Harden the terminal tool's permission system to reject commands
containing shell substitutions and interpolations (`$VAR`, `${VAR}`,
`$(…)`, backticks, `$((…))`, `<(…)`, `>(…)`) before they reach terminal
creation.
## Changes
### Shell command parser (`shell_command_parser`)
- Added structured terminal command-prefix extraction with env-var
prefix support
- Added parser-backed validation that classifies commands as
Safe/Unsafe/Unknown
- Extended normalized command extraction to include scalar env-var
assignments in order
- Preserved quoted assignment values when they contain whitespace or
special characters
### Pattern extraction (`agent/pattern_extraction`)
- Updated terminal pattern extraction to use structured parser output
- Included env-var prefixes in generated allow patterns
- Normalized regex token boundaries to `\s+` while preserving display
whitespace
### Tool permissions (`agent/tool_permissions`)
- Added invalid-terminal-command rejection for forbidden
substitutions/interpolations
- Added unconditional allow-all bypass (global default Allow, or
terminal-specific Allow with empty patterns)
- Preserved hardcoded denial precedence over allow-all
### Terminal tool (`agent/tools/terminal_tool`)
- Updated tool description and input schema to explicitly prohibit shell
substitutions
- Added comprehensive SEC-264 regression test suite (20 new tests)
covering:
- All forbidden constructs (`${HOME}`, `$1`, `$?`, `$$`, `$@`,
`$(whoami)`, backticks, `$((1+1))`, `<(ls)`, `>(cat)`, env-prefix
variants, multiline, nested)
- Allow-all exception paths (global and terminal-specific)
- Hardcoded-denial precedence
- Env-prefix permission flow (matching, value mismatch rejection,
multiple assignments, quoted whitespace)
Closes SEC-264
Release Notes:
- Terminal tool permissions regexes can now match environment variables
(e.g. `FOO=bar cmd arg1 arg2`)
- If terminal tool permissions have active permissions regexes running
on them, then bare interpolations like `$FOO` are disallowed for
security, since regexes wouldn't be able to match on them.
- Move archive button to the header for simplicity
- Hook up the delete button in the archive view
- Improve how titles are displayed before summary is generated
- Hook up keybinding for deleting threads in both the sidebar and
archive view
Release Notes:
- N/A
This PR adds the ability to save in the settings whether new threads
should start in the current project or in a new Git worktree.
Additionally, it also adds a keybinding that allows cycling through the
menu options easily, with the ability to use cmd-click/enter to choose
which one is set as the default.
No release notes because this feature/settings depends on a feature flag
that isn't out yet.
Release Notes:
- N/A
This fixes a race condition that could occur when using the sidebar:
`Failed to launch: project state not found`
We were accessing/creating the project state before an await point,
meaning that we could remove the state if session/close was called in
the meantime.
- [x] Added a solid test coverage and/or screenshots from doing manual
testing
- [x] Done a self-review taking into account security and performance
aspects
- [x] Aligned any UI changes with the [UI
checklist](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist)
Release Notes:
- N/A
This removes the assumption that one project <-> one native agent. The
native agent now maintains a project per session. We don't make use of
this right now, but it will come in handy once we start sharing ACP
connections globally.
Release Notes:
- N/A
This PR adds a "Resolve with Agent" button in each merge conflict block,
as well as "Resolve Conflicts with Agents" button on a notification for
resolving conflicts across all the files that have any. When clicking on
either of these buttons, the agent panel opens up with a template prompt
auto-submitted. For the first case, the specific content of the merge
block is already attached as context for the agent to act quickly, given
it's a local and small context. For the second case (all conflicts
across the codebase), the prompt just indicates to the agent which files
have conflicts and then it's up for the agent to see them. This felt
like a simpler way to go as opposed to extracting the content for all
merge conflicts across all damaged files.
Here's how the UI looks like:
<img width="550" height="1964" alt="Screenshot 2026-02-21 at 11 04@2x"
src="https://github.com/user-attachments/assets/96815545-ba03-40e5-9cb0-db0ce9588915"
/>
---
Before you mark this PR as ready for review, make sure that you have:
- [x] Added a solid test coverage and/or screenshots from doing manual
testing
- [x] Done a self-review taking into account security and performance
aspects
- [x] Aligned any UI changes with the [UI
checklist](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist)
Release Notes:
- Git: Added the ability to quickly resolve merge conflicts with the
agent.
---------
Co-authored-by: Bennet Bo Fenner <bennetbo@gmx.de>
Co-authored-by: Zed Zippy <234243425+zed-zippy[bot]@users.noreply.github.com>
Before you mark this PR as ready for review, make sure that you have:
- [x] Added a solid test coverage and/or screenshots from doing manual
testing
- [x] Done a self-review taking into account security and performance
aspects
- [x] Aligned any UI changes with the [UI
checklist](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist)
Release Notes:
- N/A
Emit client-side organization changed events through
`RefreshLlmTokenListener` so it produces the same `RefreshLlmTokenEvent`
used for server-pushed `UserUpdated` messages.
This keeps token refresh fan-out in one place.
Closes CLO-383.
Release Notes:
- N/A
---------
Co-authored-by: Tom Houlé <tom@tomhoule.com>
If a streaming tool call (e.g. edit file) returns an error during
streaming, we would wait until we received the whole input.
Release Notes:
- N/A
---------
Co-authored-by: Ben Brandt <benjamin.j.brandt@gmail.com>
Previously we required AgentSessionInfo all over the place, which meant
there were lots of unnecessary fake ones created all over the place.
Made the methods and functions only take the data they need so we only
use these in history contexts now, as intended.
