The sandbox_exec_main wrapper already scrubs the inherited process
environment before exec-ing the real shell. The TerminalBuilder
filtering only pruned the additive env HashMap, not the inherited
environment, so it was both redundant and incomplete. The single
filtering point in sandbox_exec_main is the authoritative one.

The struct contains only Strings, Vec<String>, and bool — no cycles
or non-serializable types — so the expect is justified.

Add trailing_var_arg = true to the Args command attribute so clap
greedily captures all remaining arguments (including flags like -l)
into paths_or_urls after the -- separator.

Fix doc comment that incorrectly said base64-encoded JSON.

When allow_network is false, handle AccessNet in the Landlock ruleset
without adding any NetPort allow-rules, which denies all TCP bind and
connect operations. This requires kernel 6.4+ (Landlock ABI V4).

If the kernel doesn't support network restriction, return a clear
error instead of silently running without it. For partially enforced
sandboxes, log a warning that network restriction may be degraded.

- Scope mach-lookup to a specific allowlist of Mach services needed
  for shell operation (DNS, directory services, security, logging,
  launch services, etc.) instead of granting unrestricted IPC access.
  Add troubleshooting comment for diagnosing missing services.

- Remove blanket iokit-open permission. Terminal shells don't need
  IOKit user client access (no GPU, audio, USB, or HID). Random
  numbers use /dev/urandom or getentropy(), timing uses syscalls.

- Remove blanket process-exec and rely on the existing subpath rules
  that grant process-exec only to designated executable directories.
  Add process-exec to the project directory rule so users can run
  scripts like ./build.sh or ./gradlew.

Resolve symlinks via std::fs::canonicalize on all sandbox paths
before applying the OS-level sandbox. Without this, a symlink
pointing outside the intended sandbox boundary would be followed
and the target would be accessible.

project_dir canonicalization failure logs a warning. System and
additional paths silently fall back to the original path if they
don't exist (handled gracefully downstream).

Paths interpolated into the macOS Seatbelt SBPL profile were not
escaped, allowing a crafted path containing double-quote characters
to inject arbitrary SBPL rules and potentially disable the sandbox.

Add sbpl_escape() which escapes backslash and double-quote characters
in path strings before interpolation into SBPL literal and subpath
forms.

Add OS-level kernel-enforced sandboxing for Zed's terminal, covering both
the interactive user terminal and the agent's terminal tool.

## Architecture

When sandbox is enabled, the shell passed to alacritty is wrapped with the
Zed binary itself invoked as `--sandbox-exec <json-config> -- <shell> [args]`.
This wrapper process:
1. Filters environment variables to an allowed set
2. Applies the OS sandbox (Seatbelt on macOS, Landlock on Linux)
3. Execs the real shell — sandbox is inherited by all children

This avoids any changes to the alacritty fork.

## Settings

New `terminal.sandbox` settings block with:
- `enabled` (default: false)
- `apply_to`: "terminal", "tool", "both", "neither"
- `system_paths`: OS-specific executable/read-only/read-write path lists
- `additional_executable_paths`, `additional_read_only_paths`,
  `additional_read_write_paths`: user-specified path allowlists
- `allow_network` (default: true)
- `allowed_env_vars`: env var allowlist

## Feature flag

Gated behind TerminalSandboxFeatureFlag (reusing "agent-git-worktrees"
flag string from the database).

## Files changed

- settings_content/terminal.rs: SandboxSettingsContent, SystemPathsSettingsContent, SandboxApplyTo
- terminal/terminal_settings.rs: SandboxConfig, ResolvedSystemPaths with OS defaults
- terminal/sandbox_macos.rs: Seatbelt FFI + SBPL profile generation
- terminal/sandbox_linux.rs: Landlock ruleset construction
- terminal/sandbox_exec.rs: --sandbox-exec wrapper entry point
- terminal/terminal.rs: env filtering + shell wrapping in TerminalBuilder::new
- project/terminals.rs: sandbox resolution for user terminal + create_terminal_task
- acp_thread/terminal.rs: sandbox resolution for agent terminal tool
- zed/main.rs: --sandbox-exec CLI argument handler
- feature_flags/flags.rs: TerminalSandboxFeatureFlag
- assets/settings/default.json: default sandbox settings

Closes #46837

Reuse the existing read-only bundled editor when opening default
settings or default key bindings again, instead of creating a duplicate
tab each time.

