Code completion

Code completion has three generations. Classical completion, IntelliSense-style and now standardised in the Language Server Protocol's textDocument/completion request, lists identifiers that are valid at the cursor according to the parser and type checker, so it is exact but only ever suggests a single token or name. Statistical completion followed Hindle et al.'s 2012 observation that source code is highly repetitive and predictable ("On the naturalness of software"), first with n-gram models and later with neural rankers. Transformer-based completion, popularised by GitHub Copilot from 2021, generates whole lines or blocks and is what most developers now mean by the term.

A modern completion request is a tight real-time pipeline. The editor debounces keystrokes, cancels in-flight requests when the user keeps typing, and builds a prompt from the prefix before the cursor, the suffix after it (formatted for a fill-in-the-middle model), and a few snippets retrieved from neighbouring open files or a local index. Latency budgets are in the low hundreds of milliseconds end to end, so providers use comparatively small models, cache aggressively and stream tokens. Post-processing decides where a suggestion should stop, typically by balancing brackets, tracking indentation or checking that the result still parses, and trims text that duplicates the suffix. Newer "next edit" features extend the idea from inserting at the cursor to predicting the next location and content of an edit elsewhere in the file.

Quality is measured differently from chat. Offline benchmarks use HumanEval-style unit tests or infilling suites, while online telemetry tracks acceptance rate and how much accepted code survives unchanged after some minutes. Ziegler et al. (2022) found acceptance rate to be the best predictor among the usage metrics they studied of developers' perceived productivity, which explains why vendors optimise for it, but acceptance says nothing about correctness or security.

Risks come from volume and friction. A developer may see hundreds of suggestions a day, each accepted with a single Tab, so automation bias is structural rather than occasional. Completions can call APIs that do not exist, use deprecated or insecure patterns, import hallucinated packages, or reproduce licensed code verbatim, and because the model sees only local context, it can contradict invariants established elsewhere in the codebase. Controls are the usual ones for untrusted code: compile and type-check, run tests and SAST in CI, and enable any vendor filters for secrets and public-code matches.