Add Windows terminal sandboxing via WSL - #58971
Merged
Merged
Conversation
Co-authored-by: Richard Feldman <oss@rtfeldman.com>
Co-authored-by: Richard Feldman <oss@rtfeldman.com>
Co-authored-by: Martin Ye <martin@zed.dev>
cla-bot
Bot
added
the
cla-signed
zed-community-bot
Bot
added
the
staff
cla-bot
Bot
removed
the
cla-signed
The hardcoded /mnt/<drive> mapping breaks when /etc/wsl.conf changes the automount root. Ask wslpath inside the chosen distro instead, and keep the structural mapping as a fallback when translation fails.
cla-bot
Bot
added
the
cla-signed
Wrapping a sandboxed command probed WSL with smol::block_on on the foreground thread, freezing the UI for the duration of a WSL VM boot and hanging Zed forever if wsl.exe wedged. Make the windows_wsl functions async, run the wrap via background_spawn, and race it against a 60-second gpui timer. kill_on_drop ensures a timed-out or cancelled wrap also kills the in-flight wsl.exe child. Timeout errors carry the unavailable-prefix so the existing turn-off-sandboxing prompt handles a wedged WSL.
wsl.exe is a console-subsystem binary, so the sandbox probe and path resolution spawns flashed a conhost window. Set CREATE_NO_WINDOW, defined locally since the sandbox crate doesn't depend on util.
# Conflicts: # crates/agent/src/thread.rs # crates/agent/src/tools/terminal_tool.rs
Parity with the Linux Bubblewrap NixOS tests, for the Windows WSL sandbox. Adds a feature-gated wsl_sandbox_test_helper bin that drives the real windows_wsl::wrap_invocation, spawns the produced wsl.exe command, and asserts the sandbox's grants and restrictions hold end-to-end (including the Windows-specific interop-escape block), plus a cargo xtask wsl-sandbox-tests subcommand and a script/test-wsl-sandbox.ps1 that provisions bwrap and unprivileged user namespaces before running. Developer/self-hosted-runner invoked, matching the Linux tests, which aren't wired into CI either.
MartinYe1234
marked this pull request as ready for review
June 17, 2026 21:06
rtfeldman
approved these changes
Jun 17, 2026
This was referenced Jun 18, 2026
Closed
jolutz
pushed a commit
to jolutz/zed
that referenced
this pull request
Aug 8, 2026
Summary - Adds Windows agent terminal sandboxing by routing commands through WSL and Bubblewrap. - Supports native Windows and WSL project paths, including elevated write grants for WSL paths. - Shows a confirmation prompt to turn off sandboxing when WSL sandbox setup is unavailable. This builds on the work in the sandbox-linux branch. Closes AI-376 Release Notes: - Added Windows terminal sandboxing for agent commands when sandboxing is enabled. --------- Co-authored-by: cameron <cameron.studdstreet@gmail.com> Co-authored-by: Richard Feldman <oss@rtfeldman.com> Co-authored-by: zed-zippy[bot] <234243425+zed-zippy[bot]@users.noreply.github.com>
paschaldev
pushed a commit
to paschaldev/zed
that referenced
this pull request
Aug 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This builds on the work in the sandbox-linux branch.
Closes AI-376
Release Notes: