This PR hardens the terminal tool's hardcoded security rules for
destructive commands like `rm -rf /`, and adds path normalization to
prevent traversal-based bypasses.
## Path normalization
Adds `normalize_path` which resolves `..`, `.`, and redundant path
separators, and `decide_permission_for_path` which checks permissions
against both raw and normalized paths (taking the most restrictive
result). This prevents attacks like `rm -rf /tmp/../../` which
previously bypassed the `rm -rf /` rule.
## rm command expansion
Adds `expand_rm_to_single_path_commands` which splits multi-argument rm
commands into individual single-path commands for checking. This catches
cases like `rm -rf /tmp /` where the dangerous path is the second
argument.
## Regex hardening
- **FLAGS**: Now accepts digits, underscores, and uppercase in long
flags (e.g. `--no-preserve-root`)
- **`--flag=value`**: Correctly matched as a single flag token
- **Trailing flags**: Handles GNU rm's acceptance of flags after path
operands (e.g. `rm / -rf`)
- **`--` marker**: Detects end-of-options bypass attempts (e.g. `rm -rf
-- /`)
- **Whitespace**: Handles tabs and other whitespace, not just spaces
## `$HOME`/`${HOME}` handling
Normalizes the suffix after `$HOME`/`${HOME}` variable references so
that traversal attacks like `rm -rf $HOME/./` or `rm -rf ${HOME}/foo/..`
are correctly detected.
Release Notes:
- Strengthened terminal security rules to detect path traversal attacks
in destructive commands like `rm -rf`.
The two `unbounded_send` calls in `ToolCallEventStream`'s authorize
methods were using `.ok()` to silently discard send failures. This meant
that if the authorization channel was closed, the tool call would hang
indefinitely waiting for a response that would never come.
## Changes
- Both `authorize_third_party_tool` and `authorize` methods now use `if
let Err(error)` to detect send failures
- On failure, logs the error with `log::error!` and returns
`Task::ready(Err(...))` so callers get immediate, meaningful feedback
Release Notes:
- Tool authorization failures are now logged and reported instead of
being silently ignored.
- **build: remove assistant_slash_commands dependency in
assistant_text_thread**
- **diagnostics: Do not depend on search**
- **Remove terminal_view's dependency on search**
- **sever breadcrumbs <-> editor dep (for the sake of terminal_view)**
Release Notes:
- N/A
This PR updates the model selector to highlight the latest models that
are available through the Zed provider:
<img width="388" height="477" alt="Screenshot 2026-02-06 at 1 46 41 PM"
src="https://github.com/user-attachments/assets/70760399-ecf6-46e3-80a7-cb998216c192"
/>
Closes CLO-205.
Release Notes:
- Added a "Latest" indicator to highlight the latest models available
through the Zed provider.
Closes https://github.com/zed-industries/zed/issues/28091
Off in language settings by default: ` "lsp_folding_ranges": "off",`,
when enabled, disables tree-sitter indent-based folding and enables
fetching of LSP ones instead.
Falls back to tree-sitter if LSP-based one brings no results.
Release Notes:
- Added `textDocument/foldingRange` LSP support, use `
"lsp_folding_ranges": "on",` language settings to fetch and prefer the
LSP folds
* split more logic away into its own modules for document colors, code
lens and inlay hints
* remove unnecessary cache_version for document colors
Release Notes:
- N/A
Previously, some settings migrations only operated on root-level keys
and missed settings nested under platform keys (`macos`, `linux`, etc.),
channel keys (`nightly`, `stable`, etc.), or profile blocks. This fixes
migrations to recurse into those nested locations.
Also fixes `m_2026_02_02` to gracefully skip when `edit_predictions` is
not an object (e.g. `true`) instead of bailing and aborting the entire
migration chain.
Release Notes:
- Fixed settings migrations to correctly handle settings nested under
platform, channel, or profile keys.
This PR adds support for setting the reasoning effort for OpenAI models
through the Zed provider.
This is gated behind the `cloud-thinking-effort` feature flag.
Release Notes:
- N/A
Co-authored-by: Tom Houlé <tom@tomhoule.com>
In `streaming_edit_file_tool.rs`, edits are sorted in reverse order and
applied sequentially. If the LLM produces overlapping edit ranges, the
first applied edit shifts the buffer, and the second edit's range
targets stale offsets, leading to incorrect results.
