惯性聚合 高效追踪和阅读你感兴趣的博客、新闻、科技资讯
阅读原文 在惯性聚合中打开

推荐订阅源

钛媒体:引领未来商业与生活新知
钛媒体:引领未来商业与生活新知
Apple Machine Learning Research
Apple Machine Learning Research
T
Tailwind CSS Blog
月光博客
月光博客
爱范儿
爱范儿
有赞技术团队
有赞技术团队
OSCHINA 社区最新新闻
OSCHINA 社区最新新闻
aimingoo的专栏
aimingoo的专栏
GbyAI
GbyAI
腾讯CDC
The Cloudflare Blog
人人都是产品经理
人人都是产品经理
MongoDB | Blog
MongoDB | Blog
Microsoft Azure Blog
Microsoft Azure Blog
IT之家
IT之家
Cyber Security Advisories - MS-ISAC
Cyber Security Advisories - MS-ISAC
云风的 BLOG
云风的 BLOG
U
Unit 42
博客园 - 三生石上(FineUI控件)
A
About on SuperTechFans
N
Netflix TechBlog - Medium
Google DeepMind News
Google DeepMind News
雷峰网
雷峰网
L
LangChain Blog

Hacker News: Front Page

SPICE simulation → oscilloscope → verification with Claude Code — Lucas Gerads Introducing Claude Opus 4.7 Qwen Studio The Future of Everything is Lies, I Guess: Where Do We Go From Here? GitHub - SeanFDZ/macmind: Single-layer transformer in HyperTalk for the classic Macintosh Show HN: Agent-cache – Multi-tier LLM/tool/session caching for Valkey and Redis Ancient DNA reveals pervasive directional selection across West Eurasia [pdf] AI cybersecurity is not proof of work Moving a large-scale metrics pipeline from StatsD to OpenTelemetry / Prometheus GitHub - Nightmare-Eclipse/RedSun: The Red Sun vulnerability repository GitHub - SethPyle376/hiraeth: Local AWS emulator focused on fast integration testing, with SQS support, SQLite-backed state, and a debug-friendly web UI. A Better Ludum Dare; Or, How to Ruin a Legacy GitHub - macOS26/Agent: Any AI, replaces Claude Code, Cursor, OpenClaw. Over 18 LLM providers (Claude, OpenAI, Gemini, Ollama, Zai, HF, Qwen) wired into a native Mac app that writes code, builds Xcode projects, bumps versions, manages git, automates Safari, use AppleScript, JS or Accessibility, extend Agent! w/ MCP Servers, run tasks from your iPhone via Messages. YouTube now lets you turn off Shorts I Made a Terminal Pager Burgers | マクドナルド公式 Commands — HackerNews CLI documentation ChatGPT for Excel PiCore - Raspberry Pi Port of Tiny Core Linux Live Nation illegally monopolized ticketing market, jury finds Google Broke Its Promise to Me. Now ICE Has My Data. Founding Engineer at Adaptional | Y Combinator CRISPR takes important step toward silencing Down syndrome’s extra chromosome GitHub - saffron-health/libretto: The AI toolkit for building reliable browser automations US v. Heppner (S.D.N.Y. 2026) no attorney-client privilege for AI chats [pdf] Unexpected €54k billing spike in 13 hours: Firebase browser key without API restrictions used for Gemini requests Fragments: April 14 Cal.com Goes Closed Source: Why AI Security Is Forcing Our Decision | Cal.com - Scheduling Software for Online Bookings Laravel raised money and now injects ads directly into your agent Codex Hacked a Samsung TV
Extension silently disables competitor extensions globall...
FossAndFurio · 2026-05-03 · via Hacker News: Front Page

On activation, Pyrefly silently writes disableLanguageServices = true to the user's
global VS Code settings for three named third-party extensions, without prompting
the user or notifying them in any way. These settings are never restored when
Pyrefly is deactivated or uninstalled, leaving those extensions permanently broken
until the user manually intervenes.

This has been verified by live reproduction on a real machine (see below).

