d39cbcfc4c
Third of a four-PR stack adding hostname-allowlisted network access to agent terminal sandboxing. Stacked on #59218 — review/merge #59217 and #59218 first. Replaces the boolean `allow_network` terminal-sandbox escalation with a hostname allowlist. The `terminal` tool now takes `allow_hosts` (exact hostnames or leading-`*.` subdomain wildcards, validated up front) and `allow_all_hosts` as a broad escape hatch. Approval prompts name the requested hosts, thread grants and persistent "allow always" settings cover requests via host-pattern subsumption the same way write paths use subtree containment, and the authorization card in the agent panel lists the requested hosts. Host allowlists aren't enforced yet in this PR: `SandboxWrap` carries the allowlist, but any network request still maps to unrestricted egress at the Seatbelt layer, matching previous behavior. Enforcement via the in-process proxy lands in the final PR of the stack. All of this is behind the existing sandboxing feature flag. For non-local projects (where the loopback proxy won't apply), host requests are widened to "arbitrary network access" before prompting so approvals match enforcement. Old persisted `network: bool` authorization details still deserialize via a serde alias. Release Notes: - N/A --------- Co-authored-by: MartinYe1234 <52641447+MartinYe1234@users.noreply.github.com> Co-authored-by: Martin Ye <martin@zed.dev>
Zed
Welcome to Zed, a high-performance, multiplayer code editor from the creators of Atom and Tree-sitter.
Installation
On macOS, Linux, and Windows you can download Zed directly or install Zed via your local package manager (macOS/Linux/Windows).
Other platforms are not yet available:
- Web (tracking discussion)
Developing Zed
Contributing
See CONTRIBUTING.md for ways you can contribute to Zed.
Also... we're hiring! Check out our jobs page for open roles.
Licensing
Zed source code is licensed primarily under GPL-3.0-or-later, with Apache-2.0 components where marked.
License information for third party dependencies must be correctly provided for CI to pass.
We use cargo-about to automatically comply with open source licenses. If CI is failing, check the following:
- Is it showing a
no license specifiederror for a crate you've created? If so, addpublish = falseunder[package]in your crate's Cargo.toml. - Is the error
failed to satisfy license requirementsfor a dependency? If so, first determine what license the project has and whether this system is sufficient to comply with this license's requirements. If you're unsure, ask a lawyer. Once you've verified that this system is acceptable add the license's SPDX identifier to theacceptedarray inscript/licenses/zed-licenses.toml. - Is
cargo-aboutunable to find the license for a dependency? If so, add a clarification field at the end ofscript/licenses/zed-licenses.toml, as specified in the cargo-about book.
Sponsorship
Zed is developed by Zed Industries, Inc., a for-profit company.
If you’d like to financially support the project, you can do so via GitHub Sponsors. Sponsorships go directly to Zed Industries and are used as general company revenue. There are no perks or entitlements associated with sponsorship.