ACP: honor clientCapabilities.fs for file delegation

Ideas Feature Requests
,
1

Feature request for product/service

Cursor CLI

Describe the request

The client sends clientCapabilities.fs.readTextFile: true during init, but Cursor never calls fs/read_text_file — it always reads files through its internal tools. Same for writes.

This means editors can’t return unsaved buffer contents or control file access through ACP.

curl https://cursor.com/install -fsS | bash
npm install @agentclientprotocol/sdk

Run below as node delegate-file-read.mjs:

import * as acp from "@agentclientprotocol/sdk";
import { spawn } from "node:child_process";
import { mkdirSync, writeFileSync } from "node:fs";
import { join } from "node:path";
import { tmpdir } from "node:os";
import { Readable, Writable } from "node:stream";

const cwd = join(tmpdir(), `repro-${Date.now()}`);
mkdirSync(cwd, { recursive: true });
const testFile = join(cwd, "hello.txt");
writeFileSync(testFile, "secret-value-abc123");

let delegated = false;
const child = spawn("cursor-agent", ["acp"], { stdio: ["pipe", "pipe", "inherit"] });
const stream = acp.ndJsonStream(Writable.toWeb(child.stdin), Readable.toWeb(child.stdout));

const client = new acp.ClientSideConnection(() => ({
  sessionUpdate: async () => {},
  requestPermission: async (p) => ({ outcome: { outcome: "selected", optionId: p.options.find((o) => o.kind === "allow_once").optionId } }),
  readTextFile: async (p) => { delegated = true; console.log(`readTextFile: ${p.path}`); return { content: "secret-value-abc123" }; },
}), stream);

await client.initialize({ protocolVersion: acp.PROTOCOL_VERSION, clientCapabilities: { fs: { readTextFile: true, writeTextFile: true } }, clientInfo: { name: "repro", version: "1.0.0" } });
const { sessionId } = await client.newSession({ cwd, mcpServers: [] });
await client.prompt({ sessionId, prompt: [{ type: "text", text: `Read the file ${testFile} and tell me its contents` }] });

console.log(`\nfs/read_text_file delegated: ${delegated ? "YES" : "NO"}`);
child.kill(); process.exit(0);

readTextFile handler never fires. The agent reads the file directly from disk.

Operating System (if it applies)

MacOS