Also adds a regression test covering repeated `OpenDefaultSettings`
dispatches.

### Before


https://github.com/user-attachments/assets/ac2477b0-dc57-451c-a400-667c3613da2c


### After


https://github.com/user-attachments/assets/309fbd32-6dad-40a0-a864-b638a583ef52



Before you mark this PR as ready for review, make sure that you have:
- [x] Added a solid test coverage and/or screenshots from doing manual
testing
- [x] Done a self-review taking into account security and performance
aspects
- [x] Aligned any UI changes with the [UI
checklist](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist)

Release Notes:

- Fixed default settings and default key bindings reopening duplicate
tabs instead of reusing the existing tab.

The title in the YAML front matter contained a colon, which YAML
interprets as a key-value separator, causing a parse error. Quoted the
title value to fix it.

<img width="1087" height="248" alt="image"
src="https://github.com/user-attachments/assets/f074af0e-937c-4289-80a9-83cde294fd23"
/>

Release Notes:

- N/A

---------

Co-authored-by: Kunall Banerjee <hey@kimchiii.space>

Fixes https://github.com/zed-industries/zed/issues/45668

https://github.com/microsoft/vscode-copilot-chat used as a reference for
headers and properties we need to set

| Before | After | 
| --- | --- |
| <img width="300"
src="https://github.com/user-attachments/assets/d112a9ef-52d2-42ff-a77b-4b4b15f950fe"
/>| <img width="300"
src="https://github.com/user-attachments/assets/0f1d7ae0-bee1-46f7-92ef-aea0fa6cde7a"
/> |

Release Notes:

- Enabled thinking mode when using Anthropic models with Copilot

Release Notes:

- N/A

Previously, `get_layer_surface` always passed `None` as the output,
causing all layer shell windows to appear on the compositor's default
output regardless of the requested display.

Store `wl_output` proxies in client state and resolve them from
`DisplayId` so the correct output is passed to `get_layer_surface`.

Release Notes:

- N/A

Fixes #42444

- Changed `accepts_text_input` on the editor to be more precise.
Previously, it returned `true` only in insert mode. Now it also returns
`true` when an operator is pending.
- On Windows, we disable the IME whenever there is no input handler
which `accepts_text_input`.
- How this improves Vim mode: in insert mode, the IME is enabled; in
normal mode, it is disabled (command keys are not intercepted); when an
operator is pending, the IME is re-enabled.

Release Notes:

- On Windows, the IME is disabled in Vim normal and visual modes.

On Windows, the WSL VM always boots up when Zed is opened, because we
eagerly discover which jupyter kernels are installed inside WSL on
startup. This is not desirable if the REPL feature is not being used.
Defer this work to the point where we actually need to know what kernels
are installed.

Release Notes:

- N/A

Release Notes:

- Fixed mouse cursor disappearing when clicking a changed file in the Git Changes panel.

(This should be merged after #48332)

This PR exposes the LSP settings schema functionality to extensions,
allowing them to provide JSON schema for `initialization_options` and
`settings` fields to enable autocomplete in settings files.

New extension API methods (v0.8.0+):
- `language_server_initialization_options_schema`
- `language_server_settings_schema`

Both methods return an optional JSON string conforming to JSON schema.
Older extension versions gracefully return `None`.

Release Notes:

- Added support for settings schemas for the next version of the
extension API so that settings autocompletion can be provided for
language server settings.

---------

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: MrSubidubi <finn@zed.dev>

Updates #50970

While investigating the executor shutdown code, Claude noticed that we
never
actually drop the app because of a reference cycle.

Release Notes:

- N/A

Co-Authored-By: Eric Holk <eric@zed.dev>

In app drop we had been calling `.close()` on the executors. This caused
problems with the BackgroundExecutor on Linux because it raced with
concurrent work: If task A was running and about to poll task B, the
poll to task B would panic with "Task polled after completion". This
didn't really matter (because the app was shutting down anyway) but
inflated our panic metrics on Linux.

It turns out that the call to `.close()` is not needed. It was added to
prevent foreground tasks being scheduled after the app was dropped; but
on all platforms the App run method does not return until after the
ForegroundExecutor is stopped (so no further tasks will run anyway).

The background case is more interesting. In test code it didn't matter
(the background executor is simulated on the main thread so tests can't
leak tasks); in app code it also didn't really make a difference. When
`fn main` returns (which it does immediately after the app is dropped)
all the background threads will be cancelled anyway.

Further confounding debugging, it turns out that the App does not get
dropped on macOS and Windows due to a reference cycle; so this was only
happening on Linux where the app quit callback is dropped instead of
retained after being called. (Fix in #50985)

Release Notes:

- N/A

---------

Co-authored-by: Eric Holk <eric@zed.dev>

Almost there!

Release Notes:

- N/A

- Fixes message editor in empty state not consuming the whole height of
the panel
- Remove duped focused method in the `ListItem`
- Remove duped "new thread" buttons when group is empty
- Add some UI adjustments like removing labels and fading out truncated
items

Release Notes:

- N/A

Release Notes:

- N/A

Closes #ISSUE

Before you mark this PR as ready for review, make sure that you have:
- [ ] Added a solid test coverage and/or screenshots from doing manual
testing
- [ ] Done a self-review taking into account security and performance
aspects
- [ ] Aligned any UI changes with the [UI
checklist](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist)

Release Notes:

- N/A *or* Added/Fixed/Improved ...

This also fixed `ep parse-output` for newer formats

Release Notes:

- N/A

This prevents child processes (e.g. shells) from inheriting it. This
generally isn't an issue, since zed is the only thing that cares about
it, but if you're trying to run zed *from* zed, you would first need to
unset it manually.

Release Notes:

- N/A

Emit client-side organization changed events through
`RefreshLlmTokenListener` so it produces the same `RefreshLlmTokenEvent`
used for server-pushed `UserUpdated` messages.

This keeps token refresh fan-out in one place.

Closes CLO-383.

Release Notes:

- N/A

---------

Co-authored-by: Tom Houlé <tom@tomhoule.com>

Follow up to https://github.com/zed-industries/zed/pull/48760 thanks to
@miguelraz and @reflectronic.

No new notes since #48760 did the same thing, only wasn't opting in to
process groups we already had in place.

Release Notes:

- N/A

Hello,

This pull request aims to improve usage of lmstudio ai provider for
remote lmstudio nodes and support api key authentication.

This has been tested on my local network from a headless lms node. See
attached demo vid

Release Notes:

- lmstudio: Added support for specifying an API key via the UI


https://github.com/user-attachments/assets/7594cf49-3198-4171-b3e9-c3264cf35b6e

---------

Co-authored-by: Bennet Bo Fenner <bennetbo@gmx.de>

We know outline the focus sidebar entry similar to the project panel.
This allows users to see what they have selected vs active

Before you mark this PR as ready for review, make sure that you have:
- [ ] Added a solid test coverage and/or screenshots from doing manual
testing
- [x] Done a self-review taking into account security and performance
aspects
- [x] Aligned any UI changes with the [UI
checklist](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist)

Release Notes:

- N/A

When checking a box in the markdown preview, it's generally very slow.

Preview updates when typing in the editor are debounced to be every
200ms, but when clicking an element in the preview, it feels sluggish to
wait that long.

In debugging, I found that the debounced task from the editor event
subscriptions replaced the non-debounced event on [line
605](https://github.com/zed-industries/zed/blob/263d8e58d809b493044160cb26fb690169007e4e/crates/markdown_preview/src/markdown_preview_view.rs#L600C49-L602C51),
and the UI took around 200 ms to update.

