	0	No documentation of managed MCP servers, settings files, policies, or workdir configuration. base_dir sets the session checkout directory but does not constitute managed configuration in the rubric's sense.

Overall — 52 / 100

Raw 48 / 92 → round(48 / 92 × 100) = 52

coder/agent-relay-cursor: 58 → 63

✅ Score improvement: 58 → 63 (+5).

Theme	Before	After
Presentation & Onboarding	6 / 17	6 / 17
Integration	5 / 25	10 / 25
Credential Hygiene	20 / 20	20 / 20
Restricted-Environment	12 / 20	12 / 20
Engineering Quality	10 / 10	10 / 10
Overall	58 / 100	63 / 100

Full scorecard for this PR

Presentation & Onboarding	Agent Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
6 / 17	10 / 25	20 / 20	12 / 20	10 / 10	63 / 100

Drilldown

Presentation & Onboarding — 6 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	6	The main example shows the default (install_cli = true). The "Requirements" section documents install_cli = false, computer_use = true, and share_desktop = true in prose with their image prerequisites, but none of these alternate modes get a dedicated code-block example. A user must infer the Terraform syntax from the variable names.
Visual preview	5	0	No image, GIF, or video is embedded in the README. The frontmatter icon field is a static SVG icon, not a preview of the module in action.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	The worker token is never a module input; Agent Relay delivers it as an ephemeral workspace secret (AGENT_RELAY_CURSOR_TOKEN), so no Terraform variable carries a secret. The README "Worker credential" section explicitly states it "never appears in the build's parameters or Terraform state." No README example inlines a literal or placeholder key.
Non-hardcoded auth path	4	4	The "Worker credential" section documents the full non-hardcoded path: the pool's service-account key stays in Agent Relay, which mints a user-scoped sub-token at dispatch and injects it as a workspace secret. No raw key is ever pasted into a template.

Restricted-Environment Readiness — 12 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	The install URL https://cursor.com/install is hardcoded in install.sh.tftpl. No module input variable overrides this URL. cli_binary changes the binary path, not the download source; install_cli toggles the download on/off. No variable replaces the download URL.
Bring-your-own binary	10	10	install_cli = false (documented in README: "Bake the CLI into the image and set this to false for faster workspaces") disables the download entirely. The install script checks command -v and skips; the start script adds ~/.local/bin to PATH unconditionally. Fully documented and tested.
Egress transparency	3	0	No dedicated "Network," "Egress," "Offline," or "Air-gapped" section exists. Endpoints (cursor.com/install, cursor.com/agents) appear scattered in the Requirements and app-URL descriptions but are not enumerated in a single section with restricted-environment guidance.
Runs without sudo	2	2	All three scripts (install.sh.tftpl, start.sh.tftpl, status.sh.tftpl) install to ~/.local/bin, write under $HOME/.coder-modules/, and run the worker as the invoking user. No sudo invocation anywhere.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	Every variable has a clear description and sensible default. cli_binary has a regex validation rejecting shell metacharacters; share_desktop has a cross-field validation requiring computer_use; serving_log_pattern rejects empty strings. All are well-documented.
Test coverage	4	4	main.tftest.hcl covers the parameter contract (names, persistence, disabled styling), script rendering (env-var wiring, token handling, flag passing), and validation failures. main.test.ts runs the actual install/start scripts in containers with a stub agent binary, exercising the full supervisor lifecycle (idle, working, serving, done, failed, orphaned), restart idempotency, shell-injection resistance, and file layout.

Agent Integration — 10 / 25

Criterion	Max	Score	Notes
AI governance	10	5	The README documents Agent Relay's governance thoroughly: auth (service-account key → user-scoped sub-token, never in state), routing (pool-based dispatch), and policy (1-hour token expiry, contract verification at startup, reaping via agent_relay_status). However, the specific product names "AI Gateway" and "Agent Firewall" are never used; the mechanism is called "Agent Relay." Per calibration, exactly one governance product documented earns half.
Dashboard entry point	5	5	Two coder_app resources are declared: "Open in Cursor Web" (cursor.com/agents/<id>) and "Open in Cursor Desktop" (cursor:// deeplink). Both are conditional on agent_relay_session_id being set. Documented in the README under the session-id paragraph.
Session continuity	5	0	No session-resume mechanism is documented. The README explicitly states the token "is not refreshed: a worker that has to reconnect after expiry fails and Cursor re-queues the request for a fresh workspace." No tmux, screen, boo, or persistent session manager is used or mentioned.
Managed configuration	5	0	No support for managed MCP servers, agent settings, policies, or workdir configuration is documented. The agent_relay_cursor_repo_url parameter is the template's responsibility to clone; the module does not manage workdir or tool configuration.

Overall — 63 / 100

Raw 58 / 92 → round(58 / 92 × 100) = 63

Tip

You can run this locally by telling your agent: "review this module against .github/scorecard/SCORECARD.md".

---

Scored against SCORECARD.md with solstice-1. Language-model scores are advisory.

[matifali]

Please add the minimum version required for agent-relay and Coder to this module README.md