{"record":{"id":"abcd28c6c49e740a","repo":"zed-industries/zed","slug":"capability-for-process-exec-desired-command-des","errorCode":null,"errorMessage":"capability for process:exec {desired_command} {desired_args:?} was not listed in the extension manifest","messagePattern":"capability for process:exec (.+?) (.+?) was not listed in the extension manifest","errorType":"validation","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"crates/extension/src/extension_manifest.rs","lineNumber":177,"sourceCode":"        }\n\n        provides\n    }\n\n    pub fn allow_exec(\n        &self,\n        desired_command: &str,\n        desired_args: &[impl AsRef<str> + std::fmt::Debug],\n    ) -> Result<()> {\n        let is_allowed = self.capabilities.iter().any(|capability| match capability {\n            ExtensionCapability::ProcessExec(capability) => {\n                capability.allows(desired_command, desired_args)\n            }\n            _ => false,\n        });\n\n        if !is_allowed {\n            bail!(\n                \"capability for process:exec {desired_command} {desired_args:?} was not listed in the extension manifest\",\n            );\n        }\n\n        Ok(())\n    }\n\n    pub fn allow_remote_load(&self) -> bool {\n        self.remote_load().is_some()\n    }\n\n    pub fn remote_load(&self) -> Option<RemoteLoad<'_>> {\n        (!self.language_servers.is_empty()\n            || !self.debug_adapters.is_empty()\n            || !self.debug_locators.is_empty())\n        .then_some(RemoteLoad { manifest: self })\n    }\n}","sourceCodeStart":159,"sourceCodeEnd":195,"githubUrl":"https://github.com/zed-industries/zed/blob/f4178619acd0d47ea1f76a2025c42962c6d6638c/crates/extension/src/extension_manifest.rs#L159-L195","documentation":"Zed extensions run sandboxed and every process execution must be pre-declared: the manifest's capabilities list must contain a process:exec entry whose command and args match the requested invocation (checked via ExtensionCapability::ProcessExec::allows). When extension code asks to exec a command/args combination not covered by any [[capabilities]] entry, this bail fires, naming exactly the desired_command and desired_args that were rejected.","triggerScenarios":"Calling the extension process-exec API (e.g. zed::Command / process executor paths that route through the manifest check) with a binary or argument list that no process:exec capability in extension.toml covers: no capability at all, a different command string, or args outside the declared prefix/pattern.","commonSituations":"Authors forgetting to add the capability when first shelling out; later adding new CLI flags to a call so the args no longer match the declared entry; renaming the binary; users installing an older extension version against a newer API that checks capabilities more strictly.","solutions":["Add a matching entry to extension.toml: [[capabilities]] with process:exec for the exact command and argument pattern shown in the error message","Make the declared args cover every flag you pass at runtime (align prefixes/patterns with how you invoke the command)","After editing, rebuild/reinstall the extension so the new manifest is loaded, then retry the operation","If you are an extension user (not author), report the missing capability to the extension's repo - only the author can declare it"],"exampleFix":"# before: extension code runs\n# zed::Command::new(\"node\").args([\"server.js\", \"--port\", \"8080\"])\n# but extension.toml declares only:\n[[capabilities]]\nprocess = \"node\"\nargs = [\"server.js\"]\n\n# after: manifest declares the full invocation\n[[capabilities]]\nprocess = \"node\"\nargs = [\"server.js\", \"--port\"]","handlingStrategy":"validation","validationCode":"// Check the capability before attempting the exec\nmanifest.check_process_exec_capability(\n    desired_command,\n    &desired_args.iter().map(String::as_str).collect::<Vec<_>>(),\n)?;\n// or, when you own the manifest: keep a single source of truth for the\n// command+args you pass and the [[capabilities]] entry you declare.","typeGuard":null,"tryCatchPattern":"match zed::Command::new(cmd).args(&args).output().await {\n    Ok(out) => handle(out),\n    Err(err) if err.to_string().contains(\"capability for process:exec\") => {\n        // manifest lacks the declaration - fail with authoring guidance\n        Err(anyhow::anyhow!(\"add process:exec for {cmd} {args:?} to extension.toml capabilities\"))\n    }\n    Err(err) => Err(err),\n}","preventionTips":["Declare every command and full arg pattern in [[capabilities]] before shipping","When you add a flag to a subprocess call, update the capability entry in the same commit","Treat the error text as the spec: it prints exactly the command/args you must declare"],"tags":["zed","extension","capabilities","process-exec","security","manifest","sandbox"],"backgroundTag":"missing-capability-declaration","analyzedSha":"f4178619acd0d47ea1f76a2025c42962c6d6638c","analyzedAt":"2026-08-20T19:29:52.058Z","contentChangedAt":"2026-08-20T19:29:52.058Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}