fix: fall back to cursor.com/install when lab latest-version returns 403

Author: PunGrumpy

.changeset/fix-cursor-cli-download-urls.md

@@ -2,4 +2,4 @@
 "cursor-action": patch
 ---
 
-Fix Cursor CLI download URLs: resolve `latest` via the lab endpoint, use `windows` in artifact paths on Win32, and allow pinning lab build ids in `cursor-version` input validation.
+Fix Cursor CLI download URLs: resolve `latest` via the lab endpoint (validate HTTP 200 and lab id shape), fall back to parsing `https://cursor.com/install` when the lab `latest-version` URL returns 403, use `windows` in artifact paths on Win32, and allow pinning lab build ids in `cursor-version` input validation.

__tests__/cursor-version.test.ts

@@ -0,0 +1,38 @@
+import { describe, expect, it } from "bun:test";
+
+import {
+  extractLabVersionFromInstallScript,
+  parseLabVersionString,
+} from "../src/cursor-version";
+
+describe("parseLabVersionString", () => {
+  it("accepts lab build id with optional v prefix and trailing newline", () => {
+    expect(parseLabVersionString("v2026.03.20-44cb435\n")).toBe(
+      "2026.03.20-44cb435"
+    );
+  });
+
+  it("rejects S3 AccessDenied XML bodies", () => {
+    expect(
+      parseLabVersionString(
+        '<?xml version="1.0"?><Error><Code>AccessDenied</Code></Error>'
+      )
+    ).toBeNull();
+  });
+});
+
+describe("extractLabVersionFromInstallScript", () => {
+  it("parses DOWNLOAD_URL from bash installer", () => {
+    const script = `DOWNLOAD_URL="https://downloads.cursor.com/lab/2026.03.20-44cb435/\${OS}/\${ARCH}/agent-cli-package.tar.gz"`;
+    expect(extractLabVersionFromInstallScript(script)).toBe(
+      "2026.03.20-44cb435"
+    );
+  });
+
+  it("parses lab URL from PowerShell installer", () => {
+    const script = `$downloadUrl = 'https://downloads.cursor.com/lab/2026.03.20-44cb435/'`;
+    expect(extractLabVersionFromInstallScript(script)).toBe(
+      "2026.03.20-44cb435"
+    );
+  });
+});

__tests__/installer.test.ts

@@ -22,15 +22,45 @@ describe("resolveVersion", () => {
 
   it("resolves latest from Cursor endpoint and normalizes v prefix", () => {
     mockHttpGet.mockResolvedValue({
+      message: { statusCode: 200 },
       readBody: mock(() => Promise.resolve("v2026.03.20-44cb435\n")),
     });
 
     expect(resolveVersion("latest")).resolves.toBe("2026.03.20-44cb435");
+    expect(mockHttpGet).toHaveBeenCalledTimes(1);
     expect(mockHttpGet).toHaveBeenCalledWith(
       "https://downloads.cursor.com/lab/latest-version"
     );
   });
 
+  it("falls back to install script when latest-version is non-200", () => {
+    const accessDeniedXml = `<?xml version="1.0" encoding="UTF-8"?><Error><Code>AccessDenied</Code></Error>`;
+    const bashSnippet = `DOWNLOAD_URL="https://downloads.cursor.com/lab/2026.03.20-44cb435/\${OS}/\${ARCH}/agent-cli-package.tar.gz"`;
+
+    mockHttpGet
+      .mockResolvedValueOnce({
+        message: { statusCode: 403 },
+        readBody: mock(() => Promise.resolve(accessDeniedXml)),
+      })
+      .mockResolvedValueOnce({
+        message: { statusCode: 200 },
+        readBody: mock(() =>
+          Promise.resolve(`#!/usr/bin/env bash\n${bashSnippet}\n`)
+        ),
+      });
+
+    expect(resolveVersion("latest")).resolves.toBe("2026.03.20-44cb435");
+    expect(mockHttpGet).toHaveBeenCalledTimes(2);
+    expect(mockHttpGet).toHaveBeenNthCalledWith(
+      1,
+      "https://downloads.cursor.com/lab/latest-version"
+    );
+    expect(mockHttpGet).toHaveBeenNthCalledWith(
+      2,
+      "https://cursor.com/install"
+    );
+  });
+
   it("returns pinned version without calling network", () => {
     expect(resolveVersion("v1.2.3")).resolves.toBe("1.2.3");
     expect(mockHttpGet).not.toHaveBeenCalled();

src/cursor-version.ts

@@ -0,0 +1,25 @@
+/** Cursor CLI lab artifacts use build ids like `2026.03.20-44cb435`. */
+export const CURSOR_LAB_VERSION_RE = /^\d+\.\d+\.\d+(?:-[A-Za-z0-9]+)?$/;
+
+/**
+ * Parses a plain-text latest-version response body (single line, optional `v` prefix).
+ */
+export const parseLabVersionString = (body: string): string | null => {
+  const firstLine =
+    body.trim().replace(/^v/, "").split(/\r?\n/)[0]?.trim() ?? "";
+  return CURSOR_LAB_VERSION_RE.test(firstLine) ? firstLine : null;
+};
+
+/**
+ * Extracts the lab build id from the official bash or PowerShell install script body.
+ */
+export const extractLabVersionFromInstallScript = (
+  body: string
+): string | null => {
+  const m = body.match(/https:\/\/downloads\.cursor\.com\/lab\/([^/'"\s]+)\//);
+  const candidate = m?.[1]?.trim();
+  if (!candidate || !CURSOR_LAB_VERSION_RE.test(candidate)) {
+    return null;
+  }
+  return candidate;
+};

src/input.ts

@@ -1,12 +1,10 @@
 import { getInput, warning } from "@actions/core";
 
