Cherry-pick of #45669 to preview

----
Closes https://github.com/zed-industries/zed/issues/42845

Repro steps:

https://github.com/zed-industries/zed/issues/42845#issuecomment-3687413958
Initial investigation and Zed memory trace:

https://github.com/zed-industries/zed/issues/42845#issuecomment-3687877977

The PR consists of 2 commits:
*

[first](https://github.com/zed-industries/zed/pull/45669/changes/732d308c8d7e9af3649ac71ea65a9c029af820fc)
adds cosmetic fixes to remove backtraces from logs yet again and print
paths in quotes, as file descriptors may return empty paths.
It also stubs the cause if OOM in project panel: that one traversed all
worktrees in `for worktree_snapshot in visible_worktrees` and "accepted"
the one with empty paths + never called `entry_iter.advance();` in "no
file name found for the worktree" case, thus looping endlessly and
bloating the memory quite fast.

*

[second](https://github.com/zed-industries/zed/pull/45669/changes/7ebfe5da2fc6d32f3fa2d71c761f8b2ec26d945b)
adds something that resembles a fix: `fn current_path` on macOS used the
file handler to re-fetch the worktree root file path on worktree root
canonicalization failure.
What's odd, is that `libc::fcntl` returns `0` in the case when external
volume is not mounted, thus resulting in the `""` path string that is
propagated all the way up.

*

[third](https://github.com/zed-industries/zed/pull/45669/changes/1a7560cef3e9fac604124c19f46b1f9c7b91815f)
moves the fix down to the platform-related FS implementations

The "fix" now checks the only usage of this method inside `async fn
process_events` for an empty path and bails if that is the case.
I am not sure what is a better fix, but this stops any memory leaks and
given how bad the situation now, seems ok to merge for now with the
`TODO` comment for more clever people to fix properly later.

----------------

Now, when I disconnect the SMB share and reconnect it again, Zed stops
displaying any files in the project tree but the ones opened as editors.

As before, at first, when the share is unmounted, Zed fails to save any
changes because of the timeouts.

Later, when the share is re-connected, macOS Finder hangs still but Zed
starts to react on saves yet still only shows the files that are open as
editors.
The files can be edited and saved from now on.

Later, when Finder finally stops hanging and indicates that the share is
mounted fully, the rest of the file structure reappear in the project
panel, and all file saves are propagated, hence can be observed in the
share in Finder.

It feels that one good improvement to add on top is some "disconnected"
indicator that clearly shows that the file is not properly handles in
the OS.
This requires much more changes and thinking as nothing like that exists
in Zed yet, hence not done.

Release Notes:

- Fixed Zed OOM-ing when macOS file descriptors become invalid

Co-authored-by: Kirill Bulatov <kirill@zed.dev>

Cherry-pick of #45593 to preview

----
Release Notes:

- N/A

Co-authored-by: Teoh Han Hui <teohhanhui@gmail.com>

Cherry-pick of #45587 to preview

----
It's still possible to leak secrets by spawning odd MCP/LSP servers from
`.zed/settings.json`

Release Notes:

- N/A

Co-authored-by: Kirill Bulatov <kirill@zed.dev>

Cherry-pick of #45584 to preview

----
Release Notes:

- (Preview only) Fix devcontainers not starting when certain env
variables were set

Co-authored-by: KyleBarton <kjb@initialcapacity.io>

Co-authored-by: Kirill Bulatov <kirill@zed.dev>
Co-authored-by: KyleBarton <kjb@initialcapacity.io>

Cherry-pick of #45500 to preview

----
* Abs path trust should transitively trust all single file worktrees on
the same host
* Init worktree trust on the client side even when devcontainers are
run: remote host unconditionally checks trust, hence the client has to
keep track of it and respond with approves/declines.
Do trust all devcontainers' remote worktrees, as containers are isolated
and "safe".

Release Notes:

- N/A

Co-authored-by: Kirill Bulatov <kirill@zed.dev>

Cherry-pick of #45231 to preview

----
## Summary
Fix panic "cannot update workspace::pane::Pane while it is already being
updated" when dragging terminal tabs to split the pane.

