We weren't handling these really before, just rendering the URI. This
should provide best-effort support for what we can render.
<img width="800" height="359" alt="image"
src="https://github.com/user-attachments/assets/51f101c7-c3be-4801-9000-62000a71faa6"
/>
(I will remove the extra labels that was just for testing)
Release Notes:
- acp: Support embedded resources in tool calls.
Agent terminal sandboxing now protects `.git` metadata by default and
exposes an explicit `allow_git_access` approval. Without it, file
contents of the `.git` directories for opened worktrees and discovered
repositories (including a linked worktree's common `.git`) cannot be
read or written, though their metadata stays visible; when approved,
those Git directories become writable so commands like fetch/commit
work. SSH commit signing keeps working because the inherited
`SSH_AUTH_SOCK` is allowed as local Unix-socket IPC, which does not let
sandboxed commands send network packets to other machines. The Seatbelt
profile also allows PTY terminal-control ioctls so signing/passphrase
prompts can manage terminal state.
This intentionally restricts only `.git` itself (whose location we know
exactly, including the worktree case) rather than
`.gitignore`/`.gitattributes`/`.gitmodules`, since those can be nested
arbitrarily and the goal is to keep the policy expressible as a plain
deny-by-default allowlist that will port to Linux and Windows sandboxes
later.
Closes AI-334
Release Notes:
- Improved agent terminal sandboxing for Git metadata, Git worktrees,
and SSH commit signing.
## Summary
Fixes#37815.
`State::fetch_models()` calls `/api/tags` to list models, then calls
`/api/show` for **every** model in that list to get its capabilities,
collecting the results with `collect::<Result<Vec<_>>>()?`. If
`/api/show` errors for even one model, the whole batch fails and
`fetched_models` is never populated. Since `is_authenticated()` is
defined as `!self.fetched_models.is_empty()`, this means a single bad
model permanently breaks both authentication state and the model picker
for the entire Ollama provider - with no error surfaced anywhere (not
the UI, not the logs), which matches the reports in #37815 of "Connect
does nothing" / "no logs, no nothing".
I hit this myself: I had a stale local reference to an Ollama Cloud
model that had been retired server-side. `/api/show` for that one model
returned `410 Gone`, which silently broke Connect and the model picker
for every other model too. Removing the retired model with `ollama rm`
fixed it immediately, which confirmed the root cause.
## Fix
Instead of aborting the whole fetch on the first error, skip individual
models that fail `/api/show` and log a warning, keeping the rest.
Extracted this into a small `skip_failed_models` helper so it's
unit-testable without mocking HTTP.
## Disclosure
I used Claude (Anthropic's Claude Code) to help track down this root
cause (tracing through `fetch_models`/`is_authenticated` in this file)
and draft the fix + tests below. I reviewed and understand the change -
it's a small, targeted fix to a single function plus two unit tests for
the new helper.
## Test plan
- [x] `cargo check -p language_models` passes
- [x] `cargo test -p language_models --lib ollama::` - all 3 tests pass
(the 2 new ones plus the existing
`test_merge_settings_preserves_display_names_for_similar_models`,
unaffected by this change)
- [x] `cargo fmt -p language_models -- --check` - no diff
## Release Notes
Release Notes:
- Fixed Ollama models silently failing to show up in the model picker
(and "Connect" appearing to do nothing) when a single model's details
couldn't be fetched, e.g. a retired Ollama Cloud model
---------
Co-authored-by: MrSubidubi <finn@zed.dev>
Co-authored-by: Ben Brandt <benjamin.j.brandt@gmail.com>
Follow-ups to the recently-landed agent terminal sandboxing work.
- Make the persistent "Allow Unsandboxed Terminal Commands" setting
(`allow_unsandboxed`) the single off-switch for the agent terminal
sandbox: when enabled, the sandboxed terminal tool isn't exposed and the
system prompt omits the sandbox section, so the model uses the plain
`terminal` tool (and on Windows, WSL sandbox setup is skipped). This
removes the dead, unwired `disabled` setting that was meant to do the
same thing but had no UI, writer, or docs. Per-command and per-thread
`unsandboxed: true` grants are unchanged.
- Expand the blocklist of Windows-specific environment variables that
aren't forwarded into the WSL sandbox (system locations, `HOME`/profile
paths, host/session identity, CPU descriptors, etc.) so they can't
shadow or break Linux commands. It stays a blocklist, so portable
variables like `LANG` still reach the command.
Release Notes:
- N/A
We finally have a cancellation mechanism to use! Made the non
side-effectful handlers stop their work if we get a cancel request
notification.
Release Notes:
- N/A
Summary
- Adds Windows agent terminal sandboxing by routing commands through WSL
and Bubblewrap.
