docker/sbx-kit-cursor-mixin:latest

schemaVersion: "3"
displayName: Cursor (mixin)
author: Docker, Inc.
description: Cursor's agent CLI as a mixin — the agent in an overlay, with the Cursor credential (API key or OAuth) and the hooks the agent needs. Layer it onto a shell base and run `cursor-agent`.
sourceUrl: https://cursor.com
version: 0.1.0
kind: mixin
provides:
    - cursor
capabilities:
    - type: com.docker.sandbox/network-policy@1
      config:
        runtime:
            allow:
                - api2.cursor.sh:443
                - api3.cursor.sh:443
                - repo42.cursor.sh:443
                - cursor.com:443
                - downloads.cursor.com:443
    - type: com.docker.sandbox/credential@1
      optional: true
      config:
        apiKey:
            inject:
                - domain: api2.cursor.sh
                  format: Bearer %s
                  header: Authorization
                - domain: api3.cursor.sh
                  format: Bearer %s
                  header: Authorization
                - domain: repo42.cursor.sh
                  format: Bearer %s
                  header: Authorization
                - domain: cursor.com
                  format: Bearer %s
                  header: Authorization
            name: CURSOR_API_KEY
            proxyManaged: true
        oauth:
            resourceHosts:
                - api2.cursor.sh
                - api3.cursor.sh
                - repo42.cursor.sh
                - cursor.com
            responseFields:
                accessToken: accessToken
                refreshToken: refreshToken
            sentinels:
                accessToken: cursor-oat-proxy-managed
                refreshToken: cursor-ort-proxy-managed
            tokenEndpoint:
                host: api2.cursor.sh
                path: /auth/poll
        phase: runtime
        service: cursor
      description: Cursor API access (API key or Cursor OAuth)
    - type: com.docker.sandbox/lifecycle@1
      config:
        files:
            - content: '{"network": {"useHttp1ForAgent": true}}'
              description: Seed HTTP/1.1+SSE for agent connections
              overwrite: false
              path: /home/agent/.cursor/cli-config.json
        install:
            - command: mkdir -p /home/agent/.cursor && chown agent:agent /home/agent/.cursor
              description: Ensure .cursor is owned by agent before seeds run
              user: "0"
            - command: |
                [ -n "$WORKSPACE_DIR" ] || { echo "WORKSPACE_DIR unset; skipping Cursor workspace pre-trust" >&2; exit 0; }
                ws="$WORKSPACE_DIR"
                slug=$(printf '%s' "$ws" | sed 's#^/##; s#/#-#g')
                dir="/home/agent/.cursor/projects/$slug"
                mkdir -p "$dir"
                esc=$(printf '%s' "$ws" | sed 's/\\/\\\\/g; s/"/\\"/g')
                [ -f "$dir/.workspace-trusted" ] || printf '{"trustedAt":"%s","workspacePath":"%s"}\n' "$(date -u +%Y-%m-%dT%H:%M:%S.000Z)" "$esc" > "$dir/.workspace-trusted"
              description: Pre-trust the workspace for the interactive TUI
              env:
                - WORKSPACE_DIR
              user: agent
    - type: com.docker.sandbox/agent-skills@1
      optional: true
      config:
        path: /home/agent/.cursor/skills
    - type: com.docker.sandbox/agent-context@1
      optional: true
      config:
        content: |
            # Cursor

            This sandbox runs the Cursor agent CLI. Credentials are proxy-managed: an
            API key or Cursor OAuth arrives as sentinels, and the workspace is
            pre-trusted so the TUI skips its trust prompt.
        directory: /home/agent/workspace
        filename: AGENTS.md
    - type: com.docker.sandbox/agent-context@2
      optional: true
      config:
        content: |
            # Cursor

            This sandbox runs the Cursor agent CLI. Credentials are proxy-managed: an
            API key or Cursor OAuth arrives as sentinels, and the workspace is
            pre-trusted so the TUI skips its trust prompt.
        directory: /home/agent/workspace
        filename: AGENTS.md
dockerfile: ./cursor-mixin.dockerfile