# Harden Git sandbox metadata grants \(\#59785\) · gitcafe/zed

[View on GitCafe](https://git.cafe/gitcafe/zed/commit/5d06fffd98b73cad8caa6efd08e5850345b60957)

Repository: [gitcafe/zed](https://git.cafe/gitcafe/zed)

Visibility: public

Requested revision: 5d06fffd98b73cad8caa6efd08e5850345b60957

Requested commit: 5d06fffd98b73cad8caa6efd08e5850345b60957

Commit: 5d06fffd98b73cad8caa6efd08e5850345b60957

Tree: b1f22f6865fc07ffa36b3b6d368ea05332c92f3f

Author: Richard Feldman

Committer: GitHub

## Message

```
Harden Git sandbox metadata grants (#59785)

Agent terminal commands that request Git metadata access now verify
linked-worktree and submodule metadata before moving Git paths from
protected to writable sandbox paths. This prevents a mutated `.git`
gitfile from redirecting a grant to unrelated repository metadata while
preserving standard submodule layouts.

Release Notes:

- Improved agent terminal sandboxing for Git metadata access.

---------

Co-authored-by: Martin Ye <martin@zed.dev>
```

## Parents

- [c49a29f46179525358eb74dbce67fddb2aafa1f0](https://git.cafe/gitcafe/zed/commit/c49a29f46179525358eb74dbce67fddb2aafa1f0?format=markdown)

[Source at this commit](https://git.cafe/gitcafe/zed/tree/5d06fffd98b73cad8caa6efd08e5850345b60957?format=markdown)