PaperClipAI/doc/architecture/runner-cursor-capabilities.md

Cursor ACP capability inventory

Evidence date: 2026-09-28. Candidate: 2026.09.26-dd393fe. This profile is not live-qualified. One authorized task-context prompt on the initial free account returned an upgrade requirement, invoked no semantic tools, and supplied no usage receipt. Its cost is unknown; the account dashboard remained unchanged at coarse precision. The user then selected another account, whose exact-model local Runner Eval passed task-context and history tools with clean terminal settlement. Its dashboard attributed 56K rounded tokens to included usage and no incremental charge; ACP still supplied no token or dollar receipt. The local Product hello subsequently passed through the real browser, server, database, native runner, and authenticated completion tool. A second local Product case passed file creation, editing, command validation, an independent exact-byte matcher, and visible workspace artifact presentation. Native interactions, restrictive permissions, recovery, and Daytona execution remain required qualification gates.

The reference is the runner's Codex app-server integration and its closed thread-item inventory in src/provider-events.ts. Cursor ACP and its private extension methods are the transport; the legacy Cursor adapter is unchanged.

Evidence and packaging

• Cursor's ACP contract describes stdio JSON-RPC, sessions, permissions and five extensions. The pinned binary reveals additional capabilities and one material documentation discrepancy below.
• packages/paperclip-runner/cursor-distributions.json pins vendor archive and complete extracted execution-closure SHA256 digests for macOS ARM64/x64 and Linux x64. All three archives were downloaded and independently inventoried (446 files on macOS, 454 on Linux). A real macOS ARM64 installation passed the materializer's full closure check.
• The archive is a complete runtime: bundled node, index.js, dynamically loaded numbered JavaScript chunks, native addons, workers, and assets. Pinning only the launcher or one executable does not pin its execution dependencies. The materializer rejects links/special files and overwrites, and verifies every file against the pinned closure digest.
• test/fixtures/cursor-acp/credential-free-probe.json records an actual macOS ARM64 initialization and nonbillable method probes. initialize reports ACP v1, session load/list, HTTP/SSE MCP, image prompts, and opt-in subagent events. Audio and embedded context are false. session/fork and session/resume return method-not-found. Creating/listing a session requires authentication.
• Static evidence comes from 5672.index.js (ACP implementation), 8096.index.js (ACP SDK protocol schemas), 190.index.js (hook paths) and index.js (CLI/configuration), all bound by the archive and closure pins. SDK schema support alone is not counted as implemented harness capability.

Capability matrix against Codex app-server

“Implemented” below means a tested Cursor implementation wired through the shared runtime, canonical activity channel and durable interaction path. It is not a claim of authenticated end-to-end qualification.

