Fix CORS proxy port, sandbox warning, update notification, missing statsigClientKey

- CORS proxy port now read from ?cors_port= URL param (was hardcoded 9080)
- Suppress terminal sandbox AppArmor notification (no helper binary in serve-web)
- Suppress "New update available" banner (not applicable for serve-web/RPM)
- Ensure statsigClientKey in product.json (needed for feature flags/model loading)
- Bump layout fix version to clear stale localStorage

Author: kleberbaum

README.md

@@ -140,14 +140,14 @@ cursor-web [port] [cors-port]
 cursor-web 8080 9080      # defaults
 ```
 
-Then open `http://localhost:8080` in your browser. The full desktop workbench loads with all Cursor AI features:
+Then open the URL shown in the terminal (includes `?cors_port=` parameter). The full desktop workbench loads with all Cursor AI features:
 - **Composer** — multi-file AI editing
 - **Agent mode** — autonomous coding agent
 - **Chat** — AI chat panel
 - **CursorTab** — AI autocomplete
 - **Model selection** — choose between Claude, GPT-4, etc.
 
-Open a specific folder: `http://localhost:8080/?folder=/path/to/project`
+Open a specific folder: `http://localhost:8080/?cors_port=9080&folder=/path/to/project`
 
 Install as a PWA via your browser's "Install" menu for a native app experience.
 
@@ -192,6 +192,8 @@ The patch script (`patch-cursor-web.sh`) applies these modifications to make the
 | 7o. migrate_editor_mode | Disable Statsig gate that forces Agent mode on every load |
 | 7p. Onboarding Ic() | Disable Agent mode force in onboarding callback |
 | 7q. Onboarding render | Skip onboarding walkthrough entirely (forces Agent mode on completion) |
+| 7r. Sandbox notification | Suppress terminal sandbox AppArmor warning (no sandbox helper in serve-web) |
+| 7s. Update notification | Suppress "New update available" banner (auto-update N/A for serve-web/RPM) |
 
 ### Server JS (`server-main.js`)
 | Patch | Description |

build-cursor-arm64.sh

@@ -153,8 +153,9 @@ d['extensionsGallery'] = {
 # Disable telemetry
 d['enableTelemetry'] = False
 d['enabledTelemetryLevels'] = {'error': False, 'usage': False}
-# Keep statsigClientKey — Statsig feature flags are needed for model loading
-# d.pop('statsigClientKey', None)
+# Ensure statsigClientKey is present — Statsig feature flags are needed for model loading
+if 'statsigClientKey' not in d:
+    d['statsigClientKey'] = 'client-Bm4HJ0aDjXHQVsoACMREyLNxm5p6zzuzhO50MgtoT5D'
 d.pop('statsigLogEventProxyUrl', None)  # Disable event logging proxy only
 d.pop('crashReporterId', None)
 d.pop('appInsightsConnectionString', None)

cursor-web.sh

@@ -21,7 +21,7 @@ fi
 
 echo "==> Starting Cursor Web on port $PORT..."
 echo "    CORS proxy on port $CORS_PORT"
-echo "    Open http://localhost:$PORT in your browser"
+echo "    Open http://localhost:$PORT/?cors_port=$CORS_PORT in your browser"
 echo "    Install as PWA: Browser menu → Install Cursor..."
 echo ""
 

patch-cursor-web.sh

@@ -444,6 +444,24 @@ if old in js:
 elif new in js and 'sC_' in js:
     print('  sC_ onboarding already patched')
 
+# 7r. Suppress terminal sandbox AppArmor notification (always fires on Linux >= 6.2 without sandbox helper)
+old = '!this._rawSandboxSupported&&e?.linuxKernelVersion?this._showSandboxUnsupportedNotification(e.linuxKernelVersion)'
+new = '!this._rawSandboxSupported&&e?.linuxKernelVersion?void 0'
+if old in js:
+    js = js.replace(old, new, 1)
+    changed = True
+    print('  sandbox AppArmor notification suppressed')
+elif new in js:
+    print('  sandbox notification already suppressed')
+
+# 7s. Suppress "New update available" notification (auto-update not applicable for serve-web/RPM)
+old = 'minor-version-notification-text>New update available'
+new = 'minor-version-notification-text>New update available" style="display:none'
+if old in js and 'style="display:none' not in js[js.find(old):js.find(old)+200] if old in js else True:
+    js = js.replace(old, new, 1)
+    changed = True
+    print('  update notification suppressed')
+
 if changed:
     open(f, 'w').write(js)
 PATCH_DESKTOP_EOF

workbench-desktop-shim.js

@@ -8,7 +8,7 @@
 // Intercept and route through local proxy.
 {
     const _originalFetch = window.fetch;
-    const PROXY_PORT = 9080;
+    const PROXY_PORT = parseInt(new URLSearchParams(window.location.search).get('cors_port') || '9080', 10);
     // Match Cursor API endpoints + Statsig feature flag domains (CORS-blocked in browser)
     const _cursorApiRe = /https?:\/\/(?:[a-z0-9-]*\.?(?:api[2-5]\.cursor\.sh)|api\.statsigcdn\.com|featureassets\.org|prodregistryv2\.org|statsigapi\.net)/;
     // Rewrite vscode-remote:// URLs to local HTTP resource endpoint
@@ -689,7 +689,7 @@ async function seedAuthTokens() {
     }
     // One-time layout reset: undo damage from migrate_editor_mode migration
     // (now disabled via workbench patch 7o) and prevent onboarding from forcing Agent mode.
-    const _layoutFixVersion = '7';
+    const _layoutFixVersion = '8';
     const _layoutFixKey = _storagePrefix + 'cursorWeb/layoutFixApplied';
     if (localStorage.getItem(_layoutFixKey) !== _layoutFixVersion) {
         // Reset Agent mode hidden flags