Therefore, I've changed the markdown parsing function to not replace the
task, unless another non-debounced task comes along. UI updates from the
editor are still debounced.

Before: 

[Screencast_20260206_145702.webm](https://github.com/user-attachments/assets/fed5f8fa-866e-4291-9ec3-f876bb6dc6ab)

After:

[Screencast_20260206_150124.webm](https://github.com/user-attachments/assets/e4e7dc2b-d899-42ff-bd28-ad1dc5a8d3d9)

Release Notes:

- Improved speed at which markdown lists update after checking or
unchecking items

Closes #ISSUE

Before you mark this PR as ready for review, make sure that you have:
- [ ] Added a solid test coverage and/or screenshots from doing manual
testing
- [ ] Done a self-review taking into account security and performance
aspects
- [ ] Aligned any UI changes with the [UI
checklist](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist)

Release Notes:

- N/A *or* Added/Fixed/Improved ...

Closes #46846

When `disable_ai: true` is set in user settings, Zed was still
connecting to configured MCP (context) servers and sending
initialization requests. This change adds checks for `DisableAiSettings`
in `ContextServerStore` to:

- Skip server connections when AI is disabled
- Disconnect from running servers when AI becomes disabled
- Connect to servers when AI is re-enabled
- Prevent registry changes from triggering connections while AI is
disabled

The fix tracks `ai_disabled` state to detect transitions and properly
manage server connections when AI is toggled.

Release Notes:

- Fixed Zed connecting to MCP servers when AI is disabled.

---------

Co-authored-by: Bennet Bo Fenner <bennetbo@gmx.de>

Release Notes:

- N/A

Before the panel resize wouldn't take into account the width of the
sidebar and the right dock could push the left dock on resize too.

Before you mark this PR as ready for review, make sure that you have:
- [ ] Added a solid test coverage and/or screenshots from doing manual
testing
- [x] Done a self-review taking into account security and performance
aspects
- [x] Aligned any UI changes with the [UI
checklist](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist)


Co-authored-by: Cameron \<cameron.studdstreet@gmail.com\>

Release Notes:

- N/A

We are seeing the timestamp comparison fail in an unexpected way, e.g.
https://zed-dev.sentry.io/issues/7293482758/events/c7f7eab3f8f2463f879d4889a80d623e,
where it seems like `text::Anchor::is_max` should be returning true but
it apparently isn't. Add some more information when this panic happens
to understand what's going on.

Release Notes:

- N/A

Co-authored-by: Piotr Osiewicz <24362066+osiewicz@users.noreply.github.com>

If a streaming tool call (e.g. edit file) returns an error during
streaming, we would wait until we received the whole input.

Release Notes:

- N/A

---------

Co-authored-by: Ben Brandt <benjamin.j.brandt@gmail.com>

Closes #49336

Before you mark this PR as ready for review, make sure that you have:
- [x] Added a solid test coverage and/or screenshots from doing manual
testing
- [x] Done a self-review taking into account security and performance
aspects
- [ ] Aligned any UI changes with the [UI

checklist](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist)

### Video:

https://drive.google.com/file/d/1qAwAoDr4wr8cs1dosvLocU-a4pngJZvr/view?usp=sharing

Release Notes:

- Fixed agent panel stealing keyboard focus from modals during workspace
restoration

In the old edit agent tool we encouraged the LLM to respond with whole
lines, which we did not do in the new edit file tool.

Release Notes:

- N/A

- Show a warning asking users to review pre-filled prompts from external
links before sending.
- Strip control characters and bidi control characters from pre-filled
prompts.
- Collapse 3+ consecutive newlines in pre-filled prompts to prevent
newline padding attacks.
- API changes make it impossible to auto-submit pre-filled prompts from
external sources.

Release Notes:

- N/A

Closes #47917

Currently, during remote development, Zed uses the first available local
LSP adapter to handle all label computing. This isn't ideal and causes
bugs because different adapters may expect different label formats. By
leveraging the `all_capable_for_proto_request` method, we can now
retrieve the specific language server name and use it as a key to find
the correct LSP adapter for label population. Even if this lookup fails,
we can still fall back to the first adapter, so this PR should provide
more accurate label population than before.

