Delegate bounded coding tasks to Cursor CLI and review diffs

Cursor Delegate hands a bounded coding task to the Cursor Agent CLI (cursor-agent) as a separate implementer. The orchestrator writes a brief and dispatches it with the bundled relay, which wraps cursor-agent -p, feeds the brief on stdin, captures the structured event stream, and writes a stable result.json. Cursor does the typing in its own session with no memory of the orchestrator's conversation; the orchestrator reviews the diff and lands the commit. This is a docs-only import: the executable scripts/relay.mjs referenced throughout is not bundled here and has to be sourced upstream to actually run the loop.

Use it when the user has explicitly asked for delegation to Cursor and the task is bounded enough to describe in a single brief. Do not use it when the task is small enough to do inline, when cursor-agent is not installed or authenticated (cursor-agent login), or when you only need Cursor's opinion on code you already wrote - a --read-only dispatch covers that case, but a plain review may not need delegation at all. The relay always passes --trust to skip the workspace-trust prompt in headless mode, so --cd should only ever point at a repository you actually trust.

The input is a brief - the goal, current state, what to change, what to leave untouched, the project's actual gate commands, and a report contract - written to a file and passed via --brief, or piped in on stdin. A fresh run defaults to write-capable with --force (commands run without approval unless the local Cursor config denies them); --no-force keeps edits but withholds automatic command approval, and --read-only switches to Cursor's plan mode with no edits at all. Optional flags choose --model <name> from the account's live cursor-agent models list, --sandbox enabled|disabled to override Cursor's own sandbox for that run, and --session <id> or --resume-last to continue a prior session with just a delta brief. The output is result.json, carrying status (completed, failed, timeout, aborted, or cursor_agent_unavailable), resolvedModel (the model Cursor actually served), permissionMode, finalMessage, and touchedFiles - a git status --porcelain snapshot of the working tree under --cd, which also picks up anything that was already dirty before dispatch.

Wraps the Cursor Agent CLI, installed via the platform installer at cursor.com/cli and authenticated with cursor-agent login; cursor-agent status confirms the session is live. The optional --add-dir flag for extra workspace roots requires cursor-agent 2026.07.23 or newer, and edits Cursor makes inside those extra roots do not show up in touchedFiles. On Windows, dispatching from a Git Bash (MSYS) console makes cursor-agent generate PowerShell-syntax hook wrappers that bash cannot run, silently blocking every command Cursor tries to execute even though file edits still land - a PowerShell or cmd console avoids this.

Orchestrating agents and engineers who already use Cursor as an implementer and want a scripted brief-dispatch-review-commit loop instead of manual copy-paste. The authorization model treats delegation as something the human opts into: the orchestrator never accepts Cursor's final message or gate claims as evidence, re-runs the project's actual test/lint/build commands itself, reads the diff against the brief for scope creep or shortfall, and reports defensible-but-unrequested decisions back to the human rather than absorbing them silently.