Skip to content

Conversation

@samgst-amazon
Copy link
Contributor

@samgst-amazon samgst-amazon commented Jun 17, 2025

Problem

With the introduction of agentic chat, Amazon Q Developer now runs its language server (Flare) in a separate Node.js process outside of VS Code's control. This creates network connectivity issues in corporate environments:

The Node.js process doesn't inherit VS Code's proxy settings, causing connection failures behind corporate proxies

Corporate SSL certificates aren't trusted by the Node.js process, resulting in certificate validation errors

Proxy authentication (including Integrated Windows Authentication) doesn't work automatically

These issues prevent Amazon Q Developer from functioning in enterprise environments with strict network policies.

Solution

This PR enables the Flare Language Server to inherit VS Code's Electron proxy settings and certificate trust store:

Added a getElectronSettings() function that extracts:

Proxy rules from Electron's session

Proxy bypass rules for local addresses

Trusted certificates from Electron's certificate store

Modified createServerOptions() to:

Apply Electron's proxy settings to the Node.js process environment

Pass trusted certificates to Node.js via NODE_EXTRA_CA_CERTS

Preserve proxy bypass rules via NO_PROXY

Simplified the proxy environment setup in baseLspInstaller.ts to focus on SSL verification settings

This approach ensures that the Node.js process uses the same proxy configuration and certificate trust store as VS Code, making Amazon Q Developer work transparently in corporate environments without requiring manual configuration.

  • Treat all work as PUBLIC. Private feature/x branches will not be squash-merged at release time.
  • Your code changes must meet the guidelines in CONTRIBUTING.md.
  • License: I confirm that my contribution is made under the terms of the Apache 2.0 license.

  • Treat all work as PUBLIC. Private feature/x branches will not be squash-merged at release time.
  • Your code changes must meet the guidelines in CONTRIBUTING.md.
  • License: I confirm that my contribution is made under the terms of the Apache 2.0 license.

@github-actions
Copy link

  • This pull request modifies code in src/* but no tests were added/updated.
    • Confirm whether tests should be added or ensure the PR description explains why tests are not required.
  • This pull request implements a feat or fix, so it must include a changelog entry (unless the fix is for an unreleased feature). Review the changelog guidelines.
    • Note: beta or "experiment" features that have active users should announce fixes in the changelog.
    • If this is not a feature or fix, use an appropriate type from the title guidelines. For example, telemetry-only changes should use the telemetry type.

@samgst-amazon samgst-amazon marked this pull request as ready for review June 17, 2025 18:32
@samgst-amazon samgst-amazon requested a review from a team as a code owner June 17, 2025 18:32

try {
// Check if user already has NODE_EXTRA_CA_CERTS set
const userCerts = process.env.NODE_EXTRA_CA_CERTS
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

not sure if this works correctly on mac -- see discussion in jetbrains/eclipse where macOS does not inherit the console environment due to how app launching works


try {
// @ts-ignore - we need this function to access certs
const certs = tls.getCACertificates()
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

not sure how this would work. the default behavior is to use the node bundled CAs, which is not what we want. should this be explicitly system? or does this just magically work because VSC is patching the return value?

@samgst-amazon samgst-amazon merged commit ad2164b into master Jun 21, 2025
30 of 31 checks passed
@samgst-amazon samgst-amazon deleted the samgst/proxy-ca-fix branch June 21, 2025 00:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants