nodeagent/.github/workflows/windows-e2e.yml

name: Windows E2E

on:
  push:
    branches: [main]
    paths:
      - 'apps/**'
      - 'packages/**'
      - 'tests/**'
      - 'scripts/**'
      - 'package.json'
      - 'pnpm-lock.yaml'
      - '.github/workflows/windows-e2e.yml'
  pull_request:
    branches: [main]
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  windows-e2e:
    name: Windows 真机验证
    runs-on: windows-latest
    timeout-minutes: 30

    steps:
      - name: 检出代码
        uses: actions/checkout@v5

      - name: 安装 pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 12

      - name: 安装 Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: pnpm

      - name: 安装依赖
        run: pnpm install --frozen-lockfile

      - name: 构建
        run: pnpm -r build

      - name: 类型检查
        run: pnpm typecheck

      # 控制台「随包分发的 Node 运行时」在 Windows 上的分支此前零覆盖
      # （准备脚本本机只在 macOS 上跑过）。此处真跑：复制 node.exe（无 strip 分支）→
      # 自检可执行 → 再验证它与 sidecar 能否走通一次 JSON-RPC 自举。
      # ⚠️ 必须先 sidecar:build —— prepare-console.mjs 的前置检查要求 sidecar.mjs 存在
      # （首次推送时漏了这步，CI 在 Windows 上当场报「未找到 sidecar/dist/sidecar.mjs」）。
      - name: 控制台 Node 运行时（Windows 分支）与自举验证
        run: |
          pnpm --filter nodeagent-console sidecar:build
          pnpm --filter nodeagent-console prepare:node
          node apps/console/scripts/verify-bundle.mjs --runtime

      - name: 单元测试 — 协议纯函数 / 清单守护 / 脚本生成
        # 来自 ci/workflow-unit-tests 分支（4d73d6e）的实质贡献；该分支基于老 main，
        # 直接 merge 会回退上万行，故只取其提交内容手工并入。
        run: node --test "tests/unit/**/*.test.mjs"

      - name: E2E — 协议与跨平台能力
        run: node tests/e2e/run.mjs

      - name: E2E — Windows 专属能力（服务 / 软件 / winget）
        run: node tests/e2e/windows.mjs

      # ⚠️ 这一步刻意用 **powershell（Windows PowerShell 5.1）** 而非 pwsh。
      # 5.1 读无 BOM 的 .ps1 会按 ANSI/GBK 解析，中文注释会破坏字符串边界 →
      # 整份脚本 ParseError（真机 2026-10-04 踩过：install.ps1 报「","后面缺少表达式」）。
      # 之前的冒烟全用 pwsh（7+ 认无 BOM UTF-8），所以 CI 绿、真机炸。
      # 这里只做「解析 + 首行 help」检查：5.1 能否读懂，就是真机的核心约束。
      # ⚠️ 必须用 shell: powershell（runner 上的 powershell 即 Windows PowerShell 5.1）。
      # 不要用 shell: cmd 再套 powershell -Command "..." —— 多行带引号经 cmd 转义会全乱
      # （实测：Missing closing '}' / '$errs' is not recognized，是步骤自身坏，不是脚本坏）。
      - name: 冒烟 — 脚本可被 Windows PowerShell 5.1 解析（BOM 守卫）
        shell: powershell
        run: |
          $ErrorActionPreference = 'Stop'
          foreach ($f in @('scripts\install.ps1', 'scripts\uninstall.ps1', 'scripts\rescue-network.ps1')) {
            $errs = $null
            [void][System.Management.Automation.Language.Parser]::ParseFile((Resolve-Path $f).Path, [ref]$null, [ref]$errs)
            if ($errs -and $errs.Count -gt 0) { throw ('5.1 parse FAILED: ' + $f + ' -> ' + $errs[0].Message) }
            Write-Host ('OK 5.1 parse: ' + $f)
          }

      - name: 冒烟 — install.ps1 安装链路
        shell: powershell
        run: |
          $ErrorActionPreference = "Stop"
          ./scripts/install.ps1 -Port 18769 -NodeId ci_win

          $task = Get-ScheduledTask -TaskName "nodeagent" -ErrorAction Stop
          Write-Host "Scheduled task state: $($task.State)"

          $cfg = Get-Content "$env:USERPROFILE\.nodeagent\agent.json" -Raw | ConvertFrom-Json
          if ($cfg.port -ne 18769) { throw "port mismatch: $($cfg.port)" }
          if (-not $cfg.key)       { throw "PSK missing in agent.json" }
          if (-not $cfg.tls)       { throw "TLS should be on by default" }

          $rule = Get-NetFirewallRule -DisplayName "nodeagent (TCP 18769)" -ErrorAction Stop
          if (-not $rule) { throw "Firewall rule" }

          Write-Host "OK  scheduled task / config / firewallall in place"

      # 一键入口冒烟：真跑 install.cmd / control.cmd。
      # 目的不是「再装一遍」，而是证明双击路径可用 —— 这些脚本是用户唯一的
      # 上手入口，语法或编码一旦坏了，只有真机 cmd.exe 才测得出来。
      # 端口用 18770 避开前一步的 18770 之外的安装，便于分辨是哪一步装的。
      - name: 冒烟 — install.cmd 双击链路（含自提权与 PSK 读取）
        shell: cmd
        run: call scripts\install.cmd 18770
        env:
          CI: "true"
      - name: 冒烟 — control.cmd 状态查询
        shell: cmd
        run: scripts\control.cmd 18770 < nul
        env:
          CI: "true"
      - name: 冒烟 — 产物包结构与编码
        shell: pwsh
        run: |
          $ErrorActionPreference = "Stop"
          pnpm pack:win
          $zip = "release/nodeagent-win-x64.zip"
          if (-not (Test-Path $zip)) { throw "zip not produced: $zip" }
          Add-Type -AssemblyName System.IO.Compression.FileSystem
          $z = [IO.Compression.ZipFile]::OpenRead((Resolve-Path $zip))
          try {
            $names = $z.Entries.Name
            # 必须随包分发
            foreach ($need in @('install.cmd','control.cmd','install.ps1','control.ps1','README.txt','agent.mjs','node.exe')) {
              if ($names -notcontains $need) { throw "missing in package: $need" }
            }
            # 必须**不**在包内：PSK.txt 是现生成给本机的，打进公开资产等于泄露密钥
            # （eaca9e0 起已从 zip 剔除；此处反向断言守住该性质）
            foreach ($forbidden in @('PSK.txt','*.key','*.pem','certs')) {
              if ($names -contains $forbidden) { throw "package must NOT contain: $forbidden" }
            }
            if ($names -match 'PSK\.txt') { throw "package leaks PSK.txt" }
            foreach ($e in $z.Entries) {
              $s = $e.Open(); $buf = New-Object byte[] 3
              [void]$s.Read($buf, 0, 3); $s.Close()
              $hasBom = ($buf[0] -eq 0xEF -and $buf[1] -eq 0xBB -and $buf[2] -eq 0xBF)
              if ($e.Name -like '*.ps1' -and -not $hasBom) { throw "$($e.Name) lost its BOM in package" }
              if ($e.Name -like '*.cmd' -and $hasBom) { throw "$($e.Name) must not have a BOM" }
            }
            Write-Host "OK - package complete; .ps1 has BOM / .cmd has none; no key shipped"
          } finally { $z.Dispose() }
      - name: 冒烟 — 双架构包（node.exe PE 架构校验）
        shell: pwsh
        run: |
          $ErrorActionPreference = "Stop"
          # 真机教训（Parallels 27 + Win11 ARM）：曾出现 arm64 包里装的其实是 x64 的 node.exe
          # —— 两份包的 node.exe 字节完全相同。x64 node 在 ARM Windows 上**能 listen，
          # 但 TLS 握手不完成**（客户端只见超时）→ 被控端实际不可用，且 macOS 侧 100% 测不出。
          # 根因是 pack.mjs 的运行时缓存文件名不含架构。这里直接验**最终产物**的 PE 架构，
          # 比只验脚本内部逻辑更靠近交付物（缓存串包 / 手工塞错文件都会被这一步拦下）。
          foreach ($arch in @('x64','arm64')) {
            node scripts/pack.mjs --arch $arch
          }
          $want = @{ 'x64' = [uint16]0x8664; 'arm64' = [uint16]0xaa64 }
          Add-Type -AssemblyName System.IO.Compression.FileSystem
          foreach ($arch in @('x64','arm64')) {
            $zip = "release/nodeagent-win-$arch.zip"
            if (-not (Test-Path $zip)) { throw "zip not produced: $zip" }
            $z = [IO.Compression.ZipFile]::OpenRead((Resolve-Path $zip))
            try {
              $e = $z.Entries | Where-Object { $_.Name -eq 'node.exe' }
              if (-not $e) { throw "missing node.exe in $zip" }
              $s = $e.Open(); $buf = New-Object byte[] 4096
              [void]$s.Read($buf, 0, 4096); $s.Close()
              # PE 头：0x3c 处为 PE 签名偏移，+4 为 Machine 字段
              $peOff = [BitConverter]::ToUInt32($buf, 0x3c)
              $machine = [BitConverter]::ToUInt16($buf, [int]$peOff + 4)
              if ($machine -ne $want[$arch]) {
                throw "node.exe arch mismatch in $zip : want 0x$('{0:x}' -f $want[$arch]) got 0x$('{0:x}' -f $machine)"
              }
              Write-Host "OK - $arch -> node.exe PE machine 0x$('{0:x}' -f $machine)"
            } finally { $z.Dispose() }
          }
      - name: 冒烟 — 被控端监听
        shell: pwsh
        run: |
          Start-Process -FilePath "node" -ArgumentList "apps/agent/dist/index.js" -NoNewWindow
          Start-Sleep -Seconds 4
          $ok = (Test-NetConnection 127.0.0.1 -Port 18769 -WarningAction SilentlyContinue).TcpTestSucceeded
          if (-not $ok) { throw "agent 未监听 18769" }
          Write-Host "agent 已在 18769 监听"

