0.10.0 breaks `customRubyCommand` in workspace settings

[nrgbistro]

Description

Ruby LSP Information

#### VS Code Version

1.108.2

#### Ruby LSP Extension Version

0.10.0

#### Ruby LSP Server Version

0.26.5

#### Ruby LSP Add-ons

- RuboCop (unknown)

#### Ruby Version

3.3.10

#### Ruby Version Manager

custom

#### Installed Extensions

<details>
<summary>Click to expand</summary>

- auto-rename-tag (0.1.10)
- better-comments (3.0.2)
- claude-code (2.1.23)
- code-spell-checker (4.4.0)
- cpptools-themes (2.0.0)
- cron-explained (1.3.1)
- docker (0.18.0)
- even-better-toml (0.21.2)
- firacode (2.2.2)
- git-graph (1.30.0)
- githistory (0.6.20)
- gitlens (17.9.0)
- jupyter-keymap (1.1.2)
- ligatures-limited (1.4.1)
- markdown-all-in-one (3.6.3)
- material-icon-theme (5.31.0)
- material-theme (3.19.0)
- prettier-vscode (12.3.0)
- prettyxml (6.7.0)
- prisma (31.4.0)
- rainbow-csv (3.24.1)
- remote-explorer (0.5.0)
- remote-ssh (0.122.0)
- remote-ssh-edit (0.87.0)
- remote-wsl (0.104.3)
- ruby-lsp (0.10.0)
- shell-syntax (1.0.5)
- svg-preview (2.8.3)
- tpack (2.0.4)
- typescript-explorer (0.4.2)
- vs-code-prettier-eslint (6.0.0)
- vscode-eslint (3.0.20)
- vscode-github-actions (0.30.1)
- vscode-html-css (2.0.13)
- vscode-pdf (0.1.6)
- vscode-pull-request-github (0.126.0)
- vscode-tailwindcss (0.14.29)
- vscode-yaml (1.19.1)
- win-ca (3.5.1)
</details>

#### Ruby LSP Settings

<details>
<summary>Click to expand</summary>

##### Workspace

```json
{
  "rubyVersionManager": {
    "identifier": "custom"
  },
  "formatter": "none",
  "linters": [
    "rubocop"
  ],
  "bundleGemfile": "services/api/Gemfile"
}

User

{
  "enabledFeatures": {
    "codeActions": true,
    "diagnostics": true,
    "documentHighlights": true,
    "documentLink": true,
    "documentSymbols": true,
    "foldingRanges": true,
    "formatting": true,
    "hover": true,
    "inlayHint": true,
    "onTypeFormatting": true,
    "selectionRanges": true,
    "semanticHighlighting": true,
    "completion": true,
    "codeLens": true,
    "definition": true,
    "workspaceSymbol": true,
    "signatureHelp": true,
    "typeHierarchy": true
  },
  "featuresConfiguration": {},
  "addonSettings": {},
  "rubyVersionManager": {
    "identifier": "custom"
  },
  "customRubyCommand": "eval \"$(proto activate bash)\"",
  "formatter": "none",
  "linters": [
    "rubocop"
  ],
  "bundleGemfile": "services/api/Gemfile",
  "testTimeout": 30,
  "branch": "",
  "pullDiagnosticsOn": "both",
  "useBundlerCompose": false,
  "bypassTypechecker": false,
  "rubyExecutablePath": "",
  "indexing": {},
  "erbSupport": true,
  "featureFlags": {},
  "sigOpacityLevel": "1"
}

Reproduction steps

1. Create .vscode/settings.json in the workspace root
2. Set rubyLsp.customRubyCommand on 0.10.0
3. See the warning that this option is not respected from workspace settings
4. Ruby LSP fails to start due to missing customRubyCommand

Code snippet or error message

2026-01-29 14:03:17.396 [info] (manama-v1) Running command: ` && ruby -EUTF-8:UTF-8 '/Users/nrgbistro/.vscode/extensions/shopify.ruby-lsp-0.10.0/activation.rb'` in /Users/nrgbistro/workspace/torq/platform/.conductor/manama-v1/services/api using shell: /bin/zsh

Setting rubyLsp.customRubyCommand from a workspace settings file works in 0.9.33. Now, it looks like this option is not respected when included in a workspace settings file on version 0.10.0.

This is problematic for me, because I commit my root .vscode/ folder specifically to ensure that Ruby LSP will automatically work for all developers. For now, a workaround is having every dev add this setting to their vscode user settings, but this is far from ideal. Wondering why this change was made and if it could be reverted to allow setting the custom ruby command from workspace settings. I will be pinning my Ruby LSP extension to 0.9.33 until this is resolved.

EDIT: I see this change mentioned in the 0.10.0 release notes, but can't find any relevant code changes or explanation for why this change was made.

[st0012]

The code change is in: e78a80c. It doesn't have a PR because it was merged from a private fork.
We decided to make this change because we discovered that with workspace level customRubyCommand, it's possible to execute arbitrary code on user's machine with just this .vscode/settings.json:

{
    "rubyLsp.rubyVersionManager": {
        "identifier": "custom"
    },
    "rubyLsp.customRubyCommand": "<run malicious command>"
}

While it only works when the user decides to trust the workspace, we also understand that many devs don't do a thorough code scan before clicking "trust", and .vscode is especially easy to miss.

So in order to reduce the security risk imposed through Ruby LSP, we decided to make this setting a user-level only config. At the same time we also added a security document other potential risks when using Ruby LSP.

[nrgbistro]

Got it, that's good to know. Very unfortunate for my workflow though. Do you think there are any ways around this beyond each developer adding the command to their own settings?

We use proto to install and manage ruby versions. Any chance it could be added as a supported ruby version manager? Not sure how much additional effort that is to add, but it would be greatly appreciated by me and my team.