Remove SSH agent access from sandbox docs (#59797)

This removes sandbox prompt and documentation wording that claimed Git
metadata access exposes the inherited SSH agent socket. Git access
remains limited to protected metadata paths, and the Seatbelt wrapper no
longer carries SSH-agent-specific handling or examples.

Release Notes:

- Fixed AI sandboxing documentation to avoid implying Git metadata
access grants SSH agent access.

crates/agent/src/templates.rs

@@ -216,8 +216,6 @@ mod tests {
         assert!(
             rendered.contains("worktree metadata that may live outside the project directories")
         );
-        assert!(rendered.contains("inherited SSH agent socket"));
-        assert!(rendered.contains("does not allow packet-sending network access"));
         assert!(rendered.contains("for the rest of the thread"));
     }
 

crates/agent/src/templates/system_prompt.hbs

@@ -199,7 +199,7 @@ You can request elevated permissions on individual `terminal` calls:
 - `allow_all_hosts: true` — lift the network restriction entirely: outbound access to any host over any protocol, so SSH, FTP, and raw sockets work too (unlike `allow_hosts`, which is HTTP/HTTPS-only). Use only when the specific hosts can't be enumerated up front.
 {{/if}}
 - `fs_write_paths: ["/abs/or/worktree-relative/path", ...]` — allow writes to specific paths (each directory grants its whole subtree). Prefer this whenever you know which paths the command needs to write.
-- `allow_git_access: true` — lift the default block on Git metadata, allowing reads and writes of file contents under `.git` directories (including worktree metadata that may live outside the project directories). Any command that touches `.git` needs this, including ones that invoke Git only incidentally (e.g. build scripts calling `git describe`/`git rev-parse`, or commit hooks). When approved, the inherited SSH agent socket also becomes reachable for SSH-based Git commit signing (local Unix-socket IPC only — it does not allow packet-sending network access); GPG commit signing via gpg-agent is not available in the sandbox.
+- `allow_git_access: true` — lift the default block on Git metadata, allowing reads and writes of file contents under `.git` directories (including worktree metadata that may live outside the project directories). Any command that touches `.git` needs this, including ones that invoke Git only incidentally (e.g. build scripts calling `git describe`/`git rev-parse`, or commit hooks).
 - `allow_fs_write_all: true` — allow unrestricted filesystem writes. Only use this when the specific paths can't be enumerated up front.
 - `unsandboxed: true` — run the command with no sandbox at all. Use only when none of the above suffice.
 

crates/sandbox/src/macos_seatbelt.rs

@@ -195,9 +195,8 @@ pub fn wrap_invocation(
 /// denied even when they would otherwise be readable or writable; file
 /// metadata remains readable. Unix domain socket paths in
 /// `allowed_unix_socket_paths` are reachable for local IPC even when IP
-/// network access is otherwise blocked; callers use this for trusted sockets
-/// inherited from the process environment, such as `SSH_AUTH_SOCK`. This does
-/// not permit sending packets to other machines.
+/// network access is otherwise blocked. This does not permit sending packets
+/// to other machines.
 ///
 /// Network access and unrestricted filesystem writes must be requested via
 /// [`SandboxPermissions`].
@@ -453,11 +452,11 @@ mod tests {
     #[test]
     fn test_generate_seatbelt_config_allows_unix_socket_paths_without_network() {
         let dir = PathBuf::from("/Users/test/projects/myproject");
-        let ssh_auth_socket = PathBuf::from("/private/tmp/com.apple.launchd.test/Listeners");
+        let socket_path = PathBuf::from("/private/tmp/com.example.test/Listeners");
         let config = generate_seatbelt_config(
             &[dir.as_path()],
             &[],
-            &[ssh_auth_socket.as_path()],
+            &[socket_path.as_path()],
             SandboxPermissions::default(),
         )
         .unwrap();
@@ -466,8 +465,8 @@ mod tests {
         assert!(config.contains("AF_UNIX"));
         assert!(config.contains("(allow network-outbound"));
         assert!(config.contains("remote unix-socket"));
-        assert!(config.contains("(literal \"/private/tmp/com.apple.launchd.test/Listeners\")"));
-        assert!(!config.contains("(subpath \"/private/tmp/com.apple.launchd.test/Listeners\")"));
+        assert!(config.contains("(literal \"/private/tmp/com.example.test/Listeners\")"));
+        assert!(!config.contains("(subpath \"/private/tmp/com.example.test/Listeners\")"));
         assert!(!config.contains("(allow network*)"));
     }
 
@@ -491,8 +490,6 @@ mod tests {
             .set_nonblocking(true)
             .expect("listener should switch to non-blocking");
 
-        // Allow both the path the command connects to and its canonical form,
-        // mirroring how the real caller resolves `SSH_AUTH_SOCK`.
         let canonical_socket_path = socket_path
             .canonicalize()
             .expect("bound socket path should canonicalize");

crates/sandbox/src/sandbox.rs

@@ -584,9 +584,6 @@ impl Sandbox {
             .collect();
         writable.extend(git_writable.iter().map(PathBuf::as_path));
         let protected: Vec<&Path> = git_protected.iter().map(PathBuf::as_path).collect();
-
-        // SSH-agent socket handling (commit signing) is deferred, so no unix
-        // sockets are allowed for now.
         let (program, args, config) = macos_seatbelt::wrap_invocation(
             &command.program,
             &command.args,

docs/src/ai/sandboxing.md

@@ -112,7 +112,6 @@ Sandboxed terminal commands:
 When network access is approved on macOS, Zed uses an HTTP/HTTPS proxy so access can be limited to approved hosts.
 Tools that do not honor proxy environment variables, such as SSH, FTP, and raw socket clients, may not work even after host-specific network access is approved.
 For networked terminal commands, prefer HTTPS URLs over SSH URLs when possible.
-When Git metadata access is approved, Zed may also expose the inherited `SSH_AUTH_SOCK` Unix socket so workflows such as SSH commit signing can work without granting outbound network access.
 
 ### Linux {#linux}