Zed patches a sandbox escape in extension hosting

Zed released 1.16.2 and 1.17.1-pre on August 24, closing a sandbox escape in how it hosts extensions. Extensions run inside that sandbox specifically so they can't reach files outside their workspace, and the bug undercut that guarantee for anyone still on the old minimum.

The fix raises the workspace minimum for wasmtime-wasi to 36.0.14, pulling in cap-primitives 3.4.6 in place of 3.4.4. That earlier patch version mishandled trailing slashes on symlinks, letting them bypass capability-based filesystem confinement, per Zed's PR #63144.

Those same builds also disable the ask_user tool by default. The PR doesn't say whether that's tied to the same escape path or a separate hardening move.

Wasmtime is a general-purpose WASM runtime, and cap-primitives is the crate that enforces its filesystem capability model. Zed's PR covers what Zed shipped, but any project embedding Wasmtime inherited the same bug if it depended on an affected cap-primitives version. That reaches well beyond editor extensions, since Wasmtime sandboxes untrusted code broadly.

How long 3.4.4 sat in the ecosystem before this got caught isn't in the PR. Neither is how many other Wasmtime embedders still depend on it. A minimum-version bump in a manifest doesn't guarantee a lockfile actually resolved to 3.4.6, so anyone using Wasmtime to sandbox agent-run code is better off confirming the resolved version directly.