Browser canvas: each canvas instance gets an isolated storage partition, so GitHub login never persists

[bghgary]

Summary

Pages opened in the browser canvas are always signed out of GitHub, and signing in inside a canvas does not carry anywhere. Each canvas instance appears to get its own storage partition, so a session established in one canvas is invisible to every other canvas.

The failure is silent: identity-gated content renders as simply absent rather than as an auth error.

Environment

• GitHub Copilot desktop app v1.1.3
• App-spawned Copilot CLI v1.0.78-2
• Windows 11 (build 26310)
• browser canvas opened via open_canvas

Reproduction

1. open_canvas a github.com URL with instanceId: "A".
2. In that page, set a marker: document.cookie = 'probe=1; path=/' and localStorage.setItem('probe','1').
3. Reload page A — both markers survive.
4. open_canvas the same origin with a different instanceId: "B".
5. In page B, read the markers — both are absent, and localStorage contains only GitHub's own freshly created keys.

Observed versus unconfirmed

Observed. Instance B cannot see instance A's cookie or localStorage, on the same origin and the same canvas provider. Within a single instance, cookie, localStorage and sessionStorage all survive a reload — so this is partitioning, not ephemeral storage. Canvas pages report meta[name="user-login"] empty and body without logged-in, with a sign-in link present.

Unconfirmed. A second path to the same end state was observed but not measured: the canvas provider restarts, the panel entry disappears, the instance becomes unreachable (its owning provider "connection:stdio-…" is not connected. Re-issue open_canvas to rehydrate), and the rehydrated canvas has a fresh profile. Whether that shares a root cause with the per-instance partitioning is not established.

Deliberately excluded: whether GitHub's HttpOnly session cookies specifically are dropped. JavaScript cannot observe those by construction, so nothing measurable here supports or refutes it.

Impact

• Pending (unsubmitted) reviews are invisible. They are only ever visible to their author. This breaks the agent-assisted review loop the app otherwise supports: an agent stages a pending review, the user opens the PR in a canvas to read it, and the draft is not there.
• No review UI — zero line-comment affordances, no "Review changes" control.
• Private and SSO-gated repositories render as 404, indistinguishable from a wrong URL.

Expected behavior

A GitHub session established in a canvas persists across reloads, other canvas instances, provider restarts, and app restarts.

Reusing the credentials the desktop app already holds would remove the sign-in step entirely and is probably the better experience, but any approach that makes the session persist addresses this.

Failing that, a visible signed-out indicator would at least stop the silent-empty-state failure — today a missing pending review and a 404 on a private repo look identical to content that isn't there.

Questions

1. Is the storage partition intended to be per canvas instance, or is instance identity leaking into the partition key unintentionally?
2. Can canvas pages on github.com reuse the app's existing authenticated session?
3. Should a canvas surface its signed-out state rather than rendering an anonymous view?

---

[Filed by Copilot on behalf of @bghgary]