AX-1941: add *.jfrog.io to workspace sandbox allowlist - #79
Closed
MatanEden1 wants to merge 5 commits into
Closed
Conversation
1 task
Co-authored-by: Cursor <cursoragent@cursor.com>
MatanEden1
force-pushed
the
ax-1941-sandbox-allowlist
branch
from
August 27, 2026 13:11
f818cad to
9902a27
Compare
- Revert the 403-as-blocked change: a server-side 403 means the CONNECT tunnel succeeded and the host IS reachable. Only HTTP 000 means blocked. - Use arithmetic (( blocked )) instead of string comparison. - Print HTTPS_PROXY in env diagnostics (all probed URLs are HTTPS). Co-authored-by: Cursor <cursoragent@cursor.com>
Do not append 000 when curl exits 56; that concatenated to 000000 and treated a CONNECT drop as reachable. Co-authored-by: Cursor <cursoragent@cursor.com>
- sandbox.json: add explicit "default": "deny" for clarity - test script: add DENY_HOSTS probe for negative coverage - test script: remove 2>/dev/null so curl errors are visible - test script: add --connect-timeout 3 for fast failure on blocked hosts Co-authored-by: Cursor <cursoragent@cursor.com>
- sandbox.json: remove "default":"deny" — workspace allow entries are unioned with Cursor's defaults; an explicit deny directive risked replacing them - test script: replace example.com deny-hosts with RFC 5737 (203.0.113.1) and RFC 2606 (.invalid TLD) addresses that are structurally guaranteed unreachable, preventing future false failures if Cursor's defaults ever include example.com - test script: add proxy env-vars guard — exit 2 when CURSOR_SANDBOX=seatbelt but neither HTTP_PROXY nor HTTPS_PROXY is set (curl would bypass the proxy, making every host look reachable) - test script: add want-argument validation in probe() to catch typos early - test script: clarify the curl "000" and ((fail++)) || true comments Co-authored-by: Cursor <cursoragent@cursor.com>
Contributor
Author
|
Superseded by #80, which includes all code review fixes. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Cursor's Agents Window (
CURSOR_SANDBOX=seatbelt) blocks*.jfrog.ioby default. All HTTPS is forced through an ephemeral local proxy;*.jfrog.ioreturns 403 while public registries (npmjs, pypi, nodejs.org) are already allowed by Cursor's defaults.Adds a workspace
.cursor/sandbox.jsonto unblock*.jfrog.io. Workspace allowlists are unioned with Cursor's defaults — only the missing host needs to be listed.Changes
.cursor/sandbox.json— workspace network allowlist adding*.jfrog.ioscripts/test-sandbox-network.sh— probe script to verify the fix from inside the Agents WindowTest plan
Run
scripts/test-sandbox-network.shfrom inside the Agents Window after applying this change. Exit 0 = hosts reachable, exit 1 = still blocked..cursor/sandbox.jsonapplies to the Agents Window surface specifically (pending hands-on check)Follow-up
Once verified, a separate PR will update the three cursor-plugin instruction sites that currently dead-end agents on
full_network/required_permissionswith no fallback.Closes #78
Made with Cursor