      - name: 冒烟 — CLI 连入（wss + 自签证书 + HMAC 鉴权）
        shell: pwsh
        run: |
          $cfg = Get-Content "$env:USERPROFILE\.nodeagent\agent.json" -Raw | ConvertFrom-Json
          node apps/cli/dist/index.js connect 127.0.0.1 --port 18769 --key $cfg.key --insecure
          Write-Host "--- status ---"
          node apps/cli/dist/index.js status
          Write-Host "--- services ---"
          node apps/cli/dist/index.js services --limit 5

      - name: 冒烟 — MCP 工具列表
        shell: pwsh
        run: |
          $cfg = Get-Content "$env:USERPROFILE\.nodeagent\agent.json" -Raw | ConvertFrom-Json
          @{ client_id="ci"; host="127.0.0.1"; port=18769; tls=$true; insecure=$true; key=$cfg.key } |
            ConvertTo-Json | Set-Content "$env:USERPROFILE\.nodeagent\config.json" -Encoding UTF8
          $req = @(
            '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"ci","version":"1.0"}}}',
            '{"jsonrpc":"2.0","method":"notifications/initialized"}',
            '{"jsonrpc":"2.0","id":2,"method":"tools/list","params":{}}'
          ) -join "`n"
          ($req + "`n") | node apps/mcp/dist/index.js 2>$null | Select-String "na_status"

      - name: 清理
        if: always()
        # 清理失败不掩盖真实结论（前置挂了会连带这里报错）
        continue-on-error: true
        shell: powershell
        run: |
          Get-Process node -ErrorAction SilentlyContinue | Stop-Process -Force -ErrorAction SilentlyContinue
          ./scripts/uninstall.ps1 -Port 18769 -Purge