This adds a `windows(2)` check on the sorted (descending by start) edits
that verifies each earlier-in-file range's end does not exceed the next
later-in-file range's start. The validation is done before entering the
buffer update closure so the error can propagate cleanly via
`anyhow::bail!`.
Release Notes:
- Fixed bug where streaming edits could apply edits incorrectly if the
model requested overlapping edit regions.
This PR renames the `cloud-thinking-toggle` feature flag to
`cloud-thinking-effort`.
This feature flag has expanded slightly in scope, so we want the name to
be more representative of what it gates.
Release Notes:
- N/A
Co-authored-by: Tom Houlé <tom@tomhoule.com>
Closes#41373
Release Notes:
- Ensures that XDG specs are followed on MacOS and Linux with backwards
compatibility.
Changes
-Added ```state_dir``` to get XDG_STATE_HOME on macos and linux, no
change to windows.
-Changed ```text_threads_dir``` to a fallback,
```text_threads_dir_fallback```
-Re-implemented ```text_threads_dir``` to use ```state_dir```
---------
Co-authored-by: AdamJedl <100023363+AdamJedl@users.noreply.github.com>
This commit updates the `paths::set_custom_data_dir` implementation so
as to always canonicalize the provided `dir`, even when dealing with an
absolute path.
This ensures that we correctly deal with symlinks and don't end up not
reacting to filesystem watcher events in this specific case. For
example, when using `--user-data-dir /tmp/zed` on macOS, since `/tmp` is
a symlink to `/private/tmp`, if any setting was changed, the application
would not react, as the event would be using
`/private/tmp/zed/config/settings.json`, while the watcher would be
looking out for `/tmp/zed/config/settings.json`.
Lastly, the canonicalization of the path is now done after
`std::fs::create_dir_all` is called, in order to guarantee that the
directory already exists at that point.
Release Notes:
- N/A
Release Notes:
- Added handling of custom blocks in the RHS editor by creating matching
dummy custom blocks rendered as spacer blocks in the LHS editor when in
split view.
This PR moves `selection` from `State` to `ProjectPanel`.
In async `update_visible_entries`, the `old.selection` copied into
`new_state` was never read or updated. After async completion, we
already either set the new selection (when provided) or keep the current
selection value. So storing `selection` in `State` was redundant.
This simplifies a confusing code path without changing behavior.
Release Notes:
- N/A
Prep for: https://github.com/zed-industries/zed/pull/46750
Edit-state cleanup in the Project Panel was inconsistent between Escape
cancel and blur. Blurring the filename editor during file/folder
creation could clear edit state without restoring the previous
selection.
This routes both paths through the same discard flow and adds test
coverage for the blur case.
Release Notes:
- Fixed an issue where blurring the filename editor in the Project Panel
could lose the previous selection while creating a file or folder.
In combination with auto-labeling staff PRs, this makes it possible to
see the community PRs with `-label:staff -label:bot` in the search query
on https://github.com/zed-industries/zed/pulls
Release Notes:
- N/A
Modifying the existing github workflow here instead of adding a new one
because we're already triggering on the same thing (new PR opened) and
checking the same thing (staff team membership) but throwing away the
result. Another CI job doing largely the same checks seemed unnecessary.
Release Notes:
- N/A
This allows us to switch the prompt format without client-side changes.
If we want to experiment with prompt formats or models other than the
currently-deployed one, we can use the raw endpoint, and do prompt
construction and output processing on the client.
This also adds an optional environment parameter to the raw endpoint, so
that we can use that endpoint in the new scheme where we're deploying to
separate environments for different zeta prompt versions.
Release Notes:
- N/A
Closes: #48560
Release Notes:
- Fixed an issue where Zed would try to open all edited files in ~ if
your git config had a globalexludes in ~ that did not exist.
---------
Co-authored-by: Cole Miller <cole@zed.dev>
A collection of small independent fixes:
- **Visual test runner**: Replace ~20 instances of `.ok()` and `let _ =`
with `.log_err()` to avoid silently discarding errors per project
guidelines.
- **recent_projects**: Add missing `remote_connection/test-support` to
the `test-support` feature gate.
