Code Action commands provided by language server are executed automatically on mouse-over

[bastiandoetsch]

Does this issue occur when all extensions are disabled?: Yes

• VS Code Version: 1.83 & 1.84-insider NOT: 1.80.2
• OS Version: macOS AMD64

Steps to Reproduce:

1. Provide code action via language server. Example from Snyk Extension:

   {"command":{"arguments":["https://learn.snyk.io/lesson/csrf-attack/?loc=ide"],"command":"snyk.openBrowser","title":"Learn more about Cross-Site Request Forgery (CSRF) (Snyk)"},"diagnostics":[{"code":"javascript/UseCsurfForExpress","codeDescription":{"href":"https://docs.snyk.io/products/snyk-code/security-rules-used-by-snyk-code"},"message":"Cross-Site Request Forgery (CSRF): CSRF protection is disabled for your Express app. This allows the...","range":{"end":{"character":18,"line":27},"start":{"character":10,"line":27}},"severity":2,"source":"Snyk Code"}],"kind":"quickfix","title":"Learn more about Cross-Site Request Forgery (CSRF) (Snyk)"}

2. When opening the Quickfixes... menu, the code action command is automatically executed on mouse-over/selection.

This is happening with current vscode versions, but not with 1.80.2 released in June, both using the same Snyk extension version. Therefore we think that a change in VSCode or one of its language server / language client related libraries is triggering this unexpected behaviour.

[glouischandra]

We are seeing the same issue in Cloud Code extension as well.

[bastiandoetsch]

@mjbvz Any chance you can have a look at it?

[bastiandoetsch]

Sorry to ping again about it, but this is rather a bad UX for users - any chance to have a look at it, @mjbvz?

[justschen]

similar to https://github.com/microsoft/vscode/issues/196938

I wasn't able to repro then in flutter, but taking a look at it again

[bastiandoetsch]

Thanks, let me know if you need more information or help for reproducing. We have been able to reproduce reliably with several people and our Snyk extension.

[bastiandoetsch]

Hey @justschen , were you able to find a way to fix the VSCode behaviour or how we from our side can avoid that?

[justschen]

Looking into this atm! @bastiandoetsch I'm unable to recreate in the Synk extension - is there a specific command that the extension contributes that causes this?

[bastiandoetsch]

Thanks for investigating! It is happening with all actions provided by the language server. "Local" code actions that directly interface with VSCode don't show this behavior. The command json I pasted in the description is one of the examples (for opening a browser window).

If you wanna see it / debug it, I'm open to a video call.

[bastiandoetsch]

Here's a screen recording displaying the issue:

https://github.com/microsoft/vscode/assets/20150761/fe3c9c93-23c5-4fa1-83d9-bb189b4bd22b

[bastiandoetsch]

Using the Snyk extension, the following steps would be necessary to reproduce:

1. Install the Snyk extension
2. Trust & Authenticate against Snyk (opens browser)
3. Run an IaC or Snyk Code scan (Snyk Open Source only exhibits this behaviour if you install the "Preview" Snyk extension)
4. When having a squiggly line, click the light bulb / go to "Quickfixes" in the hover menu
5. Move the mouse over e.g. "Learn about..." or "Open Description..." code actions.

[bastiandoetsch]

@justschen have you been able to recreate the issue now?

[justschen]

yes - deferring to december!

[bastiandoetsch]

I'm a bit sad that it's deferred, but I'm happy that it's at last reproducible :).

[justschen]

this is fixed in the latest insiders! please try it out, and if it is unresolved, feel free to open a new issue

[bastiandoetsch]

Thanks for fixing! Works like a charm!