acp_thread: Enforce the network allowlist via an in-process proxy - #59220
Merged
Conversation
cla-bot
Bot
added
the
cla-signed
zed-community-bot
Bot
added
the
staff
rtfeldman
force-pushed
the
http-proxy-03-agent-model
branch
from
June 12, 2026 19:59
1ab33c3 to
b47c0ae
Compare
rtfeldman
force-pushed
the
http-proxy-04-proxy-enforcement
branch
from
June 12, 2026 19:59
2641b08 to
8f3fe3a
Compare
First of a stack adding hostname-allowlisted network access to agent terminal sandboxing. This PR adds a new `http_proxy` crate containing only the allowlist policy types: `HostPattern` (exact hostnames or leading-`*.` subdomain wildcards, with IDN-to-punycode normalization and IP-literal / localhost rejection) and `Allowlist`, plus host-pattern subsumption (`covers`) used later to decide when an already-granted permission covers a new request. Pure, self-contained logic with no callers yet; the upstream-proxy config and the proxy server that enforces these policies land in later PRs. Release Notes: - N/A
Second of the stack. Adds `UpstreamProxy`: parsing of an upstream HTTP proxy from the environment (`HTTPS_PROXY` / `HTTP_PROXY` / `ALL_PROXY` and lowercase forms) with `NO_PROXY` bypass matching delegated to the `proxyvars` crate, basic-auth credentials (kept out of `Debug`/`Display`), and IPv6/default-port normalization. Used by the proxy server in the next PR to chain outbound connections through a corporate proxy when one is configured. Release Notes: - N/A
Final piece of the crate: the in-process HTTP/HTTPS proxy server that enforces an `Allowlist`. It speaks HTTP CONNECT for HTTPS tunnels and forward proxying for plain HTTP, vets resolved addresses against loopback/private/link-local ranges to prevent DNS-rebinding past the sandbox, pins each connection to the destination approved for its first request (so later keep-alive requests can't escape the policy decision), optionally chains through the `UpstreamProxy`, and bounds header sizes, connection counts, and connect/handshake waits since its sole client is untrusted model-driven code running inside the editor process. Includes end-to-end tests covering allowed/denied CONNECT and HTTP forward, IP-literal handling, DNS-rebinding denial, and upstream chaining. Still has no callers; wired into the agent terminal sandbox in later PRs. Release Notes: - N/A
Replace the `allow_network: bool` field on the Seatbelt `SandboxPermissions` with a `NetworkAccess` enum: `None` (block all egress), `All` (the previous `allow_network: true` behavior), and `LocalhostPort(u16)`, which confines a sandboxed command to a single loopback port. The new variant emits a Seatbelt rule permitting outbound TCP only to `localhost:<port>` and isn't used yet; it exists to pin sandboxed commands to the in-process network proxy in a later commit. The sole consumer, `acp_thread`'s terminal wrap, maps its existing boolean to `All`/`None`, so behavior is unchanged. Release Notes: - N/A
Replace the boolean `allow_network` terminal-sandbox escalation with a hostname allowlist. The `terminal` tool now takes `allow_hosts` (exact hostnames or leading-`*.` subdomain wildcards, validated up front via `http_proxy::HostPattern`) and `allow_all_hosts` as a broad escape hatch. Approval prompts name the requested hosts, thread grants and persistent "allow always" settings (`network_hosts` / `allow_all_hosts`, replacing `allow_network`) cover requests via host-pattern subsumption the same way write paths use subtree containment, and the authorization card in the agent panel lists the requested hosts in a collapsible section. Host allowlists aren't enforced yet: `SandboxWrap` carries the allowlist, but any network request still maps to unrestricted egress at the Seatbelt layer, matching previous behavior. Enforcement via an in-process proxy lands in the next commit. For non-local projects (where that proxy won't apply), host requests are widened to "arbitrary network access" before prompting so approvals match enforcement. Old persisted `network: bool` authorization details still deserialize via a serde alias. Release Notes: - N/A
