add windows smoke test workflow

Runs start.bat end-to-end on windows-latest to catch Windows-only
regressions (login, agent startup, PowerShell launcher) that Mac dev
can't reproduce locally.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: ouyyyyang

.github/workflows/windows-smoke.yml

@@ -0,0 +1,162 @@
+name: Windows smoke test
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+jobs:
+  smoke:
+    name: start.bat end-to-end on Windows
+    runs-on: windows-latest
+    timeout-minutes: 15
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+
+      - name: Install dependencies
+        shell: pwsh
+        run: npm ci
+
+      - name: Start agent via start.bat
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = "Stop"
+          Write-Host "Launching start.bat in background..."
+          $proc = Start-Process `
+            -FilePath "cmd.exe" `
+            -ArgumentList "/c", "start.bat" `
+            -WorkingDirectory "$env:GITHUB_WORKSPACE" `
+            -WindowStyle Hidden `
+            -PassThru
+          Write-Host "start.bat launcher PID: $($proc.Id)"
+
+      - name: Wait for agent to be ready
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = "Stop"
+          $portFile = "runtime/agent/agent.port"
+          $port = $null
+
+          for ($i = 0; $i -lt 90; $i++) {
+            if (Test-Path $portFile) {
+              $port = (Get-Content $portFile -Raw).Trim()
+              if ($port) { break }
+            }
+            Start-Sleep -Seconds 2
+          }
+
+          if (-not $port) {
+            Write-Error "agent.port file never appeared — start.bat failed to start the agent"
+            exit 1
+          }
+
+          Write-Host "Agent port: $port"
+          "AGENT_PORT=$port" | Out-File -FilePath $env:GITHUB_ENV -Append
+
+          $url = "http://127.0.0.1:$port/api/config"
+          for ($i = 0; $i -lt 60; $i++) {
+            try {
+              $resp = Invoke-WebRequest -UseBasicParsing -Uri $url -TimeoutSec 3
+              if ($resp.StatusCode -eq 200) {
+                Write-Host "GET /api/config -> 200 OK"
+                Write-Host $resp.Content
+                exit 0
+              }
+            } catch {
+              Start-Sleep -Seconds 2
+            }
+          }
+          Write-Error "Agent never responded on /api/config within 2 minutes"
+          exit 1
+
+      - name: Smoke test /desktop route
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = "Stop"
+          $url = "http://127.0.0.1:$env:AGENT_PORT/desktop"
+          $resp = Invoke-WebRequest -UseBasicParsing -Uri $url -TimeoutSec 10
+          if ($resp.StatusCode -ne 200) {
+            Write-Error "/desktop returned $($resp.StatusCode)"
+            exit 1
+          }
+          Write-Host "/desktop -> 200 OK ($($resp.Content.Length) bytes)"
+
+      - name: Smoke test login (POST /api/pair)
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = "Stop"
+
+          $tokenFile = "runtime/agent/app_data/pairing-token.txt"
+          if (-not (Test-Path $tokenFile)) {
+            Write-Error "pairing-token.txt missing — agent never initialized session store"
+            exit 1
+          }
+          $token = (Get-Content $tokenFile -Raw).Trim()
+          Write-Host "Pairing token: $token"
+
+          $url = "http://127.0.0.1:$env:AGENT_PORT/api/pair"
+
+          # 1. Wrong token -> 401
+          try {
+            $bad = Invoke-WebRequest -UseBasicParsing -Uri $url -Method POST `
+              -ContentType "application/json" `
+              -Body '{"token":"wrong-token"}' -TimeoutSec 5
+            Write-Error "Wrong token should have failed, got $($bad.StatusCode)"
+            exit 1
+          } catch {
+            if ($_.Exception.Response.StatusCode.value__ -ne 401) {
+              Write-Error "Wrong token expected 401, got $($_.Exception.Response.StatusCode.value__)"
+              exit 1
+            }
+            Write-Host "Wrong token -> 401 (as expected)"
+          }
+
+          # 2. Correct token -> 200 { ok: true }
+          $body = @{ token = $token } | ConvertTo-Json -Compress
+          $ok = Invoke-WebRequest -UseBasicParsing -Uri $url -Method POST `
+            -ContentType "application/json" `
+            -Body $body -TimeoutSec 5
+          if ($ok.StatusCode -ne 200) {
+            Write-Error "/api/pair returned $($ok.StatusCode)"
+            exit 1
+          }
+          Write-Host "/api/pair -> 200 OK: $($ok.Content)"
+
+      - name: Run unit tests
+        shell: pwsh
+        run: npm test
+
+      - name: Stop agent
+        if: always()
+        shell: pwsh
+        run: |
+          $pidFile = "runtime/agent/agent.pid"
+          if (Test-Path $pidFile) {
+            $agentPid = (Get-Content $pidFile -Raw).Trim()
+            try {
+              Stop-Process -Id $agentPid -Force -ErrorAction Stop
+              Write-Host "Stopped agent PID $agentPid"
+            } catch {
+              Write-Host "Agent PID $agentPid already gone"
+            }
+          }
+
+      - name: Upload agent log
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: agent-log
+          path: |
+            runtime/agent/agent.log
+            runtime/agent/agent.port
+            runtime/agent/agent.pid
+          if-no-files-found: warn