ci(windows): real isolated ./setup install, then a piped chain flow through the installed browse

windows-setup-e2e built the checkout but never ran ./setup. It now installs
the codex host into an isolated HOME (a runtime root copy with no
node_modules), then from an unrelated directory pipes a two-command chain
flow at a loopback page into the installed browse and asserts the page text,
and that empty piped input exits 1 with the usage error. Covers the
checkout-bundle path and the piped-stdin path end to end.

.github/workflows/windows-setup-e2e.yml

@@ -1,15 +1,19 @@
 name: Windows Setup E2E
 
-# End-to-end fresh-install gate for Windows. Runs `./setup` on a clean
-# windows-latest checkout and asserts the build completes, binaries
-# resolve via find-browse, and the gstack-paths state root resolves
-# cleanly. Catches Bun shell-parser regressions in package.json's build
-# chain (#1538, #1537, #1530, #1457, #1561) before they reach users.
+# End-to-end fresh-install gate for Windows. Builds a clean windows-latest
+# checkout and asserts the build completes, binaries resolve via
+# find-browse, and the gstack-paths state root resolves cleanly. Catches Bun
+# shell-parser regressions in package.json's build chain (#1538, #1537,
+# #1530, #1457, #1561) before they reach users. Then it runs `./setup` into
+# an isolated HOME and drives the installed runtime root's browse from an
+# unrelated directory: a piped two-command `chain` flow must print the page
+# text (the runtime root has no node_modules, so this is the checkout-bundle
+# path from #3026, and the piped-stdin path from #3039).
 #
 # Separate from windows-free-tests.yml because that one runs a curated
 # unit-test subset; this one exercises the install path itself.
 #
-# Runner: GitHub-hosted free windows-latest. ~3-5 min total.
+# Runner: GitHub-hosted free windows-latest. ~6-10 min total.
 
 on:
   pull_request:
@@ -21,6 +25,9 @@ on:
       - 'setup'
       - 'browse/src/cli.ts'
       - 'browse/src/find-browse.ts'
+      - 'browse/src/server.ts'
+      - 'browse/src/meta-commands.ts'
+      - 'browse/scripts/build-node-server.sh'
       - 'bin/gstack-paths'
       - '.github/workflows/windows-setup-e2e.yml'
   workflow_dispatch:
@@ -38,7 +45,7 @@ permissions:
 jobs:
   windows-setup:
     runs-on: windows-latest
-    timeout-minutes: 10
+    timeout-minutes: 25
 
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
@@ -111,3 +118,48 @@ jobs:
           echo "PLAN_ROOT=$PLAN_ROOT"
           echo "TMP_ROOT=$TMP_ROOT"
         shell: bash
+
+      - name: Install with ./setup into an isolated HOME
+        # A real install: the codex host's runtime root is a copy of the
+        # runtime files with no node_modules beside it. setup installs
+        # Playwright's Chromium (best-effort) for the journey below.
+        run: |
+          set -euo pipefail
+          E2E_HOME="$RUNNER_TEMP/gstack-e2e-home"
+          mkdir -p "$E2E_HOME"
+          HOME="$E2E_HOME" USERPROFILE="$(cygpath -w "$E2E_HOME")" ./setup --host codex
+          ROOT="$E2E_HOME/.codex/skills/gstack"
+          test -f "$ROOT/.source-path" || (echo "MISSING: $ROOT/.source-path" && exit 1)
+          test ! -e "$ROOT/node_modules" || (echo "UNEXPECTED: $ROOT/node_modules (the journey must exercise the copy without it)" && exit 1)
+          echo "runtime root: $ROOT -> source $(cat "$ROOT/.source-path")"
+        shell: bash
+
+      - name: Installed browse runs a piped chain flow from an unrelated directory
+        run: |
+          set -euo pipefail
+          E2E_HOME="$RUNNER_TEMP/gstack-e2e-home"
+          export HOME="$E2E_HOME" USERPROFILE="$(cygpath -w "$E2E_HOME")"
+          BROWSE="$E2E_HOME/.codex/skills/gstack/browse/dist/browse.exe"
+          [ -f "$BROWSE" ] || BROWSE="$E2E_HOME/.codex/skills/gstack/browse/dist/browse"
+          test -f "$BROWSE" || (echo "MISSING: installed browse" && exit 1)
+          bun -e 'Bun.serve({ hostname: "127.0.0.1", port: 47123, fetch: () => new Response("<title>gstack e2e</title><h1>gstack-windows-chain-ok</h1>", { headers: { "content-type": "text/html" } }) }); setInterval(() => {}, 1 << 30);' &
+          PAGE_PID=$!
+          trap 'kill "$PAGE_PID" 2>/dev/null || true; "$BROWSE" stop >/dev/null 2>&1 || true' EXIT
+          UNRELATED="$RUNNER_TEMP/unrelated-dir"
+          mkdir -p "$UNRELATED" && cd "$UNRELATED"
+          set +e
+          OUT=$(printf '%s\n' '[["goto","http://127.0.0.1:47123/"],["text"]]' | "$BROWSE" chain 2>&1)
+          CODE=$?
+          set -e
+          echo "$OUT"
+          test "$CODE" -eq 0 || (echo "browse chain exited $CODE" && exit 1)
+          echo "$OUT" | grep -q 'gstack-windows-chain-ok' || (echo "chain output lacks the page text: the flow did not run" && exit 1)
+          # Empty piped input is a usage error, never a silent exit 0.
+          set +e
+          EMPTY_OUT=$(printf '' | "$BROWSE" chain 2>&1)
+          EMPTY_CODE=$?
+          set -e
+          echo "$EMPTY_OUT"
+          test "$EMPTY_CODE" -eq 1 || (echo "empty chain exited $EMPTY_CODE, expected 1" && exit 1)
+          echo "$EMPTY_OUT" | grep -q 'no flow to run' || (echo "empty chain lacks the usage error" && exit 1)
+        shell: bash