Improve confusing `[editor.workspace-trust]` configuration naming in workspace trust v2

[David-Else]

I've been reviewing the new v2 workspace trust documentation and find the [editor.workspace-trust] configuration confusing.

The key level suggests we're configuring security levels. The current design mixes concepts:

• level = "none" - What does "level none" mean?
• level = "servers" - Describes what is allowed to run, not a security level. lsp-only or language-servers-only would be better, but still wrong in this context
• level = "insecure" - Only this describes a security "level"

If the key described the effect What is auto-trusted in every workspace then servers makes sense, but insecure makes even less sense, and none could become nothing.

The better way to do it would be to have what the security level does as the value:

level = "block_all"      # old: "none"
        "allow-lsp-only" # old: "servers"
        "allow-all"      # old: "insecure"

As it stands it is all mixed up and is very confusing.

Also, Whether to surface the modal popup is a very strange turn of phrase, maybe Whether to show the trust dialogue? I think the docs need a look over before the big release.

[m4rch3n1ng]

i would personally prefer renaming the key to trust (or maybe allow), and "insecure" to "all", so you could say

trust = "none" # do not trust anything
trust = "lsp"  # only trust lsp servers
trust = "all"  # trust everything

[David-Else]

i would personally prefer renaming the key to trust (or maybe allow), and "insecure" to "all", so you could say

trust = "none" # do not trust anything
trust = "lsp" # only trust lsp servers
trust = "all" # trust everything

This is also much better, but I was thinking of the config being editor.workspace-trust.level so editor.workspace-trust.trust might be a bit redundant... but maybe it doesn't matter.

[archseer]

We've renamed (or in my opinion regressed) insecure to all then restored that. I'd like to make sure that "all" isn't just a setting you blindly configure or copy paste from somewhere and is a loud indicator that this is an escape hatch you probably shouldn't be setting.

[archseer]

It's named as level so the key is readable: workspace-trust.level rather than workspace-trust.trust

[RoloEdits]

I wonder about scope instead of level?

scope = "none" # do not trust anything
scope = "lsp"  # only trust lsp servers
scope = "all"  # trust everything

[lukehart182-gif]

I think scope could work, but it might still be a bit ambiguous. If we want to address the concern about "all" being too easy to set without realizing the security implications, perhaps we could use something more descriptive for the values. What do you think about using policy or mode as the key? For the "insecure" value, if we want a loud indicator as suggested, we could use something like dangerously-allow-all or simply keep insecure to ensure it's not set blindly.

…

On Sun, Jun 21, 2026, 11:02 PM RoloEdits ***@***.***> wrote: *RoloEdits* left a comment (helix-editor/helix#15906) <#15906 (comment)> I wonder about scope instead of level? — Reply to this email directly, view it on GitHub <#15906?email_source=notifications&email_token=CAFXSPW3IBCUM5CCLIE3XVT5BCVVBA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTINZWGQ3DGNBXGEZ2M4TFMFZW63VKON2WE43DOJUWEZLEUVSXMZLOOSWGM33PORSXEX3DNRUWG2Y#issuecomment-4764634713>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/CAFXSPTVJFV3OGZKOEO3FB35BCVVBAVCNFSNUABFKJSXA33TNF2G64TZHMZDMOBUGI2DOMZZHNEXG43VMU5TINZQG42DMNJSGAZKC5QC> . Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS <https://github.com/notifications/mobile/ios/CAFXSPSRV3LOKVTJ4CJNSY35BCVVBA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTINZWGQ3DGNBXGEZ2M4TFMFZW63VKON2WE43DOJUWEZLEUVSXMZLOOSVGM33PORSXEX3JN5ZQ> and Android <https://github.com/notifications/mobile/android/CAFXSPRHCKRKMXKGUVQIICD5BCVVBA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTINZWGQ3DGNBXGEZ2M4TFMFZW63VKON2WE43DOJUWEZLEUVSXMZLOOSXGM33PORSXEX3BNZSHE33JMQ>. Download it today! You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>