fix(release-train): Windows spawn + dismiss-while-blocked review feedback

- (P1) `ao update` silently never ran on Windows because `spawn("ao", ...)`
  doesn't consult PATHEXT, so npm's `ao.cmd` shim wasn't found and the
  async ENOENT was swallowed by the error handler. Add `shell: isWindows()`
  + `windowsHide: true` per the cross-platform guide.
- (P1) Dismiss button was inert when the banner was in the `blocked` (409)
  or `error` phase — `setDismissedFor` set the localStorage flag but the
  hide condition required `phase === "idle"`, so the banner stayed pinned
  until reload. `handleDismiss` now resets phase to idle (and clears the
  error message) so the existing condition fires. Added a regression test
  covering dismiss from the 409 path.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: suraj-markup

packages/web/src/app/api/update/route.ts

@@ -13,6 +13,7 @@
 
 import { spawn } from "node:child_process";
 import { NextResponse, type NextRequest } from "next/server";
+import { isWindows } from "@aoagents/ao-core";
 import { getServices } from "@/lib/services";
 
 export const dynamic = "force-dynamic";
@@ -64,16 +65,22 @@ export async function POST(_req: NextRequest) {
   // tears down the dashboard process. We rely on PATH resolution because the
   // user installed `ao` themselves — there's no canonical install location.
   //
-  // ENOENT (binary missing from PATH) fires asynchronously as an `error`
-  // event on the child, NOT as a sync throw — without an explicit handler
-  // it would propagate as an unhandled error and crash the test runner. So
-  // we attach a noop handler here; in production, the worst-case is the
-  // banner shows "Update started" but nothing actually installs, which the
-  // user will notice on next page load.
+  // `shell: isWindows()` is required so PATHEXT gets consulted on Windows —
+  // npm's `ao` shim is `ao.cmd`, and Node.js does not look at PATHEXT for
+  // non-shell spawns, so the bare `ao` lookup would silently ENOENT on every
+  // Windows install. `windowsHide: true` keeps the shell window from flashing.
+  //
+  // ENOENT still fires asynchronously as an `error` event on the child (POSIX
+  // case where `ao` isn't on PATH), NOT as a sync throw — without an explicit
+  // handler it would propagate as an unhandled error and crash the test
+  // runner. The handler is a noop in production; the user will see "no
+  // version change" on next page load if the install never ran.
   try {
     const child = spawn("ao", ["update"], {
       detached: true,
       stdio: "ignore",
+      shell: isWindows(),
+      windowsHide: true,
     });
     child.on("error", () => {
       // Swallow async spawn errors (ENOENT etc.) so they don't become

packages/web/src/components/UpdateBanner.tsx

@@ -68,6 +68,12 @@ export function UpdateBanner() {
       // ignore
     }
     setDismissedFor(info.latest);
+    // Reset to idle so the hide condition (`dismissedFor === info.latest &&
+    // phase === "idle"`) fires even when the user dismisses while we're
+    // showing a 409 / error message. Without this the banner would stay
+    // pinned on screen until the user reloads.
+    setPhase("idle");
+    setErrorMessage(null);
   }, [info]);
 
   const handleUpdate = useCallback(async () => {

packages/web/src/components/__tests__/UpdateBanner.test.tsx

@@ -155,4 +155,34 @@ describe("UpdateBanner", () => {
 
     await screen.findByText(/3 sessions active/);
   });
+
+  it("dismiss button hides the banner even from the 'blocked' (409) error state", async () => {
+    fetchMock
+      .mockResolvedValueOnce(
+        mockVersionResponse({
+          current: "0.5.0",
+          latest: "0.5.1",
+          channel: "stable",
+          isOutdated: true,
+        }),
+      )
+      .mockResolvedValueOnce({
+        ok: false,
+        status: 409,
+        json: async () => ({
+          ok: false,
+          message: "1 session active. Run `ao stop` first.",
+          activeSessions: 1,
+        }),
+      } as Response);
+
+    const { container } = render(<UpdateBanner />);
+    const update = await screen.findByRole("button", { name: "Update" });
+    fireEvent.click(update);
+    // Wait for the 409 to surface so we're definitely in the blocked phase.
+    await screen.findByText(/1 session active/);
+
+    fireEvent.click(screen.getByRole("button", { name: "Dismiss" }));
+    await waitFor(() => expect(container.firstChild).toBeNull());
+  });
 });