- Supports native Windows and WSL project paths, including elevated
write grants for WSL paths.
- Shows a confirmation prompt to turn off sandboxing when WSL sandbox
setup is unavailable.
This builds on the work in the sandbox-linux branch.
Closes AI-376
Release Notes:
- Added Windows terminal sandboxing for agent commands when sandboxing
is enabled.
---------
Co-authored-by: cameron <cameron.studdstreet@gmail.com>
Co-authored-by: Richard Feldman <oss@rtfeldman.com>
Co-authored-by: zed-zippy[bot] <234243425+zed-zippy[bot]@users.noreply.github.com>
Adds UI for the various scenarios where sandboxing can fail on linux:
- no `bwrap` on the path
- `bwrap` is setuid
- `bwrap` exists but cannot create unprivileged userns
---
Release Notes:
- N/A or Added/Fixed/Improved ...
---------
Co-authored-by: Martin Ye <martin@zed.dev>
Release Notes:
- N/A or Added/Fixed/Improved ...
---------
Co-authored-by: Richard Feldman <oss@rtfeldman.com>
Co-authored-by: Martin Ye <martin@zed.dev>
Co-authored-by: zed-zippy[bot] <234243425+zed-zippy[bot]@users.noreply.github.com>
This makes unrestricted sandbox network access an explicit sandbox mode
instead of a fallback when the enforcing proxy is unavailable.
Host-specific network access still uses the proxy, while approved
arbitrary network access skips proxy setup and maps directly to
unrestricted egress.
Release Notes:
- Improved agent terminal sandbox network permission handling.
---------
Co-authored-by: Martin Ye <martin@zed.dev>
Co-authored-by: MartinYe1234 <52641447+MartinYe1234@users.noreply.github.com>
Final PR of a four-PR stack adding hostname-allowlisted network access
to agent terminal sandboxing. Stacked on #59219 — review/merge #59217,
#59218, and #59219 first.
Spawns the `http_proxy` allowlisting proxy for sandboxed terminal
commands that request network, and pins the Seatbelt policy to its
loopback port (`NetworkAccess::LocalhostPort`) so all egress is forced
through it. The child's proxy environment variables are pointed at the
proxy and any inherited `NO_PROXY` is blanked so nothing connects
direct; a real upstream proxy from the environment is chained through
when present. The proxy and its Seatbelt config file share one RAII
handle so both live exactly as long as the command, and per-connection
events are drained to the log.
The proxy binds loopback, so it only applies to local projects on macOS;
elsewhere the wrap falls back to unrestricted egress as before (the
agent layer widens such requests accordingly).
Release Notes:
- Added the ability to grant agent terminal commands network access to
specific hosts (rather than all-or-nothing), enforced by an allowlisting
proxy.
---------
Co-authored-by: Martin Ye <martin@zed.dev>
Co-authored-by: MartinYe1234 <52641447+MartinYe1234@users.noreply.github.com>
Third of a four-PR stack adding hostname-allowlisted network access to
agent terminal sandboxing. Stacked on #59218 — review/merge #59217 and
#59218 first.
Replaces the boolean `allow_network` terminal-sandbox escalation with a
hostname allowlist. The `terminal` tool now takes `allow_hosts` (exact
hostnames or leading-`*.` subdomain wildcards, validated up front) and
`allow_all_hosts` as a broad escape hatch. Approval prompts name the
requested hosts, thread grants and persistent "allow always" settings
cover requests via host-pattern subsumption the same way write paths use
subtree containment, and the authorization card in the agent panel lists
the requested hosts.
Host allowlists aren't enforced yet in this PR: `SandboxWrap` carries
the allowlist, but any network request still maps to unrestricted egress
at the Seatbelt layer, matching previous behavior. Enforcement via the
in-process proxy lands in the final PR of the stack. All of this is
behind the existing sandboxing feature flag. For non-local projects
(where the loopback proxy won't apply), host requests are widened to
"arbitrary network access" before prompting so approvals match
enforcement. Old persisted `network: bool` authorization details still
deserialize via a serde alias.
Release Notes:
- N/A
---------
Co-authored-by: MartinYe1234 <52641447+MartinYe1234@users.noreply.github.com>
Co-authored-by: Martin Ye <martin@zed.dev>
Fourth PR of the stack adding hostname-allowlisted network access to
agent terminal sandboxing. Stacked on the `http_proxy` crate PRs
(#59217, #59222, #59223) — review/merge those first; this PR's diff is
only the sandbox change.
Replaces the `allow_network: bool` field on the macOS Seatbelt
`SandboxPermissions` with a `NetworkAccess` enum: `None` (block all
egress), `All` (the previous `allow_network: true` behavior), and
`LocalhostPort(u16)`, which confines a sandboxed command to a single
loopback port. The new variant emits a Seatbelt rule permitting outbound
TCP only to `localhost:<port>` and isn't constructed yet; it exists to
pin sandboxed commands to the in-process network proxy in a later PR.
The sole consumer maps its existing boolean to `All`/`None`, so behavior
is unchanged.
Release Notes:
- N/A
Summary:
- Include terminal command text in sandbox authorization metadata.
- Render the command in sandbox permission prompts, including prompts to
run outside the sandbox.
- Keep write-path details visible alongside the command when both are
present.
Tests:
- cargo test -p agent sandbox
- cargo check -p agent_ui
Release Notes:
- Improved agent sandbox permission prompts to show the command being
requested.
Closes AI-393
When the user proactively cancels a turn, we mark all pending entries as
cancelled. But if something else stops/halts a turn, we weren't doing
that in the case of compaction, which means we would be stuck in a
loading state forever.
Release Notes:
- N/A _(feature hasn't been publicly released yet so no notes)_
Allows contents to update without dropping the permission (caused by
claude subagents)
Closes
https://github.com/agentclientprotocol/claude-agent-acp/issues/708
Self-Review Checklist:
- [x] I've reviewed my own diff for quality, security, and reliability
- [x] Unsafe blocks (if any) have justifying comments
- [x] The content is consistent with the [UI/UX
checklist](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist)
- [x] Tests cover the new/changed behavior
- [x] Performance impact has been considered and is acceptable
Release Notes:
- acp: Fix failed permissions requests for external agents
Running `/compact` rendered a `/compact` user-message bubble during the
live session, but that text is never sent to the model as an ordinary
user turn — it triggers a built-in compaction that produces its own
"Context compacted" entry. Showing the bubble was misleading (it implied
the model received `/compact`), and it was also inconsistent: after a
reload the bubble vanished, since the persisted thread only carries an
empty marker. This changes the direction so native slash commands are
never echoed as user messages at all, live or after reload.
`AcpThread` gains a `send_command` path that runs the turn (so the agent
still receives and handles `/compact`) without pushing a user-message
entry or capturing a git checkpoint. In the UI, `leading_native_command`
now matches a native command whether or not it has trailing text, so
both `/compact` and `/compact do X` route through the command path; the
queued-message path detects native commands too, so a `/compact` typed
while a turn is generating behaves the same. MCP/ACP commands are
unaffected and still render as normal user messages, since their text is
a real argument the agent consumes.
Release Notes:
- N/A
---------
Co-authored-by: Bennet Bo Fenner <bennetbo@gmx.de>
Fixes an issue where compaction would get marked as cancelled if the
previous turn took a while to cancel. E.g. you could reproduce this when
sending a normal message, and then interrupting generation by sending
`/compact`. If the task for the prior turn took a while to complete, it
would mark the compaction triggered by `/compact` as cancelled, even
though it was not.
Release Notes:
- N/A
This PR changes how base texts are managed by the `buffer_diff` crate,
to enable keeping two diff entities alive that share the same base text
buffer entity. Previously, each diff owned its own base text buffer and
edited it when calling `BufferDiff::set_snapshot`, so the only way to
reuse the same base text between two diffs was to have two independent
buffers for it, which is pretty inefficient.
After this PR, each diff still has a base text buffer, but
`set_snapshot` doesn't edit it. Instead, that responsibility moves into
the caller. For updating the base text buffer, this PR also introduces a
new pair of APIs, `Buffer::snapshot_with_edits` and
`Buffer::fast_forward`, which allow us to move the parsing of the new
base text into the background and then install the new syntax tree
synchronously on the foreground.
The git store uses the low-level APIs `set_snapshot` and `fast_forward`
directly, and manages the head text and index text buffers itself
(garbage-collecting them when they're no longer needed); this enables
adding an `open_staged_diff` API which returns a diff between the
managed index buffer and the managed head buffer (the latter is also
used for the uncommitted diff's base text). Other downstreams don't need
to reuse a base text buffer, and those have been migrated to use the
high-level `set_base_text` API, which now calls `set_snapshot` and
`fast_forward` internally, with a guard to prevent concurrent updates.
Another change worthy of note is that we now always diff the old base
text with the new base text to create `snapshot_with_edits`.
There are also some incidental bug fixes:
- Fixed an issue where a dangling weak unstaged diff could stick around
in the git store forever
- Restored the `IndexMatchesHead` optimization that had become
inoperative in the remote case
- Fixed a crash in the multibuffer due to the handling of
`BufferDiffEvent::LanguageChanged`, which could cause the multibuffer to
have transforms that were inconsistent with the diff base text.
