fix: correct Cursor CLI download URL resolution and version input

Author: PunGrumpy

.changeset/fix-cursor-cli-download-urls.md

@@ -0,0 +1,5 @@
+---
+"cursor-action": patch
+---
+
+Fix Cursor CLI download URLs: resolve `latest` via the lab endpoint, use `windows` in artifact paths on Win32, and allow pinning lab build ids in `cursor-version` input validation.

__tests__/input.test.ts

@@ -55,6 +55,18 @@ describe("getInputs", () => {
     expect(inputs.cursorVersion).toBe("v1.2.3");
   });
 
+  it("accepts a pinned Cursor lab build id", () => {
+    setupInputs({ "cursor-version": "2026.03.20-44cb435" });
+    const inputs = getInputs();
+    expect(inputs.cursorVersion).toBe("2026.03.20-44cb435");
+  });
+
+  it("accepts a pinned lab build id with v prefix", () => {
+    setupInputs({ "cursor-version": "v2026.03.20-44cb435" });
+    const inputs = getInputs();
+    expect(inputs.cursorVersion).toBe("v2026.03.20-44cb435");
+  });
+
   it("throws on invalid permission value", () => {
     setupInputs({ permissions: "superuser" });
     expect(() => getInputs()).toThrow(/Invalid 'permissions'/);

__tests__/installer.test.ts

@@ -0,0 +1,55 @@
+import { beforeEach, describe, expect, it, mock } from "bun:test";
+
+import * as actionsHttpClient from "@actions/http-client";
+
+const mockHttpGet = mock();
+
+class MockHttpClient {
+  public get = mockHttpGet;
+}
+
+mock.module("@actions/http-client", () => ({
+  ...actionsHttpClient,
+  HttpClient: MockHttpClient,
+}));
+
+const { buildDownloadUrl, resolveVersion } = await import("../src/installer");
+
+describe("resolveVersion", () => {
+  beforeEach(() => {
+    mock.clearAllMocks();
+  });
+
+  it("resolves latest from Cursor endpoint and normalizes v prefix", () => {
+    mockHttpGet.mockResolvedValue({
+      readBody: mock(() => Promise.resolve("v2026.03.20-44cb435\n")),
+    });
+
+    expect(resolveVersion("latest")).resolves.toBe("2026.03.20-44cb435");
+    expect(mockHttpGet).toHaveBeenCalledWith(
+      "https://downloads.cursor.com/lab/latest-version"
+    );
+  });
+
+  it("returns pinned version without calling network", () => {
+    expect(resolveVersion("v1.2.3")).resolves.toBe("1.2.3");
+    expect(mockHttpGet).not.toHaveBeenCalled();
+  });
+});
+
+describe("buildDownloadUrl", () => {
+  it("uses windows path segment and zip extension for win32", () => {
+    expect(buildDownloadUrl("1.2.3", "win32", "x64")).toBe(
+      "https://downloads.cursor.com/lab/1.2.3/windows/x64/agent-cli-package.zip"
+    );
+  });
+
+  it("uses tar.gz for linux and darwin", () => {
+    expect(buildDownloadUrl("1.2.3", "linux", "arm64")).toBe(
+      "https://downloads.cursor.com/lab/1.2.3/linux/arm64/agent-cli-package.tar.gz"
+    );
+    expect(buildDownloadUrl("1.2.3", "darwin", "x64")).toBe(
+      "https://downloads.cursor.com/lab/1.2.3/darwin/x64/agent-cli-package.tar.gz"
+    );
+  });
+});

action.yml

@@ -8,7 +8,7 @@ branding:
 
 inputs:
   cursor-version:
-    description: "Version of the Cursor CLI to install (e.g. '0.1.0' or 'latest')"
+    description: "Cursor CLI build to install: 'latest' or exact lab id (e.g. from https://downloads.cursor.com/lab/latest-version, like '2026.03.20-44cb435')"
     required: false
     default: "latest"
 

src/input.ts

@@ -4,6 +4,9 @@ import type { ActionInputs, Permission } from "./types";
 
 const VALID_PERMISSIONS: Permission[] = ["read-only", "read-write", "full"];
 
+/** Cursor CLI artifacts use paths like `2026.03.20-44cb435`, not npm-style semver only. */
+const PINNED_CURSOR_VERSION_RE = /^\d+\.\d+\.\d+(?:-[A-Za-z0-9]+)?$/;
+
 /**
  * Reads, validates, and returns all action inputs.
  * @returns The validated action inputs.
@@ -43,14 +46,17 @@ export const getInputs = (): ActionInputs => {
     );
   }
 
-  // Validate version format (semver or "latest")
+  // Validate version: "latest" or a published lab build id (see official install script / latest-version)
+  const normalizedCursorVersion = cursorVersion.replace(/^v/, "");
   if (
     cursorVersion !== "latest" &&
-    !/^\d+\.\d+\.\d+$/.test(cursorVersion.replace(/^v/, ""))
+    !PINNED_CURSOR_VERSION_RE.test(normalizedCursorVersion)
   ) {
     throw new Error(
       `Invalid 'cursor-version' value: '${cursorVersion}'. ` +
-        `Use 'latest' or a semver string like '1.2.3'.`
+        `Use 'latest', or pin an exact build id that exists on Cursor's CDN ` +
+        `(e.g. the value from https://downloads.cursor.com/lab/latest-version, ` +
+        `like '2026.03.20-44cb435'). Arbitrary values like '1.2.3' are not published and will fail to download.`
     );
   }
 

src/installer.ts

@@ -48,9 +48,9 @@ const getArch = (): Arch => {
  * Resolves "latest" to a concrete semver version string by querying
  * Cursor's version endpoint.
  */
-const resolveVersion = async (version: string): Promise<string> => {
-  if (version === "latest") {
-    // Strip leading 'v' if present for consistency
+export const resolveVersion = async (version: string): Promise<string> => {
+  if (version !== "latest") {
+    // Keep pinned versions local; no network call needed.
     return version.replace(/^v/, "");
   }
 
@@ -74,13 +74,14 @@ const resolveVersion = async (version: string): Promise<string> => {
  * Builds the download URL for the Cursor CLI tarball.
  * Pattern: https://downloads.cursor.com/lab/{version}/{platform}/{arch}/agent-cli-package.tar.gz
  */
-const buildDownloadUrl = (
+export const buildDownloadUrl = (
   version: string,
   platform: Platform,
   arch: Arch
 ): string => {
   const ext = platform === "win32" ? "zip" : "tar.gz";
-  return `${CURSOR_DOWNLOAD_BASE}/${version}/${platform}/${arch}/agent-cli-package.${ext}`;
+  const platformSegment = platform === "win32" ? "windows" : platform;
+  return `${CURSOR_DOWNLOAD_BASE}/${version}/${platformSegment}/${arch}/agent-cli-package.${ext}`;
 };
 
 const buildCacheKey = (