# Allow sandboxed Git writes from worktrees \(\#57981\) · gitcafe/zed

[View on GitCafe](https://git.cafe/gitcafe/zed/commit/eea5f57dc5a4638fc54eaa6e29b73662d64c0d94)

Repository: [gitcafe/zed](https://git.cafe/gitcafe/zed)

Visibility: public

Requested revision: eea5f57dc5a4638fc54eaa6e29b73662d64c0d94

Requested commit: eea5f57dc5a4638fc54eaa6e29b73662d64c0d94

Commit: eea5f57dc5a4638fc54eaa6e29b73662d64c0d94

Tree: 5b11681fe6f2877de2cfad992a331ac8fb841952

Author: Richard Feldman

Committer: GitHub

## Message

```
Allow sandboxed Git writes from worktrees (#57981)

Agent terminal sandboxing now protects `.git` metadata by default and
exposes an explicit `allow_git_access` approval. Without it, file
contents of the `.git` directories for opened worktrees and discovered
repositories (including a linked worktree's common `.git`) cannot be
read or written, though their metadata stays visible; when approved,
those Git directories become writable so commands like fetch/commit
work. SSH commit signing keeps working because the inherited
`SSH_AUTH_SOCK` is allowed as local Unix-socket IPC, which does not let
sandboxed commands send network packets to other machines. The Seatbelt
profile also allows PTY terminal-control ioctls so signing/passphrase
prompts can manage terminal state.

This intentionally restricts only `.git` itself (whose location we know
exactly, including the worktree case) rather than
`.gitignore`/`.gitattributes`/`.gitmodules`, since those can be nested
arbitrarily and the goal is to keep the policy expressible as a plain
deny-by-default allowlist that will port to Linux and Windows sandboxes
later.

Closes AI-334

Release Notes:

- Improved agent terminal sandboxing for Git metadata, Git worktrees,
and SSH commit signing.
```

## Parents

- [0d3badc8575aa46685b4423af2bb5fa009bda1a2](https://git.cafe/gitcafe/zed/commit/0d3badc8575aa46685b4423af2bb5fa009bda1a2?format=markdown)

[Source at this commit](https://git.cafe/gitcafe/zed/tree/eea5f57dc5a4638fc54eaa6e29b73662d64c0d94?format=markdown)