Files
zed/crates
Richard Feldman e2b15e11e2 Allow sandboxed Git writes from worktrees (#57981)
Agent terminal sandboxing now protects `.git` metadata by default and
exposes an explicit `allow_git_access` approval. Without it, file
contents of the `.git` directories for opened worktrees and discovered
repositories (including a linked worktree's common `.git`) cannot be
read or written, though their metadata stays visible; when approved,
those Git directories become writable so commands like fetch/commit
work. SSH commit signing keeps working because the inherited
`SSH_AUTH_SOCK` is allowed as local Unix-socket IPC, which does not let
sandboxed commands send network packets to other machines. The Seatbelt
profile also allows PTY terminal-control ioctls so signing/passphrase
prompts can manage terminal state.

This intentionally restricts only `.git` itself (whose location we know
exactly, including the worktree case) rather than
`.gitignore`/`.gitattributes`/`.gitmodules`, since those can be nested
arbitrarily and the goal is to keep the policy expressible as a plain
deny-by-default allowlist that will port to Linux and Windows sandboxes
later.

Closes AI-334

Release Notes:

- Improved agent terminal sandboxing for Git metadata, Git worktrees,
and SSH commit signing.
2026-06-23 15:20:21 +00:00
..
2026-04-29 10:27:47 +00:00
2026-05-04 06:30:47 +00:00
2026-04-29 10:27:47 +00:00
…
2026-06-22 18:12:49 +00:00
2026-05-27 10:31:53 +00:00
2026-04-29 10:27:47 +00:00
2026-05-27 10:31:53 +00:00
2026-06-09 22:46:22 +00:00
2026-05-27 10:31:53 +00:00