Environment secrets not working in Origin repo based Project

Support Bug Reports
, ,
1

Where does the bug appear (feature/product)?

Cursor IDE

Describe the Bug

In a Project, runtime secrets added to a Cloud Agent environment for an Origin repository do not stay saved, and agents never receive them.

Steps to Reproduce

  1. Use a personal Cursor account to create a Project and an Origin repository. Note that Origin repositories do not appear in the Cloud Agents secrets repository list. That list shows GitHub repositories only. Therefore we are forced to use environment secrets instead of repository secrets.
  2. Create a Cloud Agent environment for that Origin repo.
  3. Enter Runtime secrets on the environment.
  4. The Save button stays disabled until the install or start script is edited.
  5. Saving is then blocked with “These scripts have not been tested in an environment build”. Choose Test new build.
  6. The agent builds the scripts and proposes an environment card whose body is only install and start scripts.
  7. The environment is saved. The secrets are gone.

Attempted workaround:

  1. Submit the same four names through the environment-setup secrets card. The UI reports that secret entry completed.
  2. Mark the environment build active.
  3. Start a new background agent from the Project. It reports environment null. All four variables are unset (test -n only; values were never printed).
  4. Starting a worker with environment_build_id set to the active build id is refused: “Requested environment build is invalid.”

Environment public id: 54d57d8c-c6e3-11f1-ac31-5e2d0494121f (name sam74s/aiao-v3, source Override, recorded via BUILD_TRIGGER, environmentJsonPath null).

Builds that succeeded and still did not inject secrets into a later agent:

  • bld-20261014-02689187-1ade-4368-926e-382a575c2e9f
  • bld-20261014-58c77c06-1f40-4b6e-961e-50f674dd7bf6
  • bld-20261014-534e45f4-6307-4352-abea-93ac06b28118

Background agents that observed the secrets unset:

  • bc-a856e618-db42-456d-96f1-cb5c9acbe931 (Project coordinator; secrets also unset in its environment)
  • bc-ebf5c339-316d-5f7a-81c0-4ddfcea02876
  • bc-673720b3-cc4e-59c3-b2bc-51fa6e7548cc
  • bc-e9af1cb6-4038-5a8c-b55f-7d4472326236

Expected Behavior

Saving Runtime secrets on an environment should persist them without editing or rebuilding install/start. A new Cloud Agent or Project worker for that repository should start with those secrets injected. An active build id for that environment should be a valid environment_build_id. Origin repositories should be selectable where GitHub repositories are.

Operating System

Windows 10/11

Version Information

Version: 3.24.12 (system setup)
VS Code Extension API: 1.128.0
Commit: 37b865941ccb31e2fc90c685157534efca87f960
Date: 2026-10-09T20:56:41.904Z
Layout: IDE
Build Type: Stable
Release Track: Default
Electron: 42.10.0
Chromium: 148.0.7778.280
Node.js: 24.18.1
V8: 14.8.178.38-electron.0
xterm.js: 6.1.0-beta.291
OS: Windows_NT x64 10.0.26200

For AI issues: which model did you use?

Grok 4.7, for the Project coordinator and the background agents that checked the secrets.

Does this stop you from using Cursor

No - Cursor works, but with this issue

5

Hey @sam74s, thanks for the detailed report and the IDs, they made this quick to trace.

What’s going on: your Project started on the temporary repository that a new project gets before it’s named. After you named it sam74s/aiao-v3, the Project’s agents kept starting on that earlier temporary name. Because of that, they don’t match the environment you set up for sam74s/aiao-v3, and secret injection is skipped for them. That’s why every worker reports no environment, why all four variables are unset, and why the active build id is refused. I’ve flagged this to the team.

In the meantime, could you try this and tell me what you see?

  1. Open a new Cloud Agent (not inside the existing Project) and pick sam74s/aiao-v3 as the repository.
  2. Pick the sam74s/aiao-v3 environment if you’re asked for one.
  3. Once it starts, ask it to run test -n "$NAME" && echo set || echo unset for each of the four names. Values won’t be printed.
  4. Reply with whether each one says set or unset, and the agent’s ID.

If that works, a new Project created from sam74s/aiao-v3 should get the secrets too.

On the environment panel: secrets are saved on their own from the Secrets section (New Secret), and the Save button only covers changes to the install and start scripts. If a secret you added there no longer appears in the Secrets list after you reload the page, please tell me which page you added it from.