Release Notes:
- N/A
Adds five telemetry events to track subagent lifecycle and user
interactions:
- **Subagent Started** — fires on creation or resumption, includes
parent session, subagent session, depth, and whether it was resumed
- **Subagent Completed** — fires when `SpawnAgentTool` finishes,
includes subagent session and status (completed/error)
- **Subagent Toggled** — fires when the user expands or collapses a
subagent card
- **Subagent Stopped** — fires when the user clicks Stop on a running
subagent
- **Subagent Maximized** — fires when the user clicks Maximize to
navigate into a subagent
Release Notes:
- N/A
Add some debug logging to the streaming edit file tool, to make it
easier to debug errors.
Can be enabled with
```
"log": {
"agent": "debug",
}
```
Release Notes:
- N/A
Nightly only since no tool is using streaming on Preview.
Tools that used streaming could deadlock when the upstream LLM API
stream exited early without ever sending a ToolUse with `input_complete`
set to `true`. This is now fixes by manually dropping the tool input
channels.
Release Notes:
- N/A
Since the read times always correspond to an action log call anyway, we
can let the action log track this internally, and we don't have to
provide a reference to the Thread in as many tools.
Release Notes:
- N/A
---------
Co-authored-by: Bennet Bo Fenner <bennetbo@gmx.de>
Co-authored-by: MrSubidubi <dev@bahn.sh>
Since we were no longer just returning a string, we need to update the
content in both success and error modes to get a nice rendering
experience.
Release Notes:
- N/A
When a completion request fails with a retryable error (e.g. a 500 from
the upstream provider), the retry loop waits on a timer before trying
again. This timer did not race with the cancellation signal, so if the
user switched models and submitted a new message during the retry delay,
the old turn would continue retrying with the stale model for up to 15
seconds — making requests to the wrong provider and corrupting the
thread's message list with spurious Resume entries.
Now the retry delay races with the cancellation receiver, so the old
turn exits immediately when cancelled.
Release Notes:
- Fixed cancelled turns in a conversation that failed (e.g. 500 from the
LLM provider) bein retried even after cancellation
Removes unused `edit_agent_output` from `EditFileTool`. This makes it
easier to maintain compatibility between the `EditFileTool` and
`StreamingEditFileTool`.
Release Notes:
- N/A
Store the user's unsent message editor text in DbThread so it survives
quitting and reloading Zed. The draft flows through Thread → AcpThread →
AcpThreadView on load, and back via a debounced observer on the message
editor for saves.
Currently works for native Zed agents only; external ACP agents will
pick this up once general ACP history persistence lands.
## Changes
- **`DbThread`** / **`Thread`**: New `draft_prompt: Option<String>`
field, included in `to_db()`/`from_db()`
- **`AcpThread`**: Bridge field with getter/setter, populated during
`register_session()`
- **`NativeAgent::save_thread()`**: Copies draft from `AcpThread` →
`Thread` before persisting
- **`AcpThreadView`**: Restores draft into `MessageEditor` on load;
syncs editor text → `AcpThread` via observer; debounced (500ms) Thread
notify triggers DB save
Co-authored-by: Anthony Eid <anthony@zed.dev>
Co-authored-by: Mikayla Maki <mikayla@zed.dev>
Subagents now forward buffer reads/writes/edits to a parent action log,
allowing the parent's review experience to track all file changes made
by subagents alongside its own.
Release Notes:
- N/A
---------
Co-authored-by: Bennet Bo Fenner <bennetbo@gmx.de>
When the model, summarization model, thinking settings, speed, or
profile are updated on a thread, apply the same settings to any
currently running subagents.
Release Notes:
- N/A
Co-authored-by: Bennet Bo Fenner <bennetbo@gmx.de>
Release Notes:
- agent: Add new `spawn_agent` tool which allows the Zed Agent to
utilize subagents for doing tasks in parallel and better context
management.
Co-authored-by: Bennet Bo Fenner <bennetbo@gmx.de>
We now stream the new text into the buffer as soon as we receive partial
chunks of `new_text`. This is pretty much a full re-write of the way
streaming worked, which is now much closer to how the edit agent works:
- `ToolEditParser` buffers chunks as they stream in, and emits relevant
events (`OldTextChunk`,`NewTextChunk`, ...) that we use to power the
`EditSession` pipeline.
- `EditSession::process_events` takes care of consuming these events and
applying the edits incrementally as chunks stream in. `EditPipeline`
maintains the underlying state machine for each edit.
- We handle whitespace mismatches similar to the edit agent, the code is
shared by moving that logic to `reindent.rs`
Before you mark this PR as ready for review, make sure that you have:
- [x] Added a solid test coverage and/or screenshots from doing manual
testing
- [x] Done a self-review taking into account security and performance
aspects
- [x] Aligned any UI changes with the [UI
checklist](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist)
Release Notes:
- N/A
Before you mark this PR as ready for review, make sure that you have:
- [x] Added a solid test coverage and/or screenshots from doing manual
testing
- [x] Done a self-review taking into account security and performance
aspects
- [x] Aligned any UI changes with the [UI
checklist](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist)
Release Notes:
- N/A
This is a staff only toggle for now, since the consequences of
activating it are not obvious and quite dire (tokens costs 6 times
more).
Also, persist thinking, thinking effort and fast mode in DbThread so the
thinking mode toggle and thinking effort are persisted.
Release Notes:
- Agent: The thinking mode toggle and thinking effort are now persisted
when selecting a thread from history.
This has lots of benefits, but mainly allows users to uninstall agents.
Release Notes:
- N/A
---------
Co-authored-by: Anthony Eid <hello@anthonyeid.me>
Co-authored-by: cameron <cameron.studdstreet@gmail.com>
Richard Feldman