# Protect Git metadata in Windows sandboxes \(\#59799\) · gitcafe/zed

[View on GitCafe](https://git.cafe/gitcafe/zed/commit/3d1b26d68394a16c2432682cd89968747f8613f0)

Repository: [gitcafe/zed](https://git.cafe/gitcafe/zed)

Visibility: public

Requested revision: 3d1b26d68394a16c2432682cd89968747f8613f0

Requested commit: 3d1b26d68394a16c2432682cd89968747f8613f0

Commit: 3d1b26d68394a16c2432682cd89968747f8613f0

Tree: f194f20b5e27325f370eb10c1e673e7b185ffc7f

Author: MartinYe1234

Committer: GitHub

## Message

```
Protect Git metadata in Windows sandboxes (#59799)

Summary:

- Protect Git metadata in Windows/WSL sandboxes by passing Git policy
into the WSL Bubblewrap wrapper.
- Map protected Git paths and overlay them read-only, while allowing
approved Git metadata paths to be writable.
- Update tool descriptions and sandboxing docs for platform-specific Git
metadata behavior.

Validation:

- cargo check -p sandbox
- cargo check -p sandbox --tests --target x86_64-pc-windows-msvc
- cargo check -p agent -p acp_thread
- git --no-pager diff --check

Release Notes:

- Improved Windows agent sandboxing to protect Git metadata unless
access is approved
```

## Parents

- [776585038e56672e2bb5ee48899c79c654aeaba2](https://git.cafe/gitcafe/zed/commit/776585038e56672e2bb5ee48899c79c654aeaba2?format=markdown)

[Source at this commit](https://git.cafe/gitcafe/zed/tree/3d1b26d68394a16c2432682cd89968747f8613f0?format=markdown)