Zed Agent Tool Permissions: Auto-Approve Terminal Commands with tool_permissions

{
  "agent": {
    "tool_permissions": {
      "default": "allow",
      "tools": {
        "terminal": {
          "default": "confirm",
          "always_allow": [
            { "pattern": "^cargo\\s+(build|test|check)" },
            { "pattern": "^npm\\s+(install|test|run)" }
          ],
          "always_confirm": [{ "pattern": "sudo\\s+/" }]
        }
      }
    }
  }
}

This auto-approves cargo and npm commands, asks for sudo, and allows other tools by default. You can also edit it in the Settings Editor at zed://settings/agent.tool_permissions.

• default: fallback when nothing matches. confirm (the default), allow or deny.
• always_allow: patterns that auto-approve unless a deny or confirm rule also matches.
• always_deny: patterns that block. These cannot be overridden by other rules.
• always_confirm: patterns that always prompt, even when default is allow.
• Each pattern is a Rust regex. Matching is case insensitive unless you set "case_sensitive": true.

• terminal: the shell command string.
• edit_file, write_file, delete_path, create_directory: the path.
• move_path, copy_path: source and destination paths.
• fetch: the URL. search_web: the query.
• skill: the absolute path to the skill's SKILL.md.
• MCP tools: mcp:<server>:<tool_name>, for example mcp:github:create_issue.

• Built-in security rules (cannot be overridden)
• always_deny
• always_confirm
• always_allow
• Tool specific default
• Global default

The built-in rules apply to terminal and block recursive forced deletes of the filesystem root, your home folder (including $HOME), the current folder and the parent folder, with any flag combination.

• Allow once or Deny once: a one time choice.
• Always for [tool]: sets that tool's default. MCP tools only offer this option.
• Always for [input]: adds an always_allow or always_deny rule when a safe pattern can be found.

Before v0.224.0, tool approval used the agent.always_allow_tool_actions boolean, which defaults to false.