## Problem
When dragging a terminal tab to create a split, the app panics due to
re-entrancy: the drop handler calls `terminal_panel.center.split()`
synchronously, which invokes `mark_positions()` that tries to update all
panes in the group. When the pane being updated is part of the terminal
panel's center group, this causes a re-entrancy panic.

## Solution
Defer the split operation using `cx.spawn_in()`, similar to how
`move_item` was already deferred in the same handler. This ensures the
split (and subsequent `mark_positions()` call) runs after the current
pane update completes.

## Test plan
- Open terminal panel
- Create a terminal tab
- Drag the terminal tab to split the pane
- Verify no panic occurs and split works correctly

Co-authored-by: Ahmed M. Ammar <ahmed3mar@outlook.com>

Cherry-pick of #45328 to preview

----
Closes #45253

Release Notes:

- Fixed terminal doesn't switch to project directory when opening remote
project on Windows

Co-authored-by: feeiyu <158308373+feeiyu@users.noreply.github.com>

Cherry-pick of #45367 to preview

----
This fixes a number of issues where zed depends on the order of polling
which changed when switching scheduler. We have adjusted the algorithm
so it matches the previous order while keeping the prioritization
feature.

Release Notes:
- N/A

Co-authored-by: Yara 🏳️‍⚧️ <git@yara.blue>

Before this fix checkboxes would overflow off the visible view which
isn't ideal. This aligns the checkboxes by allowing the path name to
overflow.

#### Before
<img width="135" height="159" alt="image"
src="https://github.com/user-attachments/assets/1a9e4c64-0d7b-4a8d-870a-bb198cc7377a"
/>

#### After
<img width="148" height="165" alt="image"
src="https://github.com/user-attachments/assets/c7cf7a7c-c765-4e2b-8968-b3affcaa8649"
/>

Release Notes:

- N/A

Co-authored-by: Cole Miller <cole@zed.dev>
Co-authored-by: Matt Miller <mattrx@gmail.com>

Follow up to #42982

Release Notes:

- agent: Allow pasting code without formatting via ctrl/cmd-shift-v.
- agent: Fixed an issue where pasting a single line of code would always
insert an @mention

Cherry-pick of #45236 to preview

----
They count the requested max_output_tokens against the prompt total.
Seems like a bug on their end as most other providers don't do this, but
now we just default to None for the main models and let the API use its
default behavior which works just fine.

Closes: #45134

Release Notes:

- deepseek: Fix issue with Deepseek API that was causing the token limit
to be reached sooner than necessary

Co-authored-by: Ben Brandt <benjamin.j.brandt@gmail.com>

Cherry-pick of #45227 to preview

----
Closes https://github.com/zed-industries/zed/issues/45083

cc @agu-z 

Release Notes:

- Fixed certain rust-analyzer snippets not shown

Co-authored-by: Kirill Bulatov <kirill@zed.dev>

Cherry-pick of #45218 to preview

----
It seems we unintentionally changed the default behavior of if we use
the gemini on the path in #40663

Changing this back so by default we use a managed version of the CLI so
we can better control min versions and the like, but still allow people
to override if they need to.

Release Notes:

- N/A

Co-authored-by: Ben Brandt <benjamin.j.brandt@gmail.com>

Cherry-pick of #45210 to preview

----
Based on
https://github.com/zed-industries/zed/pull/45187#discussion_r2630140112

Release Notes:

- N/A

Co-authored-by: Lukas Wirth <lukas@zed.dev>

Co-authored-by: Kirill Bulatov <kirill@zed.dev>
Co-authored-by: Lukas Wirth <lukas@zed.dev>

Cherry-pick of #45187 to preview

----
Also do not eagerly invalidate this data on buffer reparse start

Closes https://github.com/zed-industries/zed/issues/45182

Release Notes:

- Fixed bracket colorization not applied on initial file open

Co-authored-by: Kirill Bulatov <kirill@zed.dev>

Cherry-pick of #45183 to preview

----
Was removed in

https://github.com/zed-industries/zed/pull/44887/changes#diff-1de872be76a27a9d574a0b0acec4581797446e60743d23b3e7a5f15088fa7e61

Release Notes:

- (Preview only) Fixed certain modals not being dismissed on mouse click
outside

Co-authored-by: Kirill Bulatov <kirill@zed.dev>

I think we're not triggering the after-release workflow because of
github's loop detection when you use the default GITHUB_TOKEN

Closes #ISSUE

Release Notes:

- N/A

This updates our CI workflow to try to run the autofix.yml workflow
if any of prettier, cargo fmt, or cargo clippy fail.

Release Notes:

- N/A

Split running `cargo clippy` out of the job that has access to ZIPPY
secrets as
a precaution against accidentally leaking the secrets through build.rs
or
something...

Release Notes:

- N/A

Cherry-pick of #45138 to preview

----
Follow-up of https://github.com/zed-industries/zed/pull/44887

- Inherit git worktree trust
- Tidy up the security modal


Release Notes:

- N/A

---------

Co-authored-by: Kirill Bulatov <mail4score@gmail.com>

Co-authored-by: Conrad Irwin <conrad.irwin@gmail.com>
Co-authored-by: Kirill Bulatov <mail4score@gmail.com>

Cherry-pick of #45129 to preview

----
Follow-up of https://github.com/zed-industries/zed/pull/44887

Trims the worktree trust mechanism to the actual `worktree`s, so now
"global", workspace-level things like `prettier`, `NodeRuntime`,
`copilot` and global MCP servers are considered as "trusted" a priori.

In the future, a separate mechanism for those will be considered and
added.

Release Notes:

- N/A

Co-authored-by: Kirill Bulatov <kirill@zed.dev>

Cherry-pick of #45036 to preview

----
Follow-up of https://github.com/zed-industries/zed/pull/44887

This fixes remote server builds.

Additionally:

* slightly rewords workspace trust text in the security modal
* eagerly ask for worktree trust on open

Release Notes:

- N/A

Co-authored-by: Kirill Bulatov <kirill@zed.dev>

Cherry-pick of #45079 to preview

----
On windows this will render two backslashes otherwise

Release Notes:

- N/A *or* Added/Fixed/Improved ...

Co-authored-by: Lukas Wirth <lukas@zed.dev>

Cherry-pick of #44887 to preview

----
Closes https://github.com/zed-industries/zed/issues/12589 

Forces Zed to require user permissions before running any basic
potentially dangerous actions: parsing and synchronizing
`.zed/settings.json`, downloading and spawning any language and MCP
servers (includes `prettier` and `copilot` instances) and all
`NodeRuntime` interactions.
There are more we can add later, among the ideas: DAP downloads on
debugger start, Python virtual environment, etc.

By default, Zed starts in restricted mode and shows a `! Restricted
Mode` in the title bar, no aforementioned actions are executed.
Clicking it or calling `workspace::ToggleWorktreeSecurity` command will
bring a modal to trust worktrees or dismiss the modal:

<img width="1341" height="475" alt="1"

src="https://github.com/user-attachments/assets/4fabe63a-6494-42c7-b0ea-606abb1c0c20"
/>

Agent Panel shows a message too:

<img width="644" height="106" alt="2"

src="https://github.com/user-attachments/assets/0a4554bc-1f1e-455b-b97d-244d7d6a3259"
/>

This works on local, SSH and WSL remote projects, trusted worktrees are
persisted between Zed restarts.
There's a way to clear all persisted trust with
`workspace::ClearTrustedWorktrees`, this will restart Zed.

This mechanism can be turned off with settings:
```jsonc
"session": {
  "trust_all_worktrees": true
}
```
in this mode, all worktrees will be trusted by default, allowing all
actions, but no auto trust will be persisted: hence, when the setting is
changed back, auto trusted worktrees will require another trust
confirmation.

This settings switch was added to the onboarding view also.

Release Notes:

- Introduced worktree trust mechanism, can be turned off with
`"session": { "trust_all_worktrees": true }`

---------

Co-authored-by: Matt Miller <mattrx@gmail.com>
Co-authored-by: Danilo Leal <daniloleal09@gmail.com>
Co-authored-by: John D. Swanson <swanson.john.d@gmail.com>

Co-authored-by: Kirill Bulatov <kirill@zed.dev>
Co-authored-by: Matt Miller <mattrx@gmail.com>
Co-authored-by: Danilo Leal <daniloleal09@gmail.com>
Co-authored-by: John D. Swanson <swanson.john.d@gmail.com>

Cherry-pick of #45139 to preview

----
Add support for the new Gemini 3 Flash model

Release Notes:

- Added support for Gemini 3 Flash model

Co-authored-by: Richard Feldman <richard@zed.dev>

Cherry-pick of #45050 to preview

----
Also quiet some noisy logs

Release Notes:

- N/A

Co-authored-by: Mikayla Maki <mikayla@zed.dev>

Cherry-pick of #45101 to preview

----
Reverts https://github.com/zed-industries/zed/pull/44933.

It turns out that if you're copying agent responses to paste it anywhere
else that isn't the message editor (e.g., for a follow up prompt),
getting Markdown formatting is helpful. However, with the revert, the
underlying issue in https://github.com/zed-industries/zed/issues/42958
remains, so I'll reopen that issue, unfortunately.

Release Notes:

- N/A

Co-authored-by: Danilo Leal <67129314+danilo-leal@users.noreply.github.com>

Cherry-pick of #45080 to preview

----
0.0.2 is not a pre-release artifact unlike the previous one, so our
version fetch ignored it.

Fixes https://github.com/zed-industries/zed/issues/45061

Release Notes:

- N/A *or* Added/Fixed/Improved ...

Co-authored-by: Lukas Wirth <lukas@zed.dev>

This reverts commit 2441dc3f6637431a781ae10b2e1aa8c4704b9502.

Release Notes:

- N/A

This reverts commit 914b0117fb5a23469af85e567d5723eca6b53635 (#44995).

The optimization introduced a regression that causes the main thread to
hang for **100+ seconds** in certain scenarios, requiring a force quit
to recover.

## Analysis from spindump

When a large `AutoHeight` editor is displayed inside a `List` (e.g.,
Agent Panel thread view), the clipping calculation can produce invalid
row ranges:

1. `visible_bounds` from `window.content_mask().bounds` represents the
window's content mask, not the intersection with the editor
2. When the editor is partially scrolled out of view,
`clipped_top_in_lines` becomes extremely large
3. This causes `start_row` to be computed as an astronomically high
value
4. `blocks_in_range(start_row..end_row)` then spends excessive time in
`Cursor::search_forward` iterating through the block tree

The spindump showed **~46% of samples** (459/1001 over 10+ seconds)
stuck in `BlockSnapshot::blocks_in_range()`, specifically in cursor
iteration.

### Heaviest stack trace
```
EditorElement::prepaint
  └─ blocks_in_range + 236
       └─ Cursor::search_forward (459 samples)
```

## Symptoms

- Main thread unresponsive for 33-113 seconds before sampling even began
- UI completely frozen
- High CPU usage on main thread (10+ seconds of CPU time in the sample)
- Force quit required to recover

## Path forward

The original optimization goal (reducing line layout work for clipped
editors) is valid, but the implementation needs to:
1. Correctly calculate the **intersection** of editor bounds with the
visible viewport
2. Ensure row calculations stay within valid ranges (clamped to
`max_row`)
3. Handle edge cases where the editor is completely outside the visible
bounds

Release Notes:

- Fixed a hang that could occur when viewing large diffs in the Agent
Panel

Until now, Helix-mode users would have to rely on Vim's `d *` behaviour
which cannot be reliably replicated with Helix's default delete
behaviour and so I believe that remapping this functionality to Helix's
goto mode is a better fit.

Release Notes:

- Added custom mappings for Zed specific diff and git-related actions to
Helix's goto mode:
  * `g o` - toggle selected diff hunks
  * `g O` - toggle staged
  * `g R` - restore change
  * `g u` - stage and goto next diff hunk
  * `g U` - unstage and goto next diff hunk

This re-introduces the `save_file` and `restore_file_from_disk` agent
tools that were reverted in #44949.

I pushed that original PR without trying it just to get the build off my
machine, but I had missed a step: the tools weren't added to the default
profile settings in `default.json`, so they were never enabled even
though the code was present.

## Changes

- Add `save_file` and `restore_file_from_disk` to the "write" profile in
`default.json`
- Add `Thread::has_tool()` method to check tool availability at runtime
- Make `edit_file_tool`'s dirty buffer error message conditional on
whether `save_file`/`restore_file_from_disk` tools are available (so the
agent gets appropriate guidance based on what tools it actually has)
- Update test to match new conditional error message behavior

Release Notes:

- Added `save_file` and `restore_file_from_disk` agent tools to handle
dirty buffers when editing files

Release Notes:

- N/A

Fixes #44997

## Summary

Optimizes editor rendering when an editor is partially clipped by a
parent container (e.g., a `List`). The editor now only lays out and
renders lines that are actually visible within the viewport, rather than
all lines in the document.

