Zed sandboxes its AI agent's terminal and network access

Zed shipped v1.14.1-pre on July 29 with sandboxing for the Agent's terminal and fetch tools, per the GitHub release notes. Those are the only two tools in Zed's agent that reach outside the editor: one runs shell commands, one hits the network. PR #61711 covers the change.

That's the right pair to lock down first. An editor agent that can write files is contained by definition. It's touching your project. An agent that can run arbitrary shell commands or fetch arbitrary URLs touches your machine and the internet. That's a different risk category entirely.

The same release adds a reasoning-effort selector for Anthropic-compatible providers, from PR #61579, for models that support adaptive thinking. That's a knob, not a guardrail: it lets you trade latency for depth per request instead of eating the slowest setting every time.

Rounding out the release: undo/redo for Project Panel file operations, a Skip Hooks option on commits, and configurable fonts in the Agent Panel. None of those change the threat model. They're workflow cleanup.

The release notes don't say what the sandbox actually restricts. It's unclear whether it's a full OS-level sandbox, a permission prompt, or something in between, and whether it's on by default. That matters, because a sandbox you have to opt into isn't a sandbox for the people who never open settings.

Worth watching whether Zed makes the terminal and fetch sandbox the default in a coming release, or leaves it opt-in. Every editor shipping an agent that can run shell commands faces this same question. How they answer it will matter more than how fast the agent runs.