# Data flow — microsoft/vscode

> Canonical page: https://codevetter.com/unpack/vscode/data-flow

# Data flow — microsoft/vscode

Scanned commit f6439326f6891a1eaf254a19fc1a78243cbb8f9d (2026-09-22). Generated by codevetter codevetter 1.12.0 on 2026-09-22.

Data moves through explicit service boundaries. On disk, IFileService is the single funnel: scheme-based IFileSystemProviders are registered for file:, vscode-userdata:, vscode-remote:, in-memory and IndexedDB backends. Settings flow through a layered ConfigurationService (defaults → policy → user → workspace → folder) fed by NativePolicyService/FilePolicyService/MultiplexPolicyService. Workbench state persists through IStorageService whose desktop implementation proxies reads/writes to the main-process StorageMainService over the 'storage' IPC channel. Secrets go through ISecretStorageService → IEncryptionService → OS keyring. Extension APIs are pure RPC: extHost.* objects are registered as addressable ExtHostContext instances and call MainContext.MainThread* proxies over the extension-host protocol. Telemetry is appended in the shared process via a 'telemetryAppender' channel.
- FileService.registerProvider(scheme, provider) is the input boundary for all file IO: main registers DiskFileSystemProvider for 'file' and FileUserDataProvider for 'vscode-userdata'; the workbench additionally registers IndexedDB, in-memory, HTML File System Access, and remote providers. — [src/vs/platform/files/common/fileService.ts#L26-L60](https://github.com/microsoft/vscode/blob/f6439326f6891a1eaf254a19fc1a78243cbb8f9d/src/vs/platform/files/common/fileService.ts#L26-L60) [src/vs/code/electron-main/main.ts#L191-L212](https://github.com/microsoft/vscode/blob/f6439326f6891a1eaf254a19fc1a78243cbb8f9d/src/vs/code/electron-main/main.ts#L191-L212) [src/vs/workbench/browser/web.main.ts#L40-L66](https://github.com/microsoft/vscode/blob/f6439326f6891a1eaf254a19fc1a78243cbb8f9d/src/vs/workbench/browser/web.main.ts#L40-L66)
- Desktop workbench persistence goes over IPC: StorageDatabaseChannel wrapping IStorageMainService/StorageMainService is registered on the 'storage' channel for both renderer and shared-process clients; main-process state itself uses StateService with SaveStrategy.DELAYED. — [src/vs/code/electron-main/app.ts#L1443-L1449](https://github.com/microsoft/vscode/blob/f6439326f6891a1eaf254a19fc1a78243cbb8f9d/src/vs/code/electron-main/app.ts#L1443-L1449) [src/vs/platform/storage/electron-main/storageMainService.ts](https://github.com/microsoft/vscode/blob/f6439326f6891a1eaf254a19fc1a78243cbb8f9d/src/vs/platform/storage/electron-main/storageMainService.ts) [src/vs/code/electron-main/main.ts#L201-L204](https://github.com/microsoft/vscode/blob/f6439326f6891a1eaf254a19fc1a78243cbb8f9d/src/vs/code/electron-main/main.ts#L201-L204)
- Configuration is layered: ConfigurationService is constructed with the default profile's settingsResource, the FileService, and an IPolicyService that multiplexes OS-native policies (registry/plist via NativePolicyService) and file policies (Linux system path or --policy-file), plus separate native/file managed-settings services for Copilot policy. — [src/vs/code/electron-main/main.ts#L214-L272](https://github.com/microsoft/vscode/blob/f6439326f6891a1eaf254a19fc1a78243cbb8f9d/src/vs/code/electron-main/main.ts#L214-L272) [src/vs/platform/policy/common/multiplexPolicyService.ts](https://github.com/microsoft/vscode/blob/f6439326f6891a1eaf254a19fc1a78243cbb8f9d/src/vs/platform/policy/common/multiplexPolicyService.ts) [src/vs/platform/configuration/common/configurationService.ts](https://github.com/microsoft/vscode/blob/f6439326f6891a1eaf254a19fc1a78243cbb8f9d/src/vs/platform/configuration/common/configurationService.ts)
