Set up Cursor Cloud dev environment (AGENTS.md + startup script)

[khakimov]

Summary

Sets up the development environment for the OpenScan monorepo so the primary web app can be run and tested locally, and documents the non-obvious startup steps for future cloud agents.

• Adds AGENTS.md with a ## Cursor Cloud specific instructions section covering: scope, the contracts → data-ops build order gotcha, required first-run setup (apps/web/.dev.vars, local D1 migrations, cf-typegen), how to run the web app, the OAuth-only-UI vs API email/password auth note, and lint/test/typecheck caveats.
• Suggests a minimal startup update script: pnpm install + build @repo/contracts + build @repo/data-ops.

No application code is modified. The generated apps/web/worker-configuration.d.ts, apps/web/.dev.vars, and .wrangler/state are intentionally not committed (generated/gitignored).

Environment

• Node 22 (per .nvmrc).
• Dependencies installed with pnpm; @repo/contracts and @repo/data-ops compiled to dist/ (required before anything that imports them).
• Local Cloudflare D1 created via wrangler d1 migrations apply sec-db --local (no Cloudflare account needed; miniflare-backed).
• apps/web/.dev.vars provides local BETTER_AUTH_SECRET / APP_URL / BETTER_AUTH_URL.

Hello-world verification

Created a new account, organization, and project end-to-end against the running app + local D1, both via the API and through the real onboarding UI. Verified the rows persisted in D1.

openscan_onboarding_create_org_project.mp4

Creating an organization ("Acme Security") and project ("Corp Web Assets", domain acme-demo.com) through the onboarding UI, then advancing to the Asset Discovery step.

Asset discovery step after creating org + project

Testing

• ✅ pnpm install
• ✅ pnpm --filter @repo/contracts build
• ✅ pnpm run build:data-ops
• ✅ cd apps/web && pnpm wrangler d1 migrations apply sec-db --local
• ✅ pnpm run dev:web (serves http://localhost:13000; /api/health → 200)
• ✅ pnpm --filter @repo/data-ops test:run (133 passed; 1 pre-existing failure unrelated to setup)
• ⚠️ pnpm --filter web typecheck (pre-existing errors: web app lacks vitest/drizzle-orm dev deps for its test files, plus a null-check in src/trpc/utils/project-access.ts)

_{To show artifacts inline, enable in settings.}