Self-Review Checklist:
- [x] I've reviewed my own diff for quality, security, and reliability
- [x] Unsafe blocks (if any) have justifying comments
- [x] The content is consistent with the [UI/UX
checklist](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist)
- [x] Tests cover the new/changed behavior
- [x] Performance impact has been considered and is acceptable
Closes ZED-81P
Release Notes:
- Fixed a rare crash that could occur while using the uncommitted diff.
---------
Co-authored-by: Ben Kunkle <ben@zed.dev>
Co-authored-by: Anthony Eid <hello@anthonyeid.me>
<img width="325" height="201" alt="Screenshot 2026-06-09 at 1 38 32 PM"
src="https://github.com/user-attachments/assets/a6518073-1e17-41ff-a8fc-cb279fcd4436"
/>
Adds support for Anthropic's Claude Fable 5 model when using your own
Anthropic API key. Because Fable 5 cannot be offered under Zero Data
Retention (Anthropic retains inference logs for 30 days), this gates the
model behind an explicit data-retention consent: a new
telemetry.anthropic_retention setting (default off, surfaced in the
Privacy section of the settings UI), and a hard, non-retryable check in
the cloud completion path that raises a typed error when consent is
missing.
When Fable 5 declines a request, it transparently falls back to Claude
Opus 4.8 (matching Anthropic's server-side behavior), and the agent
panel shows a callout for the consent error with "Switch to Opus 4.8" /
"Accept" actions that resume the failed turn so the user's message
continues without retyping.
Closes AI-382
Release Notes:
- Add Claude Fable 5 to Anthropic BYOK
---------
Co-authored-by: Mikayla Maki <mikayla@zed.dev>
We can't compute the actual token usage until we send a new request, so
we hide the token count until you send another message. Matching the
behaviour that we have for new threads
Release Notes:
- N/A
Co-authored-by: Richard Feldman <oss@rtfeldman.com>
Here are the things I tried to tackle on this PR:
- Make the compaction call stand out a bit more from other regular tool
calls
- Make text size of the compaction's markdown output be consistent with
the thread body text
- Don't show regular thread loading spinner while compaction is in
progress, given that has its own spinner
- Add a different icon than scissors for compaction and add it to the
autocomplete menu so its consistent w/ skills items
<img width="600" alt="Screenshot 2026-06-09 at 10 57@2x"
src="https://github.com/user-attachments/assets/5c3d25af-aa49-42e1-b6b6-c3f95c664456"
/>
Release Notes:
- N/A
Makes it so that we show "Compaction cancelled" when the user interrupts
generation.
Also fixes another small issue where the chevron of the expanded state
would not reflect if it is expanded/collapsed while there is no summary
yet.
Release Notes:
- N/A
<img width="851" height="315" alt="Screenshot 2026-06-09 at 2 15 51 AM"
src="https://github.com/user-attachments/assets/958f2d2f-db7d-4afb-b4b3-ed11f36b00e7"
/>
<img width="644" height="260" alt="Screenshot 2026-06-09 at 2 16 04 AM"
src="https://github.com/user-attachments/assets/e6a74c6b-aba5-4fbb-991c-25842ced5832"
/>
<img width="619" height="128" alt="Screenshot 2026-06-09 at 2 18 08 AM"
src="https://github.com/user-attachments/assets/ba7fa303-852b-4a17-b8df-ea5bd4df7c11"
/>
Adds an always-available `/compact` slash command to Zed's native agent
that forces a summary-based context compaction of the current
conversation, regardless of token usage. This reuses the agent's
existing compaction logic (always the summary strategy, never
provider-native), bypassing the automatic-compaction token threshold and
minimum-context-window guard since the user explicitly asked to compact.
The command lives entirely in `NativeAgent`/`NativeAgentConnection`, so
external (ACP) agents are untouched and keep their own `/compact`
implementations.
The command is gated behind the `handoff` feature flag, matching the
gate on automatic compaction, so it's only advertised and dispatched
when that flag is enabled. When the flag is off, typing `/compact` is
treated as an ordinary prompt.
Because the agent panel always renders the typed `/compact` as a user
message, the manual compaction records a matching zero-content user
message in the model thread (skipped when building model requests) so
that rewinding/truncating that message works instead of erroring, while
keeping the command itself out of the model's context.
The slash-command popup now groups commands into separate sections by
source — "Commands" (built-in, e.g. `/compact`), "MCP Server Commands",
and "ACP Agent Commands" — so same-named commands from different sources
show up as distinguishable duplicates. The source category travels on
each command's ACP `_meta`.