Capability	Cursor harness/ACP evidence	Paperclip treatment	Remaining gap or qualification
Streaming assistant/reasoning	agent_message_chunk, agent_thought_chunk in live and replay presenters	Existing ACP streaming path	Authenticated event capture required
Tool lifecycle/input/output	tool_call and tool_call_update, including raw input/output, locations and content	Canonical lifecycle, bounded output, input-changed indicator and one relative target; Cursor extensions add semantic activity	Raw input body, structured content/diffs/media and additional locations are not projected. See the exact field audit below
Human questions	cursor/ask_question, native single/multiple selections	normalizeCursorQuestionRequest: all questions required; opaque UI IDs round-trip native IDs; forged/duplicate/missing selections rejected	Active-turn adapter maps canonical answers, decline to skipped, and cancellation; durable delivery still requires end-to-end evidence
Proposed plans and decisions	cursor/create_plan with full Markdown, overview, todos, named phases and project flag	normalizeCursorPlanRequest: complete presentation; accept/reject/cancel; revision-derived question ID; rejection feedback	Foundation question descriptions allow 100,000 chars; this boundary also enforces the 196 KiB UTF-8 durable payload cap. Oversize rejects; it is never truncated. No generated planUri, since no uploaded plan artifact is fabricated
Execution checklist	Standard ACP plan and cursor/update_todos (merge)	Per-turn reducer merges by native ID and emits complete snapshots with increasing revisions	Native cancelled status is visible as “Cancelled” with canonical blocked status, since canonical plan schema has no cancelled enum
Child activity	Optional subagent_spawned, subagent_state_update; metadata has tool-call/agent/model identity	Stateful child normalizer emits canonical delegation and retains role/task across state deltas; active-turn adapter validates parent, known child spawn, and immutable tool/agent origin	Requires client _meta.subagents: true. ACPX SDK 1.4.0 lacks these two update variants. A closed opt-in pre-parser intercept binds the parent and declared descendants; child text/reasoning/plan/tool summaries are attributed to their child, never flattened into the parent. Nested media and raw tool details remain partial
Completed subagent tasks	cursor/task: description, prompt, subtype, model, ID, duration	Canonical delegation with role, model, task and duration in activity summary	Dedicated numeric duration field absent from canonical delegation schema
Subagent questions	Pinned ACP subagent handler explicitly rejects interactive questions	No unsupported affordance advertised	Confirmed harness omission; requires upstream support
Generated images	cursor/generate_image: description, path and reference-image paths	Canonical generated/viewed artifact events; description notice; realpath/regular-file containment checks; registered:false	Paths are references, not automatic uploads. Revalidate before artifact ingestion. No image bytes invented
Files and diffs	Tool content includes diff blocks with path, oldText, newText; native edit output and locations	Tool lifecycle plus the runner’s separate workspace-change evidence	Provider-reported before/after blocks are preserved by ACPX but not consumed by the canonical mapper. Additional and absolute locations are dropped; structured provider-diff projection needs implementation and live proof
True active-turn steering	No session/steer; handlePrompt cancels its existing pending prompt before starting another	Advertise steering unsupported	Concurrent prompt is interruption/replacement, not Codex-style in-place steering. Do not mislabel it
Queued follow-ups	No harness queue method discovered	Control-plane scheduling can send another prompt after settlement	No native queue-management events; do not send concurrently to emulate queueing
Cancellation	session/cancel calls the active prompt cancellation callback	Existing interruption path	Process/child cleanup and exact terminal settlement require live qualification
Turn settlement	Prompt implementation drains background subagent completion and awaits child publishers	Existing prompt result terminal boundary	Background shell commands and child errors need live denial/settlement fixtures
Session continuity	session/new, session/load; load replays historical messages, reasoning, tools, images and children	Existing session load/recovery boundary with identity fencing	Duplicate replay suppression and provider-death recovery need authenticated proof
Session discovery	session/list implemented, cwd filter absolute; pagination cursor rejected	Discovered and reported	Currently unused: runner recovers only its exact recorded session; arbitrary history browsing needs company-scoped discovery API
Fork/resume methods	session/fork and session/resume absent in agent implementation and return method-not-found	Unsupported	Session load is available; do not infer fork from SDK schema
Modes	agent, plan, ask; session/set_mode and current_mode_update	Existing review/mode activity plumbing can display changes	Generic operator mode-selection surface not implemented in this provider slice
Model selection	session/set_model, config option model, model-parameter options, config_option_update; cursor/list_available_models extension	Exact requested model must be selected/verified by shared admission	Authenticated listing and exact Luna variant echo passed. Native parameterized picker metadata and separate parameter changes also passed; this richer configuration path is not exposed by the runner. See the authenticated discovery evidence below
Available commands	available_commands_update, including skills/slash commands	ACPX persists command metadata; runner canonical mapper deliberately emits no display event	Command picker and bounded command-discovery surface are not implemented
Session metadata	session_info_update title after automatic naming	Capability documented	Runner owns normalized session identity; provider title is currently not surfaced
Prompt media	Image=true, audio=false, embeddedContext=false in observed initialize	Image inputs may be admitted by advertised capability	Product attachment-to-ACP conversion needs qualified test; audio/embedded context unsupported
MCP and semantic tools	Session MCP injection supports stdio/HTTP/SSE; user/project config also loaded	Runner-owned authenticated MCP bridge only; fail closed on ambient project MCP	Exact tool discovery and company/token boundary remain live tests
Usage/cost	No usage_update/token-usage emission found in pinned ACP implementation; prompt result contains stopReason	Must report usage unavailable, never zero or estimates presented as actual	Dollar accounting unavailable without another explicit measured source. Live spend needs a measurable bound before starting
Reviews, compaction, hooks, memory	Native mode changes, hooks present internally; no dedicated ACP counterparts to Codex context/hook/memory lifecycle found	No fabricated event families	Distinguish confirmed absence of ACP event mapping from unverified native internals
Goal controls / lineage	No ACP goal or fork lineage protocol found	Unsupported	No equivalent of Codex native goals/thread lineage

