fix: Windows OpenSSL build and remote SSH workspace recovery

.github/workflows/ci.yml

@@ -30,6 +30,11 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - name: Setup OpenSSL (Windows, prebuilt)
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: ./scripts/ci/setup-openssl-windows.ps1
+
       - name: Download frontend build artifacts
         uses: actions/download-artifact@v4
         with:

.github/workflows/desktop-package.yml

@@ -87,6 +87,11 @@ jobs:
         with:
           ref: ${{ needs.prepare.outputs.release_tag }}
 
+      - name: Setup OpenSSL (Windows, prebuilt)
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: ./scripts/ci/setup-openssl-windows.ps1
+
       - name: Setup pnpm
         uses: pnpm/action-setup@v4
 

.github/workflows/nightly.yml

@@ -88,6 +88,11 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - name: Setup OpenSSL (Windows, prebuilt)
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: ./scripts/ci/setup-openssl-windows.ps1
+
       - name: Setup pnpm
         uses: pnpm/action-setup@v4
 

CONTRIBUTING.md

@@ -19,21 +19,12 @@ Be respectful, kind, and constructive. We welcome contributors of all background
 
 #### Windows: OpenSSL Setup
 
-The desktop app includes SSH remote support, which requires OpenSSL. On Windows, you need to provide pre-built OpenSSL binaries and set environment variables before building.
+The desktop app includes SSH remote support, which pulls in OpenSSL. On Windows the workspace **does not use vendored OpenSSL**; link against **pre-built** binaries (no Perl/NASM/OpenSSL source build).
 
-1. Download the [FireDaemon OpenSSL 3.5.5 LTS ZIP (x86+x64+ARM64)](https://download.firedaemon.com/FireDaemon-OpenSSL/openssl-3.5.5.zip)
-2. Extract to a directory, e.g. `C:\Users\<you>\openssl`
-3. Set the following **user environment variables** (persist across terminal sessions):
-
-```powershell
-[System.Environment]::SetEnvironmentVariable("OPENSSL_DIR", "C:\Users\<you>\openssl\x64", "User")
-[System.Environment]::SetEnvironmentVariable("OPENSSL_NO_VENDOR", "1", "User")
-[System.Environment]::SetEnvironmentVariable("OPENSSL_STATIC", "1", "User")
-```
-
-4. Restart your terminal (or IDE) for the variables to take effect.
-
-> **Alternative**: Install [Strawberry Perl](https://strawberryperl.com/) to let Cargo build OpenSSL from source automatically — no environment variables needed.
+- **Default**: `pnpm run desktop:dev` calls `ensure-openssl-windows.mjs` on Windows. Every `desktop:build*` script runs via `scripts/desktop-tauri-build.mjs`, which does the same before `tauri build` (first run downloads FireDaemon OpenSSL 3.5.5 into `.bitfun/cache/`; later runs reuse the cache). Extra args: `pnpm run desktop:build -- <tauri-build-args>`.
+- **Manual / CI**: Download the [FireDaemon OpenSSL 3.5.5 LTS ZIP](https://download.firedaemon.com/FireDaemon-OpenSSL/openssl-3.5.5.zip), extract, set `OPENSSL_DIR` to the `x64` folder, `OPENSSL_STATIC=1`, or run `scripts/ci/setup-openssl-windows.ps1`.
+- **Opt out of auto-download**: `BITFUN_SKIP_OPENSSL_BOOTSTRAP=1` and configure `OPENSSL_DIR` yourself.
+- **`desktop:dev:raw`** skips the dev script (no OpenSSL bootstrap); set `OPENSSL_DIR` yourself, run `scripts/ci/setup-openssl-windows.ps1`, or `node scripts/ensure-openssl-windows.mjs` (warms `.bitfun/cache/` and prints PowerShell `OPENSSL_*` lines to paste).
 