Release Notes:
- N/A
---------
Co-authored-by: Bennet Bo Fenner <bennetbo@gmx.de>
Stabilizes context windows + persistent session/delete for acp agents
that support them
Self-Review Checklist:
- [x] I've reviewed my own diff for quality, security, and reliability
- [x] Unsafe blocks (if any) have justifying comments
- [x] The content is consistent with the [UI/UX
checklist](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist)
- [x] Tests cover the new/changed behavior
- [x] Performance impact has been considered and is acceptable
Release Notes:
- acp: Show context window usage and cost metrics for external agents
that support it.
- acp: Persist session deletion from history for external agents that
support it.
Removing the `Rule` variant from `MentionUri` in #58080 broke
deserialization of any thread saved before the rules-to-skills
migration. Loading one failed with `unknown variant `Rule``, making
those threads inaccessible.
This restores access without bringing back the rules feature:
- Reintroduce a backward-compatible `Rule` mention variant so legacy
threads deserialize again.
- Preserve the original rule `id` through save/load so a thread re-saved
by a newer build still loads on older Zed versions (and synthesize a
valid placeholder when the id is missing).
- Clicking a legacy rule mention now opens the skill the rule was
migrated into, and shows a notification linking the Skills docs. On
remote/collab projects the migrated file lives on the local machine, so
it opens as a read-only buffer. If no matching skill exists, it does
nothing.
Closes https://github.com/zed-industries/zed/issues/58498
Closes AI-371
Release Notes:
- Fixed old threads that mention Rules being inaccessible after Rules
were migrated to Skills
Summary:
- Allow agent tool-call locations outside visible worktrees to resolve
as local buffers.
- Fall back to opening absolute paths from the tool-call click handler.
Tests:
- cargo test -p acp_thread
test_tool_call_location_resolves_external_file
- cargo check -p agent_ui
Closes AI-362
Release Notes:
- Fixed opening agent-created files outside the current project, such as
global skill files.
## **NOTE:**
I'm new both to Rust and Zed, so it's mostly vibecoded alleged fix for
#57295, just as a PoC of expected behavior that works on macOS. So
please be critical and skeptical of the code, as it may not account for
many nuances and behavior on other platforms.
## Summary
- Fixes#57295: the `Add to Agent Thread` action (or `cmd->`) was a
silent
no-op when a terminal thread was the active conversation in the agent
panel.
- The action's deferred handler only routed through
`active_conversation_view()`,
which returns `None` for `BaseView::Terminal`, so the selection was
dropped.
- Extends the handler with an `else if` branch that, when a terminal
thread is
active, formats the selection as `@<rel-path>:<start>-<end>` (matching
the
mention syntax CLI agents already understand) and pastes it into the
terminal, then focuses the terminal so the user can edit/submit.
## Test plan
- [x] Select a range of lines in a buffer, open a terminal thread in the
agent
panel, invoke `Add to Agent Thread` from the context menu → the
formatted
mention is pasted into the terminal.
- [x] Same flow via the `cmd->` keybinding on macOS.
- [x] Multiple selections in one buffer produce space-separated
mentions.
- [x] `cargo check -p agent_ui` and `./script/clippy -p agent_ui` pass.
## Demo
<img width="2928" height="1920" alt="ScreenShot 2026-05-20 at 21 03 27"
src="https://github.com/user-attachments/assets/dc29f380-a864-4c12-b454-bdb4201f5b8d"
/>
https://github.com/user-attachments/assets/9d3914d8-8ba2-4bcb-be43-78efb342d8a8
## Release Notes:
- Fixed `Add to Agent Thread` being a no-op when a terminal thread is
the active conversation in the agent panel
---------
Co-authored-by: Martin Ye <martin@zed.dev>
Follow-up hardening on top of #57972 (granular sandbox write
permissions), based on a review of that branch. The most important fix
is that model-requested `fs_write_paths` were joined but never
normalized, so a path containing `..` could pass the lexical
subtree-containment checks while seatbelt canonicalized it to somewhere
else entirely — causing skipped approval prompts and silent runtime
write denials. Write paths are now lexically normalized (via
`util::paths::normalize_lexically`) at the point they enter the system,
both for model requests and for hand-edited persistent grants, so the
containment check, the approval prompt, and the enforced sandbox policy
all operate on the same path.
The subtree insert/prune and containment logic had drifted into roughly
five near-identical copies across `agent`, `agent_settings`, and
`settings_content`; these now share `util::paths::insert_subtree` and
`path_within_subtree`. The dead `SandboxPermissions::covers` (only ever
exercised by its own tests, duplicating the production
`covers_with_persistent`) is removed, and its tests rewritten to cover
the real settings-compilation path including `..` normalization.
