Cursor — Module 22.6

How This Lesson Fits the Module & Volume

Module 22.5 closed on Perplexity and other inference / research platforms. Module 22.6 moves the catalog into the editor: tools developers live in all day. Cursor is the first stop because it made the AI-native IDE (a VS Code fork with Tab + agent) a default comparison point. Vol. 21 already taught the product category—coding assistants as HITL ghost text, chat, and multi-file edit. This lecture names a vendor and teaches when to pick it.

Vol. 15 agentic workflows / agent loops / HITL explain why Composer/Agent is not “just better autocomplete.” Vol. 18 deployment still owns how generated code ships. Next: Windsurf (peer AI IDE), then plugins and terminal agents.

Learning Objectives

By the end of this lesson, students should be able to:

Describe Cursor as an AI-first VS Code fork with Tab (autocomplete) and Composer/Agent (multi-file agentic edit).
Contrast agentic repo work vs ghost-text autocomplete using Vol. 15 HITL language.
State a privacy/repo-context policy: index what, exclude what, Privacy Mode vs team DPA.
Compare Cursor qualitatively to Copilot, Windsurf, and terminal agents (Claude Code / Gemini CLI).
Write project rules that keep secrets out of prompts and humans on the diff.
Decide when Cursor is the daily driver vs a GitHub-native or browser prototype tool.

Definition

Cursor (Anysphere) is a desktop IDE forked from VS Code that embeds large-language-model assistance as a first-class surface: inline Tab completion, scoped inline edit, chat, and a multi-file Composer / Agent that can plan, read, and patch several files. It typically indexes the workspace (with ignore rules) so the model can retrieve repo context beyond the open buffer. Cursor is a coding assistant product in the Vol. 21 sense—not an unsupervised deploy agent. SKU names (Tab, Composer, Agent, Privacy Mode, Business) evolve; read the current product sheet before an RFP.

Agentic vs Autocomplete

Vol. 21 listed five IDE patterns. Cursor ships at least three of them in one window. Do not treat them as one risk class.

Surface	What the model sees	Human action	Vol. 15 analogue
Tab (ghost text)	Cursor neighborhood + light file/language context	Accept / ignore one snippet	Suggestion, not an agent loop
Inline edit / Chat	Selection + instruction + optional @files	Review diff in the buffer	Single-step tool use
Composer / Agent	Plan + retrieved repo chunks + terminal/test output if enabled	Review multi-file diff; run tests	Agent loop with HITL apply
Repo Q&A (@codebase)	Index / retrieval, not the whole monorepo paste	Verify paths against source	RAG node inside the IDE

Use Tab when

Boilerplate, obvious next line
You are already staring at the file
Latency must stay “keystroke”

Use Agent when

The change spans modules
You have a failing test to repair
You can afford a plan + review cycle

Do not use Agent when

The task is exploit / malware (Vol. 20 refuse)
Secrets live in the working tree unignored
Nobody will run CI before merge

Privacy and Repo Context

Repo-aware quality depends on an index. Privacy depends on what that index and the prompt exclude. Vol. 11 context length still bounds what one request can hold; Cursor retrieves rather than dumping the monorepo. Vol. 20 privacy / copyright apply: .env, keys, customer dumps, and license-sensitive blobs stay out.

Privacy Mode (when enabled on current plans) is the procurement talking point: prompts/code not used to train foundation models and tighter retention. It is not a substitute for ignore files, secret scanning, or a Business DPA. Confirm the current privacy FAQ—do not memorize a retention day count from a blog.

Catalog Snapshot (Qualitative)

Dimension	Cursor	GitHub Copilot	Windsurf
Pricing posture	Individual + team seats; agent/premium-model usage often metered separately—read the live plan sheet	Seat tiers (Free/Pro/Business/Enterprise) + premium-request usage on some SKUs	Seat / plan + agent usage; confirm current Codeium/Windsurf sheet
Strengths	AI-native UX; strong multi-file Agent; VS Code extension ecosystem; project rules	Multi-IDE plugin; GitHub PR/org gravity; enterprise content exclusion + procurement path	Cascade flow UX; memories; familiar VS Code-like shell
Weaknesses	Fork must track upstream VS Code; usage surprises on Agent; not the native GitHub.com review surface	Plugin UX can feel less “AI-first” than a fork; agentic multi-file historically lagged (gap narrows)	Smaller mindshare / org SKUs than Copilot; vendor entity has shifted—re-check ownership
Agentic vs autocomplete	Both first-class (Tab + Agent)	Autocomplete heritage; Chat/Edits/Agent added	Supercomplete + Cascade agent
Privacy / repo	Ignore + Privacy Mode + Business controls	Content exclusion, org policy, no-train on Business/Enterprise (verify)	Index + ignore + team privacy settings
Ship path (Vol. 18)	Local/git → your CI/CD	Same + GitHub Actions/PRs	Local/git → your CI/CD

Project Rules Sketch (Educational)

Keep policy in-repo so every Agent run sees the same constraints. This is configuration you maintain—not an exploit, not a jailbreak.

# .cursorignore  (do not index / attach)
.env
.env.*
**/secrets/**
**/*.pem
**/node_modules/**
**/dist/**
**/*.min.js

# .cursor/rules/hitl.mdc  (project rule — names evolve; check docs)
# Always: human reviews diff; run tests before commit.
# Never: generate exploits, malware, or credential-stealing code.
# Prefer Tab for local edits; Agent only with a written task + test command.
# Context: @ relevant packages, not the whole monorepo.

# team_policy.py — checklist before enabling Agent on a private repo
POLICY = {
    "privacy_mode_required": True,
    "human_must_accept_diff": True,
    "forbid_exploit_or_malware_tasks": True,
    "index_excludes": [".env", "secrets/", "node_modules/"],
    "test_command": "pytest -q",
    "ci_required_before_merge": True,
}

def agent_allowed(task: str, has_reviewer: bool) -> bool:
    banned = ("exploit", "malware", "ransomware", "keylogger")
    if any(w in task.lower() for w in banned):
        return False
    return has_reviewer and POLICY["privacy_mode_required"]

When to Pick Cursor

Pick Cursor when

The team already thinks in VS Code keybindings.
Multi-file Agent + project rules are the daily loop.
You will keep git + Vol. 18 CI as the ship path.
Privacy Mode + ignore files satisfy the DPA conversation.

Pick something else when

JetBrains / Visual Studio / Xcode is non-negotiable → Copilot.
GitHub.org review + content exclusion is the RFP center → Copilot.
Terminal-only / Anthropic stack → Claude Code.
Prompt-to-running-web-app with zero install → Bolt.new / Lovable / Replit.

Related Lectures

Lecture	Role
Coding assistants (21.1)	Product patterns: ghost text, context budget, pass@k
Agent loop / HITL	Why Agent ≠ Tab
Deployment / FastAPI	Generated code still ships through your pipeline
Privacy / Security	Ignore files, no-train claims, defensive policy
Windsurf / Copilot	Peer IDEs next

Common Misconception

“Cursor Agent can ship to production unsupervised.” It proposes diffs; Vol. 18 deployment and CI still own production. Second: Privacy Mode means you can index .env. Third: Tab quality equals Agent quality—different context and risk. Fourth: a public HumanEval screenshot is your internal eval (Vol. 19 / Vol. 21). Fifth: Cursor replaces Copilot for every JetBrains shop. Sixth: inventing a monthly dollar price from memory belongs on the catalog slide.

Knowledge Check

Short Answer: What kind of product is Cursor in the Vol. 21 taxonomy? Answer: An HITL coding-assistant IDE (VS Code fork), not an unsupervised deploy agent.
True/False: Tab autocomplete and Composer/Agent are the same risk class. Answer: False—Agent is a multi-file loop; Tab is ghost text.
Multiple Choice: Repo awareness in Cursor is primarily: (a) whole-monorepo paste every request, (b) index + retrieval + ignore rules, (c) only the last git commit message. Answer: (b).
Short Answer: Name two things that belong in ignore/exclude lists. Answer: Any of .env, secrets, keys, node_modules, dist, minified bundles.
True/False: Privacy Mode replaces a Business DPA and secret scanning. Answer: False—it is one control among several.
Multiple Choice: Pricing posture is best described as: (a) seats plus possible agent/premium usage, (b) a fake $20 figure from memory, (c) free unlimited Agent forever. Answer: (a).
Short Answer: When should a team pick Copilot instead of Cursor? Answer: Multi-IDE (JetBrains/VS/Xcode) or GitHub-org procurement / content exclusion is the center of the RFP.
True/False: This lecture teaches generating exploits inside Cursor Agent. Answer: False—policy forbids exploit/malware tasks.
Multiple Choice: Cursor Agent maps closest to Vol. 15: (a) unconstrained free agent over prod, (b) agent loop with HITL apply, (c) PCA. Answer: (b).
Short Answer: Which Vol. 21 lecture defined ghost text vs multi-file edit? Answer: Coding assistants.

Key Takeaways

Cursor is an AI-native VS Code fork: Tab for autocomplete, Agent for multi-file HITL work.
Repo context is indexed/retrieved; ignore lists and Privacy Mode are procurement + engineering controls.
Pricing is seat + usage posture—never invent dollar figures.
Pick Cursor for VS Code + Agent daily drivers; pick Copilot, terminal agents, or browser builders for other constraints.
Next: Windsurf — peer AI IDE (Cascade).

Trainer’s Guide

Lab: On a toy repo students own, add ignore rules + a HITL project rule. Complete one Tab-only task and one Agent multi-file task. Measure accept vs revert. No third-party attacking; no malware prompts.

Whiteboard: Draw Tab vs Agent vs Copilot plugin vs Claude Code CLI. Arrow Vol. 18 deployment under all four. Preview Windsurf as the other VS Code-like AI IDE.

Recap: Cursor opens Module 22.6 by turning Vol. 21 coding-assistant theory into a vendor choice—autocomplete vs agent, privacy vs index, IDE vs GitHub vs terminal. Continue to Windsurf.