`air.exe` has access denied on Windows 11 Enterprise

[metanoid]

System details:

Positron and OS details:

Positron 2025-08.0-130
Windows 11 Enterprise

Session details:

R 4.5.0

Describe the issue:

Using version 2025.07.0-204 the Console is able to create a new R 4.5.0 session on start-up.
Changing nothing other than clicking "Restart to Update" causes Positron to update to 2025.08.0-130.
Starting this version of positron gives:
R 4.5.0 failed to start up (exit code 5) Failed to start process for session: Access is denied. (os error 5)

Edit: This is actually another problem than air.exe that's no longer reproducible. The problem with air.exe remains, see discussion below.

Steps to reproduce the issue:

Update from Positron 2025.07.0-204 to 2025.08.0-130 on a computer where PowerShell use is restricted by corporate IT policy.

[metanoid]

Switching back to 2025.04.0-204 works as a temporary workaround

[austin3dickey]

Hey @metanoid thanks for the issue! I will try to reproduce this behavior on a Windows machine with restricted use.

[austin3dickey]

In the meantime: could you please check out these two issues and see if any of the workarounds help for you?

• kallichore server did not start #7025
• R console failing to start #8000

[metanoid]

I updated back to the August build:

Positron Version: 2025.08.0 (user setup) build 130
Code - OSS Version: 1.102.0
Commit: 76ddce5
Date: 2025-08-01T20:29:20.753Z
Electron: 35.6.0
Chromium: 134.0.6998.205
Node.js: 22.15.1
V8: 13.4.114.21-electron.0
OS: Windows_NT x64 10.0.22631

I can report the following:
Running air.exe has an Access is denied. error:

\.positron\extensions\posit.air-vscode-0.16.0-win32-x64\bundled\bin>air
Access is denied.

But running kcserver.exe does work:

\AppData\Local\Programs\Positron\resources\app\extensions\positron-supervisor\resources\kallichore>kcserver
06:59:00 [INFO] Using OS-assigned port: 50671
06:59:00 [INFO] Using TCP transport on port: 50671
Listening at 127.0.0.1:50671
06:59:00 [INFO] Generated random auth token: [redacted]

  ,            _   _           _
 /|   /       | | | | o       | |
  |__/   __,  | | | |     __  | |     __   ,_    _
  | \   /  |  |/  |/  |  /    |/ \   /  \_/  |  |/
  |  \_/\_/|_/|__/|__/|_/\___/|   |_/\__/    |_/|__/
  A Jupyter Kernel supervisor. Version 0.1.51.
  Copyright (c) 2025, Posit Software PBC. All rights reserved.

And also ark.exe works:

\AppData\Local\Programs\Positron\resources\app\extensions\positron-r\resources\ark>ark
Ark 0.1.201, an R Kernel.

However, the 'KernelSupervisor' reports the following (lightly edited for privacy):