The remaining changes reduce brittleness: the sandbox permission option
ids (`allow`, `allow_thread`, `allow_always`, `deny`) are now shared
constants in `acp_thread` instead of bare string literals scattered
across the agent and UI, `persist_sandbox_always_permission` logs
instead of silently doing nothing when no filesystem is available, and a
comment documents why replay always resolves the terminal tool to the
non-sandboxed variant.
Release Notes:
- N/A
---------
Co-authored-by: Martin Ye <martin@zed.dev>
Co-authored-by: MartinYe1234 <52641447+MartinYe1234@users.noreply.github.com>
Brings stable logout and additional directories support as well as
removing dep on rmcp + tokio
This also removed the unstable model selector (replaced awhile ago by
session config options) so it removes all of that code.
Native agent still uses it because we have a special model selector that
would need more work to rip out
Self-Review Checklist:
- [x] I've reviewed my own diff for quality, security, and reliability
- [x] Unsafe blocks (if any) have justifying comments
- [x] The content is consistent with the [UI/UX
checklist](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist)
- [x] Tests cover the new/changed behavior
- [x] Performance impact has been considered and is acceptable
Release Notes:
- N/A
Adds granular, per-path write permissions to the agent's sandboxed
`terminal` tool.
Previously a command could only request unrestricted filesystem writes
(`allow_fs_write: true`) as an all-or-nothing escape hatch. Now the
model can request write access to specific paths via `fs_write_paths`,
and each granted directory covers its whole subtree. The broad escape
hatch is still available as `allow_fs_write_all: true` for cases where
the paths can't be enumerated up front.
Approval prompts now let the user grant a write request either just for
that command or for the rest of the conversation. Conversation grants
are tracked in memory (never persisted) using pure subtree containment,
so later commands writing under an already-granted path run without
prompting again.
Closes AI-335
Release Notes:
- Improved the agent's terminal sandbox so commands can request write
access to specific paths instead of all-or-nothing filesystem access,
with the option to grant access for a single command or the rest of the
conversation.
---------
Co-authored-by: Anant Goel <anantdgoel@gmail.com>
Co-authored-by: Richard Feldman <oss@rtfeldman.com>
Refactor to isolate alacritty types into the terminal crate and offers
comparable apis where needed for similar functionality. However, these
are Zed-owned types instead of the dependency leaking across multiple
crates, making alacritty an implementation detail of the terminal crate.
Self-Review Checklist:
- [x] I've reviewed my own diff for quality, security, and reliability
- [x] Unsafe blocks (if any) have justifying comments
- [x] The content is consistent with the [UI/UX
checklist](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist)
- [x] Tests cover the new/changed behavior
- [x] Performance impact has been considered and is acceptable
Release Notes:
- N/A
Adds the flat context compaction marker data model and replays persisted
markers into native agent transcripts as static dividers. This lets
compacted thread boundaries deserialize, render, and export to Markdown
without enabling automatic compaction behavior yet.
Release Notes:
- Improved agent threads to show restored context compaction dividers in
conversations
Adds opt-in rendering for Markdown frontmatter metadata blocks in
Markdown Preview and agent markdown.
- Simple `key: value` metadata blocks now render as a two-column table,
while more complex metadata falls back to a code-style block.
- Metadata block content and key/value rows are parsed in the parser
step, and the request layout simply takes over rendering.
<img width="1288" height="436" alt="image"
src="https://github.com/user-attachments/assets/b35b949a-8bc4-47db-82ef-ed835e9ac06f"
/>
Release Notes:
- Added support for rendering Markdown frontmatter metadata blocks in
Markdown Preview and Agent Panel.
Self-Review Checklist:
- [x] I've reviewed my own diff for quality, security, and reliability
- [x] Unsafe blocks (if any) have justifying comments
- [x] The content is consistent with the [UI/UX
checklist](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist)
- [x] Tests cover the new/changed behavior
- [x] Performance impact has been considered and is acceptable
Closes #ISSUE
Release Notes:
- N/A or Added/Fixed/Improved ...
---------
Co-authored-by: zed-zippy[bot] <234243425+zed-zippy[bot]@users.noreply.github.com>
Stacked on top of #57430.
When the `sandboxing` feature flag is on (macOS only), agent-run
terminal commands are launched under `/usr/bin/sandbox-exec` with a
per-command Seatbelt policy:
- **Reads:** any path on the filesystem.
- **Writes:** each project worktree plus a per-command `$TMPDIR`.
- **Network:** blocked.
