← All reportsPublic report

microsoft/vscode

Visual Studio Code

190k stars TypeScript View on GitHubprofiled 11d ago
Try GitZoid
400PRs this week
56Contributors
1437Deps scanned
0Issues found
01 · Repo overview

How vscode is put together

This is microsoft/vscode (Code - OSS), the open-source Visual Studio Code editor, version 1.136.0. It is a large TypeScript/Electron desktop application organized into layered modules under src/vs (base, platform, editor, workbench, code), plus a Node-based remote server (src/server-*.ts, vs/server), bundled extensions under extensions/, a Rust-based CLI under cli/, and an extensive Gulp/esbuild build system under build/. Data flows from the Electron main process (src/main.ts bootstraps app, sandbox, protocols, NLS) through IPC to renderer/workbench processes and extension hosts; a separate server entry supports browser/remote scenarios. The repo also integrates AI features via Copilot and Anthropic/OpenAI SDK dependencies.

Languages

TypeScriptJavaScriptRust

Frameworks

ElectronNode.jsxterm.jsGulpesbuildMochaPlaywright

Datastores

SQLite (@vscode/sqlite3)

Infrastructure

Azure DevOps Pipelines (build/azure-pipelines/*.yml)Docker dev container (.devcontainer/Dockerfile)GitHub CodespacesElectron desktop packaging (Inno Setup, rcedit, @electron/osx-sign)Azure Blob Storage / Cosmos DB for build toolingCodeQL (CodeQL.yml)

Major components

Electron main process bootstrap

src/main.ts and src/bootstrap-*.ts configure the Electron app: sandbox toggles, command-line switches, userData paths, crash reporter, privileged custom schemes, NLS, then load vs/code/electron-main.

Core layered source tree (src/vs)

The editor itself, split into base (utilities), platform (DI services), editor (Monaco-style editing surface), workbench (UI shell/contributions), and code (process entries).

Remote/server runtime

src/server-cli.ts and src/server-main.ts bootstrap a headless Node server (vs/server/node) that serves VS Code remotely, injecting dev node module lookup paths when running from sources.

Bundled extensions

extensions/ contains built-in extensions (including extensions/copilot built with its own compile/watch pipeline) packaged via esbuild-common.mts scripts.

Rust CLI

cli/ is a standalone Rust binary (Cargo.toml/Cargo.lock) accompanying the editor, with its own contribution guide and rustfmt config.

Build & release pipeline

build/ holds Gulp files (gulpfile.vscode*.ts, reh/web/cli variants), esbuild transpilation (buildConfig.ts useEsbuildTranspile), hygiene/lint tooling, policy export, and Azure DevOps product-build YAML definitions.

Lint & hygiene enforcement

eslint.config.js plus ~50 custom rules in .eslint-plugin-local enforce layering, localization, disposal, telemetry-property, and API-shape conventions across the codebase.

Dev container environment

.devcontainer provides Dockerfile/devcontainer.json/post-create.sh to build Code - OSS in Docker or Codespaces with a Fluxbox/VNC desktop.

The last two weeks of VS Code development were dominated by the Agent Host and chat sessions experience, with heavy investment in session management, chat UI polish (pills, backgrounds, sticky scroll), and reliability fixes around sandbox credentials and authentication. Underneath that, the team shipped platform-level updates like a new Electron version, system certificates enabled by default, and various performance and stability fixes. The overall arc shows VS Code maturing its AI agent capabilities while continuing routine editor maintenance.

Week by week

2026-08-24Agent Host sessions got more robust and customizable, with security defaults tightened and chat surfaces refined.latest6 changes

Feature

System certificates enabled by default

Node.js now trusts your operating system's certificate store out of the box, improving compatibility with corporate networks.

Feature

Customizable Agents chat backgrounds

Users can now personalize the background of the Agents chat view, with better alignment of floating panels during startup and layout changes.

Fix

Sandbox credential and task reliability

Sandbox tasks now wait for complete credentials before connecting, get realistic time budgets, and produce clearer error messages when they fail.

Feature

Open Chat Agent keybinding

You can now jump straight into an Agent chat session with a keyboard shortcut, and recently used sessions are kept handy in the list.

Chore

Electron upgraded to 42.9.3

The underlying desktop framework was bumped to a newer version for updated platform support and fixes.

Fix

Graceful handling of embedding errors

A server rejection when generating embeddings now shows a friendly message instead of crashing, fixing a long-standing issue.

2026-08-17Chat pills and session management were overhauled while Agent Host gained telemetry, trust gating, and service cleanup.6 changes

Refactor

Chat pill cleanup

The workspace chat pill was removed, floating pills were repositioned above the chat input, and browser websites no longer clutter the artifacts pill.

Feature

Auto-generated titles for external sessions

Untitled external chat sessions now get meaningful names automatically, and the sessions list defaults to showing recent ones first.

Feature

Workspace trust gate for sessions

Opening a chat session now respects workspace trust settings, protecting users from untrusted content.

Refactor

Smoother chat sticky scroll

Sticky headers in chat take up less vertical space and scroll more fluidly.

Fix

Syntax highlighting cache fix

A failed load of the syntax-highlighting engine no longer gets permanently cached, fixing broken highlighting until restart.

Refactor

Sealed Agent Host service graph

Internal Agent Host services were restructured to be more predictable and easier to maintain, along with new usage telemetry for recursive agent turns.

03 · Security check

Dependencies and code review

1437 dependencies scanned

Dependency advisories

Security Watch

No known advisories across 1437 scanned dependencies.

No known advisories in the scanned dependencies.

Code review

No concrete code-level issues confirmed.

Get this report every week for your repos.

GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.

$19 a month, flat · First 10 outputs free · No card required