# agent: Model sandbox network escalation as a host allowlist \(\#59219\) · gitcafe/zed

[View on GitCafe](https://git.cafe/gitcafe/zed/commit/8117571de35c24521d54e13eeb004541fabff46b)

Repository: [gitcafe/zed](https://git.cafe/gitcafe/zed)

Visibility: public

Requested revision: 8117571de35c24521d54e13eeb004541fabff46b

Requested commit: 8117571de35c24521d54e13eeb004541fabff46b

Commit: 8117571de35c24521d54e13eeb004541fabff46b

Tree: 6d9ed14e7a1168cd99303a9c86b58f4a36627aa9

Author: Richard Feldman

Committer: GitHub

## Message

```
agent: Model sandbox network escalation as a host allowlist (#59219)

Third of a four-PR stack adding hostname-allowlisted network access to
agent terminal sandboxing. Stacked on #59218 — review/merge #59217 and
#59218 first.

Replaces the boolean `allow_network` terminal-sandbox escalation with a
hostname allowlist. The `terminal` tool now takes `allow_hosts` (exact
hostnames or leading-`*.` subdomain wildcards, validated up front) and
`allow_all_hosts` as a broad escape hatch. Approval prompts name the
requested hosts, thread grants and persistent "allow always" settings
cover requests via host-pattern subsumption the same way write paths use
subtree containment, and the authorization card in the agent panel lists
the requested hosts.

Host allowlists aren't enforced yet in this PR: `SandboxWrap` carries
the allowlist, but any network request still maps to unrestricted egress
at the Seatbelt layer, matching previous behavior. Enforcement via the
in-process proxy lands in the final PR of the stack. All of this is
behind the existing sandboxing feature flag. For non-local projects
(where the loopback proxy won't apply), host requests are widened to
"arbitrary network access" before prompting so approvals match
enforcement. Old persisted `network: bool` authorization details still
deserialize via a serde alias.

Release Notes:

- N/A

---------

Co-authored-by: MartinYe1234 <52641447+MartinYe1234@users.noreply.github.com>
Co-authored-by: Martin Ye <martin@zed.dev>
```

## Parents

- [c896cc99a9d0f173fef502ce6345e224c27ecb12](https://git.cafe/gitcafe/zed/commit/c896cc99a9d0f173fef502ce6345e224c27ecb12?format=markdown)

[Source at this commit](https://git.cafe/gitcafe/zed/tree/8117571de35c24521d54e13eeb004541fabff46b?format=markdown)