## Problem

When an `AutoHeight` editor with thousands of lines is placed inside a
scrollable `List` (such as in the Agent Panel thread view), the editor
would lay out **all** lines during prepaint, even though only a small
portion was visible. Profiling showed that ~50% of frame time was spent
in `EditorElement::prepaint` → `LineWithInvisibles::from_chunks`,
processing thousands of invisible lines.

## Solution

Calculate the intersection of the editor's bounds with the current
content mask (which represents the visible viewport after all parent
clipping). Use this to determine:
1. `clipped_top_in_lines` - how many lines are clipped above the
viewport
2. `visible_height_in_lines` - how many lines are actually visible

Then adjust `start_row` and `end_row` to only include visible lines. The
parent container handles positioning, so `scroll_position` remains
unchanged for paint calculations.

## Example

For a 3000-line editor where only 50 lines are visible:
- **Before**: Lay out and render 3000 lines
- **After**: Lay out and render ~50 lines

## Testing

Verified the following scenarios work correctly:
- Editor fully visible (no clipping)
- Editor clipped from top
- Editor clipped from bottom
- Editor completely outside viewport (renders nothing)
- Fractional line clipping at boundaries
- Scrollable editors with internal scroll state inside a clipped
container

Release Notes:

- Improved agent panel performance when rendering large diffs.

Release Notes:

- Added project settings schema to the schema_generator CLI. This allows
for exporting the project settings schema as JSON for use in other
tools.

Closes #41994

This PR introduces Element-bounded drag tolerance for Ctrl/Cmd+click in
terminal.

Previously, Ctrl/Cmd+click on terminal links required pixel-perfect
accuracy. Any mouse movement during the click would cancel the
navigation, making it frustrating to click on links, especially on
high-DPI displays or with sensitive mice.

Users can now click anywhere within a clickable element (file path, URL,
hyperlink), drag the cursor anywhere within that same element's
boundaries and release to trigger navigation

Implementation:

- Stores detected element metadata (`text` and `grid_range`) on
Ctrl/Cmd+mouse-down
- Tracks cursor position during drag, preserving click state while
within element bounds
  - Verifies element match on mouse-up before triggering navigation
  - Uses existing `find_from_grid_point()` for element detection

Before:


[before.webm](https://github.com/user-attachments/assets/ee80de66-998e-4d8e-94d0-f5e65eb06d22)

After:


[after.webm](https://github.com/user-attachments/assets/7c9ddd9e-cfc1-4c79-b62c-78e9d909e6f4)

Release Notes:

- terminal: Fixed an issue where `ctrl|cmd+click` on links was very
sensitive to mouse movement. Clicking links now tolerates mouse movement
within the same clickable element, making link navigation more reliable

---------

Co-authored-by: Ben Kunkle <ben@zed.dev>

Release Notes:

- Fixed double slash in commit URLs

The github_url variable was generating URLs with an extra slash like
"https://github.com//user/repo/commit/xxxx" due to manual string
formatting
of the base_url() result.

Fixed by replacing manual URL construction with the proper
build_commit_permalink() method that uses Url::join() for correct
path handling, consistent with how other Git hosting providers
construct URLs.

Signed-off-by: Xiaobo Liu <cppcoffee@gmail.com>

Closes #40678

The python file below simulates the macros at various timings and can be
run by running:
1. `sudo python3 -m pip install evdev --break-system-packages`
2. `sudo python3 zed_shift_brace_replayer.py`

Checked timings for hold=0.1, =0.01 and =0.001 with the latter two no
longer causing incorrect inputs.