Spawn the `http_proxy` allowlisting proxy for sandboxed terminal commands that request network, and pin the Seatbelt policy to its loopback port (`NetworkAccess::LocalhostPort`) so all egress is forced through it. The child's proxy environment variables are pointed at the proxy and any inherited `NO_PROXY` is blanked so nothing connects direct; a real upstream proxy from the environment is chained through when present. The proxy and its Seatbelt config file share one RAII handle so both live exactly as long as the command. Per-connection events are drained to the log. The proxy binds loopback, so it only applies to local projects and macOS hosts; elsewhere the wrap falls back to unrestricted egress as before (callers widen the request accordingly). Release Notes: - N/A
rtfeldman
force-pushed
the
http-proxy-03-agent-model
branch
from
June 13, 2026 02:22
b47c0ae to
ee98620
Compare
rtfeldman
force-pushed
the
http-proxy-04-proxy-enforcement
branch
from
June 13, 2026 02:22
8f3fe3a to
d54a8a7
Compare
rtfeldman
marked this pull request as ready for review
June 15, 2026 18:48
…zed-industries/zed into http-proxy-04-proxy-enforcement
Thread project locality through SandboxWrap instead of re-reading project.is_local() at proxy-spawn time, and have setup_network_proxy return a resolved NetworkPolicy that apply_sandbox_wrap maps directly. This keeps the enforced egress policy in lockstep with the locality decision the agent layer used when prompting the user, and removes the duplicated macos/is_local/wants_network gating between the two functions.
On command completion the proxy handle was dropped inside this.update on the foreground thread, where its Drop joins the listener thread (after a loopback wakeup connect). Take the handle and drop it on a background task so a slow shutdown can't stall the UI.
MartinYe1234
approved these changes
Jun 15, 2026
This was referenced Jun 18, 2026
Closed
This was referenced Jul 1, 2026
This was referenced Jul 10, 2026
jolutz
pushed a commit
to jolutz/zed
that referenced
this pull request
Aug 8, 2026
…d-industries#59220) Final PR of a four-PR stack adding hostname-allowlisted network access to agent terminal sandboxing. Stacked on zed-industries#59219 — review/merge zed-industries#59217, zed-industries#59218, and zed-industries#59219 first. Spawns the `http_proxy` allowlisting proxy for sandboxed terminal commands that request network, and pins the Seatbelt policy to its loopback port (`NetworkAccess::LocalhostPort`) so all egress is forced through it. The child's proxy environment variables are pointed at the proxy and any inherited `NO_PROXY` is blanked so nothing connects direct; a real upstream proxy from the environment is chained through when present. The proxy and its Seatbelt config file share one RAII handle so both live exactly as long as the command, and per-connection events are drained to the log. The proxy binds loopback, so it only applies to local projects on macOS; elsewhere the wrap falls back to unrestricted egress as before (the agent layer widens such requests accordingly). Release Notes: - Added the ability to grant agent terminal commands network access to specific hosts (rather than all-or-nothing), enforced by an allowlisting proxy. --------- Co-authored-by: Martin Ye <martin@zed.dev> Co-authored-by: MartinYe1234 <52641447+MartinYe1234@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Final PR of a four-PR stack adding hostname-allowlisted network access to agent terminal sandboxing. Stacked on #59219 — review/merge #59217, #59218, and #59219 first.
Spawns the
http_proxyallowlisting proxy for sandboxed terminal commands that request network, and pins the Seatbelt policy to its loopback port (NetworkAccess::LocalhostPort) so all egress is forced through it. The child's proxy environment variables are pointed at the proxy and any inheritedNO_PROXYis blanked so nothing connects direct; a real upstream proxy from the environment is chained through when present. The proxy and its Seatbelt config file share one RAII handle so both live exactly as long as the command, and per-connection events are drained to the log.The proxy binds loopback, so it only applies to local projects on macOS; elsewhere the wrap falls back to unrestricted egress as before (the agent layer widens such requests accordingly).
Release Notes: