The cockpit is not the engine room.
Cursor’s September 2 changelog says its agents can execute tools on self-hosted machines while code, build output, and secrets remain on infrastructure the customer controls. It describes personal machines, dynamically scheduled team pools, integrations with existing sandbox vendors, and computer use on Linux and Mac.[1]
That is not “local mode” in the old desktop-app sense. The steering surface can be hosted while the wrench turns elsewhere. The important boundary is no longer the window frame. It is the tool-execution route.
Do not ask whether the agent is local. Ask which plane crosses which boundary.
The session tree is becoming operations UI.
VS Code 1.136 adds a hierarchy for related agent chats, surfaces per-chat status and pending approvals, supports sessions across multi-root workspaces experimentally, and previews Agent Merge for iterating on review feedback, checks, and conflicts.[2] The release also preserves an honest wrinkle: agent hooks remain scoped to one workspace folder even when the session spans several.
This is the right kind of friction. A parent session can dispatch work, but the interface still needs to show which child is blocked, which folder owns policy, and who has the merge brake. A tree without authority labels is just a prettier pile of tabs.
Instructions are shipping units now.
OpenAI’s former standalone skills catalog now points readers to its plugins repository and plugin-building guide. The old README describes skills as folders of instructions, scripts, and resources; its deprecation notice moves current examples toward a larger installable package boundary.[3]
The migration is the signal: durable agent behavior is becoming deployable software inventory. That means version, owner, granted reach, rollback path, and fixtures belong beside the prose. “It is only instructions” stopped being a serious threat model the moment those instructions could call tools.
Wire a breakaway, not a monolith.
- Steer plane: declare the session that owns intent, approvals, and the stop button.
- Run plane: name the machine or pool that can read files, reach networks, and spend compute.
- Policy plane: pin the workspace rules, hooks, skills, and plugin versions shaping behavior.
- Proof plane: land tests, diffs, logs, and merge authority somewhere inspectable outside the model’s narration.
- Breakaway drill: kill the worker, revoke the plugin, or detach the session; prove the artifact and receipt survive.