- Extension-host RPC is symmetric: createApiFactoryAndRegisterActors registers ~40 ExtHostContext.* actors (ExtHostCommands, ExtHostDocuments, ExtHostTerminalService, ExtHostChatAgents2, ExtHostMpcService…) and obtains MainContext.MainThread* proxies; shapes are declared in extHost.protocol.ts and marshalled by RPCProtocol. — [src/vs/workbench/api/common/extHost.api.impl.ts#L183-L259](https://github.com/microsoft/vscode/blob/f6439326f6891a1eaf254a19fc1a78243cbb8f9d/src/vs/workbench/api/common/extHost.api.impl.ts#L183-L259) [src/vs/workbench/api/common/extHost.protocol.ts](https://github.com/microsoft/vscode/blob/f6439326f6891a1eaf254a19fc1a78243cbb8f9d/src/vs/workbench/api/common/extHost.protocol.ts) [src/vs/workbench/services/extensions/common/rpcProtocol.ts](https://github.com/microsoft/vscode/blob/f6439326f6891a1eaf254a19fc1a78243cbb8f9d/src/vs/workbench/services/extensions/common/rpcProtocol.ts)
- Secrets flow: extension secret storage calls ISecretStorageService → IEncryptionService which picks an OS keyring provider (gnome-libsecret/kwallet via Electron safeStorage, or Windows/macOS stores) with an explicit 'use weaker encryption' plaintext fallback and a --use-inmemory-secretstorage argv.json escape hatch. — [src/vs/workbench/services/secrets/electron-browser/secretStorageService.ts](https://github.com/microsoft/vscode/blob/f6439326f6891a1eaf254a19fc1a78243cbb8f9d/src/vs/workbench/services/secrets/electron-browser/secretStorageService.ts) [src/vs/platform/encryption/common/encryptionService.ts](https://github.com/microsoft/vscode/blob/f6439326f6891a1eaf254a19fc1a78243cbb8f9d/src/vs/platform/encryption/common/encryptionService.ts) [src/main.ts#L286-L291](https://github.com/microsoft/vscode/blob/f6439326f6891a1eaf254a19fc1a78243cbb8f9d/src/main.ts#L286-L291)
- Telemetry is funneled to the shared process: the main-process TelemetryService uses a TelemetryAppenderClient over the shared-process 'telemetryAppender' channel; PII paths are computed via getPiiPathsFromEnvironment and the 1DS SDK packages are dependencies. — [src/vs/code/electron-main/app.ts#L1299](https://github.com/microsoft/vscode/blob/f6439326f6891a1eaf254a19fc1a78243cbb8f9d/src/vs/code/electron-main/app.ts#L1299) [src/vs/platform/telemetry/common/telemetryService.ts](https://github.com/microsoft/vscode/blob/f6439326f6891a1eaf254a19fc1a78243cbb8f9d/src/vs/platform/telemetry/common/telemetryService.ts) [package.json#L103-L104](https://github.com/microsoft/vscode/blob/f6439326f6891a1eaf254a19fc1a78243cbb8f9d/package.json#L103-L104)
- Text file persistence path: dirty TextFileEditorModel instances are saved through TextFileService with TextFileSaveParticipant hooks (e.g., format-on-save, trim) before FileService.writeFile hits the disk provider; working-copy backups are handled separately by workingCopyBackupService. — [src/vs/workbench/services/textfile/common/textFileEditorModel.ts](https://github.com/microsoft/vscode/blob/f6439326f6891a1eaf254a19fc1a78243cbb8f9d/src/vs/workbench/services/textfile/common/textFileEditorModel.ts) [src/vs/workbench/services/textfile/common/textFileSaveParticipant.ts](https://github.com/microsoft/vscode/blob/f6439326f6891a1eaf254a19fc1a78243cbb8f9d/src/vs/workbench/services/textfile/common/textFileSaveParticipant.ts) [src/vs/workbench/services/workingCopy/browser/workingCopyBackupService.ts](https://github.com/microsoft/vscode/blob/f6439326f6891a1eaf254a19fc1a78243cbb8f9d/src/vs/workbench/services/workingCopy/browser/workingCopyBackupService.ts)