Affected extensions

  • detachhead.basedpyright
  • codeium.windsurfpyright
  • anysphere.cursorpyright

Source

lsp/src/extension-interop.ts:

export async function disableWindsurfPyrightIfInstalled() {
  const windsurfPyrightExtension = vscode.extensions.getExtension('codeium.windsurfpyright');
  if (windsurfPyrightExtension) {
    const config = vscode.workspace.getConfiguration('windsurfPyright');
    await config.update('disableLanguageServices', true, vscode.ConfigurationTarget.Global);
  }
}

export async function disableBasedPyrightIfInstalled() {
  const basedPyrightExtension = vscode.extensions.getExtension('detachhead.basedpyright');
  if (basedPyrightExtension) {
    const config = vscode.workspace.getConfiguration('basedpyright');
    await config.update('disableLanguageServices', true, vscode.ConfigurationTarget.Global);
  }
}

export async function disableCursorPyrightIfInstalled() {
  const cursorPyrightExtension = vscode.extensions.getExtension('anysphere.cursorpyright');
  if (cursorPyrightExtension) {
    const config = vscode.workspace.getConfiguration('cursorpyright');
    await config.update('disableLanguageServices', true, vscode.ConfigurationTarget.Global);
  }
}

These are called unconditionally in lsp/src/extension.ts on activation.

Relevant commits: 69985d1d, c0ab0d76, 72458900, 2fb5205a (December 8-9, 2025)

Why this is a problem

1. Silent global modification
ConfigurationTarget.Global writes to the user's global settings.json, affecting
every workspace on the machine. The user receives no notification, no prompt, no
indication this has occurred.

2. No cleanup on deactivation or uninstall
There is no corresponding deactivate() logic that restores these settings.
A user who installs Pyrefly, then uninstalls it, is left with basedpyright,
windsurfpyright, or cursorpyright silently broken — with no obvious cause.
They would need to know to manually find and delete these keys from their
global settings.json to restore functionality.

3. Targets extensions by publisher ID
This is not a generic "disable conflicting language servers" mechanism.
It hardcodes the extension IDs of specific named competitors and disables
them individually. The user has no opt-out.

Live reproduction

Reproduced independently on both VSCodium and stock VS Code 1.118.1.

Test 1 — VSCodium

Tested with detachhead.basedpyright installed.

~/.config/VSCodium/User/settings.json before installing Pyrefly:

{
    "python.languageServer": "Default"
}

After installing Pyrefly and opening a single Python file:

{
    "python.languageServer": "Default",
    "basedpyright.disableLanguageServices": true
}

After uninstalling Pyrefly:

{
    "python.languageServer": "Default",
    "basedpyright.disableLanguageServices": true
}

The key persists. basedpyright remains broken with no indication of why.

Test 2 — VS Code 1.118.1 (clean isolated profile)

To rule out any VSCodium-specific behaviour, reproduced on stock VS Code using a
completely clean profile (--user-data-dir /tmp/vscode-test-profile) with no prior
configuration.

settings.json before installing Pyrefly: file did not exist (empty profile)

After installing detachhead.basedpyright, then meta.pyrefly, and opening a single Python file:

{
    "python.languageServer": "None",
    "basedpyright.disableLanguageServices": true
}

Same result. The write happens on first Python file open regardless of editor or prior configuration.

Expected behavior

If Pyrefly needs exclusive access to Python language services to function correctly,
it should:

  1. Ask the user before modifying settings owned by other extensions
  2. Restore those settings in deactivate() when Pyrefly is disabled or uninstalled
  3. Or at minimum, log what it changed so users can reverse it

Additional concern: forced Microsoft extension dependencies

package.json declares "extensionDependencies": ["ms-python.python"].

VSCodium and VS Code treat this as a hard bidirectional lock — installing Pyrefly
automatically installs:

  • ms-python.python
  • ms-python.debugpy
  • ms-python.vscode-python-envs

Uninstalling any of those three also uninstalls Pyrefly.

The only thing ms-python.python is used for is querying the active Python interpreter
path for the optional "Run File / Run Test" CodeLens buttons. The core LSP features
(type checking, completions, hover, go-to-definition) run entirely through the
pyrefly binary and have no dependency on ms-python.python at all.

For users on VSCodium or other FOSS VS Code distributions who specifically avoid
Microsoft extensions, this is a significant and undisclosed side effect of installing
what is presented as an independent open source tool.

Steps to reproduce

  1. Install detachhead.basedpyright and confirm it is working (completions, hover, etc.)
  2. Install meta.pyrefly
  3. Open a Python file (triggers Pyrefly activation)
  4. Check your global settings.jsonbasedpyright.disableLanguageServices is now true
  5. Uninstall meta.pyrefly
  6. Observe that basedpyright.disableLanguageServices remains true — basedpyright
    is still broken with no indication of why