Wire and isolation findings

The documentation calls todo/task/image methods notifications. The pinned presenter actually calls connection.extMethod(...).catch(...): these messages can carry JSON-RPC IDs. They need immediate acknowledgement plus activity normalization. They must never become human input requests or block awaiting an unnecessary decision.

Question and plan requests lack a session ID. The shared hook binds them to the retained connection, active execution/session/turn and originating request ID; it rejects stale/duplicate answers, cancels on turn termination, persists requests before exposing them, and awaits exact JSON-RPC pipe-write delivery before recording a resolved interaction. This proves transport handoff, not an additional provider application-level acknowledgement. The provider module does not substitute a best-guess session.

Fixed launch arguments are --disable-project-configs --disable-auto-update acp, using the verified bundled Node and absolute verified index.js. Private HOME/XDG roots are required together with CURSOR_CONFIG_DIR, CURSOR_DATA_DIR, disabled compilation caching, AGENT_CLI_CREDENTIAL_STORE=memory, and NO_OPEN_BROWSER=1. Only explicitly bound CURSOR_API_KEY or CURSOR_AUTH_TOKEN may enter. The controller creates a provider/session-scoped credential-name binding from the explicit task environment, ignoring inherited or caller-supplied markers. Rust forwards it through the closed sidecar environment boundary. Before host admission, the sidecar rejects missing, stale, wrong-provider or unbound credentials and removes the marker before provider launch. Tests cover this full boundary and preserve legacy credential behavior. Do not use --force, --trust, or --approve-mcps to paper over governance.

--disable-project-configs only suppresses .cursor/cli.json. It does not suppress project MCP, Cursor/Claude hooks, or installed plugins. assertCursorWorkspacePolicy refuses ambient project execution config from the workspace through its nearest Git root, including symlinks and unreadable configuration. Ordinary Claude settings with neither hooks nor plugins remain admissible. Enterprise system hooks are checked too. The host repeats admission checks before native launch. Continuous protection of these config paths during execution remains a qualification requirement. Admission alone cannot prevent a concurrent file mutation. Team-provided remote hooks are another upstream boundary and remain unqualified under restrictive execution.

Artifact paths are never automatically read or uploaded. References require a present regular file under the physical workspace, reject traversal and symbolic links, and retain registered:false. Private/outside paths are omitted and produce a visible warning. This is metadata validation, not durable file ownership or a replacement for artifact registration checks.

Verification and open work

Passed in the provider worktree:

• 17 Cursor Vitest cases: questions, multi-selection, native ID round-trip, invalid answers, exact plan revisions, outcomes, todo delta merging, delegation metadata, path containment/symlink refusal, child identity retention, private launch defaults and project config gates; active-turn canonical response mapping and immediate acknowledgements; stale/foreign/unknown child identity rejection.
• 5 materializer Node tests: platform pins, entire-tree tampering, linked paths, archive tampering before extraction, and overwrite refusal.
• Targeted strict TypeScript compilation for both provider modules and their imported contracts.
• Credential-free wire initialization and auth/method probes, plus real macOS ARM64 materialization and archive/closure inventories for the other two platforms.

The generic native-distribution lease now snapshots the pinned closure, launches Cursor through its verified bundled Node with a closed-module guard, and uses the existing lifetime guardian. A real nonbillable Cursor initialization passed through that lease. Its six focused tests passed, including argument fencing, external module rejection, and native child ownership/exit proof. The existing snapshot suite also passed. The foundation’s later master integration refreshes the common Claude/Codex pins; the candidate pack below was built against that synchronized graph.

Priority follow-ups before advertising support: (1) per-attempt cost attribution despite missing native usage receipts; (2) restrictive denial and interruption proof; (3) remaining local and Daytona files/artifacts, questions/plans, recovery and settlement proof; (4) parent tool content/diff projection and richer nested child presentation; (5) authenticated trace audit for additional unconsumed native fields. Shared receipt/recovery coverage now proves pipe delivery, provider-loss expiry, exact lifecycle IDs and no approval replay.

Remaining rich capabilities intentionally unused: session discovery, generic mode/config-option UI, provider session titles, command/skill picker metadata, full nested child transcripts beyond bounded delegation summaries, native numeric task duration, and optional planUri. They are listed above with reasons; neither “unsupported” nor “complete” should be inferred for unverified live behaviors. The final combined report must update this inventory with integration evidence and include any further events observed during authenticated qualification.

Shared display-channel verification additionally covers exact rich-event schema validation, terminal/semantic/source injection rejection, active-turn fences, complete Unicode plan preservation through durable outbox persistence, secret redaction disclosure, and oversized UTF-8 rejection. The 4 KiB diagnostic preview cap remains active for diagnostics, never full approval documents.

Child transcript boundary and remaining fields

Pinned source creates a separate session-update presenter for every child and can use another child as the immediate parent. Enabling _meta.subagents therefore requires handling both lifecycle and ordinary child session updates. The Cursor-specific ACPX compatibility path tracks declared descendants per stream and active prompt, forwards them only under the retained root parent authority, and suppresses unknown child sessions. It leaves the SDK's standard parent update schema closed. Known child updates never become parent assistant messages. Old-stream, foreign-parent, pre-turn, settled, aborted, oversized, unknown-child and duplicate-spawn cases are covered.

Child assistant/reasoning text, plan steps and tool lifecycle are displayed in each child's activity summary. The 4,000-character activity surface retains a clearly marked tail when it fills; this is a summary, not a complete nested transcript. Child tool raw input/output, locations, diffs, media content and other child update fields are not rendered by this summary surface and produce explicit partial-detail notices. Adding canonical child transcript/tool surfaces is the next priority for these meaningful exposed fields. Native capabilities:{} currently carries no populated child capability fields; _meta.cursor.agentId and toolCallId are retained internally for immutable origin checks. Nested parent identity is represented in activity metadata because canonical delegation has no parent-child relation field. Native disconnected now yields a failed child with a visible explanation, never a successful completion.

Three real ACP stream tests prove child lifecycle/transcript preservation before SDK parsing, nested parent attribution, standard parent parsing, and old-stream/turn/connection fences. Shared extension, reply-delivery and Pi receipt package cases pass against the resulting patched package; the current totals are recorded below. Three native factory cases verify all platform pins, exact profiles, and rejection of unsupported distributions; native assets resolve only from the runner-owned package authority.

Integrated pack and offline launch evidence

The full build-provider-pack.mjs --candidate-providers=cursor path passed on source 01959b8a602683f13706807983f02c3cba9d36a0 (foundation includes upstream master 14795136f56c11ed83dc754791945bb5a0b8f7fd). It used standalone Node, pnpm 9.15.4, a fresh production deployment and the pinned vendor archive. The build checked portable Node relocation, fresh ACPX import and complete Cursor materialization. The retained manifest is packages/paperclip-runner/test/fixtures/cursor-acp/provider-pack-darwin-arm64.json; it contains only relative paths and digests.

• Pack digest: sha256:f0b622e9151c1c0886e6220c48ea71993b65887baa88b1600b27462074748ddb.
• Cursor declaration: sha256:1157a5d071abbd57ab132f22bace75c65e84cc47a045b0023475488755e14899.
• macOS ARM64 closure: sha256:77394184a89b0e7384971181da19c3c82d83a399b04e7944b3f94fe3d7e62b25.
• Resolved dependency lock: sha256:ec689ad9c31aa2004c7c2c39889764d55897ac2e6d899c8f059d9c23b082c2c8, also the reviewed Daytona build digest for this branch. This digest was resolved from the clean tracked lock with the exact Docker resolution-only command. The frozen install retained it. Image creation rejects a different digest before execution.

provider-pack-offline-proof.json records a real launch through the generic profile installation registry from the pack’s verified native closure and retained snapshot, using private directories and no credentials. ACP v1 initialize succeeds. The correct cursor/list_available_models, session/list and session/new methods return authentication-required; session/fork and session/resume return method-not-found. The process produced no stderr, was explicitly terminated after these probes, and its lease closed. The earlier discovery fixture’s _cursor/list_available_models probe used an incorrect method prefix; this later probe corrects that uncertainty without changing the original evidence.

At the prior foundation checkpoint 7721662f2, the TypeScript/verified-sidecar build and all 177 targeted cases passed: Cursor normalization/policy/artifacts, credential bindings, the durable launcher's actual process specification, candidate backend admission, and sidecar behavior. The actual process-launch regressions verify explicit candidate credentials and their marker survive the final closed allowlist; ambient credentials and caller-supplied markers cannot select themselves. The prior source f09a9a3f8 passed all 47 CI jobs after one retry for runner shutdown and a wall-clock rate-limit case, plus Greptile 5/5; it also passed 29 installed ACPX/materializer Node cases and 6 Daytona image-content cases. These prior results remain historical, distinct from the final source proof.

The current pack/probe binds foundation a589381f9, including candidate admission, biller attribution, explicit unavailable usage, actual-spawn credential binding, and preservation of usage receipts on terminal provider failure. The verified TypeScript build, 56 Cursor/sidecar/eval-provider tests, 67 shared live/eval tests, and 25 mixed-usage contract tests passed during these qualification fixes. Earlier pack evidence remains in Git history. Its explicit offline factory model sentinel is not an authenticated model selection; no ACP prompt was sent. Daytona content identity includes the candidate selection, Cursor materializer and distribution manifest. This is local macOS ARM64 packaging/initialization evidence only. It does not qualify Linux execution, a Daytona image build/run, authenticated model work, permissions, or dollar accounting. No screenshot is claimed for these headless tests. That offline probe submitted no prompts and incurred no model usage. Subsequent authenticated attempts are recorded separately below.

Authenticated discovery evidence

test/fixtures/cursor-acp/authenticated-capability-probe.json records the user-authorized follow-up on 2026-09-28. The pinned verified distribution returned 41 model entries, created a session, accepted gpt-5.6-luna[context=272k,reasoning=medium,fast=false] through both session/set_model and session/set_config_option, and returned that exact value. No model prompt was sent. These facts establish authentication and model selection, not inference entitlement or full runner qualification.

The native picker has two materially different interfaces. Ordinary ACP advertises fixed variant IDs. It rejected grok-4.7[context=256k,reasoning_effort=low,fast=false], although each individual parameter value is advertised by the separate catalog. Advertising client _meta.parameterizedModelPicker:true enables base model grok-4.7 and separate session/set_config_option calls; context 256k, reasoning_effort:low, and fast:false all succeeded and were echoed. The runner does not yet negotiate or project this parameterized configuration path. Follow-up P2: bind the model plus complete verified parameter map to profile/recovery identity and expose supported options without silently choosing a default. In particular, this account's Grok and Composer catalog defaults enable the more expensive Fast option.

