Make unrestricted sandbox network access explicit - #59385
Merged
Conversation
First of a stack adding hostname-allowlisted network access to agent terminal sandboxing. This PR adds a new `http_proxy` crate containing only the allowlist policy types: `HostPattern` (exact hostnames or leading-`*.` subdomain wildcards, with IDN-to-punycode normalization and IP-literal / localhost rejection) and `Allowlist`, plus host-pattern subsumption (`covers`) used later to decide when an already-granted permission covers a new request. Pure, self-contained logic with no callers yet; the upstream-proxy config and the proxy server that enforces these policies land in later PRs. Release Notes: - N/A
Second of the stack. Adds `UpstreamProxy`: parsing of an upstream HTTP proxy from the environment (`HTTPS_PROXY` / `HTTP_PROXY` / `ALL_PROXY` and lowercase forms) with `NO_PROXY` bypass matching delegated to the `proxyvars` crate, basic-auth credentials (kept out of `Debug`/`Display`), and IPv6/default-port normalization. Used by the proxy server in the next PR to chain outbound connections through a corporate proxy when one is configured. Release Notes: - N/A
Final piece of the crate: the in-process HTTP/HTTPS proxy server that enforces an `Allowlist`. It speaks HTTP CONNECT for HTTPS tunnels and forward proxying for plain HTTP, vets resolved addresses against loopback/private/link-local ranges to prevent DNS-rebinding past the sandbox, pins each connection to the destination approved for its first request (so later keep-alive requests can't escape the policy decision), optionally chains through the `UpstreamProxy`, and bounds header sizes, connection counts, and connect/handshake waits since its sole client is untrusted model-driven code running inside the editor process. Includes end-to-end tests covering allowed/denied CONNECT and HTTP forward, IP-literal handling, DNS-rebinding denial, and upstream chaining. Still has no callers; wired into the agent terminal sandbox in later PRs. Release Notes: - N/A
Replace the `allow_network: bool` field on the Seatbelt `SandboxPermissions` with a `NetworkAccess` enum: `None` (block all egress), `All` (the previous `allow_network: true` behavior), and `LocalhostPort(u16)`, which confines a sandboxed command to a single loopback port. The new variant emits a Seatbelt rule permitting outbound TCP only to `localhost:<port>` and isn't used yet; it exists to pin sandboxed commands to the in-process network proxy in a later commit. The sole consumer, `acp_thread`'s terminal wrap, maps its existing boolean to `All`/`None`, so behavior is unchanged. Release Notes: - N/A
Replace the boolean `allow_network` terminal-sandbox escalation with a hostname allowlist. The `terminal` tool now takes `allow_hosts` (exact hostnames or leading-`*.` subdomain wildcards, validated up front via `http_proxy::HostPattern`) and `allow_all_hosts` as a broad escape hatch. Approval prompts name the requested hosts, thread grants and persistent "allow always" settings (`network_hosts` / `allow_all_hosts`, replacing `allow_network`) cover requests via host-pattern subsumption the same way write paths use subtree containment, and the authorization card in the agent panel lists the requested hosts in a collapsible section. Host allowlists aren't enforced yet: `SandboxWrap` carries the allowlist, but any network request still maps to unrestricted egress at the Seatbelt layer, matching previous behavior. Enforcement via an in-process proxy lands in the next commit. For non-local projects (where that proxy won't apply), host requests are widened to "arbitrary network access" before prompting so approvals match enforcement. Old persisted `network: bool` authorization details still deserialize via a serde alias. Release Notes: - N/A
Spawn the `http_proxy` allowlisting proxy for sandboxed terminal commands that request network, and pin the Seatbelt policy to its loopback port (`NetworkAccess::LocalhostPort`) so all egress is forced through it. The child's proxy environment variables are pointed at the proxy and any inherited `NO_PROXY` is blanked so nothing connects direct; a real upstream proxy from the environment is chained through when present. The proxy and its Seatbelt config file share one RAII handle so both live exactly as long as the command. Per-connection events are drained to the log. The proxy binds loopback, so it only applies to local projects and macOS hosts; elsewhere the wrap falls back to unrestricted egress as before (callers widen the request accordingly). Release Notes: - N/A
…zed-industries/zed into http-proxy-04-proxy-enforcement
Thread project locality through SandboxWrap instead of re-reading project.is_local() at proxy-spawn time, and have setup_network_proxy return a resolved NetworkPolicy that apply_sandbox_wrap maps directly. This keeps the enforced egress policy in lockstep with the locality decision the agent layer used when prompting the user, and removes the duplicated macos/is_local/wants_network gating between the two functions.
On command completion the proxy handle was dropped inside this.update on the foreground thread, where its Drop joins the listener thread (after a loopback wakeup connect). Take the handle and drop it on a background task so a slow shutdown can't stall the UI.
cla-bot
Bot
added
the
cla-signed
zed-community-bot
Bot
added
the
staff
rtfeldman
force-pushed
the
proxy-follow-ups
branch
from
June 15, 2026 21:14
00a9467 to
eceb9d9
Compare
rtfeldman
force-pushed
the
proxy-follow-ups
branch
from
June 15, 2026 21:16
eceb9d9 to
b0b64b4
Compare
rtfeldman
marked this pull request as ready for review
June 15, 2026 21:17
MartinYe1234
approved these changes
Jun 15, 2026
This was referenced Jul 1, 2026
This was referenced Jul 10, 2026
jolutz
pushed a commit
to jolutz/zed
that referenced
this pull request
Aug 8, 2026
This makes unrestricted sandbox network access an explicit sandbox mode instead of a fallback when the enforcing proxy is unavailable. Host-specific network access still uses the proxy, while approved arbitrary network access skips proxy setup and maps directly to unrestricted egress. Release Notes: - Improved agent terminal sandbox network permission handling. --------- Co-authored-by: Martin Ye <martin@zed.dev> Co-authored-by: MartinYe1234 <52641447+MartinYe1234@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This makes unrestricted sandbox network access an explicit sandbox mode instead of a fallback when the enforcing proxy is unavailable. Host-specific network access still uses the proxy, while approved arbitrary network access skips proxy setup and maps directly to unrestricted egress.
Release Notes: