Some repos and tasks may only run on pre-approved execution environments (specific Mac/Windows machines, private workers like MAC with VPN and multi-repo checkouts, GPUs, local certs, internal services—not just “wrong OS”).
The goal is execution governance:
-
When starting an agent (including subagents, automations, and API runs), the only selectable or routable targets are runners you have registered in advance—not Cursor’s default managed Linux cloud VMs unless you explicitly allow them.
-
That policy should bind to repository or task scope (“this repo may only use these runners”), not rely on someone remembering to pick the right entry in a dropdown each time.
-
Subagents must inherit the same runner policy as the parent session. They must not silently escape to a separate cloud VM (e.g. via /in-cloud or equivalent) and run where the parent was not allowed to run.
What is wanted: an allowlist plus default enforcement plus no subagent bypass—a single product-level policy.
What Cursor documents today: team-level “require self-hosted” and pool/worker routing with explicit pool or worker names—not a repo-declared “allowed runners = these three” that constrains UI, API, and subagents together.