VSCode's SSH Agent Is Bananas
Thomas Ptacek details how VSCode Remote SSH installs a persistent WebSocket agent with filesystem, file-editing, and shell access, resembling remote-access tooling.
A Fly.io blog post by Thomas Ptacek examines how VSCode's remote SSH editing works: it stages a Bash snippet that downloads a full agent including a bundled Node binary onto the remote host. The agent communicates with the VSCode frontend over a port-forwarded WebSockets connection and can browse the filesystem, edit arbitrary files, spawn shell PTY processes, and persist itself. Ptacek warns against allowing VSCode remote editing on shared dev servers or during production incidents, noting the design resembles remote-access tooling.
- VSCode Remote SSH runs a stager downloading a full agent with bundled Node binary.
- Agent connects via WebSockets over port-forwarded SSH to the frontend.
- Protocol can browse filesystem, edit files, launch shell PTYs, and persist.
- Author cautions against VSCode remote editing on shared dev or production systems.
Full article529 words · extracted from fly.io · click to collapse
-
Author
-
-
Name
- Thomas Ptacek @tqbf
- @tqbf
We’re interested in getting integrated into the flow VSCode uses to do remote editing over SSH, because everybody is using VSCode now, and, in particular, they’re using forks of VSCode that generate code with LLMs.
”hallucination” is what we call it when LLMs get code wrong; “engineering” is what we call it when people do.
LLM-generated code is useful in the general case if you know what you’re doing. But it’s ultra-useful if you can close the loop between the LLM and the execution environment (with an “Agent” setup). There’s lots to say about this, but for the moment: it’s a semi-effective antidote to hallucination: the LLM generates the code, the agent scaffolding runs the code, the code generates errors, the agent feeds it back to the LLM, the process iterates.
So, obviously, the issue here is you don’t want this iterative development process happening on your development laptop, because LLMs have boundary issues, and they’ll iterate on your system configuration just as happily on the Git project you happen to be working in. A thing you’d really like to be able to do: run a closed-loop agent-y (“agentic”? is that what we say now) configuration for an LLM, on a clean-slate Linux instance that spins up instantly and that can’t screw you over in any way. You get where we’re going with this.
Anyways! I would like to register a concern.
Emacs hosts the spiritual forebearer of remote editing systems, a blob of hyper-useful Elisp called “Tramp”. If you can hook Tramp up to any kind of interactive environment — usually, an SSH session — where it can run Bourne shell commands, it can extend Emacs to that environment.
So, VSCode has a feature like Tramp. Which, neat, right? You’d think, take Tramp, maybe simplify it a bit, switch out Elisp for Typescript.
You’d think wrong!
Unlike Tramp, which lives off the land on the remote connection, VSCode mounts a full-scale invasion: it runs a Bash snippet stager that downloads an agent, including a binary installation of Node.
I think this is the source code?
The agent runs over port-forwarded SSH. It establishes a WebSockets connection back to your running VSCode front-end. The underlying protocol on that connection can:
- Wander around the filesystem
- Edit arbitrary files
- Launch its own shell PTY processes
- Persist itself
In security-world, there’s a name for tools that work this way. I won’t say it out loud, because that’s not fair to VSCode, but let’s just say the name is murid in nature.
I would be a little nervous about letting people VSCode-remote-edit stuff on dev servers, and apoplectic if that happened during an incident on something in production.
It turns out we don’t have to care about any of this to get a custom connection to a Fly Machine working in VSCode, so none of this matters in any kind of deep way, but: we’ve decided to just be a blog again, so: we had to learn this, and now you do too.
-
Next post ↑
- Did Semgrep Just Get A Lot More Interesting? Previous post ↓
- AI GPU Clusters, From Your Laptop, With Livebook