I need to add my service to the include list to support my extension's use of shareService()

[0xJuancito]

Product and Version VSCode v1.38.1
OS Version macOS Mojave v10.14.6
Live Share Extension Version v1.0.905
Target Platform or Language Node.js v10.16.3

Steps to Reproduce / Scenario:

I've tried to use vsls v0.3.1291 to create a VSCode extension for collaborative music livecoding on top of Live Share. For that purpose, I need to use the shareService() method, but it always returns null.

I've tried setting this parameter: "liveshare.featureSet": "insiders" but it didn't work. I also tried publishing the app in the Marketplace and downloading it, but with the same result

It is related to this issue: #736

[parithon]

I'm experiencing this behavior too.

Version: 1.38.1 (system setup)
Commit: b37e54c98e1a74ba89e03073e5a3761284e3ffb0
Date: 2019-09-11T13:35:15.005Z
Electron: 4.2.10
Chrome: 69.0.3497.128
Node.js: 10.11.0
V8: 6.9.427.31-electron.0
OS: Windows_NT x64 10.0.18362
ms-vsliveshare.vsliveshare: 1.0.950
vsls: 0.3.1291

[fubaduba]

Thanks for reporting this issue. We are going to prioritize this and figure out why the method is behaving unexpectedly.

[lostintangent]

This should be resolved now! Please let us know if you’re still encountering issues 👍

[parithon]

Hi @lostintangent - unless I am doing something wrong whatever changed did not fix the issue for me. I am willing to do a live-share session to figure it out :)

But you can also see my code in the above mention.

-VSCODE-
Version: 1.43.1 (user setup)
Commit: fe22a9645b44368865c0ba92e2fb881ff1afce94
Date: 2020-03-18T07:01:20.184Z
Electron: 7.1.11
Chrome: 78.0.3904.130
Node.js: 12.8.1
V8: 7.8.279.23-electron.0
OS: Windows_NT x64 10.0.19035

-NPM-
"vsls": "^0.3.1291"

Live Share Extension: 1.0.1783

[parithon]

@lostintangent

I still encounter this issue with my project.

[daytonellwanger]

@parithon , do you have the liveshare.featureSet setting in VS Code set to insiders? If not, could you try that?

[parithon]

Yes, I do.

[parithon]

To test, I changed my extension id and publisher to match those used by vscode-test-explorer-liveshare and also changed the shared service name to match what is used in that extension and it returned an object as expected.

[lostintangent]

@parithon Hmm, that seems to indicate that our logic for the API permissions regressed, and is only allowing whitelisted extensions to call it. We should obviously fix that 😁

As you discovered, you can unblock yourself by using an the publisher/ID of an extension that’s already allowed, but we can also whitelist your extension if you can share a pointer to it, so we can see what it does and how it uses this API (we limit access to this API so we can ensure it’s used properly).

[parithon]

I am the co-author of the following: https://github.com/clarkio/vscode-twitch-highlighter

[ElianHugh]

Sorry to bump, but I just wanted to check if whitelisting was still required/resolved for shareService, as I can't find this in the docs and have been only having null returned.

I've been fiddling with the API in order to better integrate LiveShare with Vscode-R, but this has been brick walling me a bit.

I can open a new issue if that would suit!

Thanks! :)

[lostintangent]

Hey! Currently, the allow list is required. We could add the R extension to the list though, and get you unblocked. Would you mind sharing how you plan to use the Live Share API with this extension?

[ElianHugh]

Hey! Currently, the allow list is required. We could add the R extension to the list though, and get you unblocked. Would you mind sharing how you plan to use the Live Share API with this extension?

Thanks! At the moment, guest sessions for Vscode-R are unable to use the environment viewer due to it relying on local files for data. In order to have a synced environment viewer, I was hoping to use RPC to request file content from the host, to feed to the guest session.

Relevant issues:
#4098
#555

[ElianHugh]

Just thought I would bump this!

For an example of how this would be used in the extension, please see this fork of vscode-r: https://github.com/ElianHugh/vscode-R-Live-Share/blob/master/src/rShare.ts

Essentially, the guest requests file content from the host, the host reads the content and returns it to the guest. This content is used to populate tables, graphs, workspace viewers, etc.

If you would like more information, please let me know! Thanks!

[lostintangent]

@ElianHugh Hey! I just sent out a PR to add the R extension to the Live Share allow list. That should be merged and ready by this afternoon, so I'll ping the thread as soon as that's live 👍🏻

[lostintangent]

@ElianHugh FYI, this change has been made, and so if you reload VS Code, you should see that the R extension is able to access the Live Share API. Let us know if you run into any problems. Thanks!

