trust-lsp.toml

trust-lsp.toml configures workspace indexing, reusable libraries, dependencies, diagnostics, vendor profile behavior, and runtime-assisted editor features.

The language server discovers these filenames:

• trust-lsp.toml
• .trust-lsp.toml
• trustlsp.toml

If a selected file cannot be read or parsed, the language server publishes a configuration warning and applies no partial values. Other invalid settings fall back atomically and publish stable codes so the editor explains what was ignored:

Code	Configuration problem	User action
C001	The selected file cannot be read or parsed.	Fix file access or TOML syntax.
C002	The standard-library profile is unknown.	Use full, iec, none, or an explicit allowlist.
C003	A numeric bound is outside its documented domain, or the throttle tuple is incoherent.	Correct the bound or throttle ordering, or remove the keys to use safe defaults.
C004	Workspace visibility is unknown.	Use public, private, or hidden.
C005	A severity override has a blank code or unknown severity.	Use a real diagnostic code and a supported severity.
C006	The vendor_profile is unknown; trust-runtime, trust-dev test and trust-harness --project refuse to run the project with it.	Use a profile listed in Vendor Profiles or iec.

Minimal Example

[project]
include_paths = ["src"]
vendor_profile = "siemens"
stdlib = "iec"

[runtime]
control_endpoint = "unix:///path/to/project/.trust-runtime/control.sock"

[project]

Key	Type	Default	Notes
include_paths	string array	[]	The project's own source folders; when set, they replace the project folder.
library_paths	string array	[]	Library folders, indexed like [[libraries]] entries named after their folder; see Library files.
vendor_profile	string	none	Controls formatting and diagnostic defaults.
stdlib	string or string array	full	String = profile; array = allowlist of names.

Common stdlib forms:

Form	Meaning	Example
string profile	use a named built-in profile	stdlib = "full"
IEC-only profile	limit to IEC-facing standard library	stdlib = "iec"
disabled	no preloaded stdlib symbols	stdlib = "none"
explicit allowlist	load only named entries	stdlib = ["ABS", "CTU", "TON"]

[dependencies]

Use this for reusable truST packages that should participate in normal project compilation.

Key	Type	Required	Notes
<name>.path	string	path dependency	Local package root.
<name>.git	string	git dependency	Remote git URL.
<name>.version	string	recommended	Resolver/version contract.
<name>.rev / tag / branch	string	optional	Choose at most one git locator.

Path dependency:

[dependencies]
MyLib = { path = "../libraries/my_lib", version = "0.1.0" }

Git dependency:

[dependencies]
MyLib = { git = "https://example.com/my-lib.git", tag = "v0.1.0", version = "0.1.0" }

Dependency rules:

Condition	Requirement
dependency source	set exactly one of path or git
git locator	set at most one of rev, tag, or branch
locked/offline behavior	configure from [build]

The folder of every resolved dependency, transitive ones included, is a library folder: see Library files.

[[libraries]]

Use this for index-only packs, vendor stubs, or attached docs that should not be treated as first-class project dependencies.

[[libraries]]
name = "siemens-stubs"
path = "vendor/siemens"
version = "0.1.0"
docs = ["docs/vendor.md"]

Key	Type	Required	Notes
name	string	yes	Display/name key.
path	string	yes	Library root.
version	string	no	Informational or resolver hint.
dependencies	array of tables	no	Index-only dependency metadata.
docs	string array	no	Attached docs paths.

Library files

A library is judged in its own project, as CODESYS and TwinCAT judge it: an application is only one of a library's users, so the unused-symbol warnings W001, W002, and W009 are never reported for a library's files, in the editor and in trust-lsp check alike. Every other diagnostic stays on for them.

The library folders are the [[libraries]] paths, the library_paths of [project], and the folders of resolved [dependencies] packages, transitive ones included. The project's own source folders are its include_paths, or the project folder when none are set. For each file, the deepest folder that holds it decides, and an own folder wins over an equally deep library folder:

Layout	Library files
[[libraries]] path = "libs/vendor"	the files under libs/vendor
include_paths = ["src"] and a library at src/vendor	the files under src/vendor only
a library at an own source folder (path = "." without include_paths, or an include path)	none
Plant = { path = "../.." } in an example that lies inside the library	the library's files, not the example's own sources
OscatOop = { path = "../../../../libraries/oscat/oop" }, outside the project folder	the package's files, diagnosed with this project's [diagnostics] settings

Folders are compared after resolving symbolic links, junctions, and short names. To see a library's own unused declarations, open the library as its own project.