 ### Install dependencies
 

CONTRIBUTING_CN.md

@@ -19,21 +19,12 @@
 
 #### Windows：OpenSSL 配置
 
-桌面端包含 SSH 远程功能，该功能依赖 OpenSSL。在 Windows 上需要提供预编译的 OpenSSL 并设置环境变量，才能正常编译。
+桌面端包含 SSH 远程功能，会链接 OpenSSL。Windows 上**不使用 OpenSSL 源码编译（vendored）**，需使用**预编译**库。
 
-1. 下载 [FireDaemon OpenSSL 3.5.5 LTS ZIP（x86+x64+ARM64）](https://download.firedaemon.com/FireDaemon-OpenSSL/openssl-3.5.5.zip)
-2. 解压到任意目录，例如 `C:\Users\<用户名>\openssl`
-3. 在 PowerShell 中执行以下命令，将环境变量**永久写入用户环境**：
-
-```powershell
-[System.Environment]::SetEnvironmentVariable("OPENSSL_DIR", "C:\Users\<用户名>\openssl\x64", "User")
-[System.Environment]::SetEnvironmentVariable("OPENSSL_NO_VENDOR", "1", "User")
-[System.Environment]::SetEnvironmentVariable("OPENSSL_STATIC", "1", "User")
-```
-
-4. 重启终端（或 IDE）使环境变量生效。
-
-> **备选方案**：安装 [Strawberry Perl](https://strawberryperl.com/)，Cargo 会自动从源码编译 OpenSSL，无需配置环境变量。
+- **默认**：Windows 下 `pnpm run desktop:dev` 会调用 `ensure-openssl-windows.mjs`；所有 `desktop:build*` 均通过 `scripts/desktop-tauri-build.mjs` 执行，在 `tauri build` 前做相同引导（首次下载到 `.bitfun/cache/`，之后走缓存）。额外参数：`pnpm run desktop:build -- <tauri build 参数>`。
+- **手动 / CI**：下载 [FireDaemon ZIP](https://download.firedaemon.com/FireDaemon-OpenSSL/openssl-3.5.5.zip)，解压后将 `OPENSSL_DIR` 指向 `x64`，并设 `OPENSSL_STATIC=1`，或运行 `scripts/ci/setup-openssl-windows.ps1`。
+- **关闭自动下载**：设置 `BITFUN_SKIP_OPENSSL_BOOTSTRAP=1` 并自行配置 `OPENSSL_DIR`。
+- **`desktop:dev:raw`** 不经过 `dev.cjs`（无 OpenSSL 引导）；请自行设置 `OPENSSL_DIR`、运行 `scripts/ci/setup-openssl-windows.ps1`，或执行 `node scripts/ensure-openssl-windows.mjs`（会预热 `.bitfun/cache/` 并打印可在 PowerShell 中粘贴的 `OPENSSL_*` 命令）。
 
 ### 安装依赖
 

Cargo.toml

@@ -78,10 +78,10 @@ flate2 = "1.0"
 toml = "0.8"
 
 # Git
-git2 = { version = "0.18", default-features = false, features = ["https", "vendored-libgit2", "vendored-openssl"] }
+git2 = { version = "0.18", default-features = false, features = ["https", "vendored-libgit2"] }
 
-# OpenSSL — vendored so no system OpenSSL is needed (required by russh-keys on Windows)
-openssl = { version = "0.10", features = ["vendored"] }
+# OpenSSL — Linux/macOS: `bitfun-core` adds `vendored` via target cfg. Windows: link prebuilt (OPENSSL_DIR); see README.
+openssl = { version = "0.10" }
 
 # Terminal
 portable-pty = "0.8"

README.md

@@ -111,15 +111,7 @@ Make sure you have the following prerequisites installed:
 - Rust toolchain (install via [rustup](https://rustup.rs/))
 - [Tauri prerequisites](https://v2.tauri.app/start/prerequisites/) for desktop development
 
-**Windows only**: The desktop app includes SSH remote support which requires OpenSSL. Before building, download the [FireDaemon OpenSSL 3.5.5 LTS ZIP](https://download.firedaemon.com/FireDaemon-OpenSSL/openssl-3.5.5.zip), extract it, and set these environment variables in PowerShell:
-
-```powershell
-[System.Environment]::SetEnvironmentVariable("OPENSSL_DIR", "C:\path\to\openssl\x64", "User")
-[System.Environment]::SetEnvironmentVariable("OPENSSL_NO_VENDOR", "1", "User")
-[System.Environment]::SetEnvironmentVariable("OPENSSL_STATIC", "1", "User")
-```
-
-Then restart your terminal before running the build commands.
+**Windows only**: The desktop build links against a **prebuilt** OpenSSL (no OpenSSL source compile). `desktop:dev` and all `desktop:build*` scripts use `ensure-openssl-windows.mjs` (via `desktop-tauri-build.mjs` for builds): the first time OpenSSL is needed, it downloads [FireDaemon OpenSSL 3.5.5](https://download.firedaemon.com/FireDaemon-OpenSSL/openssl-3.5.5.zip) into `.bitfun/cache/`; later runs reuse that cache. Override with `OPENSSL_DIR` pointing at the **`x64`** folder from the ZIP, or `BITFUN_SKIP_OPENSSL_BOOTSTRAP=1` and your own `OPENSSL_*`.
 
 ```bash
 # Install dependencies

README.zh-CN.md

@@ -114,15 +114,7 @@ Mini Apps 从对话中涌现，Skills 在社区里更新，Agent 在协作中进
 - [Rust 工具链](https://rustup.rs/)
 - [Tauri 前置依赖](https://v2.tauri.app/start/prerequisites/)（桌面端开发需要）
 
-**Windows 特别说明**：桌面端包含 SSH 远程功能，依赖 OpenSSL。构建前请下载 [FireDaemon OpenSSL 3.5.5 LTS ZIP](https://download.firedaemon.com/FireDaemon-OpenSSL/openssl-3.5.5.zip)，解压后在 PowerShell 中执行：
-
-```powershell
-[System.Environment]::SetEnvironmentVariable("OPENSSL_DIR", "C:\解压路径\openssl\x64", "User")
-[System.Environment]::SetEnvironmentVariable("OPENSSL_NO_VENDOR", "1", "User")
-[System.Environment]::SetEnvironmentVariable("OPENSSL_STATIC", "1", "User")
-```
-
-执行后重启终端再运行构建命令。
+**Windows 特别说明**：桌面使用**预编译 OpenSSL**（不编译 OpenSSL 源码）。`desktop:dev` 与全部 `desktop:build*` 会通过 `ensure-openssl-windows.mjs`（构建走 `desktop-tauri-build.mjs`）自动准备：首次需要时下载 [FireDaemon OpenSSL 3.5.5](https://download.firedaemon.com/FireDaemon-OpenSSL/openssl-3.5.5.zip) 到 `.bitfun/cache/`，之后复用缓存。可自行设置 `OPENSSL_DIR` 为 ZIP 内 **`x64`** 目录，或 `BITFUN_SKIP_OPENSSL_BOOTSTRAP=1` 并自行配置 `OPENSSL_*`。
 
