GlassBox

GlassBox is a VS Code extension that captures outbound network activity from the local machine (Windows MVP), streams events to VS Code through localhost WebSocket, and highlights traffic that appears related to Microsoft Copilot Studio.

Features

• Activity Bar container with views:
  • Extension Traffic
  • Controls
  • Identity
  • Overview
  • Live Network
  • Domains
  • Files/Data Egress
  • Alerts
  • Messages
• Local companion monitor service (src/companion/server.ts) communicating with extension over ws://127.0.0.1.
• Start/stop commands:
  • GlassBox: Start Monitoring
  • GlassBox: Stop Monitoring
• Event schema includes:
  • timestamp
  • process / pid
  • destination hostname / IP / port
  • protocol
  • HTTP method / URL (when available)
  • request bytes / response bytes
  • content type / status code (when available)
  • duration
• Automatic sensitive data redaction for Authorization/Cookie/OAuth/API key/access-token style fields.
• JSONL logging in extension storage.
• Domain allowlist/blocklist, plus UI domain filter.
• Extension/source filter (all by default) to focus telemetry by inferred source category.
• Extension Traffic view groups inferred source categories with counters and byte totals, and clicking a row auto-applies the filter.
• Controls view exposes key actions directly in the UI (start/pause/stop/export/filter/privacy toggle/settings UI/settings JSON).
• Identity view shows host/user/VS Code instance identifiers and a stable fingerprint for cross-user correlation.
• Export captured events to JSON.
• Copilot Studio attribution heuristic tags events as Copilot Studio when process/domain patterns match.
• Optional local proxy mode to enrich method, URL, status code, content type, and byte counts.
• Optional payload preview capture in proxy mode for request/response text snippets (sanitized/redacted).

Architecture

1. src/extension.ts
   • Activates providers and commands.
2. src/monitor/monitorClient.ts
   • Spawns companion service process.
   • Maintains WebSocket connection.
   • Applies filters and logs events.
3. src/companion/server.ts
   • Polls outbound TCP connections (netstat on Windows).
   • Resolves PID to process and reverse-DNS hostname where possible.
   • Emits event JSON messages.
   • Can host an optional local forward proxy for richer HTTP metadata.
4. src/views/*
   • Tree views for monitoring data.

HTTPS Inspection Extension Point

Current MVP intentionally does not inspect encrypted payloads. The service protocol and data model are designed so an intercepting local proxy can later add method, URL, headers, status, and byte counts with deeper fidelity.

Configuration

Settings under glassbox.*:

• glassbox.allowlistDomains
• glassbox.blocklistDomains
• glassbox.domainFilter
• glassbox.sampleIntervalMs
• glassbox.maxRetainedEvents
• glassbox.proxyModeEnabled
• glassbox.proxyListenPort
• glassbox.extensionFilter
• glassbox.capturePayloadPreview
• glassbox.includeIdentifiableInfo

Identity and Correlation

The Identity view exposes identifiable metadata to help correlate logs across many systems:

• host name
• logged-in user name
• user domain (when available)
• VS Code machine ID
• VS Code session ID
• VS Code app details
• extension version
• generated identity fingerprint

Each captured event is stamped with key identity markers (identityFingerprint, hostname, username, vscodeMachineId, vscodeSessionId) and JSON export includes a top-level identity object.

When glassbox.includeIdentifiableInfo is set to false, host/user/machine/session identifiers are hidden in the Identity view and omitted from new event stamps/exports; the generated fingerprint remains available for correlation.

Use command GlassBox: Toggle Identifiable Info to switch privacy mode quickly from the Identity view toolbar.

Use command GlassBox: Copy Identity Summary to copy a compact identity payload to clipboard.

Optional Proxy Mode

When glassbox.proxyModeEnabled is true, the companion service starts a localhost proxy (default 127.0.0.1:44900) and emits enriched events with:

• HTTP method
• URL
• status code
• content type
• request/response byte counts

To route VS Code traffic through the proxy, configure VS Code settings as needed:

• http.proxy: http://127.0.0.1:44900
• http.proxySupport: on or override

Notes:

• HTTPS CONNECT tunnels are supported and include destination, status, bytes, and duration.
• Full HTTPS payload inspection is still deferred to future intercepting proxy capabilities.
• Message preview in Messages view is best-effort and only available for proxy-visible plaintext/textual payloads.

Development

npm install
npm run compile
npm test

Press F5 in VS Code to launch the Extension Development Host.

Packaging

npm run package

This generates:

• glassbox-0.1.1.vsix

Notes and Limitations

• MVP focuses on Windows (netstat parser path).
• Low-level packet capture and full HTTP metadata extraction require additional instrumentation and optional proxy mode.
• The extension does not patch or modify any Microsoft Copilot extension.