GitHub Copilot Internal Architecture: Context Injection and Session Storage Analysis

Analysis of GitHub Copilot's network traffic via a Man-in-the-Middle (MitM) proxy and VS Code source code reveals that the tool is evolving into a stateful system. It achieves this by combining user workspace data, recent edits, conversation history, and a local SQLite database to assemble context for the LLM.

Model Routing and Discovery

GitHub Copilot uses a multi-stage process to determine which model should handle a specific user request. This process begins during the bootstrap stage, where the extension performs authentication via OAuth and discovers available models.

Model Discovery

Copilot makes two distinct requests to identify available capabilities:

A request to /models to retrieve a general list of available models.
A request to /agents/swe/models to identify models specifically suited for agentic Software Engineering (SWE) capabilities.

Intent-Based Routing

When a user sends a message in "Auto" mode, Copilot does not immediately call a generative model. Instead, it sends the prompt to a /models/session/intent endpoint. The system scores the prompt against various intents—such as code-gen, debugging, reasoning, and tool-use—and uses this classification to route the request to the most appropriate model for the task.

Context Injection and Privacy Risks

Copilot's ability to provide relevant suggestions depends on the context it injects into prompts. However, this mechanism can inadvertently leak sensitive data from files the user is not currently editing.

The "Recent Edits" Leak

Copilot implements a sliding window for context that includes up to 20 files, 8 edit summaries, and 3 lines of context around each change. Because this window tracks recent edits across the workspace, a secret stored in a .env file can be included in a prompt triggered by keystrokes in a completely unrelated file (e.g., a pyproject.toml file).

Lack of Default Secret Filtering

Analysis of the VS Code source code confirms that there is no default scrubbing, redaction, or secret-filtering step in the write path for context. While "repository policies" exist for Business and Enterprise plans to restrict certain files, individual plans have no default rules treating .env files as special, nor is there integration with .gitignore to prevent sensitive files from being sent to the API.

Local State and the Chronicle Tool

GitHub Copilot maintains a local state to provide long-term memory across sessions, implemented via a tool called Chronicle.

The session-store.db

Copilot utilizes a local SQLite database named session-store.db to store session summaries, repositories, branches, and a complete history of user prompts and assistant responses.

Plaintext Storage and Tool Access

The user_message and assistant_response columns in the session-store.db are stored in plain text. The LLM can access this history through a tool called session_store_sql, which allows the model to run SQL queries against the local database to answer questions about previous work (e.g., "What did I work on this week?").

Source code analysis of sessionStore.ts confirms that turn.user_message is inserted into the database as-is, without any masking or sanitization.

Technical Implementation of the Analysis

To uncover these behaviors, the researcher used mitmproxy to intercept HTTPS traffic between the Electron-based VS Code application and GitHub's servers.

Interception Setup

Because VS Code is built on Electron (Chromium + Node.js), traffic can be routed through a proxy by configuring the following settings:

Http Proxy: http://localhost:8080
Http Proxy Strict SSL: Unchecked (to allow the mitmproxy CA certificate).
Http: Proxy Support: Set to override to force proxy support for extensions.

Alternative Observation Methods

Community discussion suggests other methods for observing Copilot's internals:

eBPF: Using eBPF can capture raw plaintext data directly from the wire before encryption or after decryption, bypassing the need to fight certificate pinning or mTLS.
Agent Debug Logs: VS Code includes a built-in feature accessible via the "show agent debug logs" option in the Copilot conversation menu, which displays tool calls, prompts, and model selection logic.

Conclusion: Context as the Product

The differentiation between AI coding tools is shifting from the raw power of the underlying model to the sophistication of the "harness"—the system that assembles the right context. The primary engineering challenge is now balancing context density (keeping prompts lean and cache-friendly) with strict privacy boundaries to ensure sensitive developer state does not cross into model APIs or plaintext local storage.