astral-sh/ruff · error

external commands are disabled in an untrusted workspace

Error message

external commands are disabled in an untrusted workspace

What it means

A std::io::Error (PermissionDenied) returned by UntrustedWorkspaceExecutor::execute when the workspace is untrusted: ty deliberately blocks all external command execution so untrusted projects cannot run arbitrary processes during checking.

Source

Thrown at crates/ty_server/src/system.rs:326

impl<'de> Deserialize<'de> for WorkspaceTrust {
    fn deserialize<D>(deserializer: D) -> std::result::Result<Self, D::Error>
    where
        D: Deserializer<'de>,
    {
        // The LSP option is `untrustedWorkspace`, so `true` means untrusted.
        Ok(match Option::<bool>::deserialize(deserializer)? {
            Some(true) => Self::Untrusted,
            Some(false) | None => Self::Trusted,
        })
    }
}

/// Rejects commands without retaining the LSP document index.
struct UntrustedWorkspaceExecutor;

impl CommandExecutor for UntrustedWorkspaceExecutor {
    fn execute(&self, _command: Command) -> Result<Output> {
        Err(std::io::Error::new(
            std::io::ErrorKind::PermissionDenied,
            "external commands are disabled in an untrusted workspace",
        ))
    }

    fn dyn_clone(&self) -> Box<dyn CommandExecutor> {
        Box::new(Self)
    }
}

fn not_a_text_document(path: impl Display) -> std::io::Error {
    std::io::Error::new(
        std::io::ErrorKind::InvalidInput,
        format!("Input is not a text document: {path}"),
    )
}

fn virtual_path_not_found(path: impl Display) -> std::io::Error {

View on GitHub (pinned to 26f38c119c)

Solutions

1. Mark the workspace as trusted to allow command execution
2. Remove configuration that depends on running external commands when untrusted

When it happens

Trigger: Thrown at crates/ty_server/src/system.rs:326 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of astral-sh/ruff@26f38c119c (2026-09-05). Data as JSON: /api/errors/8e11a89215d13e66. Report an issue: GitHub.