+import { CURSOR_LAB_VERSION_RE } from "./cursor-version";
 import type { ActionInputs, Permission } from "./types";
 
 const VALID_PERMISSIONS: Permission[] = ["read-only", "read-write", "full"];
 
-/** Cursor CLI artifacts use paths like `2026.03.20-44cb435`, not npm-style semver only. */
-const PINNED_CURSOR_VERSION_RE = /^\d+\.\d+\.\d+(?:-[A-Za-z0-9]+)?$/;
-
 /**
  * Reads, validates, and returns all action inputs.
  * @returns The validated action inputs.
@@ -50,7 +48,7 @@ export const getInputs = (): ActionInputs => {
   const normalizedCursorVersion = cursorVersion.replace(/^v/, "");
   if (
     cursorVersion !== "latest" &&
-    !PINNED_CURSOR_VERSION_RE.test(normalizedCursorVersion)
+    !CURSOR_LAB_VERSION_RE.test(normalizedCursorVersion)
   ) {
     throw new Error(
       `Invalid 'cursor-version' value: '${cursorVersion}'. ` +

src/installer.ts

@@ -13,10 +13,15 @@ import {
   find,
 } from "@actions/tool-cache";
 
+import {
+  extractLabVersionFromInstallScript,
+  parseLabVersionString,
+} from "./cursor-version";
 import type { Arch, Platform } from "./types";
 
 const CURSOR_DOWNLOAD_BASE = "https://downloads.cursor.com/lab";
 const CURSOR_VERSION_URL = "https://downloads.cursor.com/lab/latest-version";
+const CURSOR_INSTALL_SCRIPT_URL = "https://cursor.com/install";
 
 const getPlatform = (): Platform => {
   const p = process.platform;
@@ -44,9 +49,38 @@ const getArch = (): Arch => {
   throw new Error(`Unsupported architecture: ${a}`);
 };
 
+const tryResolveLatestFromVersionUrl = async (
+  client: HttpClient
+): Promise<string | null> => {
+  const response = await client.get(CURSOR_VERSION_URL);
+  const statusCode = response.message.statusCode ?? 0;
+  const body = await response.readBody();
+  if (statusCode !== 200) {
+    debug(
+      `Cursor lab latest-version returned HTTP ${statusCode}; trying install script fallback.`
+    );
+    return null;
+  }
+  return parseLabVersionString(body);
+};
+
+const tryResolveLatestFromInstallScript = async (
+  client: HttpClient
+): Promise<string | null> => {
+  const response = await client.get(CURSOR_INSTALL_SCRIPT_URL);
+  const statusCode = response.message.statusCode ?? 0;
+  const body = await response.readBody();
+  if (statusCode !== 200) {
+    throw new Error(
+      `Cursor install script returned HTTP ${statusCode} (expected 200).`
+    );
+  }
+  return extractLabVersionFromInstallScript(body);
+};
+
 /**
- * Resolves "latest" to a concrete semver version string by querying
- * Cursor's version endpoint.
+ * Resolves "latest" to a concrete lab build id via the version endpoint, with
+ * fallback to the official install script (the lab endpoint often returns 403).
  */
 export const resolveVersion = async (version: string): Promise<string> => {
   if (version !== "latest") {
@@ -55,14 +89,27 @@ export const resolveVersion = async (version: string): Promise<string> => {
   }
 
   debug("Resolving latest Cursor CLI version...");
-  const client = new HttpClient("cursor-action");
+  // Match `curl https://cursor.com/install` so cursor.com returns the shell script (not HTML).
+  const client = new HttpClient("curl/8.5.0 (compatible; cursor-action)");
 
   try {
-    const response = await client.get(CURSOR_VERSION_URL);
-    const body = await response.readBody();
-    const resolved = body.trim().replace(/^v/, "");
-    debug(`Resolved latest version: ${resolved}`);
-    return resolved;
+    const fromEndpoint = await tryResolveLatestFromVersionUrl(client);
+    if (fromEndpoint) {
+      debug(`Resolved latest version (lab endpoint): ${fromEndpoint}`);
+      return fromEndpoint;
+    }
+
+    const fromScript = await tryResolveLatestFromInstallScript(client);
+    if (fromScript) {
+      debug(`Resolved latest version (install script): ${fromScript}`);
+      return fromScript;
+    }
+
+    throw new Error(
+      "Could not resolve latest Cursor CLI version: lab endpoint did not return a valid version " +
+        "and the official install script did not contain a download URL. " +
+        "Pin `cursor-version` to a known lab build id, or try again later."
+    );
   } catch (error) {
     throw new Error(`Failed to resolve latest Cursor CLI version: ${error}`, {
       cause: error,