Determine if "do you want positron helper to accept incoming network connections?" can be suppressed

[jennybc]

Upon first launch of one of our pre-release builds, a macOS user sees the pop-up above. I captured this one on 2023-08-31 with the build described below. If I quit and relaunch, I do not see the pop-up again.

@jmcphers is disappointed that we're still seeing this since we are now fully code-signed and notarized:

It's possible we can't do anything about this since we are using network connections between different layers of the system (e.g. there's a TCP connection between the LSP and the extension host, which is probably what's triggering this) but perhaps something about the way we're doing network can be configured so that macOS sees it as lower risk (e.g. maybe we are listening too promiscuously/to too many interfaces)

Positron Version: 2023.08.0 (Universal) build 292
Code - OSS Version: 1.79.0
Commit: a3ae4f14ee5355a9243b1d2075a15b79591f7c7e
Date: 2023-08-31T02:36:29.136Z
Electron: 22.3.10
Chromium: 108.0.5359.215
Node.js: 16.17.1
V8: 10.8.168.25-electron.0
OS: Darwin arm64 22.6.0

[jmcphers]

One way around this might be to avoid using TCP entirely in the LSPs. Most LSPs don't use TCP; they use standard IO streams (stdin/stdout). The reason we don't do this is that our LSPs are co-located in-process with the kernels. And of course you only get one stdin/stdout pair, which we need to reserve for input/output from the kernel itself.

Some possible paths forward:

• Figure out if there's a way to use TCP that doesn't make macOS freak out. This is likely to affect other operating systems in different ways; for example, Windows Firewall settings have been known to break software that relies on TCP for internal communication (such as ... for example ... RStudio)
• Use file descriptor magic to make it possible to use stdio streams. I'm not sure if this is actually possible, but it feels like it could be. For example, could we open a couple of new fds and have the client attach to those instead of to stdin/stdout?
• Use stream multiplexing magic to make it possible to use stdio streams. Again, not sure if this is actually possible, but perhaps if we decorated/demarcated LSP input and output, it could share stdio streams with the kernel.
• Use some other form of transport. The node-languageclient project lets you define your own transport so long as it has a basic reader/writer interface. We could try using a third option besides TCP and stdio -- sockets/domain sockets? pipes? Note that we'd also need support for this on the tokio/TowerLsp side for ark.
• Run away from home and live in the woods.

[kevinushey]

Do we know what specifically is causing this macOS popup to be triggered? Some Googling suggests you can suppress this if you ensure your TCP server explicitly listens on localhost.

I wonder if the port-finding code here:

positron/extensions/jupyter-adapter/src/PortFinder.ts

Lines 52 to 53 in fef2820

	// Begin attempting to listen on the candidate port
	test.listen(candidate);

should also explicitly provide localhost or 127.0.0.1?

See also: https://nodejs.org/api/net.html#serverlistenport-host-backlog-callback

[jmcphers]

@kevinushey Thanks, that's a great find! I made the change locally and did a full rebuild. I didn't see the dialog this time, although the heuristics for showing it are pretty vague, so it's hard to tell if it's fixed or not. Worth a shot, either way. #1218

[jmcphers]

@jennybc Want to see if this is fixed for you now?

[juliasilge]

I'm using 2023.08.0 (Universal) build 363 today and I did not see this. I definitely have run into this on the first launch of previous builds in the past.

[petetronic]

I installed build 409 today and I also did not see this dialog, but have seen it in prior builds last week. Can we now consider this request as being addressed?

[jmcphers]

I think so!

[jmcphers]

Reopening as @jthomasmock has reported seeing this again.

[jthomasmock]

The popup was on build 3750 after updating to Mac (OSX 13.6 (22G120))

[juliasilge]

I just updated to Mac OSX 14.1 and opened up a release version of Positron totally fresh, after doing rm -rf ~/Library/Application\ Support/Positron. I do not see the dialog.

@jthomasmock Apologies for making you try again, but can you check if you still see this dialog on a totally fresh open of a release build? We aren't having any other reports of this or ability to reproduce it.

[jthomasmock]

Followed Julia's instructions and did fresh install with latest build - no issue/warning on my end 🎉

I'll defer to y'all on closing issue though.

[juliasilge]

Yeah, let's close for now since we aren't able to reproduce it. We can definitely reopen or make a new issue if we have further problems!

[jmcphers]

It's baaaaack. https://positpbc.slack.com/archives/C05M2EZCPGR/p1699929160768829

[jmcphers]

I have also seen this in release builds of VS Code when working with Jupyter; it may be that it just isn't possible to suppress it.

[petetronic]

From the comments here it sounds like this is not done? Re-opening for consideration.

[jmcphers]

Possibly related to #5800.