fix: v2.5.3 — Windows workspace folders, picker on top, no console flashes

A workspace could not be created on Windows: "cwd must be an absolute path"
for D:\…, because createLane/canonicalCwd tested for a leading "/".

- lanes.js: path.isAbsolute/path.resolve; canonicalCwd stops at any root (a
  missing drive looped forever); resolveLaneByCwd and /ensure accept "\" too
- native-dialog.js: the Windows picker gets an invisible TopMost owner form,
  shown first — an ownerless dialog from the background server opened behind
  the browser, or hidden
- windows-hide.js: every child process on Windows starts with windowsHide,
  required first by the server and the detached scripts (a console window
  flashed per git/npm call)
- Confirm/update/clear-data modals and the quota panel scroll instead of
  overflowing a short window

client/src/components/ConfirmModal.tsx

@@ -85,14 +85,14 @@ export function ConfirmModal({
     >
       <div
         ref={panelRef}
-        className="relative w-full max-w-md rounded-xl border border-border bg-surface-1 shadow-xl shadow-black/40"
+        className="relative flex max-h-full w-full max-w-md flex-col rounded-xl border border-border bg-surface-1 shadow-xl shadow-black/40"
         onClick={(e) => e.stopPropagation()}
         role="dialog"
         aria-modal="true"
         aria-labelledby={titleId}
         aria-describedby={message ? messageId : undefined}
       >
-        <div className="flex items-start gap-3 p-5">
+        <div className="flex min-h-0 items-start gap-3 overflow-y-auto p-5">
           {destructive && (
             <div className="w-9 h-9 rounded-lg bg-status-danger/10 border border-status-danger/20 flex items-center justify-center flex-shrink-0">
               <AlertTriangle className="w-4.5 h-4.5 text-status-danger" aria-hidden />

client/src/components/StatusBar.tsx

@@ -208,7 +208,7 @@ function QuotaPanel({
       onMouseLeave={onLeave}
       onFocus={onEnter}
       onBlur={onLeave}
-      className="fixed bottom-7 right-2 z-[9999] w-[19rem] max-w-[calc(100vw-1rem)] rounded-lg border border-border bg-surface-2 px-3 py-2.5 text-[11px] leading-snug text-fg-primary shadow-lg shadow-black/20"
+      className="fixed bottom-7 right-2 z-[9999] max-h-[calc(100vh-2.5rem)] w-[19rem] max-w-[calc(100vw-1rem)] overflow-y-auto rounded-lg border border-border bg-surface-2 px-3 py-2.5 text-[11px] leading-snug text-fg-primary shadow-lg shadow-black/20"
     >
       <div className="mb-2 font-semibold">{t("statusBar.quotaTitle")}</div>
       {groups.map(([id, list]) => (

client/src/components/UpdateNotifier.tsx

@@ -330,7 +330,7 @@ export function UpdateNotifier() {
           longest label is a whole sentence ("restarting the dashboard…"). */}
       <div
         ref={panelRef}
-        className="w-full max-w-2xl card shadow-2xl animate-slide-up overflow-hidden"
+        className="w-full max-w-2xl max-h-full flex flex-col card shadow-2xl animate-slide-up overflow-hidden"
       >
         {/* Header */}
         <div className="flex items-start justify-between gap-3 px-5 py-4 border-b border-border">
@@ -370,7 +370,7 @@ export function UpdateNotifier() {
         </div>
 
         {/* Body */}
-        <div className="px-5 py-4 space-y-3">
+        <div className="min-h-0 overflow-y-auto px-5 py-4 space-y-3">
           <p className="text-sm text-fg-secondary leading-relaxed">
             {pluginManaged ? t("pluginAutoNote") : release ? t("releaseLead") : t("lead")}
           </p>

client/src/components/config/ConfirmDeleteModal.tsx

@@ -67,7 +67,7 @@ export function ConfirmDeleteModal<
         aria-modal="true"
         aria-labelledby="cc-confirm-delete-title"
         aria-describedby="cc-confirm-delete-body"
-        className="relative w-full max-w-lg rounded-xl border border-status-danger/40 bg-surface-1"
+        className="relative flex max-h-full w-full max-w-lg flex-col rounded-xl border border-status-danger/40 bg-surface-1"
         onClick={(e) => e.stopPropagation()}
       >
         <div className="border-b border-border px-4 py-2.5 flex items-center gap-2">
@@ -76,7 +76,7 @@ export function ConfirmDeleteModal<
             {t("edit.confirmDelete")}
           </span>
         </div>
-        <div className="p-4 space-y-3">
+        <div className="min-h-0 overflow-y-auto p-4 space-y-3">
           <p id="cc-confirm-delete-body" className="text-xs text-fg-secondary leading-relaxed">
             {t("edit.confirmDeleteBody")}
           </p>

client/src/pages/Settings.tsx

@@ -1229,7 +1229,7 @@ function ClearDataDialog({
         aria-modal="true"
         aria-labelledby="clear-data-title"
         aria-describedby="clear-data-body"
-        className="card w-full max-w-md space-y-4 border-status-danger/40 p-5"
+        className="card max-h-full w-full max-w-md space-y-4 overflow-y-auto border-status-danger/40 p-5"
         onClick={(e) => e.stopPropagation()}
       >
         <h2

client/src/pages/__tests__/__snapshots__/screens.snapshot.test.tsx.snap

@@ -7233,7 +7233,7 @@ exports[`screen snapshots > Settings — about 1`] = `
             <p
               class="text-[10px] text-status-warning/90 mt-1"
             >
-              UI build v2.5.2 (rebuild client to match)
+              UI build v2.5.3 (rebuild client to match)
             </p>
           </div>
           <div

openapi.yaml

@@ -3,7 +3,7 @@
 openapi: 3.0.3
 info:
   title: Agent Dashboard for Claude Code API
-  version: 2.5.2
+  version: 2.5.3
   description: HTTP API for real-time Claude Code session monitoring, agent lifecycle tracking, analytics, pricing, hooks ingestion, and workflow intelligence.
   contact:
     name: Nguyễn Ngọc Trí Vĩ

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "agenthub",
-  "version": "2.5.2",
+  "version": "2.5.3",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "agenthub",
-      "version": "2.5.2",
+      "version": "2.5.3",
       "hasInstallScript": true,
       "license": "UNLICENSED",
       "dependencies": {

package.json

@@ -1,6 +1,6 @@
 {
   "name": "agenthub",
-  "version": "2.5.2",
+  "version": "2.5.3",
   "bin": {
     "agenthub": "bin/agenthub.js"
   },

scripts/cc-update-all-helper.js

@@ -22,6 +22,7 @@
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
 
+require("../server/lib/windows-hide").install(); // before child_process is read
 const fs = require("fs");
 const { rotateIfLarge } = require("./log-rotate");
 const path = require("path");

scripts/plugin-bootstrap.js

@@ -26,6 +26,7 @@
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
 
+require("../server/lib/windows-hide").install(); // before child_process is read
 const fs = require("fs");
 const { rotateIfLarge } = require("./log-rotate");
 const os = require("os");

scripts/plugin-update-helper.js

@@ -31,6 +31,7 @@
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
 
+require("../server/lib/windows-hide").install(); // before child_process is read
 const fs = require("fs");
 const { rotateIfLarge } = require("./log-rotate");
 const path = require("path");

scripts/restart-helper.js

@@ -7,6 +7,7 @@
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
 
+require("../server/lib/windows-hide").install(); // before child_process is read
 const { spawn } = require("child_process");
 
 const [, , pidArg, entry] = process.argv;

server/__tests__/native-dialog.test.js

@@ -44,6 +44,16 @@ describe("native-dialog", () => {
     assert.ok(!args.slice(0, -2).join(" ").includes("shell script"));
   });
 
+  it("gives the Windows dialog a TopMost owner, so it does not open behind the browser", () => {
+    for (const kind of ["dir", "file"]) {
+      const [[cmd, args]] = nd.dialogCommands(kind, "C:\\x", "win32");
+      assert.equal(cmd, "powershell.exe");
+      const script = args.at(-1);
+      assert.match(script, /\$o\.TopMost = \$true;.*\$o\.Show\(\);.*\$d\.ShowDialog\(\$o\)/);
+      assert.ok(!script.includes("C:\\x"), "the folder travels in env, never the script");
+    }
+  });
+
   it(
     "answers the chosen path, null on Cancel, and falls through a missing program",
     {
@@ -95,10 +105,16 @@ describe("native-dialog", () => {
 
   it("tells a Cancel from a failure per program", () => {
     assert.equal(nd.isCancel("zenity", ""), true);
-    assert.equal(nd.isCancel("zenity", "Gtk-Message: GtkDialog mapped without a transient parent"), true);
+    assert.equal(
+      nd.isCancel("zenity", "Gtk-Message: GtkDialog mapped without a transient parent"),
+      true
+    );
     assert.equal(nd.isCancel("kdialog", "qt.qpa.xcb: could not connect to display :1"), false);
     assert.equal(nd.isCancel("osascript", "execution error: User canceled. (-128)"), true);
-    assert.equal(nd.isCancel("osascript", "execution error: No user interaction allowed. (-1713)"), false);
+    assert.equal(
+      nd.isCancel("osascript", "execution error: No user interaction allowed. (-1713)"),
+      false
+    );
     assert.equal(nd.isCancel("powershell.exe", ""), true);
     assert.equal(nd.isCancel("powershell.exe", "Add-Type : Cannot add type"), false);
   });

