github / github/copilot-cli

Secret filtering can block the CLI UI thread

Open
#3,900 0 comments 0 reactions 0 assignees View on GitHub
area:sessions area:terminal-rendering
Dominant language
Shell
Stars
11.2k
Forks
1.9k
Avg merge
14h 16m
Merged PRs (30d)
6

Description

### Describe the bug

Copilot CLI does secret scanning synchronously on the UI thread, which can freeze the TUI if taking too long. This can easily happen if the response objects are large because of the single threaded scanning. Also, scanning the response as structured objects with recursion is much slower than scanning by treating it as a single string.

In my situation, the freezing was worsened by the fact Copilot attempted to replay and submit past events when a session was resumed. Up to 500 events will be scanned for secrets at a time with scheduled batches, all happening on the UI thread and causing noticeable TUI freezing. What's more, if the remote submission fails, it will repeatedly scan the same 500 events for up to 5 times

### Affected version

1.0.64-3

### Steps to reproduce the behavior

Make some tool calls with large responses, and observe the TUI freezing

### Expected behavior

TUI shouldn't freeze regardless of the size of the responses or whether they are strings or structured data

### Additional context

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by locating the synchronous secret-scanning path used by the CLI UI and the session-resume replay and batch-submission flow. Reproduce the freeze with large structured responses and resumed sessions, then verify that scanning no longer blocks the TUI and that failed submissions do not repeatedly rescan the same events.

Written by the indexing model from the issue text.

Assessment

Tech stack
shell
Domain
cli, performance, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.