This prompt was shown shortly after launching the LSP server and it's not part of my own plugin. So I suppose that it's from the LSP server.
The setup was SourceKit-LSP with an xcode-build-server setup in an Xcode workspace.
It this from SourceKit LSP?
This is potentially confusing because users would expect a reference to the language support plugin (Noctule in this case) and JetBrains IDEs already have a separate workspace trust configuration. Is there a way to customize and/or turn this off?
How can I reset the state for testing it some more?
I search the GitHub repo, but couldn't find the answers.
Yes, this is from sourcekit-lsp. As the message says, this is asking whether to trust the workspace's .bsp/ or .sourcekit-lsp/ settings. Until you trust it, the workspace is open without loading those files.
This is currently only implemented in sourcekit-lsp bundled in Xcode beta. I'm going to upstream it in the GitHub repo soon.
The standard LSP has a mechanism to show a message and ask for the answer from the client. window/showMessageRequest was introduced in 2016 for LSP 2.x and is not client capability gated.
I understand why it was added, but from my perspective as a 3rd-party integrating SourceKit LSP I have to say that I don't like it that much.
The message is potentially confusing because it's unclear what happens if "Don't Trust" is selected. I don't think a user knows that completions, go to definition, etc. will stop working.
If a user selected "Don't Trust" there's no way to ask SourceKit-LSP to show this again. At least there's no way I'm aware of. Instead, every LSP client / integration has to implement to locate the user's ~/.sourcekit-lsp/config.json to allow a user to change the trust setting again.
Isn't this duplicating the IDE's trust settings of VSCode, JetBrains and others?
Questions:
Is only the SourceKit-LSP configuration in the user's home directory used to read setting bypassWorkspaceTrust or can this be configured in a directory's .sourcekit-lsp/config.json, too? The IDE has its own trust setting setup already and I could apply the user's trust choice in the configuration, if supported.
Will this message appear in any case, or only when specific settings are specified in .bsp/ or .sourcekit-lsp/? I don't use any settings in these folders (and specify all settings via command-line), will I receive this message in Swift 6.4? Can I specify bypassWorkspaceTrust via command-line when I start the sourcekit-lsp executable?
What will happen if a client editor is not capable of showMessageRequest? I guess sourcekit-lsp will silently fail to access the workspace folder?
Suggestions for clearer wording would be very welcome!
If the user answers "Trust Workspace", the decision is persisted in ~/.sourcekit-lsp/trusted-workspaces.json. However, a "Don't Trust" response is not persisted, so the user can restart the client to be prompted again.
Yes, that's one of the reasons we implemented the opt-out mechanism. Clients that already have their own workspace trust mechanism may want to bypass SourceKit-LSP's workspace trust checks. Such clients can set initializationOptions.bypassWorkspaceTrust to true in the initialize request.
No, bypassWorkspaceTrust cannot be specified in a workspace's .sourcekit-lsp/config.json, because that would defeat the whole purpose of the workspace trust mechanism.
Alternatively, sourcekit-lsp provides the --bypass-workspace-trust command-line option.
Only if there's a .bsp/ or .sourcekit-lsp/ directory in the workspace root. If neither directory exists, the dialog is not displayed and all functionality should work as usual.
You can pass --bypass-workspace-trust when launching sourcekit-lsp.
If the window/showMessageRequest server-to-client request returns an error, it is treated as "Don't Trust".
While thinking about different wording, it occurred to me that multiple workspace directories can be set up by an LSP client. If 3 separate workspace are passed in the init, will this message show all three names? That could become a long, unreadable list in the worst case...
Or would $n messages appear for $n workspace directories? That wouldn't be helpful, either ;)
For the message:
I'd add a line break after Do you trust the authors of files in "$name"? because it's the main question
In my setup it wasn't a .bsp/ directory, but a buildServer.json file (xcode-build-server does not use the new directory setup yet).
I'd also add a line break before Only trust workspaces from sources you trust.
Only trust workspaces from sources you trust. has "trust" twice. Perhaps changes to something like Only trust workspaces from sources you know.?
I'd add something like "Code completion, navigation and other features are only available in workspaces you trust`. (I'm not a native speaker, just a suggestion) I'm not sure which features would be turned off, but assume that most would be made unavailable.
Thanks for the details, that's helpful! Details on the implementation would be great to have in the sourcekit-lsp GitHub repo.
Ah, the initialization option is what I need.
Thanks!
I won't be able to use the command-line option because (I suppose) it can not be used with swift < 6.4. I'd like to avoid version-checking the binaries first before building the command line options.
The initialization option seems like the best way for my setup, I think.
Thank you for your reply and your time to provide details on how it works!