[Davsterl]

Re-labeling this thread for any other services who wish to add their service to the supported list.

[parithon]

@parithon Hmm, that seems to indicate that our logic for the API permissions regressed, and is only allowing whitelisted extensions to call it. We should obviously fix that 😁

As you discovered, you can unblock yourself by using an the publisher/ID of an extension that’s already allowed, but we can also whitelist your extension if you can share a pointer to it, so we can see what it does and how it uses this API (we limit access to this API so we can ensure it’s used properly).

I am the co-author of the following: https://github.com/clarkio/vscode-twitch-highlighter

@lostintangent I never got a response to this. Has your team had the opportunity to fix the regression or can you please add this extension to the allowed whitelist? To see an example of what we're trying to accomplish you can see the branch: https://github.com/parithon/vscode-twitch-highlighter/tree/liveshare

TLDR; We will be using VSLS to notify guests whenever a highlighted line is added or removed.

[pfitzseb]

Hey, would be great if the Julia extension could also be added to the list of supported extensions (well, a fix for that regression would be even better, of course).
Our current plan is to support synchronizing plots (WIP PR) and the workspace view, but that may be extended to other features like inline results.

[daytonellwanger]

Just to be clear, shareService is only available to extensions on an allow list that we maintain. If your extension isn't part of that list, the expected behavior is that shareService returns null. We do this to avoid abuse, since extensions can stream arbitrary data between clients using it. All other parts of the extension API don't require special permissions.

If you would like your extension added to the allow list, please reply with a description of how you intend to use the API.

@parithon @pfitzseb I'll take a look at your requests.

[daytonellwanger]

@parithon @pfitzseb I've added both of your extensions to the allow list. Let me know if shareService works now. Looking forward to seeing what y'all build!

[labuladong]

@daytonellwanger Hi, thanks for this amazing functionality, please add my extension to the allow list.

I write an extension to help users to play with LeetCode (here), this extension provides many useful command, such as open question, find a solution and so on.

When I know about live share extension, I think my extension may provide something like a 'room', many people can solve LeetCode problem together. But I found execution of vscode extension command cannot be shared through live share, so I decide to use vsls API to pass extension command between host and guest.

Seems that get shareService is the only solution, please add my extension to the allow list or give me some suggestions, thanks again!

[daytonellwanger]

Hey @labuladong , yes, it sounds like shareService is what you would need to support your scenario.

Is your extension source code stored in a public repo? The one linked to from the the extension marketplace doesn't look like the repo for the extension.

Do you have a prototype of your Live Share feature? You should be able to test locally by changing your extension ID to one of the approved extensions as mentioned in this thread (I'll look into coming up with a better development experience for extensions pre-approval).

[labuladong]

@daytonellwanger Hi, thanks for your reply. My repo is here. I have tried to use approved extension ID locally and it works perfectly, I will develop my extension in this way now.

[daytonellwanger]

Hey @labuladong , I took a quick look at the extension and it looks like it makes it quite easy for the host to execute arbitrary commands on the guest's machine (see here). Do you have any security measures in place to prevent a guest from being exploited by a malicious host? We wouldn't want Live Share to be the enabler for a hack.

[daytonellwanger]

Maybe we should open a separate issue to further discuss?

[labuladong]

@daytonellwanger Let's discuss it here

[labuladong]

@daytonellwanger Hi, I've tested locally and improved the usage of vsls API, I use a whitelist to avoid executing arbitrary commands here. Do you have any suggestion? Please add my extension to the allow list and look forward to your reply, thanks :)

[daytonellwanger]

Hey @labuladong , I'm no longer working on the Live Share team, but I'll make sure they have someone else follow up on getting your extension on the allow list.

[labuladong]

@daytonellwanger Thanks! And best wishes to you :)

[labuladong]

Can someone put my extension on the allow list? Thanks! @lostintangent @Davsterl

[ElianHugh]

Hello again :) Sorry to bump, but the shareService API has stopped working for the R extension. Specifically, shareService() is always returning null, where before it was appropriately returning a SharedService object. We did go through a publisher change last year which may have affected the whitelisting?

[fubaduba]

Hey @ElianHugh thank you for bringing this to our attention. We will take a look at our allow list and check why the R extension has stopped working with the shareService(). Please stay tuned.

[c-st]

Hello @fubaduba. We recently started developing our extension based on vsls and noticed that we were having similar issues with shareService not working. We worked around that during development by using name and publisher of an existing extension in our package.json.

What is the suggested procedure to get our extension whitelisted once we're ready to release?