agent: Model sandbox network escalation as a host allowlist - #59219
Merged
Conversation
cla-bot
Bot
added
the
cla-signed
zed-community-bot
Bot
added
the
staff
rtfeldman
force-pushed
the
http-proxy-03-agent-model
branch
from
June 12, 2026 19:59
1ab33c3 to
b47c0ae
Compare
rtfeldman
force-pushed
the
http-proxy-02-sandbox-enum
branch
from
June 12, 2026 19:59
70035ec to
683e314
Compare
First of a stack adding hostname-allowlisted network access to agent terminal sandboxing. This PR adds a new `http_proxy` crate containing only the allowlist policy types: `HostPattern` (exact hostnames or leading-`*.` subdomain wildcards, with IDN-to-punycode normalization and IP-literal / localhost rejection) and `Allowlist`, plus host-pattern subsumption (`covers`) used later to decide when an already-granted permission covers a new request. Pure, self-contained logic with no callers yet; the upstream-proxy config and the proxy server that enforces these policies land in later PRs. Release Notes: - N/A
Second of the stack. Adds `UpstreamProxy`: parsing of an upstream HTTP proxy from the environment (`HTTPS_PROXY` / `HTTP_PROXY` / `ALL_PROXY` and lowercase forms) with `NO_PROXY` bypass matching delegated to the `proxyvars` crate, basic-auth credentials (kept out of `Debug`/`Display`), and IPv6/default-port normalization. Used by the proxy server in the next PR to chain outbound connections through a corporate proxy when one is configured. Release Notes: - N/A
Final piece of the crate: the in-process HTTP/HTTPS proxy server that enforces an `Allowlist`. It speaks HTTP CONNECT for HTTPS tunnels and forward proxying for plain HTTP, vets resolved addresses against loopback/private/link-local ranges to prevent DNS-rebinding past the sandbox, pins each connection to the destination approved for its first request (so later keep-alive requests can't escape the policy decision), optionally chains through the `UpstreamProxy`, and bounds header sizes, connection counts, and connect/handshake waits since its sole client is untrusted model-driven code running inside the editor process. Includes end-to-end tests covering allowed/denied CONNECT and HTTP forward, IP-literal handling, DNS-rebinding denial, and upstream chaining. Still has no callers; wired into the agent terminal sandbox in later PRs. Release Notes: - N/A
Replace the `allow_network: bool` field on the Seatbelt `SandboxPermissions` with a `NetworkAccess` enum: `None` (block all egress), `All` (the previous `allow_network: true` behavior), and `LocalhostPort(u16)`, which confines a sandboxed command to a single loopback port. The new variant emits a Seatbelt rule permitting outbound TCP only to `localhost:<port>` and isn't used yet; it exists to pin sandboxed commands to the in-process network proxy in a later commit. The sole consumer, `acp_thread`'s terminal wrap, maps its existing boolean to `All`/`None`, so behavior is unchanged. Release Notes: - N/A
Replace the boolean `allow_network` terminal-sandbox escalation with a hostname allowlist. The `terminal` tool now takes `allow_hosts` (exact hostnames or leading-`*.` subdomain wildcards, validated up front via `http_proxy::HostPattern`) and `allow_all_hosts` as a broad escape hatch. Approval prompts name the requested hosts, thread grants and persistent "allow always" settings (`network_hosts` / `allow_all_hosts`, replacing `allow_network`) cover requests via host-pattern subsumption the same way write paths use subtree containment, and the authorization card in the agent panel lists the requested hosts in a collapsible section. Host allowlists aren't enforced yet: `SandboxWrap` carries the allowlist, but any network request still maps to unrestricted egress at the Seatbelt layer, matching previous behavior. Enforcement via an in-process proxy lands in the next commit. For non-local projects (where that proxy won't apply), host requests are widened to "arbitrary network access" before prompting so approvals match enforcement. Old persisted `network: bool` authorization details still deserialize via a serde alias. Release Notes: - N/A
rtfeldman
force-pushed
the
http-proxy-03-agent-model
branch
from
June 13, 2026 02:22
b47c0ae to
ee98620
Compare
rtfeldman
force-pushed
the
http-proxy-02-sandbox-enum
branch
from
June 13, 2026 02:22
683e314 to
9e31735
Compare
rtfeldman
marked this pull request as ready for review
June 15, 2026 18:48
MartinYe1234
approved these changes
Jun 15, 2026
MartinYe1234
