ACP (cursor-agent acp): plugins do not load, and project hooks are read from the wrong folder

Support Bug Reports
, , ,
1

Where does the bug appear (feature/product)?

Cursor CLI

Describe the Bug

In ACP mode (cursor-agent acp, used by JetBrains AI Chat), these parts do not work as they do in the IDE and in cursor-agent -p:

  1. Plugins do not load. This is true for team or public marketplace plugins, ~/.cursor/plugins/local, and --plugin-dir. No plugin rules, skills, subagents or hooks are available. The same plugins load in the IDE and in cursor-agent -p.
  2. Project hooks are read from the wrong folder. ACP reads ~/.cursor/projects/<workspace-slug>/.cursor/hooks.json, not <workspace>/.cursor/hooks.json. A hooks.json in the state folder runs, and its deny works. The workspace file never runs. User hooks (~/.cursor/hooks.json) run.
  3. Lifecycle hooks do not fire. sessionStart, beforeSubmitPrompt, subagentStart, subagentStop, afterAgentResponse and stop do not fire in ACP. Tool hooks fire (preToolUse, beforeShellExecution, afterShellExecution, beforeReadFile, postToolUse).
  4. permissions.deny in ~/.cursor/cli-config.json is not applied in ACP. The same deny in <workspace>/.cursor/cli.json works.
  5. ~/.cursor/agents/ does not load in ACP, and ~/.cursor/rules/ loads only when the workspace is under the home folder. Is this intended?

Steps to Reproduce

  1. Make a test workspace (git init) with .cursor/cli.json: { "permissions": { "allow": ["Shell(echo)"], "deny": [] } }.
  2. Add <workspace>/.cursor/hooks.json with a beforeShellExecution hook that returns {"permission":"deny"} for the command echo probe-deny.
  3. Install a local plugin (or use --plugin-dir) that has an always-on rule with a codeword, a skill, and the same kind of deny hook.
  4. Start cursor-agent acp and send initialize, authenticate (cursor_login), session/new with cwd = the workspace, then session/prompt: “Run echo probe-deny. Then give the plugin rule codeword without reading files.”
  5. Result: the command runs, and the agent has no plugin rule codeword. available_commands_update has no plugin skill.
  6. Copy the same hooks.json to ~/.cursor/projects/<workspace-slug>/.cursor/hooks.json (the workspace path with each non-alphanumeric run changed to -). Run step 4 again: now the deny works.
  7. Add "deny": ["Shell(echo:probe-user-deny*)"] to ~/.cursor/cli-config.json and ask the agent to run echo probe-user-deny: it asks for approval and runs. The same deny in <workspace>/.cursor/cli.json blocks it.

Expected Behavior

ACP loads the same plugins, hooks and permissions as cursor-agent in the terminal, and it reads project hooks from <workspace>/.cursor/hooks.json.

Operating System

Linux

Version Information

cursor-agent 2026.09.18-9a7762b (installed by JetBrains AI Chat from the ACP registry) and 2026.09.27-44a7577 (CLI). The IDE comparison was on Cursor 3.21.16.

For AI issues: which model did you use?

Auto. The issue does not depend on the model.

Additional Information

Clients: JetBrains AI Chat (IntelliJ IDEA 2026.2), and a minimal ACP client over stdio.

Hook ask works in ACP: the client gets session/request_permission with “Hook requested approval: <user_message>”.

For item 2, the ACP session code seems to pass the project state folder (~/.cursor/projects/<slug>) to the hooks config loader as the project folder.

Does this stop you from using Cursor

No - Cursor works, but with this issue

6

Hey @Muhammed_Saad, Status + workarounds per item:

  1. Plugins in ACP don’t load yet (they work in the IDE and cursor-agent -p). Not intended; we’ve let the team know. For now, place them standalone: skills in ~/.cursor/skills/, rules in <workspace>/.cursor/rules/, subagents in <workspace>/.cursor/agents/.

  2. Project hooks folder is wrong, so <workspace>/.cursor/hooks.json won’t run. We’ve let the team know. Workaround: use ~/.cursor/hooks.json (it runs in ACP); since it applies to every repo, gate on the project path inside the script.

  3. Lifecycle hooks (sessionStart, beforeSubmitPrompt, afterAgentResponse, stop) not firing in ACP is an issue we’re tracking, and I’ve added your report to it.

  4. cli-config.json deny isn’t ACP-specific: a workspace .cursor/cli.json permissions block replaces the global allow/deny rather than merging, so "deny": [] clears your global deny. Put the deny rules in the workspace cli.json, or drop the empty deny/permissions block so the global one applies.

  5. ~/.cursor/agents/ and ~/.cursor/rules/ behave the same in the terminal CLI (not ACP-specific). Use <workspace>/.cursor/agents/ and <workspace>/.cursor/rules/ (or AGENTS.md); ~/.cursor/rules/ only loads when it’s a parent of your workspace.

I’ll follow up here as these move.

7

Thanks @mohitjain,

Waiting for the team and fixes