The model can request relaxations on individual calls via three new
input flags on the `terminal` tool:
- `allow_network: true`
- `allow_fs_write: true`
- `unsandboxed: true`
Each one triggers a separate always-prompt user approval (bypassing any
`always_allow` rules, since escalation is a stronger trust boundary than
the baseline command approval). The flags are silently ignored when
sandboxing is off, so the model can't surreptitiously change runtime
behavior by setting them in the no-op case.
The per-command tempdir is provisioned regardless of sandbox state so
the model can't infer whether the sandbox is in effect by looking at
`$TMPDIR`.
The Seatbelt config file's lifetime is tied to the `Terminal` entity via
an opaque RAII handle (`SandboxConfigHandle = Box<dyn Any + Send>`), so
cancellation paths drop it automatically.
### Notes for review
- The writable scope passed to the sandbox is the project's worktree
paths plus the per-command tempdir, **not** the resolved `cd` working
directory — `cd` is model-controlled, and using it as the writable scope
would let the model widen its own write permissions outside the project.
- The new tool flags are always present in the JSON schema (with
`#[serde(default)]`), even when the sandbox prompt section isn't
rendered. The system prompt only documents them when the section is
present, so the model shouldn't try to use them when it's not — but the
schema doesn't actively reject them, just ignores them.
- I opted not to add an end-to-end test for the escalation prompt path:
the existing `FakeThreadEnvironment` ignores the new params and toggling
the feature flag in tests is more wiring than felt worth it for a first
cut. The pure-function pieces (`sandbox_approval_title`, schema,
deserialization) are covered, and the sandbox crate itself has
end-to-end tests that actually invoke `sandbox-exec`.
Release Notes:
- N/A
---------
Co-authored-by: MartinYe1234 <52641447+MartinYe1234@users.noreply.github.com>
For long threads we will spend more and more time cloning the messages
just to save them to the database, as we need a copy of everything to do
so asynchronously. Messages are really expensive to clone though and we
accumulate a lot of them really fast, so even for smaller threads we
start seeing pauses in the millisecond range. The fix to this is fairly
simple though, we never mutate the messages once pushed to the vec, so
just Arc them.
This PR also slightly changes `UserMessage` to be a bit faster to clone
as well.
Release Notes:
- Fixed a cause of stutters when interacting with the agent
If the agent server supports it, we pass along the multiple directories.
Self-Review Checklist:
- [x] I've reviewed my own diff for quality, security, and reliability
- [x] Unsafe blocks (if any) have justifying comments
- [x] The content is consistent with the [UI/UX
checklist](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist)
- [x] Tests cover the new/changed behavior
- [x] Performance impact has been considered and is acceptable
Closes#54480
Release Notes:
- acp: External agents that support it now have access to all working
directories in a project.
Self-Review Checklist:
- [x] I've reviewed my own diff for quality, security, and reliability
- [x] Unsafe blocks (if any) have justifying comments
- [x] The content is consistent with the [UI/UX
checklist](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist)
- [x] Tests cover the new/changed behavior
- [x] Performance impact has been considered and is acceptable
Release Notes:
- acp: Add Logout flow for agents that support it.
When the agent mentions a file path inside `backticks` (e.g. ``
`src/main.rs` `` or `` `src/main.rs:42` ``), the rendered code span now
becomes a clickable link in the agent panel. Clicking opens the
referenced file in the workspace, jumping to the right line and column
when present.
## How it works
- **Shared path resolution.** Extracted `OpenTarget` and the
workspace/worktree resolution logic out of
`terminal_view::terminal_path_like_target` into a new
`workspace::path_link` module so both the terminal and the agent panel
can use the same code. Includes a `sanitize_path_text` helper ported
from the terminal's URL/punctuation handling. Pure refactor — terminal
behavior is unchanged.
- **`markdown` crate hook.** Added
`MarkdownElement::on_code_span_link(callback)`. When the callback
returns `Some(url)` for a given code span's contents, the existing
`push_link` machinery wires up cmd-hover, hit testing, and the existing
`on_url_click` callback. When it returns `None`, the code span renders
as before. The hook is opt-in, so `markdown` stays workspace-agnostic.
- **Agent panel wiring.** `render_agent_markdown` constructs an
`AgentCodeSpanResolver` that snapshots the project's visible worktree
entries plus their file extensions. `try_resolve` does a cheap
synchronous heuristic check (path must contain `/`/`\` or end in an
extension present in the workspace, can't be a URL, can't be all digits,
etc.) and then looks the candidate up in the per-worktree
`HashSet<Arc<RelPath>>`. On a hit it returns a `MentionUri::File` or
`MentionUri::Selection` URI, which the existing `thread_view::open_link`
already knows how to open at the right line.