server/__tests__/windows-hide.test.js

@@ -0,0 +1,50 @@
+/**
+ * @file Tests for server/lib/windows-hide.js: on win32 every child process,
+ * async or sync, is started with `windowsHide: true`; elsewhere nothing changes.
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+
+const { test } = require("node:test");
+const assert = require("node:assert/strict");
+const { install } = require("../lib/windows-hide");
+
+function fakeCp() {
+  const seen = [];
+  class ChildProcess {
+    spawn(options) {
+      seen.push(options);
+    }
+  }
+  const rec = (...args) => seen.push(args);
+  return { seen, cp: { ChildProcess, spawnSync: rec, execFileSync: rec, execSync: rec } };
+}
+
+test("win32: async spawns and every sync form get windowsHide", () => {
+  const { seen, cp } = fakeCp();
+  install(cp, "win32");
+  install(cp, "win32"); // idempotent: no double wrap
+
+  new cp.ChildProcess().spawn({ file: "git", windowsHide: false });
+  cp.execFileSync("git", ["status"]);
+  cp.execFileSync("git", ["status"], { cwd: "x" });
+  cp.execFileSync("git", { cwd: "x" });
+  cp.execSync("dir");
+  cp.spawnSync("git", ["log"], undefined);
+
+  assert.deepEqual(seen, [
+    { file: "git", windowsHide: true },
+    ["git", ["status"], { windowsHide: true }],
+    ["git", ["status"], { cwd: "x", windowsHide: true }],
+    ["git", { cwd: "x", windowsHide: true }],
+    ["dir", { windowsHide: true }],
+    ["git", ["log"], { windowsHide: true }],
+  ]);
+});
+
+test("other platforms are left alone", () => {
+  const { cp } = fakeCp();
+  const before = { ...cp, spawn: cp.ChildProcess.prototype.spawn };
+  install(cp, "linux");
+  assert.equal(cp.execSync, before.execSync);
+  assert.equal(cp.ChildProcess.prototype.spawn, before.spawn);
+});

server/index.js

@@ -3,6 +3,9 @@
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
 
+// First, before any module destructures child_process: no console window per
+// git/npm call on Windows (server/lib/windows-hide.js).
+require("./lib/windows-hide").install();
 if (!process.env.NODE_ENV) process.env.NODE_ENV = "production";
 
 // A server started from inside a Claude Code session (the bootstrap fallback,

server/lib/lanes.js

@@ -9,6 +9,7 @@
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
 
+const path = require("node:path");
 const { db } = require("../db");
 const aiTools = require("./ai-tools");
 const {
@@ -182,17 +183,18 @@ function normalizeTitle(value) {
  */
 function canonicalCwd(cwd) {
   // A relative path must stay relative, so createLane still refuses it.
-  if (!cwd.startsWith("/")) return cwd;
-  const trimmed = cwd.replace(/\/+$/, "");
+  // path.isAbsolute, not a leading "/": a Windows cwd is `D:\…`.
+  if (!path.isAbsolute(cwd)) return cwd;
+  const trimmed = path.resolve(cwd);
   // A path that does not exist yet resolves through its deepest existing
   // ancestor, so /link/new and /real/new still name the same lane.
-  const path = require("node:path");
   const tail = [];
   for (let dir = trimmed; ; dir = path.dirname(dir)) {
     try {
-      return path.join(require("node:fs").realpathSync.native(dir || "/"), ...tail);
+      return path.join(require("node:fs").realpathSync.native(dir), ...tail);
     } catch {
-      if (dir === "/" || !dir) return trimmed;
+      // A root (`/`, `D:\` — a drive that does not exist) is its own dirname.
+      if (path.dirname(dir) === dir) return trimmed;
       tail.unshift(path.basename(dir));
     }
   }
@@ -210,7 +212,7 @@ function createLane({
   tool = "claude",
   router_profile = null,
 } = {}) {
-  if (!cwd || typeof cwd !== "string" || !cwd.startsWith("/")) {
+  if (!cwd || typeof cwd !== "string" || !path.isAbsolute(cwd)) {
     throw Object.assign(new Error("cwd must be an absolute path"), { code: "EBADCWD" });
   }
   validateKind(kind);
@@ -603,12 +605,13 @@ function recoverInterruptedProvisioning() {
  */
 function resolveLaneByCwd(cwd, tool) {
   if (!cwd || typeof cwd !== "string") return null;
-  const target = cwd.replace(/\/+$/, "");
+  // A Windows cwd ends in and nests under `\`.
+  const target = cwd.replace(/[\\/]+$/, "");
   let best = null;
   for (const lane of listLanes()) {
     if (tool && lane.tool !== tool) continue;
-    const base = lane.cwd.replace(/\/+$/, "");
-    if (target === base || target.startsWith(`${base}/`)) {
+    const base = lane.cwd.replace(/[\\/]+$/, "");
+    if (target === base || target.startsWith(`${base}/`) || target.startsWith(base + path.sep)) {
       if (!best || base.length > best.cwd.length) best = lane;
     }
   }

server/lib/native-dialog.js

@@ -95,7 +95,12 @@ function dialogCommands(kind, dir, platform = process.platform) {
           "-NoProfile",
           "-STA",
           "-Command",
-          `[Console]::OutputEncoding = [Text.Encoding]::UTF8; Add-Type -AssemblyName System.Windows.Forms; ${dialog}; if ($d.ShowDialog() -eq 'OK') { [Console]::Out.Write(${result}) } else { exit 1 }`,
+          // The server is a background process, and Windows will not let one
+          // bring a window to the front: an ownerless dialog opened BEHIND the
+          // browser (or hidden — the first ShowWindow of a process started
+          // with windowsHide). An invisible TopMost owner, shown first, takes
+          // that first ShowWindow and keeps the dialog on top.
+          `[Console]::OutputEncoding = [Text.Encoding]::UTF8; Add-Type -AssemblyName System.Windows.Forms; $o = New-Object System.Windows.Forms.Form; $o.TopMost = $true; $o.ShowInTaskbar = $false; $o.FormBorderStyle = 'None'; $o.Opacity = 0; $o.Width = 1; $o.Height = 1; $o.Show(); $o.Activate(); ${dialog}; if ($d.ShowDialog($o) -eq 'OK') { [Console]::Out.Write(${result}) } else { exit 1 }`,
         ],
       ],
     ];

server/lib/windows-hide.js

@@ -0,0 +1,41 @@
+/**
+ * @file Makes every child process on Windows start with `windowsHide: true`.
+ * The dashboard runs detached, with no console of its own, so Windows gave
+ * each console program it ran (git, npm, where, …) a NEW console window — a
+ * flash that stole focus on every poll. Node has no global default, so this
+ * patches `ChildProcess.prototype.spawn` (the one path spawn/exec/execFile/fork
+ * and their promisified forms all take) and wraps the sync exports. Require it
+ * FIRST in an entry point: a `const { execSync } = require("child_process")`
+ * evaluated before it keeps the unwrapped function. A no-op off Windows.
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+
+const DONE = Symbol.for("agenthub.windowsHide");
+
+function install(cp = require("child_process"), platform = process.platform) {
+  if (platform !== "win32" || cp[DONE]) return;
+  cp[DONE] = true;
+
+  const spawn = cp.ChildProcess.prototype.spawn;
+  cp.ChildProcess.prototype.spawn = function (options) {
+    options.windowsHide = true;
+    return spawn.call(this, options);
+  };
+
+  // spawnSync(cmd, args?, opts?), execFileSync(file, args?, opts?), execSync(cmd, opts?)
+  for (const name of ["spawnSync", "execFileSync", "execSync"]) {
+    const fn = cp[name];
+    cp[name] = function (...args) {
+      while (args.length > 1 && args[args.length - 1] == null) args.pop();
+      const last = args[args.length - 1];
+      if (args.length > 1 && typeof last === "object" && !Array.isArray(last)) {
+        args[args.length - 1] = { ...last, windowsHide: true };
+      } else {
+        args.push({ windowsHide: true });
+      }
+      return fn.apply(this, args);
+    };
+  }
+}
+
+module.exports = { install };

server/routes/lanes.js

@@ -406,7 +406,7 @@ router.post("/ensure", sameOriginGuard, (req, res) => {
   // it, a nested cwd still resolves to its owner, which is what the CLI and
   // other callers adopting "the lane I am inside" rely on.
   const found = lanesLib.resolveLaneByCwd(cwd, body.tool || "claude");
-  const strip = (p) => p.replace(/\/+$/, "");
+  const strip = (p) => p.replace(/[\\/]+$/, "");
   const owner = found && (body.exact !== true || strip(found.cwd) === strip(cwd)) ? found : null;
   if (owner) {
     // First-write wins on the title: an ensure-with-title on an existing lane

statusline/statusline.js

@@ -67,6 +67,7 @@ function gitBranch(cwd) {
       cwd,
       timeout: 500,
       stdio: ["ignore", "pipe", "ignore"],
+      windowsHide: true,
     })
       .toString()
       .trim();