Consider ls_specific_settings in project configurations only for trusted projects

CHANGELOG.md

@@ -4,7 +4,8 @@ Status of the `main` branch. Changes prior to the next official version change w
 
 * General:
   - Add notion of trusted projects via new global configuration setting `trusted_project_path_patterns`.
-    Existing users are advised to edit this setting.
+    Current effects:
+    - `ls_specific_settings` defined in project configurations will only be applied for trusted projects    
   - Fix `--project-from-cwd` hijacking git worktrees nested under a Serena project. `find_project_root`
     now walks up in a single pass so the nearest project boundary wins (either a `.serena/project.yml`
     or a `.git`, including worktree/submodule pointer files), instead of preferring an ancestor's

docs/02-usage/050_configuration.md

@@ -200,9 +200,12 @@ Most users will not need to adjust these settings.
 :::
 
 Under the key `ls_specific_settings` in `serena_config.yml`, you can you pass global per-language, 
-language server-specific configuration. You can use the same key in the project configuration files (`project.yml`
+language server-specific configuration. 
+
+You can use the same key in the project configuration files (`project.yml`
 and `project.local.yml` ) to override or extend the global settings for a specific project.
-The settings are merged on top-level, meaning that project-level settings for a language will replace global settings for the same language.
+The settings are merged on top-level, meaning that project-level settings for a language will replace global settings for the same language.  
+Note: Project-level settings are considered only for *trusted projects* (which are defined in the [global configuration](global-config)).
 
 Structure:
 

src/serena/project.py

@@ -425,7 +425,15 @@ class Project(ToStringMixin):
 
             log.info(f"Creating language server manager for {self.project_root}")
             self._language_server_manager_init_error = None
-            ls_specific_settings = {**self.serena_config.ls_specific_settings, **self.project_config.ls_specific_settings}
+            ls_specific_settings = dict(self.serena_config.ls_specific_settings)
+            if self.project_config.ls_specific_settings:
+                if self.is_trusted():
+                    ls_specific_settings.update(self.project_config.ls_specific_settings)
+                else:
+                    log.warning(
+                        f"Project path {self.project_root} is not trusted, ignoring LS-specific settings from project configuration. "
+                        "To trust the project, modify the trusted path patterns in the global configuration."
+                    )
             factory = LanguageServerFactory(
                 project_root=self.project_root,
                 project_data_path=self._serena_data_folder,

src/serena/resources/project.template.yml

@@ -54,8 +54,8 @@ ignore_all_files_in_gitignore: true
 
 # advanced configuration option allowing to configure language server-specific options.
 # Maps the language key to the options.
-# Have a look at the docstring of the constructors of the LS implementations within solidlsp (e.g., for C# or PHP) to see which options are available.
-# No documentation on options means no options are available.
+# The settings are considered only if the project is trusted (see global configuration to define trusted projects).
+# See https://oraios.github.io/serena/02-usage/050_configuration.html#language-server-specific-settings
 ls_specific_settings: {}
 
 # list of additional workspace folder paths for cross-package reference support (e.g. in monorepos).