[build]

Key	Type	Default	Notes
target	string	none	Editor-side build target hint.
profile	string	none	Profile name such as debug or release.
flags	string array	[]	Additional compile flags.
defines	string array	[]	Preprocessor/define flags.
dependencies_offline	bool	false	Disables network fetch/clone for git deps.
dependencies_locked	bool	false	Requires pinned revisions or lock entries.
dependency_lockfile	string	trust-lsp.lock	Lock file path.

[[targets]] can override profile, flags, and defines per named target.

[indexing]

Key	Type	Default
max_files	integer	none
max_ms	integer	none
cache	bool	true
cache_dir	string	.trust-lsp/index-cache
memory_budget_mb	integer	none
evict_to_percent	integer	80
throttle_idle_ms	integer	0
throttle_active_ms	integer	8
throttle_max_ms	integer	50
throttle_active_window_ms	integer	250

[diagnostics]

Key	Type	Default	Notes
warn_unused	bool	profile default	Toggle the unused-symbol warnings W001, W002, and W009; library files never receive them.
warn_unreachable	bool	profile default	Toggle unreachable-code warnings.
warn_missing_else	bool	profile default	Toggle missing-ELSE warnings.
warn_implicit_conversion	bool	profile default	Toggle implicit-conversion warnings.
warn_shadowed	bool	profile default	Toggle shadowing warnings.
warn_deprecated	bool	profile default	Toggle deprecation warnings.
warn_complexity	bool	profile default	Toggle complexity warnings.
warn_nondeterminism	bool	profile default	Toggle nondeterminism warnings.
warn_numeric_hazards	bool	profile default	Toggle numeric-hazard warnings.
rule_pack	string	none	Named diagnostic bundle.
external_paths	string array	[]	JSON files containing diagnostics produced by external tools.
severity_overrides	table	{}	Per-code overrides such as W003 = "error".

Each external diagnostic may use a string severity or a numeric LSP severity. String values are trimmed before ASCII-case-insensitive matching and accept error, warning, info, information, or hint; numeric values accept 1..=4. An absent or invalid severity defaults to warning.

Supported rule packs include:

• iec-safety
• safety
• siemens-safety
• codesys-safety
• beckhoff-safety
• twincat-safety
• mitsubishi-safety
• gxworks3-safety

Vendor profiles also affect defaults:

• siemens: disables missing-ELSE and implicit-conversion warnings by default
• codesys / beckhoff / twincat: keep standard warning set enabled
• mitsubishi / gxworks3: keep standard warning set enabled

[runtime]

Key	Type	Notes
control_endpoint	string	Runtime control endpoint for debug-assisted features. Omit it to use the editor's runtime control endpoint setting, when one is set. To name a project's runtime, copy the endpoint that trust-runtime ctl --project <dir> endpoint --json reports; the platform default and the endpoint file are described in runtime.toml.
control_auth_token	string	Optional auth token for the control endpoint. It is sent only to the control_endpoint written next to it, never to an editor endpoint.

[workspace]

Key	Type	Default	Notes
priority	integer	0	Workspace federation priority.
visibility	string	public	public, private, or hidden.

[telemetry]

Key	Type	Default	Notes
enabled	bool	false	Opt-in only.
path	string	.trust-lsp/telemetry.jsonl when enabled	Output file.
flush_every	integer	25	Flush interval.

[dependency_policy]

Use this to constrain git dependencies:

[dependency_policy]
allowed_git_hosts = ["github.com", "gitlab.com"]
allow_http = false
allow_ssh = false

Key	Type	Default	Notes
allowed_git_hosts	string array	[]	Explicit host allowlist.
allow_http	bool	false	Permit insecure git/http transport.
allow_ssh	bool	false	Permit SSH transport.

Optional [package]

Reusable library manifests may also declare:

[package]
version = "0.1.0"

That version is used by the dependency resolver when another project consumes the package.

Key	Type	Required	Notes
version	string	yes	Package version exposed to dependents.

Related

• Vendor Profiles
• Project Layout
• Agent Quickstart