Note: The agent may not request write access to .git , since this allows an agent to write hooks that run outside the sandbox. Note that Zed's sandbox does catch this attack and will fail-closed, meaning that the untrusted command will not be run. But this is still blocked by the sandbox, since write access to /home/alice was never granted. Left unaddressed, it would allow a malicious agent to gain write access to any directory it has read access to. If you run git commit from a regular terminal app, then the hook would run outside the sandbox.