Credential setup uses Cursor's documented browser login, with an isolated task-owned home and the pinned file credential store. Only the access token was explicitly saved in the operator's private secret file; credentials and refresh tokens are absent from retained public fixtures. The official usage guide distinguishes included usage from on-demand charges and warns that spend-limit enforcement is delayed. The first prompt therefore requires a separately reserved budget and attribution from the account usage records; missing ACP usage remains unknown, never zero-cost inference.

Authenticated qualification attempts

test/fixtures/cursor-acp/authenticated-qualification-attempts.json retains sanitized per-attempt source, package, daemon, model, timing, cleanup, and cost evidence. The first canonical get-task-context attempt used pack source e5159fb67ad28bf6a691bfa64ffddb332d96f8be, exact Luna selection, one turn, a 60-second limit, a $0.50 declared envelope inside a $2 reservation, and zero retries. This is a Runner Eval against the mock control plane, not Product E2E or restrictive-permission qualification.

The provider returned only an upgrade requirement and then normal completion. Source inspection of pinned 5672.index.js confirms that actionable authentication/entitlement errors are rendered as ordinary assistant text and lose their typed failure before ACP settlement. No text-matching terminal heuristic is used. This is a P1 native-wrapper gap: preserve typed errors upstream or through a verified owned hook. The semantic oracle must still fail a response that did not invoke the required tool.

The replacement-account attempt passed all four canonical get-task-context checks at source 01959b8a602683f13706807983f02c3cba9d36a0, using newly rebuilt daemon source f77ae83aeb6d802c73f1c955760017ae272eba29. Both get_task_context and get_task_history returned successful authenticated semantic results. It took 29.291 seconds and exited cleanly. The Usage page showed a new gpt-5.6-luna-medium row at 19:28:55 UTC with 56K tokens, marked Included. Incremental cash was zero for that row; metered dollars remain unavailable. A conservative $0.07 list-price bound assumes at most 57K rounded tokens at the maximum listed $1.20/M rate and is not an invoice amount. There was no retry.

The local Product hello first stopped at agent creation with HTTP 422 before any provider prompt. Foundation 26dde3cfe fixed exact host-owned candidate/model admission at the public agent API. The separately authorized replacement passed at source edf538e61e712dddb6b4d59045c3dcfd445686c7, from 19:41:56.376 to 19:42:38.761 UTC. All six independent matchers passed: one exact completion marker, task Done, run succeeded, native mode, and local execution. The retained run confirms the 120-second configured deadline, no timeout, committed finalization, and clean cleanup. The final screenshot was inspected and shows the Cursor assignee, tool activity, one completion marker, and Done status. Native usage is null. The account Usage page attributes a new 19:42:25 UTC Luna row with 41.7K tokens, Included in Pro Plus, and zero incremental cash. Metered dollars remain unavailable; a conservative $0.06 list-price bound uses at most 42K rounded tokens at $1.20/M and is not a billing receipt. This proves the local completion-tool product path, not native question/plan, permission, file, recovery, or Daytona qualification. Both attempts remain in the sanitized evidence fixture.

The local file-edit Product case passed at source fe132224c2b30a8d9ce7b46cea38b8760af233fc, from 19:44:43.582 to 19:45:24.406 UTC. All seven matchers passed, including an independent exact-byte read of the 24-byte final file. A native shell command created then rewrote the file and asserted the expected bytes; tool lifecycle and output were retained. The inspected browser screenshot shows the file, a downloadable workspace artifact card, edited-file activity, the completion marker, and Done. Cleanup passed. This is workspace artifact discovery and presentation evidence, not provider-reported diff projection. The account Usage page attributes a 19:44:59 UTC Luna row with 84.1K tokens, Included in Pro Plus, and zero incremental cash. Metered dollars remain unknown; the conservative list-price bound is $0.102, not an invoice. The trace also confirms a meaningful remaining field gap: native command rawOutput.exitCode:0 survives in serialized output, while canonical exitCode remains null; extracting only validated command results is a P2 follow-up.