## Edge cases handled
- Code spans inside fenced code blocks stay plain (gated on
`builder.code_block_stack.is_empty()`, matching how regular markdown
links behave).
- Trailing prose punctuation (`` `src/main.rs.` ``) is stripped before
lookup.
- Identifiers like `` `String` ``, `` `await` ``, `` `npm run dev` ``
stay plain — they don't pass the path-like heuristic.
- Cross-platform path separators handled via the per-worktree
`PathStyle`.
## Tests
- `crates/markdown` — unit test asserting code spans become links when
the callback returns `Some`, and stay plain when it doesn't.
- `crates/agent_ui` — unit test for `AgentCodeSpanResolver::try_resolve`
covering hits with and without a `:line` suffix, misses, identifiers,
and trailing punctuation.
- Existing `terminal_view` tests cover the moved resolution code
(unchanged behavior).
## Notes
- There's currently a temporary `log::info!` in
`AgentCodeSpanResolver::try_resolve` that reports per-call worktree-walk
timing and a cumulative total. Kept in for now to verify the feature
isn't being called excessively during streaming renders. Can be removed
before merge.
- Resolution is sync-only against worktree entries; absolute paths
outside the workspace are not resolved (would require an async re-render
path).
Closes AI-277
Release Notes:
- Made file paths in `backticks` clickable in the agent panel; clicking
opens the referenced file at the given line when present.
Turns out we were creating an ImageDecoder on every frame (added in
#46167) when a tool returned an image as output, because we were trying
to get its dimensions. That is now cached on `ContentBlock::Image`.
Release Notes:
- N/A
Closes AI-266
This PR adds a built-in skill called `create-skill`, which allows the
Zed agent to have access to a skill that teaches it how to properly
create skills for Zed. You can manually invoke it as well as just
letting the model auto-invoke it in case your prompt suggests creating a
new skill.
Release Notes:
- Agent: Added a built-in skill called `create-skill` to make the Zed
agent informed about how to do that.
---------
Co-authored-by: Richard Feldman <richard@zed.dev>
Still behind a feature flag for now for testing with various agents.
Self-Review Checklist:
- [x] I've reviewed my own diff for quality, security, and reliability
- [x] Unsafe blocks (if any) have justifying comments
- [x] The content is consistent with the [UI/UX
checklist](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist)
- [x] Tests cover the new/changed behavior
- [x] Performance impact has been considered and is acceptable
Release Notes:
- N/A
Closes AI-261
This PR adds mention disambiguation in the agent panel, which works both
for regular @-mentions as well as for skills. Effectively, when you
mention files with the same name, the mention crease displays the next
path parent name, following a similar approach to common tabs in the
editor. For skills, the skill source is displayed (either global or from
some project).
<img width="500" alt="Screenshot 2026-05-15 at 6 32@2x"
src="https://github.com/user-attachments/assets/72c99480-cf32-42ac-9304-3f65167a1d94"
/>
Release Notes:
- Agent: Improved file and skill mention disambiguation in the agent
panel.
---------
Co-authored-by: Richard Feldman <richard@zed.dev>
Behind feature flag until we move RFD forward, but already working great
on codex
Self-Review Checklist:
- [x] I've reviewed my own diff for quality, security, and reliability
- [x] Unsafe blocks (if any) have justifying comments
- [x] The content is consistent with the [UI/UX
checklist](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist)
- [x] Tests cover the new/changed behavior
- [x] Performance impact has been considered and is acceptable
Release Notes:
- N/A
---------
Co-authored-by: zed-zippy[bot] <234243425+zed-zippy[bot]@users.noreply.github.com>
Still behind a flag until RFD progresses. But also fixes one area where
we would have called delete even if we didn't have support.
Self-Review Checklist:
- [x] I've reviewed my own diff for quality, security, and reliability
- [x] Unsafe blocks (if any) have justifying comments
- [x] The content is consistent with the [UI/UX
checklist](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist)
- [x] Tests cover the new/changed behavior
- [x] Performance impact has been considered and is acceptable
Release Notes:
- N/A
Closes AI-230
This PR makes skills, added as /-mentions, be rendered in the agent
panel as creases, like anything you'd @-mention. Naturally, clicking on
the crease button opens the corresponding skill file in a buffer.
It turned out to be quite a bit of plumbing to make this work,
particularly as I am also introducing an interface to display dividers
and headers in the completion menu. This was relevant to me to add
because it sets a good foundation to convert many agent panel-related
actions as slash commands.
Release Notes:
- N/A
---------
Co-authored-by: MartinYe1234 <52641447+MartinYe1234@users.noreply.github.com>
Ben Brandt