mirror of
https://github.com/zed-industries/zed.git
synced 2026-05-31 19:05:00 +07:00
f0341c96a1
Some checks are pending
Congratsbot / check-author (push) Waiting to run
Congratsbot / congrats (push) Blocked by required conditions
run_tests / orchestrate (push) Waiting to run
run_tests / check_style (push) Waiting to run
run_tests / clippy_windows (push) Blocked by required conditions
run_tests / clippy_linux (push) Blocked by required conditions
run_tests / clippy_mac (push) Blocked by required conditions
run_tests / clippy_mac_x86_64 (push) Blocked by required conditions
run_tests / run_tests_windows (push) Blocked by required conditions
run_tests / run_tests_linux (push) Blocked by required conditions
run_tests / run_tests_mac (push) Blocked by required conditions
run_tests / miri_scheduler (push) Blocked by required conditions
run_tests / doctests (push) Blocked by required conditions
run_tests / check_workspace_binaries (push) Blocked by required conditions
run_tests / build_visual_tests_binary (push) Blocked by required conditions
run_tests / check_wasm (push) Blocked by required conditions
run_tests / check_dependencies (push) Blocked by required conditions
run_tests / check_docs (push) Blocked by required conditions
run_tests / check_licenses (push) Blocked by required conditions
run_tests / check_scripts (push) Blocked by required conditions
run_tests / check_postgres_and_protobuf_migrations (push) Blocked by required conditions
run_tests / extension_tests (push) Blocked by required conditions
run_tests / tests_pass (push) Blocked by required conditions
deploy_nightly_docs / deploy_docs (push) Has been skipped
Stacked on top of #57430. When the `sandboxing` feature flag is on (macOS only), agent-run terminal commands are launched under `/usr/bin/sandbox-exec` with a per-command Seatbelt policy: - **Reads:** any path on the filesystem. - **Writes:** each project worktree plus a per-command `$TMPDIR`. - **Network:** blocked. The model can request relaxations on individual calls via three new input flags on the `terminal` tool: - `allow_network: true` - `allow_fs_write: true` - `unsandboxed: true` Each one triggers a separate always-prompt user approval (bypassing any `always_allow` rules, since escalation is a stronger trust boundary than the baseline command approval). The flags are silently ignored when sandboxing is off, so the model can't surreptitiously change runtime behavior by setting them in the no-op case. The per-command tempdir is provisioned regardless of sandbox state so the model can't infer whether the sandbox is in effect by looking at `$TMPDIR`. The Seatbelt config file's lifetime is tied to the `Terminal` entity via an opaque RAII handle (`SandboxConfigHandle = Box<dyn Any + Send>`), so cancellation paths drop it automatically. ### Notes for review - The writable scope passed to the sandbox is the project's worktree paths plus the per-command tempdir, **not** the resolved `cd` working directory — `cd` is model-controlled, and using it as the writable scope would let the model widen its own write permissions outside the project. - The new tool flags are always present in the JSON schema (with `#[serde(default)]`), even when the sandbox prompt section isn't rendered. The system prompt only documents them when the section is present, so the model shouldn't try to use them when it's not — but the schema doesn't actively reject them, just ignores them. - I opted not to add an end-to-end test for the escalation prompt path: the existing `FakeThreadEnvironment` ignores the new params and toggling the feature flag in tests is more wiring than felt worth it for a first cut. The pure-function pieces (`sandbox_approval_title`, schema, deserialization) are covered, and the sandbox crate itself has end-to-end tests that actually invoke `sandbox-exec`. Release Notes: - N/A --------- Co-authored-by: MartinYe1234 <52641447+MartinYe1234@users.noreply.github.com>
65 lines
1.6 KiB
TOML
65 lines
1.6 KiB
TOML
[package]
|
|
name = "acp_thread"
|
|
version = "0.1.0"
|
|
edition.workspace = true
|
|
publish.workspace = true
|
|
license = "GPL-3.0-or-later"
|
|
|
|
[lints]
|
|
workspace = true
|
|
|
|
[lib]
|
|
path = "src/acp_thread.rs"
|
|
doctest = false
|
|
|
|
[features]
|
|
test-support = ["gpui/test-support", "project/test-support", "dep:parking_lot"]
|
|
|
|
[dependencies]
|
|
action_log.workspace = true
|
|
agent-client-protocol.workspace = true
|
|
async-channel.workspace = true
|
|
base64.workspace = true
|
|
anyhow.workspace = true
|
|
buffer_diff.workspace = true
|
|
chrono.workspace = true
|
|
collections.workspace = true
|
|
feature_flags.workspace = true
|
|
multi_buffer.workspace = true
|
|
file_icons.workspace = true
|
|
futures.workspace = true
|
|
gpui.workspace = true
|
|
itertools.workspace = true
|
|
language.workspace = true
|
|
language_model.workspace = true
|
|
log.workspace = true
|
|
markdown.workspace = true
|
|
parking_lot = { workspace = true, optional = true }
|
|
image.workspace = true
|
|
portable-pty.workspace = true
|
|
project.workspace = true
|
|
prompt_store.workspace = true
|
|
sandbox.workspace = true
|
|
serde.workspace = true
|
|
serde_json.workspace = true
|
|
settings.workspace = true
|
|
task.workspace = true
|
|
telemetry.workspace = true
|
|
terminal.workspace = true
|
|
text.workspace = true
|
|
ui.workspace = true
|
|
url.workspace = true
|
|
util.workspace = true
|
|
uuid.workspace = true
|
|
watch.workspace = true
|
|
urlencoding.workspace = true
|
|
|
|
[dev-dependencies]
|
|
env_logger.workspace = true
|
|
gpui = { workspace = true, "features" = ["test-support"] }
|
|
indoc.workspace = true
|
|
parking_lot.workspace = true
|
|
project = { workspace = true, "features" = ["test-support"] }
|
|
rand.workspace = true
|
|
util.workspace = true
|
|
settings.workspace = true
|