# VSCode's SSH Agent Is Bananas

DevFeed: [VSCode's SSH Agent Is Bananas](<https://devfeed.tech/articles/vscode-s-ssh-agent-is-bananas-1722.md>)

Original publisher: [Read original article](<https://fly.io/blog/vscode-ssh-wtf/>)

Published: 2025-02-07T00:00:00Z

Content type: opinion

Language: en

Sources: [The Fly Blog](<https://devfeed.tech/sources/the-fly-blog.md>)

Topics: [Visual Studio Code](<https://devfeed.tech/topics/visual-studio-code.md>), [OpenSSH](<https://devfeed.tech/topics/openssh.md>), [Security](<https://devfeed.tech/topics/security.md>), [Large Language Model](<https://devfeed.tech/topics/llm.md>), [Shell](<https://devfeed.tech/topics/shell.md>), [WebSocket](<https://devfeed.tech/topics/websocket.md>), [Linux](<https://devfeed.tech/topics/linux.md>), [Command-line interface](<https://devfeed.tech/topics/cli.md>), [Emacs](<https://devfeed.tech/topics/emacs.md>), [Development](<https://devfeed.tech/topics/development.md>)

Tags: [agentic](<https://devfeed.tech/tags/agentic.md>), [bash](<https://devfeed.tech/tags/bash.md>), [cdn](<https://devfeed.tech/tags/cdn.md>), [close-to-users](<https://devfeed.tech/tags/close-to-users.md>), [commands](<https://devfeed.tech/tags/commands.md>), [deploy-app-servers](<https://devfeed.tech/tags/deploy-app-servers.md>), [docker](<https://devfeed.tech/tags/docker.md>), [elixir](<https://devfeed.tech/tags/elixir.md>), [filesystem](<https://devfeed.tech/tags/filesystem.md>), [fly](<https://devfeed.tech/tags/fly.md>), [fly-io](<https://devfeed.tech/tags/fly-io.md>), [front-end](<https://devfeed.tech/tags/front-end.md>), [heroku-alternative](<https://devfeed.tech/tags/heroku-alternative.md>), [heroku-competitor](<https://devfeed.tech/tags/heroku-competitor.md>), [hosting](<https://devfeed.tech/tags/hosting.md>), [i](<https://devfeed.tech/tags/i.md>), [linux](<https://devfeed.tech/tags/linux.md>), [llm](<https://devfeed.tech/tags/llm.md>), [networking](<https://devfeed.tech/tags/networking.md>), [postgresql-clusters](<https://devfeed.tech/tags/postgresql-clusters.md>), [processes](<https://devfeed.tech/tags/processes.md>), [protocol](<https://devfeed.tech/tags/protocol.md>), [security](<https://devfeed.tech/tags/security.md>), [servers](<https://devfeed.tech/tags/servers.md>), [ssh](<https://devfeed.tech/tags/ssh.md>), [typescript](<https://devfeed.tech/tags/typescript.md>), [vscode](<https://devfeed.tech/tags/vscode.md>)

## AI overview

The article critiques VSCode's SSH-based remote editing architecture, especially its use of a Bash stager to download an agent with Node, forward it over SSH, and connect it to the VSCode frontend through WebSockets. It contrasts this design with Emacs Tramp and raises security concerns about the agent's ability to access files, launch shell processes, and persist itself. The article also discusses using isolated Linux instances for closed-loop LLM-assisted development.

## Source excerpt

We're interested in getting integrated into the flow VSCode uses to do remote editing over SSH, because everybody is using VSCode now, and, in particular, they're using forks of VSCode that generate code with LLMs. "hallucination" is what we call it when LLMs get code wrong; "engineering" is what we call it when people do. LLM-generated code is useful in the general case if you know what you're doing. But it's ultra-useful if you can close the loop between the LLM and the execution environment (with an "Agent" setup). There's lots to say about this, but for the moment: it's a semi-effective antidote to hallucination: the LLM generates the code, the agent scaffolding runs the code, the code generates errors, the agent feeds it back to the LLM, the process iterates. So, obviously, the issue here is you don't want this iterative development process happening on your development laptop, because LLMs have boundary issues, and they'll iterate on your system configuration just as happily on the Git project you happen to be working in. A thing you'd really like to be able to do: run a closed-loop agent-y ("agentic"? is that what we say now) configuration for an LLM, on a clean-slate Linux instance that spins up instantly and that can't screw you over in any way. You get where we're going with this. Anyways! I would like to register a concern. Emacs hosts the spiritual forebearer of remote editing systems, a blob of hyper-useful Elisp called "Tramp". If you can hook Tramp up to any kind of interactive environment -- usually, an SSH session -- where it can run Bourne shell commands, it can extend Emacs to that environment. So, VSCode has a feature like Tramp. Which, neat, right? You'd think, take Tramp, maybe simplify it a bit, switch out Elisp for Typescript. You'd think wrong! Unlike Tramp, which lives off the land on the remote connection, VSCode mounts a full-scale invasion: it runs a Bash snippet stager that downloads an agent, including a binary installation of Node. I th