zed-industries/zed · error · anyhow::Error

capability for process:exec {desired_command} {desired_args:

Error message

capability for process:exec {desired_command} {desired_args:?} was not listed in the extension manifest

What it means

Zed extensions run sandboxed and every process execution must be pre-declared: the manifest's capabilities list must contain a process:exec entry whose command and args match the requested invocation (checked via ExtensionCapability::ProcessExec::allows). When extension code asks to exec a command/args combination not covered by any [[capabilities]] entry, this bail fires, naming exactly the desired_command and desired_args that were rejected.

Source

Thrown at crates/extension/src/extension_manifest.rs:177

        }

        provides
    }

    pub fn allow_exec(
        &self,
        desired_command: &str,
        desired_args: &[impl AsRef<str> + std::fmt::Debug],
    ) -> Result<()> {
        let is_allowed = self.capabilities.iter().any(|capability| match capability {
            ExtensionCapability::ProcessExec(capability) => {
                capability.allows(desired_command, desired_args)
            }
            _ => false,
        });

        if !is_allowed {
            bail!(
                "capability for process:exec {desired_command} {desired_args:?} was not listed in the extension manifest",
            );
        }

        Ok(())
    }

    pub fn allow_remote_load(&self) -> bool {
        self.remote_load().is_some()
    }

    pub fn remote_load(&self) -> Option<RemoteLoad<'_>> {
        (!self.language_servers.is_empty()
            || !self.debug_adapters.is_empty()
            || !self.debug_locators.is_empty())
        .then_some(RemoteLoad { manifest: self })
    }
}

View on GitHub (pinned to f4178619ac)

Solutions

1. Add a matching entry to extension.toml: [[capabilities]] with process:exec for the exact command and argument pattern shown in the error message
2. Make the declared args cover every flag you pass at runtime (align prefixes/patterns with how you invoke the command)
3. After editing, rebuild/reinstall the extension so the new manifest is loaded, then retry the operation
4. If you are an extension user (not author), report the missing capability to the extension's repo - only the author can declare it

Example fix

# before: extension code runs
# zed::Command::new("node").args(["server.js", "--port", "8080"])
# but extension.toml declares only:
[[capabilities]]
process = "node"
args = ["server.js"]

# after: manifest declares the full invocation
[[capabilities]]
process = "node"
args = ["server.js", "--port"]

// Check the capability before attempting the exec
manifest.check_process_exec_capability(
    desired_command,
    &desired_args.iter().map(String::as_str).collect::<Vec<_>>(),
)?;
// or, when you own the manifest: keep a single source of truth for the
// command+args you pass and the [[capabilities]] entry you declare.

match zed::Command::new(cmd).args(&args).output().await {
    Ok(out) => handle(out),
    Err(err) if err.to_string().contains("capability for process:exec") => {
        // manifest lacks the declaration - fail with authoring guidance
        Err(anyhow::anyhow!("add process:exec for {cmd} {args:?} to extension.toml capabilities"))
    }
    Err(err) => Err(err),
}

When it happens

Trigger: Calling the extension process-exec API (e.g. zed::Command / process executor paths that route through the manifest check) with a binary or argument list that no process:exec capability in extension.toml covers: no capability at all, a different command string, or args outside the declared prefix/pattern.

Common situations: Authors forgetting to add the capability when first shelling out; later adding new CLI flags to a call so the args no longer match the declared entry; renaming the binary; users installing an older extension version against a newer API that checks capabilities more strictly.

Related errors

• capability for process:exec {desired_command} {desired_args:
• capability for download_file {desired_url} is not granted by
• capability for npm:install {package_name} is not granted by
• grammar name '{grammar_name}' must be written in snake_case:
• extension dir {} is not an absolute path

AI-assisted analysis of zed-industries/zed@f4178619ac (2026-08-20). Data as JSON: /api/errors/abcd28c6c49e740a. Report an issue: GitHub.