# SSH and editors

Open a shell, copy files, forward ports, or connect VS Code and Cursor to a sandbox, with your own `ssh` and `scp`.

> **Status:** works on real VMs, and checked by HareBox's real-VM tests. On the labelled simulator, the tunnel reports that it needs a real machine; file commands work everywhere.

## How it works

Nothing in a sandbox listens on a public address. `harebox ssh` runs your system's `ssh` with `harebox tunnel` as its `ProxyCommand`: an authenticated WebSocket on the HareBox API, which carries the connection into the VM to its own `sshd` on loopback. The SSH session is encrypted end to end between your machine and the VM. HareBox only carries the bytes, and can't read them.

The first time, the CLI makes a key for HareBox in its config folder, authorizes it on the sandbox, and pins the sandbox's real host key in a HareBox-only `known_hosts`, with strict checking. Every fork gets its own host keys.

## A shell, or one command

```sh
harebox ssh current
harebox ssh current -- uname -a
```

The account is `user`, with passwordless `sudo`. You need OpenSSH's `ssh` and `ssh-keygen` installed.

## Copy files

```sh
harebox scp current:/home/user/report.pdf .
harebox scp ./site current:/home/user/site
```

Write a sandbox path as `ID:PATH`, or `current:PATH`. Folders copy recursively. Without SSH, `harebox file` and `harebox push` copy files through the API:

```sh
harebox new --name files
harebox file write current --path /home/user/note.txt --raw hello
harebox file read current --path /home/user/note.txt
harebox file ls current --path /home/user
```

## Forward a port

```sh
harebox forward current 8080:3000
```

This listens on `127.0.0.1:8080` on your machine and carries each connection to port 3000 in the sandbox. It doesn't need SSH. Write one number, such as `8080`, to use the same port on both sides. For a URL others can open, use [`harebox host`](endpoints.html) instead.

## VS Code, Cursor and other editors

Print a block for your `~/.ssh/config`, then connect with the editor's Remote-SSH to `harebox-<ID>`:

```sh
harebox ssh-config current >> ~/.ssh/config
```

## Your own keys

To authorize a key you already have, for example for a teammate:

```sh
harebox new --name sshkey
harebox ssh-key add current --public-key "ssh-ed25519 AAAAC3NzaC1 me@laptop"
```

Adding the same key again changes nothing. Keys live in the sandbox's `/home/user/.ssh/authorized_keys`, so they travel with snapshots, templates and forks.