- Remote authority flow: workbench asks IRemoteAuthorityResolverService to resolve 'vscode-remote://…' authorities; resolution is delegated to a resolver extension in the extension host, after which RemoteAgentService channels (file system, terminals, extension management, extension host) run over the remote socket via IRemoteSocketFactoryService. — [src/vs/platform/remote/common/remoteAuthorityResolver.ts](https://github.com/microsoft/vscode/blob/f6439326f6891a1eaf254a19fc1a78243cbb8f9d/src/vs/platform/remote/common/remoteAuthorityResolver.ts) [src/vs/workbench/services/remote/common/remoteAgentService.ts](https://github.com/microsoft/vscode/blob/f6439326f6891a1eaf254a19fc1a78243cbb8f9d/src/vs/workbench/services/remote/common/remoteAgentService.ts) [src/vs/platform/remote/common/remoteSocketFactoryService.ts](https://github.com/microsoft/vscode/blob/f6439326f6891a1eaf254a19fc1a78243cbb8f9d/src/vs/platform/remote/common/remoteSocketFactoryService.ts) [src/vs/workbench/browser/web.main.ts#L82-L84](https://github.com/microsoft/vscode/blob/f6439326f6891a1eaf254a19fc1a78243cbb8f9d/src/vs/workbench/browser/web.main.ts#L82-L84)
- URL/protocol input boundary: vscode:// deep links are received by ElectronURLListener in the main process, routed via the 'url' channel and URLHandlerRouter to window or extension handlers; initial protocol URLs are captured before the first window opens. — [src/vs/platform/url/electron-main/electronUrlListener.ts](https://github.com/microsoft/vscode/blob/f6439326f6891a1eaf254a19fc1a78243cbb8f9d/src/vs/platform/url/electron-main/electronUrlListener.ts) [src/vs/code/electron-main/app.ts#L1436, ](https://github.com/microsoft/vscode/blob/f6439326f6891a1eaf254a19fc1a78243cbb8f9d/src/vs/code/electron-main/app.ts#L1436, ) [src/vs/platform/url/common/urlIpc.ts](https://github.com/microsoft/vscode/blob/f6439326f6891a1eaf254a19fc1a78243cbb8f9d/src/vs/platform/url/common/urlIpc.ts)
- Extension scanning/activation data flow: ExtensionsScannerService (main) + ExtensionsProfileScannerService feed ExtensionDescriptionRegistry in the workbench; ImplicitActivationEvents computes activation events, ExtensionRunningLocationTracker assigns local/remote/web-worker locations, and deltas stream through _onDidChangeExtensions. — [src/vs/workbench/services/extensions/common/abstractExtensionService.ts#L60-L140](https://github.com/microsoft/vscode/blob/f6439326f6891a1eaf254a19fc1a78243cbb8f9d/src/vs/workbench/services/extensions/common/abstractExtensionService.ts#L60-L140) [src/vs/platform/extensionManagement/node/extensionsScannerService.ts](https://github.com/microsoft/vscode/blob/f6439326f6891a1eaf254a19fc1a78243cbb8f9d/src/vs/platform/extensionManagement/node/extensionsScannerService.ts) [src/vs/workbench/services/extensions/common/extensionRunningLocationTracker.ts](https://github.com/microsoft/vscode/blob/f6439326f6891a1eaf254a19fc1a78243cbb8f9d/src/vs/workbench/services/extensions/common/extensionRunningLocationTracker.ts)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)