Jmp/harnesses

extensions/cursor-cli/home-manager.nix

@@ -0,0 +1,19 @@
+{ lib, pkgs, ... }:
+
+{
+  home.packages = [
+    pkgs.cursor-cli
+  ];
+
+  home.activation.cursorCliHttp1ForAgent = lib.hm.dag.entryAfter [ "writeBoundary" ] ''
+    config="$HOME/.cursor/cli-config.json"
+    tmp="$config.tmp"
+    mkdir -p "$HOME/.cursor"
+    if [ -s "$config" ] && ${pkgs.jq}/bin/jq '.network = (.network // {}) | .network.useHttp1ForAgent = true' "$config" > "$tmp"; then
+      mv "$tmp" "$config"
+    else
+      rm -f "$tmp"
+      printf '%s\n' '{"network":{"useHttp1ForAgent":true}}' > "$config"
+    fi
+  '';
+}

firewall-vm.nix

@@ -294,6 +294,7 @@ in
         "--listen-port 8080"
         "--set termlog_verbosity=warn"
         "--set flow_detail=0"
+        "--set store_streamed_bodies=true"
         # Defer opening the upstream TCP connection until after our addon
         # runs. Originally needed for the SNI deny path's address rewrite
         # to take effect (the default "eager" strategy opens the upstream
@@ -334,6 +335,7 @@ in
         "--listen-port 8081"
         "--set termlog_verbosity=warn"
         "--set flow_detail=0"
+        "--set store_streamed_bodies=true"
         "--set connection_strategy=lazy"
         "--set confdir=%t/mitmproxy-transparent"
         "-s /etc/agent-vm/mitmproxy_addon.py"

flake.nix

@@ -26,7 +26,10 @@
 
       pkgs = import nixpkgs {
         inherit system;
-        config.allowUnfreePredicate = pkg: nixpkgs.lib.getName pkg == "claude-code";
+        config.allowUnfreePredicate = pkg: builtins.elem (nixpkgs.lib.getName pkg) [
+          "claude-code"
+          "cursor-cli"
+        ];
       };
 
       mkVM = module: nixpkgs.lib.nixosSystem {