- **util/shell.rs**: Add doc comment on `supports_posix_chaining()`
explaining its relationship to tool permission pattern matching.
Release Notes:
- N/A
Searching (and related vim stuff like `*`/`n`/`N`) now work in the LHS
of a
split diff.
Also fixes the bug with indent guides being visible through the spacer
checkerboard pattern.
Release Notes:
- N/A
Closes#46506
Release Notes:
- Fixed an issue where the codestral URL used for credentials would be
different than the one used for requests causing authentication errors
This PR extends error telemetry coverage in the agent panel, building on
#46836 which added telemetry for thread errors.
`"Agent Panel Error Shown"` (extended)
Now also fires for:
- **Load errors** - when an agent fails to start
- **Configuration errors** - when LLM provider setup is incomplete
`"Agent Token Limit Warning"` (new event)
Fires when a thread approaches or exceeds its token/context limit. This
is tracked separately from errors because it's an informational warning,
not a failure.
## Implementation Notes
- All telemetry fires **once per error occurrence**, not on every render
- Load error telemetry fires in `handle_load_error()` when the error is
first received
- Token limit telemetry uses a flag to track state transitions (Normal →
Warning → Exceeded)
- Configuration error telemetry tracks the last emitted error kind to
avoid duplicates
Release Notes:
- N/A *or* Added/Fixed/Improved ...
---------
Co-authored-by: Michael Benfield <mbenfield@zed.dev>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
This PR adds a new `supported_effort_levels` method to the
`LanguageModel` trait.
This can be used to retrieve the list of effort levels that the model
supports, which will eventually be used to drive the UI for selecting
the thinking effort.
Right now this list will only be populated for Cloud models.
Release Notes:
- N/A
The provider dropdown and GitHub Copilot sign-in button were not
tab-navigable because they lacked tab_index. The copilot button
conditionally sets tab_index only when edit_prediction is true, since
it's also used in the agent configuration panel where tab navigation
isn't used.
Closes#48391
Release Notes:
- Fixed focus skipping provider dropdown and GitHub Copilot button in
edit prediction settings
Implements the enhancement requested in #24655 - enables tab switcher to
show all open files across all panes deduped. It's called "follow mode"
because whichever is the active pane is ALWAYS where the file, terminal,
etc will be opened from the tab switcher (not married to this mode
name).
Adds `follow_mode: true` option to `tab_switcher::ToggleAll`. When
enabled:
- **Shows all tabs across panes** - Same file in multiple panes appears
once (deduped by path)
- **Opens in active pane** - Selecting a file opens it in current pane,
creating independent editor instances
- **Moves terminals** - Non-file items (terminals, multibuffers) move to
current pane instead of duplicating
- **Preview & restore** - Navigate with arrow keys / tab to preview,
Escape restores original state
Intended for vim/helix `:buffers` command workflow while respecting
Zed's tab-based paradigm.
### Usage
```json
["tab_switcher::ToggleAll", {"follow_mode": true}]
```
### Implementation
**Preview pattern:** Clone item handles during navigation, clean up on
dismiss
- **Files**: Preview with cloned handle, confirm closes preview and
opens fresh (independent editors)
- **Terminals**: Preview with cloned handle, confirm removes from source
(moves to current pane)
**Key technical details:**
- Ignore workspace events during follow mode to prevent list re-sorting
from preview operations
- Preserve preview tab status on confirm
- Close operations remove from all panes in follow mode
- Remove from source before activating to ensure correct focus
management
### Test Coverage
21 tests total (14 new follow mode tests):
- File behavior: deduplication, independent editors, preview status
preservation, close behavior
- Non-file behavior: terminal movement, focus management, single pane
scenarios
- General: MRU stability, restore on dismiss
### Release Notes
- Added `follow_mode` option to `tab_switcher::ToggleAll` for vim-style
buffer list showing all deduped open files across panes opening in
active pane
## Q&A
**Q: Why not tie this to vim mode?**
A: This feature is different enough from vim/helix buffer behavior that
I opted not to couple them. It is an approximation using Zed's tab
switcher/picker and would take architectural changes to implement real
vim/helix buffers. Additionally, both follow mode and regular tab
switcher mode are useful window/tab management workflows that vim or
non-vim users may want regardless of their editing mode preference.
