Repository navigation
fix(demo): wait out the trust race instead of configuring it away - #28
Merged
Merged
Conversation
The settings shipped in #27 cannot work: `security.workspace.trust.*` is user-scope by design and VS Code ignores it from devcontainer, remote and workspace settings. A fresh Codespace built from that commit raised the same modal, so the three keys are removed rather than left in place looking like a fix. What actually triggers the prompt is timing. Creating a terminal counts as executing code, so a `postAttachCommand` terminal that starts before Codespaces has finished granting trust makes VS Code ask, and while that modal stands the extension never activates: no panel, no analysis, no terminal. Two of three Codespaces opened on 2026-09-11 hit it; the third had simply attached more slowly. The startup terminal now waits ten seconds first — time the demo was already spending on its first analysis. A wait is a mitigation, not a guarantee, so DEMO.md now says what to click if the question appears anyway. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
RodolpheKouyoumdjian
added a commit
that referenced
this pull request
Sep 11, 2026
Four fresh Codespaces on 2026-09-11 all opened untrusted and all raised "Do you trust the authors of the files in this folder?" as soon as the startup terminal asked to execute code. The ten-second wait added in #28 did not prevent it — it only moved the same modal later, after a pause in which the demo looked broken. So the terminal starts immediately again. The question arrives at once, DEMO.md says what to click, and nothing here pretends the prompt is avoidable: an earlier attempt via `security.workspace.trust.*` was ignored because those keys are user-scope by design. Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #27, which did not work.
Why #27 could not work
security.workspace.trust.enabled/.startupPrompt/.bannerare user-scope by design — VS Code ignores them fromdevcontainer.json, remote and workspace settings (docs, vscode#147736). A fresh Codespace built from 97d68c5 raised the same modal and sat in Restricted Mode. The keys are removed rather than left looking like a fix.What actually happens
Creating a terminal counts as executing code. When
postAttachCommandstarts one before Codespaces has finished granting trust, VS Code asks "Do you trust the authors of the files in this folder?", and while that modal stands the extension never activates (untrustedWorkspaces.supported: false): no panel, no analysis, no terminal.Observed 2026-09-11: two of three fresh Codespaces hit it; the one that did not had simply attached more slowly — which is the shape of a race, and the reason this is worth mitigating rather than ignoring.
This PR
postAttachCommand: sleep 10 && drift analyze < /dev/null— the terminal waits for trust to settle, using time the demo was already spending on its first analysis.All 16 devcontainers and DEMO.md files regenerated;
check-demos.mjspasses.🤖 Generated with Claude Code