This addresses the root cause of #47917, which stems from two main
issues. For example, in remote Python development, the `basedpyright`
adapter might incorrectly handle labels even when the remote server is
actually `ty`. The completion items returned by `ty` are slightly
different from `basedpyright`: `ty` stores labels in
`labelDetails.detail`, while basedpyright uses
`labelDetails.description`. By matching the correct adapter, we ensure
labels are populated properly for completion items.
```json
// RPC message returned by `ty`, label is in `labelDetails.detail`
{
  ...
  "labelDetails": { "detail": " (import pathlib)" },
  ...
}

// RPC message returned by `basedpyright`, label is in `labelDetails.description`
{
  ...
  "labelDetails": { "description": "pathlib" },
  ...
}
```
Additionally, adapters registered via `register_available_lsp_adapter`
are lazy-loaded into the `LanguageRegistry` (which is the case for `ty`
before). In remote scenarios, the adapter might be loaded on the remote
server but not on the local host, making it hard to find in
`lsp_adapters`. This is partially resolved in #50662, and combined with
this PR, we can fully address #47917.

There is still more to do, however. In some cases, we still can't find
the correct local LSP adapter if the local host lacks the registry that
the remote server has; this typically happens when the adapter is
registered via `register_available_lsp_adapter`. I've opened a feature
discussion #49178 to track this. If it's decided that this needs further
refinement, I'm happy to continue working on it.


Before you mark this PR as ready for review, make sure that you have:
- [ ] Added a solid test coverage and/or screenshots from doing manual
testing
- [x] Done a self-review taking into account security and performance
aspects
- [x] Aligned any UI changes with the [UI
checklist](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist)

Release Notes:

- Fixed missing labels for `ty` completion items in remote development.

Co-authored-by: Conrad Irwin <conrad.irwin@gmail.com>

Split WslRemote out of the remote_kernels bucket in the kernel picker,
giving it its own "WSL Kernels" section. Use the distro name and
kernelspec display name for WSL entries instead of the generic "WSL"
string.

In python_env_kernel_specifications, detect WSL projects via
RemoteConnectionOptions and return WslRemote instead of SshRemote. Stop
marking WSL worktrees as remote so global kernel specs load.

Fix ark kernel stdout pollution by building the wsl.exe bash command
with a quoted cd and inline env assignment, so exec replaces the shell
and doesn't echo input back.

Closes #50459 

Before you mark this PR as ready for review, make sure that you have:
- [x] Added a solid test coverage and/or screenshots from doing manual
testing
- [x] Done a self-review taking into account security and performance
aspects
- [x] Aligned any UI changes with the [UI
checklist](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist)

Release Notes:

- N/A

Previously we required AgentSessionInfo all over the place, which meant
there were lots of unnecessary fake ones created all over the place.

Made the methods and functions only take the data they need so we only
use these in history contexts now, as intended.

Release Notes:

- N/A

Making the message editor take all the available space, and improving
the loading state for external agents a bit.

Release Notes:

- N/A

- Make clicking on the project header collapse/expand the group as
opposed to activating the workspace
- Added the "threads" label close to the sidebar toggle button
- Made the open folder icon button open the file finder directly as
opposed to the recent projects popover

Release Notes:

- N/A

Adding some adjustments so the toolbar looks more like the designs we've
been working on. All that changes here are only valid for the v2 feature
flag. Haven't changed anything for today's production version.

Release Notes:

- N/A

Add an explicit `Editor && mode == auto_height` context block. This
ensures that `Shift+Enter` and `Ctrl+Enter` correctly insert a newline
at the cursor position in editors like the AI Agent Panel,
preventing them from inheriting conflicting overrides (e.g., JetBrains
mapping `Shift+Enter` to `editor::NewlineBelow`).

Closes #47269

Release Notes:

- Fixed an issue where `Shift+Enter` would insert a newline at the end
of the text instead of the cursor position in the Agent Panel when using
certain keymaps.