**Q: How to use this?**
A: For a vim/helix-like workflow:
1. **Bind the follow mode tab switcher** - Add to your keymap:
```json
{
"context": "Workspace",
"bindings": {
"cmd-i": ["tab_switcher::ToggleAll", {"follow_mode": true}]
}
}
```
2. **Hide the tab bar (optional)** - Add to settings:
```json
{
"tab_bar": {
"show": false
}
}
```
3. **Move tabs to other pane on close (optional)** - Add to your keymap
to join tabs into next pane when closing:
```json
{
"context": "Pane",
"bindings": {
"cmd-w": "pane::JoinIntoNext"
}
}
```
This makes closing a tab behave more like vim's split closure - items
move to the adjacent pane instead of being closed.
If you find that you'd rather have the tab bar visible, there's a pretty
good chance you don't need/want this feature. Vim/helix don't have
visible tab bars, so this feature is primarily for users who want that
sort of experience where buffers are not tied to a specific split/pane
and closing a split does not impact the available buffers.
## Future Work
A few additional features could make for more complete vim/helix-like
buffer workflow:
**`:bd` (buffer delete) improvements:**
- Should close the buffer from ALL panes, not just the current one
- Current implementation: `workspace::CloseActiveItem` only closes in
current pane
- Needed: New action like `workspace::CloseActiveItemAcrossPanes` and/or
update vim command mapping
**`:q` (quit) improvements:**
- Should close the split/pane while preserving its tabs
- Behavior: merge tabs into next pane (like `pane::JoinIntoNext`),
unless it's the last pane
- Last pane: close the pane and all its items
- Current implementation: `workspace::CloseActiveItem` closes active
item, not the pane
- Needed: New action or pane closure logic that moves tabs before
closing
These are complementary to this feature and can be done as separate PRs.
Release Notes:
- Add `tab_switcher::ToggleUnique` to allow a more vim-like tab
switching experience.
This PR removes the `fn name()` default method from the `AgentTool`
trait (which just returned `Self::NAME`) and replaces all call sites
with direct use of the `NAME` associated constant. This lets us use it
as a single source of truth in macros that want to access it at compile
time.
This PR also replaces hardcoded tool name string literals throughout the
codebase with the corresponding `NAME` constants, so tool name
references stay in sync if a tool is renamed.
Intentionally not changed:
- **Display strings** like `"Thinking"` and `"Subagent"` (user-facing UI
labels)
- **Serde attributes** like `#[serde(rename = "thinking")]` (wire
format)
- **The test assertion** `assert_eq!(SubagentTool::NAME, "subagent")`
(replacing the literal would make it tautological)
- **MCP server names** like `"mcp:srv:terminal"` (not tool identifiers)
Release Notes:
- N/A
<img width="588" height="485" alt="Screenshot 2026-02-05 at 1 29 10 PM"
src="https://github.com/user-attachments/assets/f3d36c8b-b371-4226-af60-bdc2c6b34009"
/>
<img width="586" height="468" alt="Screenshot 2026-02-05 at 1 30 15 PM"
src="https://github.com/user-attachments/assets/878e91ad-948c-4b35-a37b-f5a8db7e0b3f"
/>
This adds Claude Opus 4.6 as a new Anthropic model, along with 1M
context window variants for both Opus 4.6 and Sonnet 4.5.
## Opus 4.6
Adds `ClaudeOpus4_6` and `ClaudeOpus4_6Thinking` with the same
properties as other Claude 4+ models (200k context, 8192 max output
tokens, fine-grained tool streaming beta header).
## 1M context variants
Adds 1M context window variants for Sonnet 4.5 and Opus 4.6. These are
identical to their base models except:
- Context window is 1,000,000 tokens instead of 200,000
- They send the `context-1m-2025-08-07` beta header
Release Notes:
- Added Claude Opus 4.6
- Now Claude Opus 4.6 and Sonnet 4.5 BYOK models support variations that
have context windows of 1 million tokens (and have different pricing)
Release Notes:
- Fixed `HelixSelectLine` with an empty first line and a pre-existing
selection.
---------
Co-authored-by: Jakub Konka <kubkon@jakubkonka.com>
Co-authored-by: Lena Falk <lena@zed.dev>
Richard Feldman