The first attempt also exposed the shared live-eval layer's rejection of missing usage. The foundation now retains explicit unavailable-usage records for diagnostic candidates, leaves the numeric receipt ledger empty, preserves the response for grading, and keeps unknown aggregate costs unknown across mixed turns. This fix does not retroactively turn the retained failed attempt into a pass.

Cursor's Grok Bot billing documentation says linking SuperGrok grants Grok Bot usage while leaving the Cursor plan unchanged. Cursor's pricing page lists Composer for free Hobby and frontier models for paid plans. These documents and model-list presence do not establish entitlement for a particular CLI prompt. The operator selected a replacement Pro+ account; its exact Luna configuration was echoed successfully, with no automatic model substitution.

Exact remaining field audit

This source audit follows pinned native update → ACPX runtime → canonicalProviderEventsFromAcpxRuntimeEvent → Paperclip activity. It supplements the higher-level capability matrix and does not claim an authenticated trace was captured.

Native field/interface	Preserved boundary	Current projection / reason for partial use	Follow-up
Parent tool rawInput	ACPX forwards the body	Canonical tool schema exposes only inputUpdated; full native arguments are not displayed	P1: bounded/redacted tool-argument presentation with company and path checks
Parent tool content[] diff path, oldText, newText	ACPX forwards structured content; native permission requests also use it for proposed changes	Canonical tool mapper uses rawOutput, so completed provider-reported diff blocks have no dedicated output surface; separate workspace evidence is not equivalent	P1: validate physical workspace locations and expose attributed diff artifacts
Parent tool content[] images/resource blocks	ACPX forwards blocks and produces a summary	Structured media is unused by canonical tool output; safe registration/location semantics must precede ingestion	P1: validated artifact reference projection with explicit provenance
Parent tool locations[]	ACPX forwards bounded locations	Only first relative location becomes target; absolute paths and additional locations are discarded	P1: workspace-aware multi-file attribution; never strip arbitrary absolute prefixes
Parent tool rawOutput	ACPX forwards raw value	Canonical output is bounded serialized text, not lossless structured data; truncation is marked by output metadata	P2: typed tool-result detail viewer when useful
Plan step priority/native extras	ACPX plan entries	Display uses body/status and fixed ordinal step IDs; priority and unknown metadata have no canonical fields	P2: add explicit bounded fields if native traces show product value
Commands, config options, session title	ACPX persists/normalizes available_commands_update, config_option_update, session_info_update	Canonical display mapper explicitly skips these tags; exact model admission remains separate	P2: company-scoped command/config/title surfaces
Child tool raw arguments/results, locations, diffs and media	Cursor child intercept retains validated update for its adapter	Child activity keeps bounded attributed summaries, with visible partial-detail notices; there is no nested transcript/tool detail surface	P1: canonical child transcript and tool/artifact relation model
Child _meta.cursor.agentId / tool origin / parent ID	Retained for immutable-origin and descendant checks	Internal identity guards; parent relationship is textual metadata because canonical delegation lacks an edge field	P2: typed delegation lineage
Task numeric durationMs, optional accepted planUri	Native task/plan extensions	Duration is visible in summary; no numeric delegation field. No plan URI is returned because no plan artifact is registered	P2: typed duration; only return an actually registered plan URI
Session list, model parameters, generic mode control	Confirmed native ACP methods	No operator UI or cross-session discovery API in this integration; recovery loads only the runner-owned exact session	P2: explicit company-scoped controls; authenticated model catalog first

True steering, native queueing, fork/resume, native usage receipts and interactive child questions are absent from this pinned ACP implementation as described above. Their absence is distinct from the implemented-but-unused fields in this table. Remote team hooks, actual artifact traces, authenticated terminal settlement and Linux/Daytona behavior remain unverified, not confirmed absent.