{"record":{"id":"2848f6d58926f5d3","repo":"zed-industries/zed","slug":"cannot-authorize-network-access-to-host-erro","errorCode":null,"errorMessage":"cannot authorize network access to {host:?}: {error}","messagePattern":"cannot authorize network access to (.+?): (.+?)","errorType":"exception","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"crates/agent/src/tools/fetch_tool.rs","lineNumber":210,"sourceCode":"}\n\n/// Extracts the host from a fetch URL as a [`http_proxy::HostPattern`] so it can\n/// be matched against the shared network grants. Mirrors the scheme handling in\n/// [`normalize_url`] (defaulting to `https://` when none is given).\nfn host_pattern_for_url(url: &str) -> Result<http_proxy::HostPattern> {\n    let normalized = normalize_url(url);\n    let parsed =\n        url::Url::parse(&normalized).with_context(|| format!(\"could not parse URL {url:?}\"))?;\n    let host = parsed\n        .host_str()\n        .with_context(|| format!(\"URL {url:?} has no host to authorize network access for\"))?;\n    http_proxy::HostPattern::parse(host).map_err(|error| match error {\n        http_proxy::HostPatternError::IpLiteral(_) => anyhow::anyhow!(\n            \"cannot fetch {host:?}: loopback and IP-literal hosts can't be granted network \\\n             access individually. They are only reachable once unsandboxed access has been \\\n             granted (for example, via a terminal command that requests it).\"\n        ),\n        error => anyhow::anyhow!(\"cannot authorize network access to {host:?}: {error}\"),\n    })\n}\n\nimpl AgentTool for FetchTool {\n    type Input = FetchToolInput;\n    type Output = String;\n\n    const NAME: &'static str = \"fetch\";\n\n    fn kind() -> acp::ToolKind {\n        acp::ToolKind::Fetch\n    }\n\n    fn allow_in_restricted_mode() -> bool {\n        false\n    }\n\n    fn initial_title(","sourceCodeStart":192,"sourceCodeEnd":228,"githubUrl":"https://github.com/zed-industries/zed/blob/bc538def4545534201bbfcac4e95ac34ea6501b6/crates/agent/src/tools/fetch_tool.rs#L192-L228","documentation":"The URL's host could not be parsed into a grantable HostPattern for a reason other than being an IP literal: the pattern parser rejected the host string itself (invalid characters, malformed labels). Because network access cannot be authorized, the fetch fails before connecting; the message includes the parser's error.","triggerScenarios":"URLs whose host contains characters invalid for host patterns — glob metacharacters like '*', '?', '[', ']' — or empty/malformed hosts surviving URL normalization.","commonSituations":"Model-generated URLs with glob-like or regex-like hosts; hostnames with underscores (invalid in DNS but present in some internal systems); copy-paste artifacts introducing stray characters.","solutions":["Correct the host: remove glob metacharacters and stray characters from the hostname.","Pre-validate the URL with `url::Url::parse` before handing it to the fetch tool.","If an underscore host is genuinely required, expose the service under a valid DNS name instead."],"exampleFix":"# before\nfetch http://api_.example.com/x     # '_' rejected by HostPattern::parse\nfetch http://*.example.com/x       # glob metacharacter in host\n\n# after\nfetch http://api.example.com/x","handlingStrategy":"validation","validationCode":"let host = url::Url::parse(&normalize_url(url))?\n    .host_str()\n    .ok_or_else(|| anyhow::anyhow!(\"URL {url:?} has no host\"))?\n    .to_string();\n// Fail early with the parser's own error instead of mid-fetch.\nhttp_proxy::HostPattern::parse(&host)?;","typeGuard":"fn is_grantable_host(host: &str) -> bool {\n    !host.is_empty()\n        && !host.chars().any(|c| matches!(c, '*' | '?' | '[' | ']'))\n        && http_proxy::HostPattern::parse(host).is_ok()\n}","tryCatchPattern":null,"preventionTips":["Strip glob metacharacters ('*', '?', '[', ']') from hostnames before fetching.","Pre-validate every URL with url::Url::parse before handing it to the fetch tool.","Re-map underscore-containing hosts to valid DNS names."],"tags":["fetch","network","url","validation"],"backgroundTag":null,"analyzedSha":"bc538def4545534201bbfcac4e95ac34ea6501b6","analyzedAt":"2026-08-16T07:30:46.435Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}