2025-08-06 08:53:26.332 [info] Positron Kernel Supervisor activated
2025-08-06 08:53:26.341 [info] 06:53:15 [Positron] Kallichore server PID 62804 is not running
2025-08-06 08:53:26.341 [info] 06:53:15 [Positron] Could not reconnect to Kallichore server at http://npipe:\\.\pipe\kallichore-62804:. Starting a new server
2025-08-06 08:53:26.341 [info] 06:53:15 [Positron] Generated connection file path: C:\Users\me\AppData\Local\Temp\kallichore-8bb8cf7a-22480.json
2025-08-06 08:53:26.341 [info] 06:53:15 [Positron] Using native IPC transport: named pipes
2025-08-06 08:53:26.341 [info] 06:53:15 [Positron] Starting Kallichore server c:\Users\me\AppData\Local\Programs\Positron\resources\app\extensions\positron-supervisor\resources\kallichore\kcserver.exe with connection file C:\Users\me\AppData\Local\Temp\kallichore-8bb8cf7a-22480.json
2025-08-06 08:53:26.343 [info] 06:53:20 [Positron] Read named pipe connection information from C:\Users\me\AppData\Local\Temp\kallichore-8bb8cf7a-22480.json: \\.\pipe\kallichore-5564, constructed base path: http://npipe:\\.\pipe\kallichore-5564:
2025-08-06 08:53:26.343 [info] 06:53:20 [Positron] Kallichore 0.1.51 server online with 0 sessions
2025-08-06 08:53:26.343 [info] 06:53:20 [Positron] Running as pid 5564 (terminal pid 19500)
2025-08-06 08:53:26.343 [info] 06:53:20 [Positron] Kallichore server started in 4947ms
2025-08-06 08:53:26.343 [info] 06:53:20 [Positron] Streaming Kallichore server logs from C:\Users\me\AppData\Local\Temp\kallichore-8bb8cf7a-22480.log (log level: debug)
2025-08-06 08:53:26.343 [info] 06:53:17 [INFO] Using named pipe: \\.\pipe\kallichore-5564
2025-08-06 08:53:26.343 [info] 06:53:17 [INFO] Generated random auth token: [redacted]
2025-08-06 08:53:26.343 [info] 06:53:17 [INFO] Wrote connection details to C:\Users\me\AppData\Local\Temp\kallichore-9cb8cf7a-23456.json
2025-08-06 08:53:26.343 [info] 06:53:17 [DEBUG] (1) kcserver: Starting Kallichore
2025-08-06 08:53:26.343 [info] 06:53:17 [INFO] Starting named pipe HTTP server on: \\.\pipe\kallichore-5564
2025-08-06 08:53:26.343 [info] 06:53:17 [INFO] Server set to shut down after 1 hours of inactivity
06:53:27 [Positron] Creating session: {"sessionId":"r-5312302a","sessionMode":"console","createdTimestamp":1754463207204,"startReason":"Affiliated R runtime for workspace"}
06:53:28 [INFO] new_session("r-5312302a") - X-Span-ID: "[redacted]"
06:53:28 [DEBUG] (4) kcserver::server: Created log file for session r-5312302a at "C:\\Users\\me\\AppData\\Local\\Temp\\kernel_log_r-5312302a.txt"
06:53:29 [INFO] start_session("r-5312302a") - X-Span-ID: "[redacted]"
06:53:29 [DEBUG] (4) kcserver::kernel_state: [session r-5312302a] status 'idle' => 'starting' (start API called)
06:53:29 [INFO] [session r-5312302a] Kernel supports JEP 66 (protocol version 5.5) - creating registration socket for handshake
06:53:29 [DEBUG] (4) kcserver::kernel_session: Started registration socket for session r-5312302a with port 50573
06:53:29 [DEBUG] (4) kcserver::kernel_session: Wrote registration file for session r-5312302a at "C:\\Users\\me\\AppData\\Local\\Temp\\registration_r-5312302a.json" with port 50573
06:53:29 [DEBUG] (4) kcserver::kernel_session: Starting kernel for session r-5312302a: ["c:\\Users\\me\\AppData\\Local\\Programs\\Positron\\resources\\app\\extensions\\positron-r\\resources\\ark\\ark.exe", "--connection_file", "C:\\Users\\me\\AppData\\Local\\Temp\\registration_r-5312302a.json", "--log", "C:\\Users\\me\\AppData\\Local\\Temp\\kernel-gp1OC3\\kernel.log", "--startup-file", "c:\\Users\\me\\AppData\\Local\\Programs\\Positron\\resources\\app\\extensions\\positron-r\\resources\\scripts\\startup.R", "--session-mode", "console", "--", "--interactive", "--no-restore-data"]
06:53:30 [ERROR] Failed to start kernel: Access is denied. (os error 5)
06:53:30 [DEBUG] (4) kcserver::kernel_state: [session r-5312302a] status 'starting' => 'exited' (kernel start failed)
06:53:40 [INFO] Heartbeat now tracking client: 22480

I can attempt other experiments if you like, but I need the simple explanation of how to run each experiment.

[juliasilge]

Ah interesting, so it looks like the problem is air! We had someone run into something similar in #8394. Does the workaround outlined there help you out?

@DavisVaughan and @lionel-, we may need to evaluate this again.

[juliasilge]

Some open questions here:

• Did air failing really stop R from running?

• For air failures, we could bundle the air binary in our build and tell the extension where it is. Would we do the same for ruff?