Repository navigation
Conversation
Integrates independently reviewed client leaf 41eb69c9a6a4d2a61f739c473335698fb0dd20f3. Native runtime qualification remains separate.
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 59 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@coderabbitai full review Owner requested independent review before any merge. Observed head: Check the exact official acquisition URL/pin, byte/archive/member bounds, source identity, hosted-only admission, failure handling and closed evidence. This remains an acquisition-only slice: HTTP 403 before vendor bytes is not native project/lifecycle/MCP proof. Preserve all qualification flags and avoid alternate headers, credentials, unofficial mirrors or guessed runtime pins. Report concrete source-bound findings and missing merge evidence. |
|
Current official acquisition condition — 2026-10-29
The leaf remains at
86730e880ff4da254e9111c5703e26eba02cf993. The current official installer still constructs the reviewed Linux x64 archive URL for2026.10.22-27dcf5f. A bounded request from the current working environment returned HTTP 403 again, before any executable bytes. This is an availability recheck, not a new hosted native qualification run.No supported relocation or replacement pin was established. The historical four hosted acquisition attempts remain unchanged failed evidence. No alternate headers, credentials, unverified runtime or local vendor execution were substituted.
Program #520 is now reconciled with current main at
5317da5c; this leaf's native discovery, lifecycle/restart/removal, MCP, authentication and real-model claims remain unqualified until supported official bytes can be acquired and reviewed. VS Code remains outside the active scope.Preserved source-bound history
Purpose
Collect source-bound acquisition evidence for Cursor before adding native project lifecycle or MCP qualification, stacked on #520.
Implemented slice
The Cursor leaf is acquisition-only. It admits only the official Linux x64 candidate
2026.10.22-27dcf5f, with bounded download, closed archive inventory and source identity capture on a genuine disposable GitHub-hosted runner. It does not run an unreviewed launcher, infer bundled Node/support pins, or register later native phases.Actual evidence and current gate
Published source
86730e880ff4da254e9111c5703e26eba02cf993, treed9aaa65208c77adbca7e721e7e58580f7ae7c6c3, is captured in research run 40235265317, attempt 3. The unchanged retry again failed before acquisition withHTTP Error 403: Forbiddenat the same official candidate URL. Artifact12670773589has SHA-2562b0af924557b3c55f7ebfeb4b1d111171b57d06c8addae20c7ec4395de2af823. The earlier attempt independently recorded the same acquisition refusal. No Cursor process executed in either capture.The inert admission/selection job passed. Other cancelled checks are not presented as a fully green head. The acquisition block must be resolved using verified supported official bytes before the archive, launcher and complete runtime closure can be frozen and reviewed.
Remaining qualification
Actual project discovery, public add/update/repair/remove, restart and removal behavior, original-user/project isolation, MCP initialize/list/call, vendor authentication and real-model behavior remain unqualified. All five initial qualification flags are false. Help output or a successful future download will not establish those later gates.
Two independent plan rounds and implementation review are recorded in the consolidated plan; focused inert collector and shared capture/admission contracts passed without local vendor execution. Raw evidence remains in bounded CI artifacts. No release publication.
Official-route audit, 2026-10-26
The current official installer still constructs exactly
https://downloads.cursor.com/lab/2026.10.22-27dcf5f/linux/x64/agent-cli-package.tar.gzfor Linux x86-64; the publisher installation documentation still directs users to that installer. This matches the collector's candidate. No documented relocation or supported acquisition correction was found. The retained attempt-3 artifact independently confirms the 403 before bytes or native execution; its cause or permanence is unknown. No alternate pin, bypass header or unverified runtime was substituted.Current bounded availability recheck
The same-source attempt 4 is complete and failed again during acquisition with
HTTPError: HTTP Error 403: Forbidden. No Cursor archive was acquired and no Cursor process executed. All five qualification flags remain false.Artifact
12695536285is 1,303 bytes; outer SHA-256ea0aeba8b4204dd4b5db91e44acc93c7eff94d6688538167e2c2f8693e49d802. Independent inspection verified both ZIP CRCs, 11 unique ordinary inner members, all 10 recorded stream byte/hash joins, the exact published commit/tree and clean-source receipts. The genuine hosted image reports Ubuntu24/X64, image20261023.334.3. Native acquisition bytes and later observations are absent.On 2026-10-27 the publisher installation documentation and official installer still identify the same pinned
2026.10.22-27dcf5fLinux x64 package URL. No supported relocation or new acquisition correction was established. This closes the previous queued-status note; it does not request another unchanged retry or substitute headers, credentials, pins, unverified bytes or local execution. The acquisition refusal remains unresolved before later runtime qualification.