 ```bash
 # 安装依赖

package.json

@@ -26,17 +26,17 @@
     "preview": "pnpm --dir src/web-ui preview",
     "desktop:dev": "node scripts/dev.cjs desktop",
     "desktop:dev:raw": "cross-env-shell CI=true \"cd src/apps/desktop && tauri dev\"",
-    "desktop:build": "cross-env-shell CI=true \"cd src/apps/desktop && tauri build\"",
-    "desktop:build:fast": "cross-env-shell CI=true \"cd src/apps/desktop && tauri build --debug --no-bundle\"",
-    "desktop:build:release-fast": "cross-env-shell CI=true \"cd src/apps/desktop && tauri build --no-bundle -- --profile release-fast\"",
-    "desktop:build:exe": "cross-env-shell CI=true \"cd src/apps/desktop && tauri build --no-bundle\"",
-    "desktop:build:nsis": "cross-env-shell CI=true \"cd src/apps/desktop && tauri build --bundles nsis\"",
-    "desktop:build:arm64": "cross-env-shell CI=true \"cd src/apps/desktop && tauri build --target aarch64-apple-darwin --bundles dmg\"",
-    "desktop:build:x86_64": "cross-env-shell CI=true \"cd src/apps/desktop && tauri build --target x86_64-apple-darwin --bundles dmg\"",
-    "desktop:build:linux": "cross-env-shell CI=true 'cd src/apps/desktop && tauri build'",
-    "desktop:build:linux:deb": "cross-env-shell CI=true 'cd src/apps/desktop && tauri build --bundles deb'",
-    "desktop:build:linux:rpm": "cross-env-shell CI=true 'cd src/apps/desktop && tauri build --bundles rpm'",
-    "desktop:build:linux:appimage": "cross-env-shell CI=true 'cd src/apps/desktop && tauri build --bundles appimage'",
+    "desktop:build": "node scripts/desktop-tauri-build.mjs",
+    "desktop:build:fast": "node scripts/desktop-tauri-build.mjs --debug --no-bundle",
+    "desktop:build:release-fast": "node scripts/desktop-tauri-build.mjs --no-bundle -- --profile release-fast",
+    "desktop:build:exe": "node scripts/desktop-tauri-build.mjs --no-bundle",
+    "desktop:build:nsis": "node scripts/desktop-tauri-build.mjs --bundles nsis",
+    "desktop:build:arm64": "node scripts/desktop-tauri-build.mjs --target aarch64-apple-darwin --bundles dmg",
+    "desktop:build:x86_64": "node scripts/desktop-tauri-build.mjs --target x86_64-apple-darwin --bundles dmg",
+    "desktop:build:linux": "node scripts/desktop-tauri-build.mjs",
+    "desktop:build:linux:deb": "node scripts/desktop-tauri-build.mjs --bundles deb",
+    "desktop:build:linux:rpm": "node scripts/desktop-tauri-build.mjs --bundles rpm",
+    "desktop:build:linux:appimage": "node scripts/desktop-tauri-build.mjs --bundles appimage",
     "installer:build": "pnpm --dir BitFun-Installer run installer:build",
     "installer:build:fast": "pnpm --dir BitFun-Installer run installer:build:fast",
     "installer:build:only": "pnpm --dir BitFun-Installer run installer:build:only",

scripts/ci/setup-openssl-windows.ps1

@@ -0,0 +1,33 @@
+# Downloads FireDaemon OpenSSL (prebuilt) and sets OPENSSL_* for cargo/openssl-sys on Windows.
+# Used by GitHub Actions; developers may run locally if paths are not already set.
+# Keep $Version in sync with OPENSSL_VERSION in scripts/ensure-openssl-windows.mjs.
+$ErrorActionPreference = "Stop"
+$Version = "3.5.5"
+$Url = "https://download.firedaemon.com/FireDaemon-OpenSSL/openssl-$Version.zip"
+$TempRoot = if ($env:RUNNER_TEMP) { $env:RUNNER_TEMP } else { $env:TEMP }
+$Root = Join-Path $TempRoot "firedaemon-openssl"
+$Zip = Join-Path $TempRoot "openssl-$Version.zip"
+
+New-Item -ItemType Directory -Force -Path $Root | Out-Null
+if (-not (Test-Path $Zip)) {
+    Invoke-WebRequest -Uri $Url -OutFile $Zip
+}
+Expand-Archive -Path $Zip -DestinationPath $Root -Force
+
+$X64 = Join-Path $Root "x64"
+$LibCrypto = Join-Path $X64 "lib\libcrypto.lib"
+if (-not (Test-Path $LibCrypto)) {
+    throw "Expected prebuilt OpenSSL at $LibCrypto (extract layout changed?)"
+}
+
+$Dir = (Resolve-Path $X64).Path
+if ($env:GITHUB_ENV) {
+    Add-Content -Path $env:GITHUB_ENV -Value "OPENSSL_DIR=$Dir"
+    Add-Content -Path $env:GITHUB_ENV -Value "OPENSSL_LIB_DIR=$Dir\lib"
+    Add-Content -Path $env:GITHUB_ENV -Value "OPENSSL_STATIC=1"
+} else {
+    $env:OPENSSL_DIR = $Dir
+    $env:OPENSSL_LIB_DIR = "$Dir\lib"
+    $env:OPENSSL_STATIC = "1"
+    Write-Host "Set OPENSSL_DIR=$Dir (current session only)"
+}

scripts/desktop-tauri-build.mjs

@@ -0,0 +1,50 @@
+#!/usr/bin/env node
+/**
+ * Runs `tauri build` from src/apps/desktop with CI=true.
+ * On Windows: shared OpenSSL bootstrap (see ensure-openssl-windows.mjs).
+ */
+import { spawnSync } from 'child_process';
+import { fileURLToPath } from 'url';
+import { dirname, join } from 'path';
+import { ensureOpenSslWindows } from './ensure-openssl-windows.mjs';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const ROOT = join(__dirname, '..');
+
+function tauriBuildArgsFromArgv() {
+  const args = process.argv.slice(2);
+  // `node script.mjs -- --foo` leaves a leading `--`; strip so `tauri build` sees the same argv as before.
+  let i = 0;
+  while (i < args.length && args[i] === '--') {
+    i += 1;
+  }
+  return args.slice(i);
+}
+
+async function main() {
+  const forward = tauriBuildArgsFromArgv();
+
+  await ensureOpenSslWindows();
+
+  const desktopDir = join(ROOT, 'src', 'apps', 'desktop');
+  // Tauri CLI reads CI and rejects numeric "1" (common in CI providers).
+  process.env.CI = 'true';
+
+  const r = spawnSync('pnpm', ['exec', 'tauri', 'build', ...forward], {
+    cwd: desktopDir,
+    env: process.env,
+    stdio: 'inherit',
+    shell: true,
+  });
+
+  if (r.error) {
+    console.error(r.error);
+    process.exit(1);
+  }
+  process.exit(r.status ?? 1);
+}
+
+main().catch((e) => {
+  console.error(e);
+  process.exit(1);
+});

scripts/dev.cjs

@@ -7,6 +7,7 @@
 
 const { execSync, spawn } = require('child_process');
 const path = require('path');
+const { pathToFileURL } = require('url');
 const {
   printHeader,
   printSuccess,
@@ -177,7 +178,20 @@ async function main() {
 
   try {
     if (mode === 'desktop') {
-      await runCommand('npx tauri dev', path.join(ROOT_DIR, 'src/apps/desktop'));
+      if (process.platform === 'win32') {
+        printInfo('Windows: ensuring prebuilt OpenSSL (cached under .bitfun/cache/)');
+        try {
+          const { ensureOpenSslWindows } = await import(
+            pathToFileURL(path.join(__dirname, 'ensure-openssl-windows.mjs')).href
+          );
+          await ensureOpenSslWindows();
+        } catch (error) {
+          printError('OpenSSL bootstrap failed');
+          printError(error.message || String(error));
+          process.exit(1);
+        }
+      }
+      await runCommand('pnpm exec tauri dev', path.join(ROOT_DIR, 'src/apps/desktop'));
     } else {
       await runCommand('pnpm exec vite', path.join(ROOT_DIR, 'src/web-ui'));
     }