Marshall Bowers
3bf71c690f
This PR adds the ability to control the capabilities granted to extensions by the extension host via the new `granted_extension_capabilities` setting. This setting is a list of the capabilities granted to any extension running in Zed. The currently available capabilities are: - `process:exec` - Grants extensions the ability to invoke commands using [`zed_extension_api::process::Command`](https://docs.rs/zed_extension_api/latest/zed_extension_api/process/struct.Command.html) - `download_file` - Grants extensions the ability to download files using [`zed_extension_api::download_file`](https://docs.rs/zed_extension_api/latest/zed_extension_api/fn.download_file.html) - `npm:install` - Grants extensions the ability to install npm packages using [`zed_extension_api::npm_install_package`](https://docs.rs/zed_extension_api/latest/zed_extension_api/fn.npm_install_package.html) Each of these capabilities has parameters that can be used to customize the permissions. For instance, to only allow downloads from GitHub, the `download_file` capability can specify an allowed `host`: ```json [ { "kind": "download_file", "host": "github.com", "path": ["**"] } ] ``` The same capability can also be granted multiple times with different parameters to build up an allowlist: ```json [ { "kind": "download_file", "host": "github.com", "path": ["**"] }, { "kind": "download_file", "host": "gitlab.com", "path": ["**"] } ] ``` When an extension is not granted a capability, the associated extension APIs protected by that capability will fail. For instance, trying to use `zed_extension_api::download_file` when the `download_file` capability is not granted will result in an error that will be surfaced by the extension: ``` Language server phpactor: from extension "PHP" version 0.4.3: failed to download file: capability for download_file https://github.com/phpactor/phpactor/releases/download/2025.07.25.0/phpactor.phar is not granted by the extension host ``` Release Notes: - Added a `granted_extension_capabilities` setting to control the capabilities granted to extensions.
Zed
Welcome to Zed, a high-performance, multiplayer code editor from the creators of Atom and Tree-sitter.
Installation
On macOS and Linux you can download Zed directly or install Zed via your local package manager.
Other platforms are not yet available:
- Windows (tracking issue)
- Web (tracking issue)
Developing Zed
- Building Zed for macOS
- Building Zed for Linux
- Building Zed for Windows
- Running Collaboration Locally
Contributing
See CONTRIBUTING.md for ways you can contribute to Zed.
Also... we're hiring! Check out our jobs page for open roles.
Licensing
License information for third party dependencies must be correctly provided for CI to pass.
We use cargo-about to automatically comply with open source licenses. If CI is failing, check the following:
- Is it showing a
no license specifiederror for a crate you've created? If so, addpublish = falseunder[package]in your crate's Cargo.toml. - Is the error
failed to satisfy license requirementsfor a dependency? If so, first determine what license the project has and whether this system is sufficient to comply with this license's requirements. If you're unsure, ask a lawyer. Once you've verified that this system is acceptable add the license's SPDX identifier to theacceptedarray inscript/licenses/zed-licenses.toml. - Is
cargo-aboutunable to find the license for a dependency? If so, add a clarification field at the end ofscript/licenses/zed-licenses.toml, as specified in the cargo-about book.