[zed_shift_brace_replayer.py](https://github.com/user-attachments/files/23560570/zed_shift_brace_replayer.py)

Release Notes:

- linux: fixed a race condition where the macros containing modifier +
key would sometimes be processed without the modifier

Related to: 
- #44510 
- #44407 

Previously we were searching for hyperlinks on every scroll, even if Cmd
was not held. With this PR,
- We only search for hyperlinks on scroll if Cmd is held
- We now clear `last_hovered_word` in all cases where Cmd is not held
- Renamed `word_from_position` -> `schedule_find_hyperlink`
- Simplified logic in `schedule_find_hyperlink`

Performance measurements

The test scrolls up and down 20,000x in a loop. However, since this PR
is just removing a code path that was very dependent on the length of
the line in terminal, it's not super meaningful as a comparison. The
test uses a line length of "long line ".repeat(1000), and in main the
performance is directly proportional to the line length, so for
benchmarking it in main it only scrolls up and down 20x. I think all
that is really useful to say is that currently scrolling is slow, and
proportional to the line length, and with this PR it is buttery-smooth
and unaffected by line length. I've included a few data points below
anyway. At least the test can help catch future regressions.
 
| Branch | Command | Scrolls | Iter/sec | Mean [ms] | SD [ms] |
Iterations | Importance (weight) |
|:---|:---|---:|---:|---:|---:|---:|---:|
| main | tests::perf::scroll_long_line_benchmark | 40 | 16.85 | 712.00 |
2.80 | 12 | average (50) |
| this PR | tests::perf::scroll_long_line_benchmark | 40 | 116.22 |
413.60 | 0.50 | 48 | average (50) |
| this PR | tests::perf::scroll_long_line_benchmark | 40,000 | 9.19 |
1306.40 | 7.00 | 12 | average (50) |
| only overhead | tests::perf::scroll_long_line_benchmark | 0 | 114.29 |
420.90 | 2.00 | 48 | average (50) |


Release Notes:

- terminal: Improved scroll performance

This reverts the windows part of commit
636d11ebec8e74f0f0c173e858597fb57ccfa0b9.


Release Notes:

- N/A

Closes #44825

Release Notes:

- Fixed a case where an incorrect match could be generated in
label_for_completion

---------

Co-authored-by: Kirill Bulatov <mail4score@gmail.com>

Although the copilot bot integration is referred to by
`copilot-swe-agent[bot]`
(https://api.github.com/users/copilot-swe-agent[bot]), GitHub parses the
copilot identity as @\copilot in some cases, e.g.
https://github.com/zed-industries/zed/pull/44915#issuecomment-3657567754.
This causes the CLA check to still fail despite Copilot being added to
the CLA endpoint (and https://api.github.com/users/copilot returning a
404 for that very name..).

This PR fixes this by also considering the name alias of Copilot for the
`contributor` endpoint.

Release Notes:

- N/A

This PR introduces a few components for the model selector pickers.
Given we're still maintaining two flavors of it due to one of them being
wired through ACP and the other through the language model registry,
having one source of truth for the UI should help with maintenance
moving forward, considering that despite the internal differences, they
look and behave the same from the standpoint of the UI.

Release Notes:

- N/A

Now that we can use `Tooltip::element`, we don't need a separate
file/component just for this.

Release Notes:

- N/A

Improves upon https://github.com/zed-industries/zed/pull/42674

Before:

<img width="520" height="202" alt="image"
src="https://github.com/user-attachments/assets/efb1650b-4c0e-4424-8d9b-90de80c72df2"
/> <img width="157" height="211" alt="image"
src="https://github.com/user-attachments/assets/cf4605f3-88e5-4724-ad2b-1219ed04a945"
/>

After:

<img width="529" height="208" alt="image"
src="https://github.com/user-attachments/assets/382fd523-a3d9-4700-a8df-c339419fc6dc"
/>
<img width="133" height="208" alt="image"
src="https://github.com/user-attachments/assets/f22b72d9-d416-47f9-92af-ea1de6fb5583"
/>



Release Notes:

- Fixed an issue where Markdown tables would sometimes show double
borders.

## Summary

This fixes a minor bug I found #44981 

- Fix percent-encoded filenames appearing in agent mentions after
message submission.
- Decode file:// paths in MentionUri::parse using the existing
urlencoding crate (already used elsewhere in the codebase).
- Add tests for non-ASCII file URIs.

## Screenshots

<img width="409" height="116" alt="image"
src="https://github.com/user-attachments/assets/32ef033b-6232-47c5-80c7-d5247d5dae88"
/>