enabled auto-merge
June 15, 2026 21:34
MartinYe1234
force-pushed
the
http-proxy-03-agent-model
branch
from
June 15, 2026 21:44
0b80817 to
ee98620
Compare
This was referenced Jun 18, 2026
Closed
This was referenced Jul 1, 2026
jolutz
pushed a commit
to jolutz/zed
that referenced
this pull request
Aug 8, 2026
…stries#59219) Third of a four-PR stack adding hostname-allowlisted network access to agent terminal sandboxing. Stacked on zed-industries#59218 — review/merge zed-industries#59217 and zed-industries#59218 first. Replaces the boolean `allow_network` terminal-sandbox escalation with a hostname allowlist. The `terminal` tool now takes `allow_hosts` (exact hostnames or leading-`*.` subdomain wildcards, validated up front) and `allow_all_hosts` as a broad escape hatch. Approval prompts name the requested hosts, thread grants and persistent "allow always" settings cover requests via host-pattern subsumption the same way write paths use subtree containment, and the authorization card in the agent panel lists the requested hosts. Host allowlists aren't enforced yet in this PR: `SandboxWrap` carries the allowlist, but any network request still maps to unrestricted egress at the Seatbelt layer, matching previous behavior. Enforcement via the in-process proxy lands in the final PR of the stack. All of this is behind the existing sandboxing feature flag. For non-local projects (where the loopback proxy won't apply), host requests are widened to "arbitrary network access" before prompting so approvals match enforcement. Old persisted `network: bool` authorization details still deserialize via a serde alias. Release Notes: - N/A --------- Co-authored-by: MartinYe1234 <52641447+MartinYe1234@users.noreply.github.com> Co-authored-by: Martin Ye <martin@zed.dev>
jolutz
pushed a commit
to jolutz/zed
that referenced
this pull request
Aug 8, 2026
…d-industries#59220) Final PR of a four-PR stack adding hostname-allowlisted network access to agent terminal sandboxing. Stacked on zed-industries#59219 — review/merge zed-industries#59217, zed-industries#59218, and zed-industries#59219 first. Spawns the `http_proxy` allowlisting proxy for sandboxed terminal commands that request network, and pins the Seatbelt policy to its loopback port (`NetworkAccess::LocalhostPort`) so all egress is forced through it. The child's proxy environment variables are pointed at the proxy and any inherited `NO_PROXY` is blanked so nothing connects direct; a real upstream proxy from the environment is chained through when present. The proxy and its Seatbelt config file share one RAII handle so both live exactly as long as the command, and per-connection events are drained to the log. The proxy binds loopback, so it only applies to local projects on macOS; elsewhere the wrap falls back to unrestricted egress as before (the agent layer widens such requests accordingly). Release Notes: - Added the ability to grant agent terminal commands network access to specific hosts (rather than all-or-nothing), enforced by an allowlisting proxy. --------- Co-authored-by: Martin Ye <martin@zed.dev> Co-authored-by: MartinYe1234 <52641447+MartinYe1234@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Third of a four-PR stack adding hostname-allowlisted network access to agent terminal sandboxing. Stacked on #59218 — review/merge #59217 and #59218 first.
Replaces the boolean
allow_networkterminal-sandbox escalation with a hostname allowlist. Theterminaltool now takesallow_hosts(exact hostnames or leading-*.subdomain wildcards, validated up front) andallow_all_hostsas a broad escape hatch. Approval prompts name the requested hosts, thread grants and persistent "allow always" settings cover requests via host-pattern subsumption the same way write paths use subtree containment, and the authorization card in the agent panel lists the requested hosts.Host allowlists aren't enforced yet in this PR:
SandboxWrapcarries the allowlist, but any network request still maps to unrestricted egress at the Seatbelt layer, matching previous behavior. Enforcement via the in-process proxy lands in the final PR of the stack. All of this is behind the existing sandboxing feature flag. For non-local projects (where the loopback proxy won't apply), host requests are widened to "arbitrary network access" before prompting so approvals match enforcement. Old persistednetwork: boolauthorization details still deserialize via a serde alias.Release Notes: