From ab16b920511da03381b5a19116cc2cfeddc91005 Mon Sep 17 00:00:00 2001
From: Nu11ified <manasr224@gmail.com>
Date: Wed, 25 Feb 2026 16:07:01 +0000
Subject: [PATCH 1/7] fix: enable copy/paste, add SSH password auth,
 auto-accept host keys

- Add ApplicationMenu with Edit menu (copy, paste, cut, undo, redo,
  selectAll) so clipboard operations work in the Electrobun webview
- Add password-based SSH authentication as alternative to key-based,
  using sshpass -e with SSHPASS env var for security
- Change StrictHostKeyChecking from accept-new to no with
  UserKnownHostsFile=/dev/null to prevent host key prompts
---
 src/main/index.ts                      | 31 +++++++++++-
 src/main/services/ssh-provisioner.ts   | 39 ++++++++++++---
 src/renderer/pages/CreateWorkspace.tsx | 69 ++++++++++++++++++++++----
 src/shared/rpc-types.ts                |  3 +-
 src/shared/types.ts                    |  1 +
 5 files changed, 125 insertions(+), 18 deletions(-)

diff --git a/src/main/index.ts b/src/main/index.ts
index 7667211..abc8e2f 100644
--- a/src/main/index.ts
+++ b/src/main/index.ts
@@ -2,7 +2,7 @@
 // Main process entry point. Creates the window first for immediate feedback,
 // then initializes services and loads plugins in the background.
 
-import { BrowserWindow, BrowserView, Utils } from "electrobun/bun";
+import { BrowserWindow, BrowserView, Utils, ApplicationMenu } from "electrobun/bun";
 import { join, resolve } from "node:path";
 import { platform, homedir } from "node:os";
 import { mkdirSync, appendFileSync, promises as fsp } from "node:fs";
@@ -1151,6 +1151,7 @@ const rpc = BrowserView.defineRPC<BlockDevRPC>({
             host: params.host,
             user: params.user,
             keyPath: params.keyPath,
+            password: params.password,
           });
         } catch (err) {
           return { success: false, error: err instanceof Error ? err.message : String(err) };
@@ -1165,6 +1166,7 @@ const rpc = BrowserView.defineRPC<BlockDevRPC>({
               host: params.host,
               user: params.user,
               keyPath: params.keyPath,
+              password: params.password,
               agentPort: params.agentPort,
             },
             agentBinaryPath,
@@ -1553,6 +1555,33 @@ try {
     rpc,
   });
 
+  // Set up application menu so copy/paste/cut/undo/redo work in the webview
+  ApplicationMenu.setApplicationMenu([
+    {
+      label: "BlockDev",
+      submenu: [
+        { role: "about" },
+        { type: "divider" },
+        { role: "quit" },
+      ],
+    },
+    {
+      label: "Edit",
+      submenu: [
+        { role: "undo" },
+        { role: "redo" },
+        { type: "divider" },
+        { role: "cut" },
+        { role: "copy" },
+        { role: "paste" },
+        { role: "pasteAndMatchStyle" },
+        { role: "delete" },
+        { type: "divider" },
+        { role: "selectAll" },
+      ],
+    },
+  ]);
+
   crashLog("Window created successfully");
   console.log("BlockDev window created");
 
diff --git a/src/main/services/ssh-provisioner.ts b/src/main/services/ssh-provisioner.ts
index 1f7b767..666641c 100644
--- a/src/main/services/ssh-provisioner.ts
+++ b/src/main/services/ssh-provisioner.ts
@@ -8,14 +8,20 @@ export interface SSHConfig {
   host: string;
   user: string;
   keyPath?: string;
+  password?: string;
   agentPort?: number;
 }
 
 export type ProvisionProgress = (stage: string, message: string) => void;
 
 export class SSHProvisioner {
+  /** Base SSH options: auto-accept host keys, never prompt interactively. */
   private buildSshArgs(config: SSHConfig): string[] {
-    const args = ["-o", "ConnectTimeout=10", "-o", "StrictHostKeyChecking=accept-new"];
+    const args = [
+      "-o", "ConnectTimeout=10",
+      "-o", "StrictHostKeyChecking=no",
+      "-o", "UserKnownHostsFile=/dev/null",
+    ];
     if (config.keyPath) {
       args.push("-i", config.keyPath);
     }
@@ -24,19 +30,39 @@ export class SSHProvisioner {
   }
 
   private buildScpArgs(config: SSHConfig): string[] {
-    const args = ["-o", "ConnectTimeout=10", "-o", "StrictHostKeyChecking=accept-new"];
+    const args = [
+      "-o", "ConnectTimeout=10",
+      "-o", "StrictHostKeyChecking=no",
+      "-o", "UserKnownHostsFile=/dev/null",
+    ];
     if (config.keyPath) {
       args.push("-i", config.keyPath);
     }
     return args;
   }
 
+  /** When password auth is used, prefix the command with sshpass -e and set SSHPASS env var. */
+  private buildCommandPrefix(config: SSHConfig): string[] {
+    if (config.password) {
+      return ["sshpass", "-e"];
+    }
+    return [];
+  }
+
+  private getSpawnEnv(config: SSHConfig): Record<string, string> | undefined {
+    if (config.password) {
+      return { ...process.env, SSHPASS: config.password } as Record<string, string>;
+    }
+    return undefined;
+  }
+
   /** Test SSH connectivity. Returns true if we can connect and run a command. */
   async testConnection(config: SSHConfig): Promise<{ success: boolean; error?: string }> {
     try {
-      const proc = Bun.spawn(["ssh", ...this.buildSshArgs(config), "echo blockdev-ok"], {
+      const proc = Bun.spawn([...this.buildCommandPrefix(config), "ssh", ...this.buildSshArgs(config), "echo blockdev-ok"], {
         stdout: "pipe",
         stderr: "pipe",
+        env: this.getSpawnEnv(config),
       });
 
       const stdout = await new Response(proc.stdout).text();
@@ -122,9 +148,10 @@ export class SSHProvisioner {
 
   /** Run a command over SSH, return stdout. */
   private async sshExec(config: SSHConfig, command: string): Promise<string> {
-    const proc = Bun.spawn(["ssh", ...this.buildSshArgs(config), command], {
+    const proc = Bun.spawn([...this.buildCommandPrefix(config), "ssh", ...this.buildSshArgs(config), command], {
       stdout: "pipe",
       stderr: "pipe",
+      env: this.getSpawnEnv(config),
     });
 
     const stdout = await new Response(proc.stdout).text();
@@ -141,8 +168,8 @@ export class SSHProvisioner {
   /** Copy a local file to the remote host via SCP. */
   private async scpUpload(config: SSHConfig, localPath: string, remotePath: string): Promise<void> {
     const proc = Bun.spawn(
-      ["scp", ...this.buildScpArgs(config), localPath, `${config.user}@${config.host}:${remotePath}`],
-      { stdout: "pipe", stderr: "pipe" },
+      [...this.buildCommandPrefix(config), "scp", ...this.buildScpArgs(config), localPath, `${config.user}@${config.host}:${remotePath}`],
+      { stdout: "pipe", stderr: "pipe", env: this.getSpawnEnv(config) },
     );
 
     const exitCode = await proc.exited;
diff --git a/src/renderer/pages/CreateWorkspace.tsx b/src/renderer/pages/CreateWorkspace.tsx
index 5a572a8..a043239 100644
--- a/src/renderer/pages/CreateWorkspace.tsx
+++ b/src/renderer/pages/CreateWorkspace.tsx
@@ -52,9 +52,11 @@ export function CreateWorkspace({ onBack, onCreate }: CreateWorkspaceProps) {
 
   // Location state
   const [serverLocation, setServerLocation] = useState<"local" | "remote">("local");
+  const [sshAuthMode, setSshAuthMode] = useState<"key" | "password">("key");
   const [sshHost, setSshHost] = useState("");
   const [sshUser, setSshUser] = useState("root");
   const [sshKeyPath, setSshKeyPath] = useState("~/.ssh/id_ed25519");
+  const [sshPassword, setSshPassword] = useState("");
   const [agentPort, setAgentPort] = useState(9847);
   const [testingConnection, setTestingConnection] = useState(false);
   const [connectionTestResult, setConnectionTestResult] = useState<{ success: boolean; error?: string } | null>(null);
@@ -132,7 +134,7 @@ export function CreateWorkspace({ onBack, onCreate }: CreateWorkspaceProps) {
 
   const canNext =
     (step === 0 && selectedFramework !== null) ||
-    (step === 1 && (serverLocation === "local" || (serverLocation === "remote" && sshHost.trim() && sshUser.trim() && agentPort > 0 && agentPort <= 65535))) ||
+    (step === 1 && (serverLocation === "local" || (serverLocation === "remote" && sshHost.trim() && sshUser.trim() && agentPort > 0 && agentPort <= 65535 && (sshAuthMode === "key" || sshPassword.trim())))) ||
     (step === 2 && selectedVersion !== null) ||
     (step === 3 && !creating);
 
@@ -150,7 +152,8 @@ export function CreateWorkspace({ onBack, onCreate }: CreateWorkspaceProps) {
       const result = await rpc.request("testSSHConnection", {
         host: sshHost,
         user: sshUser,
-        keyPath: sshKeyPath || undefined,
+        keyPath: sshAuthMode === "key" ? (sshKeyPath || undefined) : undefined,
+        password: sshAuthMode === "password" ? sshPassword : undefined,
       });
       setConnectionTestResult(result);
     } catch (err) {
@@ -176,7 +179,8 @@ export function CreateWorkspace({ onBack, onCreate }: CreateWorkspaceProps) {
           const provResult = await rpc.request("provisionRemoteAgent", {
             host: sshHost,
             user: sshUser,
-            keyPath: sshKeyPath || undefined,
+            keyPath: sshAuthMode === "key" ? (sshKeyPath || undefined) : undefined,
+            password: sshAuthMode === "password" ? sshPassword : undefined,
             agentPort,
           });
 
@@ -205,7 +209,8 @@ export function CreateWorkspace({ onBack, onCreate }: CreateWorkspaceProps) {
               agentPort: provResult.agentPort,
               token: provResult.token,
               sshUser,
-              sshKeyPath: sshKeyPath || undefined,
+              sshKeyPath: sshAuthMode === "key" ? (sshKeyPath || undefined) : undefined,
+              sshPassword: sshAuthMode === "password" ? sshPassword : undefined,
             },
           });
 
@@ -451,15 +456,59 @@ export function CreateWorkspace({ onBack, onCreate }: CreateWorkspaceProps) {
                         />
                       </div>
                     </div>
+
+                    {/* Auth mode toggle */}
                     <div>
-                      <label htmlFor="ssh-key-path" className="text-xs text-text-dim uppercase tracking-wide">SSH Key Path</label>
-                      <input
-                        id="ssh-key-path"
-                        type="text" value={sshKeyPath} onChange={(e) => setSshKeyPath(e.target.value)}
-                        className="w-full mt-1 px-4 py-3 rounded-xl bg-card border border-border-subtle text-text-primary text-sm font-mono focus:outline-none focus:border-accent transition-colors"
-                      />
+                      <label className="text-xs text-text-dim uppercase tracking-wide">Authentication</label>
+                      <div className="flex gap-3 mt-1">
+                        <button
+                          onClick={() => { setSshAuthMode("key"); setConnectionTestResult(null); }}
+                          className={`flex-1 px-4 py-2.5 rounded-xl text-sm font-medium transition-all duration-300 cursor-pointer ${
+                            sshAuthMode === "key"
+                              ? "bg-accent text-black"
+                              : "bg-card border border-border-subtle text-text-muted hover:text-text-primary"
+                          }`}
+                        >
+                          SSH Key
+                        </button>
+                        <button
+                          onClick={() => { setSshAuthMode("password"); setConnectionTestResult(null); }}
+                          className={`flex-1 px-4 py-2.5 rounded-xl text-sm font-medium transition-all duration-300 cursor-pointer ${
+                            sshAuthMode === "password"
+                              ? "bg-accent text-black"
+                              : "bg-card border border-border-subtle text-text-muted hover:text-text-primary"
+                          }`}
+                        >
+                          Password
+                        </button>
+                      </div>
                     </div>
 
+                    {/* SSH Key Path (shown for key auth) */}
+                    {sshAuthMode === "key" && (
+                      <div>
+                        <label htmlFor="ssh-key-path" className="text-xs text-text-dim uppercase tracking-wide">SSH Key Path</label>
+                        <input
+                          id="ssh-key-path"
+                          type="text" value={sshKeyPath} onChange={(e) => setSshKeyPath(e.target.value)}
+                          className="w-full mt-1 px-4 py-3 rounded-xl bg-card border border-border-subtle text-text-primary text-sm font-mono focus:outline-none focus:border-accent transition-colors"
+                        />
+                      </div>
+                    )}
+
+                    {/* Password (shown for password auth) */}
+                    {sshAuthMode === "password" && (
+                      <div>
+                        <label htmlFor="ssh-password" className="text-xs text-text-dim uppercase tracking-wide">Password</label>
+                        <input
+                          id="ssh-password"
+                          type="password" value={sshPassword} onChange={(e) => setSshPassword(e.target.value)}
+                          placeholder="Enter SSH password"
+                          className="w-full mt-1 px-4 py-3 rounded-xl bg-card border border-border-subtle text-text-primary text-sm font-mono focus:outline-none focus:border-accent transition-colors"
+                        />
+                      </div>
+                    )}
+
                     {/* Test Connection button */}
                     <button
                       onClick={handleTestConnection}
diff --git a/src/shared/rpc-types.ts b/src/shared/rpc-types.ts
index 49611c6..4f1d789 100644
--- a/src/shared/rpc-types.ts
+++ b/src/shared/rpc-types.ts
@@ -204,7 +204,7 @@ type BunRequests = {
   };
   // --- Remote server provisioning ---
   testSSHConnection: {
-    params: { host: string; user: string; keyPath?: string };
+    params: { host: string; user: string; keyPath?: string; password?: string };
     response: { success: boolean; error?: string };
   };
   provisionRemoteAgent: {
@@ -212,6 +212,7 @@ type BunRequests = {
       host: string;
       user: string;
       keyPath?: string;
+      password?: string;
       agentPort?: number;
     };
     response: { success: boolean; token?: string; agentPort?: number; error?: string };
diff --git a/src/shared/types.ts b/src/shared/types.ts
index 9f22bfe..fe7520d 100644
--- a/src/shared/types.ts
+++ b/src/shared/types.ts
@@ -94,6 +94,7 @@ export type ServerLocation =
       token: string;
       sshUser?: string;
       sshKeyPath?: string;
+      sshPassword?: string;
     };
 
 export interface ServerConfig {

From fa12bd66a02cca61d9569c50424a3598828a608b Mon Sep 17 00:00:00 2001
From: Nu11ified <manasr224@gmail.com>
Date: Wed, 25 Feb 2026 16:29:30 +0000
Subject: [PATCH 2/7] fix: address code review feedback from PR #3

- Add sshpass availability check with helpful install instructions
- Validate jvmArgs is an array in agent setup-server handler
- Persist workspace migration to disk so it only runs once
- Require non-empty SSH key path when key auth is selected
---
 agent/index.ts                         |  4 ++++
 src/main/services/ssh-provisioner.ts   | 16 ++++++++++++++++
 src/main/services/workspace-manager.ts |  5 +++++
 src/renderer/pages/CreateWorkspace.tsx |  2 +-
 4 files changed, 26 insertions(+), 1 deletion(-)

diff --git a/agent/index.ts b/agent/index.ts
index 37de668..b7ad52f 100644
--- a/agent/index.ts
+++ b/agent/index.ts
@@ -188,6 +188,10 @@ async function handleMessage(ws: import("bun").ServerWebSocket<{ authenticated:
       ws.send(JSON.stringify({ type: "error", message: "setup-server requires framework, mcVersion, build (strings) and port (number)" }));
       return;
     }
+    if (r.jvmArgs !== undefined && !Array.isArray(r.jvmArgs)) {
+      ws.send(JSON.stringify({ type: "error", message: "setup-server field 'jvmArgs' must be an array if provided" }));
+      return;
+    }
   }
 
   try {
diff --git a/src/main/services/ssh-provisioner.ts b/src/main/services/ssh-provisioner.ts
index 666641c..b200e7d 100644
--- a/src/main/services/ssh-provisioner.ts
+++ b/src/main/services/ssh-provisioner.ts
@@ -49,6 +49,18 @@ export class SSHProvisioner {
     return [];
   }
 
+  /** Verify sshpass is installed when password auth is needed. */
+  private async checkSshpass(): Promise<void> {
+    const proc = Bun.spawn(["which", "sshpass"], { stdout: "pipe", stderr: "pipe" });
+    const exitCode = await proc.exited;
+    if (exitCode !== 0) {
+      throw new Error(
+        "sshpass is required for password authentication but was not found. " +
+        "Install it with: sudo apt install sshpass (Debian/Ubuntu), brew install sshpass (macOS), or sudo yum install sshpass (RHEL/CentOS)."
+      );
+    }
+  }
+
   private getSpawnEnv(config: SSHConfig): Record<string, string> | undefined {
     if (config.password) {
       return { ...process.env, SSHPASS: config.password } as Record<string, string>;
@@ -59,6 +71,8 @@ export class SSHProvisioner {
   /** Test SSH connectivity. Returns true if we can connect and run a command. */
   async testConnection(config: SSHConfig): Promise<{ success: boolean; error?: string }> {
     try {
+      if (config.password) await this.checkSshpass();
+
       const proc = Bun.spawn([...this.buildCommandPrefix(config), "ssh", ...this.buildSshArgs(config), "echo blockdev-ok"], {
         stdout: "pipe",
         stderr: "pipe",
@@ -85,6 +99,8 @@ export class SSHProvisioner {
     agentBinaryPath: string,
     onProgress?: ProvisionProgress,
   ): Promise<{ token: string; agentPort: number }> {
+    if (config.password) await this.checkSshpass();
+
     const agentPort = config.agentPort ?? DEFAULT_AGENT_PORT;
     const remoteDir = "~/.blockdev-agent";
     const remoteBinary = `${remoteDir}/blockdev-agent`;
diff --git a/src/main/services/workspace-manager.ts b/src/main/services/workspace-manager.ts
index 35e202c..0199935 100644
--- a/src/main/services/workspace-manager.ts
+++ b/src/main/services/workspace-manager.ts
@@ -63,11 +63,16 @@ export class WorkspaceManager {
     const manifest: WorkspaceManifest = JSON.parse(raw);
 
     // Migrate workspaces that predate the remote server feature
+    let migrated = false;
     for (const server of manifest.servers) {
       if (!server.location) {
         (server as any).location = { type: "local" };
+        migrated = true;
       }
     }
+    if (migrated) {
+      await this.saveManifest(dirPath, manifest);
+    }
 
     this.currentWorkspace = manifest;
     this.currentPath = dirPath;
diff --git a/src/renderer/pages/CreateWorkspace.tsx b/src/renderer/pages/CreateWorkspace.tsx
index a043239..0ebd5b4 100644
--- a/src/renderer/pages/CreateWorkspace.tsx
+++ b/src/renderer/pages/CreateWorkspace.tsx
@@ -134,7 +134,7 @@ export function CreateWorkspace({ onBack, onCreate }: CreateWorkspaceProps) {
 
   const canNext =
     (step === 0 && selectedFramework !== null) ||
-    (step === 1 && (serverLocation === "local" || (serverLocation === "remote" && sshHost.trim() && sshUser.trim() && agentPort > 0 && agentPort <= 65535 && (sshAuthMode === "key" || sshPassword.trim())))) ||
+    (step === 1 && (serverLocation === "local" || (serverLocation === "remote" && sshHost.trim() && sshUser.trim() && agentPort > 0 && agentPort <= 65535 && (sshAuthMode === "key" ? sshKeyPath.trim() : sshPassword.trim())))) ||
     (step === 2 && selectedVersion !== null) ||
     (step === 3 && !creating);
 

From c665b8dd0e6cfdcf8a770039f72399e0d485f718 Mon Sep 17 00:00:00 2001
From: Nu11ified <manasr224@gmail.com>
Date: Wed, 25 Feb 2026 16:38:17 +0000
Subject: [PATCH 3/7] ci: add retry logic for flaky Electrobun CLI downloads

The Electrobun build downloads its CLI and core binaries from GitHub
Releases, which intermittently fails with socket hangup errors on CI.
Retry up to 3 times with a 10s delay between attempts.
---
 .github/workflows/build.yml | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 9751b35..8f9df0d 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -99,7 +99,22 @@ jobs:
           ELECTROBUN_APPLEID: ${{ secrets.ELECTROBUN_APPLEID }}
           ELECTROBUN_APPLEIDPASS: ${{ secrets.ELECTROBUN_APPLEIDPASS }}
           ELECTROBUN_TEAMID: ${{ secrets.ELECTROBUN_TEAMID }}
-        run: bunx electrobun build --env=stable --targets=$BUILD_TARGETS
+        shell: bash
+        run: |
+          max_attempts=3
+          for attempt in $(seq 1 $max_attempts); do
+            echo "Build attempt $attempt of $max_attempts..."
+            if bunx electrobun build --env=stable --targets="$BUILD_TARGETS"; then
+              echo "Build succeeded on attempt $attempt"
+              exit 0
+            fi
+            if [ $attempt -lt $max_attempts ]; then
+              echo "Build failed, retrying in 10s..."
+              sleep 10
+            fi
+          done
+          echo "Build failed after $max_attempts attempts"
+          exit 1
 
       # Electrobun outputs distributable files to artifacts/ with names like:
       #   stable-macos-arm64-BlockDev.dmg

From 94bf093cc052d49e9523bd3343b3caf6758e97da Mon Sep 17 00:00:00 2001
From: Nu11ified <manasr224@gmail.com>
Date: Wed, 25 Feb 2026 16:57:09 +0000
Subject: [PATCH 4/7] fix: address PR #4 review feedback, disable Windows build
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Add Windows guard for sshpass check with clear error message
- Trim SSH host/user/keyPath before sending to prevent whitespace errors
- Validate jvmArgs elements are strings, not just an array
- Disable Windows build target (Electrobun tar extraction broken on
  Windows drive paths — upstream issue)
---
 .github/workflows/build.yml            |  8 +++++---
 agent/index.ts                         |  4 ++--
 src/main/services/ssh-provisioner.ts   |  7 +++++++
 src/renderer/pages/CreateWorkspace.tsx | 24 ++++++++++++------------
 4 files changed, 26 insertions(+), 17 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 8f9df0d..0d3db2c 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -33,9 +33,11 @@ jobs:
           - os: ubuntu-latest
             targets: linux-x64
             artifact-name: blockdev-linux
-          - os: windows-latest
-            targets: win-x64
-            artifact-name: blockdev-windows
+          # Windows disabled: Electrobun CLI tar extraction fails on Windows
+          # drive paths (D: interpreted as remote host). Upstream issue.
+          # - os: windows-latest
+          #   targets: win-x64
+          #   artifact-name: blockdev-windows
 
     runs-on: ${{ matrix.os }}
     name: Build (${{ matrix.os }})
diff --git a/agent/index.ts b/agent/index.ts
index b7ad52f..2e870a2 100644
--- a/agent/index.ts
+++ b/agent/index.ts
@@ -188,8 +188,8 @@ async function handleMessage(ws: import("bun").ServerWebSocket<{ authenticated:
       ws.send(JSON.stringify({ type: "error", message: "setup-server requires framework, mcVersion, build (strings) and port (number)" }));
       return;
     }
-    if (r.jvmArgs !== undefined && !Array.isArray(r.jvmArgs)) {
-      ws.send(JSON.stringify({ type: "error", message: "setup-server field 'jvmArgs' must be an array if provided" }));
+    if (r.jvmArgs !== undefined && (!Array.isArray(r.jvmArgs) || !r.jvmArgs.every((a: unknown) => typeof a === "string"))) {
+      ws.send(JSON.stringify({ type: "error", message: "setup-server field 'jvmArgs' must be an array of strings if provided" }));
       return;
     }
   }
diff --git a/src/main/services/ssh-provisioner.ts b/src/main/services/ssh-provisioner.ts
index b200e7d..1e44338 100644
--- a/src/main/services/ssh-provisioner.ts
+++ b/src/main/services/ssh-provisioner.ts
@@ -51,6 +51,13 @@ export class SSHProvisioner {
 
   /** Verify sshpass is installed when password auth is needed. */
   private async checkSshpass(): Promise<void> {
+    if (process.platform === "win32") {
+      throw new Error(
+        "Password-based SSH authentication is not supported on Windows. " +
+        "Please use SSH key authentication instead."
+      );
+    }
+
     const proc = Bun.spawn(["which", "sshpass"], { stdout: "pipe", stderr: "pipe" });
     const exitCode = await proc.exited;
     if (exitCode !== 0) {
diff --git a/src/renderer/pages/CreateWorkspace.tsx b/src/renderer/pages/CreateWorkspace.tsx
index 0ebd5b4..1caab6a 100644
--- a/src/renderer/pages/CreateWorkspace.tsx
+++ b/src/renderer/pages/CreateWorkspace.tsx
@@ -150,10 +150,10 @@ export function CreateWorkspace({ onBack, onCreate }: CreateWorkspaceProps) {
     setConnectionTestResult(null);
     try {
       const result = await rpc.request("testSSHConnection", {
-        host: sshHost,
-        user: sshUser,
-        keyPath: sshAuthMode === "key" ? (sshKeyPath || undefined) : undefined,
-        password: sshAuthMode === "password" ? sshPassword : undefined,
+        host: sshHost.trim(),
+        user: sshUser.trim(),
+        keyPath: sshAuthMode === "key" ? (sshKeyPath.trim() || undefined) : undefined,
+        password: sshAuthMode === "password" ? (sshPassword || undefined) : undefined,
       });
       setConnectionTestResult(result);
     } catch (err) {
@@ -177,10 +177,10 @@ export function CreateWorkspace({ onBack, onCreate }: CreateWorkspaceProps) {
         try {
           // Provision the agent first
           const provResult = await rpc.request("provisionRemoteAgent", {
-            host: sshHost,
-            user: sshUser,
-            keyPath: sshAuthMode === "key" ? (sshKeyPath || undefined) : undefined,
-            password: sshAuthMode === "password" ? sshPassword : undefined,
+            host: sshHost.trim(),
+            user: sshUser.trim(),
+            keyPath: sshAuthMode === "key" ? (sshKeyPath.trim() || undefined) : undefined,
+            password: sshAuthMode === "password" ? (sshPassword || undefined) : undefined,
             agentPort,
           });
 
@@ -205,12 +205,12 @@ export function CreateWorkspace({ onBack, onCreate }: CreateWorkspaceProps) {
             build: selectedBuild,
             location: {
               type: "remote" as const,
-              host: sshHost,
+              host: sshHost.trim(),
               agentPort: provResult.agentPort,
               token: provResult.token,
-              sshUser,
-              sshKeyPath: sshAuthMode === "key" ? (sshKeyPath || undefined) : undefined,
-              sshPassword: sshAuthMode === "password" ? sshPassword : undefined,
+              sshUser: sshUser.trim(),
+              sshKeyPath: sshAuthMode === "key" ? (sshKeyPath.trim() || undefined) : undefined,
+              sshPassword: sshAuthMode === "password" ? (sshPassword || undefined) : undefined,
             },
           });
 

From d597f1251e487909841a777574f7d0dda9b9d0a7 Mon Sep 17 00:00:00 2001
From: Nu11ified <manasr224@gmail.com>
Date: Wed, 25 Feb 2026 16:58:41 +0000
Subject: [PATCH 5/7] ci: re-enable Windows build with tar fix

Electrobun's CLI calls tar to extract downloaded binaries. On Windows
GitHub Actions, GNU tar from Git/MSYS2 interprets drive letters (D:)
as remote host prefixes, breaking extraction.

Fix: prepend System32 to PATH so Windows' native bsdtar is used, and
set TAR_OPTIONS=--force-local as a safety net for any remaining GNU
tar invocations.
---
 .github/workflows/build.yml | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 0d3db2c..9afa708 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -33,11 +33,9 @@ jobs:
           - os: ubuntu-latest
             targets: linux-x64
             artifact-name: blockdev-linux
-          # Windows disabled: Electrobun CLI tar extraction fails on Windows
-          # drive paths (D: interpreted as remote host). Upstream issue.
-          # - os: windows-latest
-          #   targets: win-x64
-          #   artifact-name: blockdev-windows
+          - os: windows-latest
+            targets: win-x64
+            artifact-name: blockdev-windows
 
     runs-on: ${{ matrix.os }}
     name: Build (${{ matrix.os }})
@@ -87,6 +85,16 @@ jobs:
 
           rm "$CERT_FILE"
 
+      # On Windows, GNU tar from Git/MSYS2 interprets drive letters (D:) as
+      # remote hosts, breaking Electrobun's CLI extraction. Prioritize Windows'
+      # native bsdtar (System32) and set --force-local as a safety net.
+      - name: Fix tar for Windows drive paths
+        if: runner.os == 'Windows'
+        shell: bash
+        run: |
+          echo "C:\Windows\System32" >> "$GITHUB_PATH"
+          echo "TAR_OPTIONS=--force-local" >> "$GITHUB_ENV"
+
       - name: Generate Windows icon
         if: runner.os == 'Windows'
         run: bun scripts/generate-ico.ts

From 7af8337e4b9c6aff3e7449b16bab943a0f687845 Mon Sep 17 00:00:00 2001
From: Nu11ified <manasr224@gmail.com>
Date: Wed, 25 Feb 2026 17:00:32 +0000
Subject: [PATCH 6/7] =?UTF-8?q?ci:=20fix=20Windows=20build=20=E2=80=94=20u?=
 =?UTF-8?q?se=20TAR=5FOPTIONS=20only,=20not=20PATH?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Prepending System32 to PATH caused bash to resolve to the WSL
launcher (System32\bash.exe) instead of Git Bash, breaking all
shell: bash steps. TAR_OPTIONS=--force-local alone is sufficient
to prevent GNU tar from interpreting D: as a remote host.
---
 .github/workflows/build.yml | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 9afa708..5026e52 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -86,14 +86,12 @@ jobs:
           rm "$CERT_FILE"
 
       # On Windows, GNU tar from Git/MSYS2 interprets drive letters (D:) as
-      # remote hosts, breaking Electrobun's CLI extraction. Prioritize Windows'
-      # native bsdtar (System32) and set --force-local as a safety net.
+      # remote hosts, breaking Electrobun's CLI extraction. --force-local
+      # tells GNU tar to treat all archive paths as local files.
       - name: Fix tar for Windows drive paths
         if: runner.os == 'Windows'
-        shell: bash
-        run: |
-          echo "C:\Windows\System32" >> "$GITHUB_PATH"
-          echo "TAR_OPTIONS=--force-local" >> "$GITHUB_ENV"
+        shell: pwsh
+        run: echo "TAR_OPTIONS=--force-local" >> $env:GITHUB_ENV
 
       - name: Generate Windows icon
         if: runner.os == 'Windows'

From f0d0883833e857255a4824ea8201f4694c468150 Mon Sep 17 00:00:00 2001
From: Nu11ified <manasr224@gmail.com>
Date: Wed, 25 Feb 2026 17:08:32 +0000
Subject: [PATCH 7/7] fix: use dedicated known_hosts with accept-new instead of
 disabling host key verification

Replace StrictHostKeyChecking=no + UserKnownHostsFile=/dev/null with
a safer approach:
- StrictHostKeyChecking=accept-new: auto-accepts first-time keys but
  rejects changed keys (detects MITM attacks on known hosts)
- Dedicated ~/.blockdev/known_hosts file: keeps BlockDev's host keys
  separate from the user's ~/.ssh/known_hosts
- BatchMode=yes for key auth to prevent any interactive prompts
  (disabled for password auth since sshpass needs the prompt)
---
 src/main/services/ssh-provisioner.ts | 35 +++++++++++++++++++++++-----
 1 file changed, 29 insertions(+), 6 deletions(-)

diff --git a/src/main/services/ssh-provisioner.ts b/src/main/services/ssh-provisioner.ts
index 1e44338..c5e50bc 100644
--- a/src/main/services/ssh-provisioner.ts
+++ b/src/main/services/ssh-provisioner.ts
@@ -1,9 +1,15 @@
 // src/main/services/ssh-provisioner.ts
 // Handles deploying the blockdev-agent binary to a remote VPS via SSH/SCP.
 
-import { existsSync } from "node:fs";
+import { existsSync, mkdirSync } from "node:fs";
+import { join } from "node:path";
+import { homedir } from "node:os";
 import { DEFAULT_AGENT_PORT } from "../../shared/agent-protocol";
 
+// Dedicated known_hosts file so BlockDev doesn't pollute ~/.ssh/known_hosts
+// but still detects changed host keys (MITM protection).
+const BLOCKDEV_KNOWN_HOSTS = join(homedir(), ".blockdev", "known_hosts");
+
 export interface SSHConfig {
   host: string;
   user: string;
@@ -15,13 +21,27 @@ export interface SSHConfig {
 export type ProvisionProgress = (stage: string, message: string) => void;
 
 export class SSHProvisioner {
-  /** Base SSH options: auto-accept host keys, never prompt interactively. */
+  constructor() {
+    // Ensure the directory for our known_hosts file exists
+    mkdirSync(join(homedir(), ".blockdev"), { recursive: true });
+  }
+
+  /**
+   * Base SSH options: accept-new auto-accepts first-time host keys without
+   * prompting, but still rejects changed keys (MITM protection). Uses a
+   * dedicated known_hosts file so we don't pollute ~/.ssh/known_hosts.
+   */
   private buildSshArgs(config: SSHConfig): string[] {
     const args = [
       "-o", "ConnectTimeout=10",
-      "-o", "StrictHostKeyChecking=no",
-      "-o", "UserKnownHostsFile=/dev/null",
+      "-o", "StrictHostKeyChecking=accept-new",
+      "-o", `UserKnownHostsFile=${BLOCKDEV_KNOWN_HOSTS}`,
     ];
+    // BatchMode prevents all interactive prompts (good for key auth) but
+    // must be off for password auth since sshpass needs the password prompt.
+    if (!config.password) {
+      args.push("-o", "BatchMode=yes");
+    }
     if (config.keyPath) {
       args.push("-i", config.keyPath);
     }
@@ -32,9 +52,12 @@ export class SSHProvisioner {
   private buildScpArgs(config: SSHConfig): string[] {
     const args = [
       "-o", "ConnectTimeout=10",
-      "-o", "StrictHostKeyChecking=no",
-      "-o", "UserKnownHostsFile=/dev/null",
+      "-o", "StrictHostKeyChecking=accept-new",
+      "-o", `UserKnownHostsFile=${BLOCKDEV_KNOWN_HOSTS}`,
     ];
+    if (!config.password) {
+      args.push("-o", "BatchMode=yes");
+    }
     if (config.keyPath) {
       args.push("-i", config.keyPath);
     }