fix(windows): suppress console-window flashes from gateway subprocesses + cache nearest_root

[hellofrommorgan]

What & why

On Windows, the headless gateway runs as pythonw.exe (no console). When it shells out to console programs without the Win32 CREATE_NO_WINDOW flag, a cmd.exe window flashes on screen. The worst offenders fire on every agent file edit / turn, so the user sees windows popping up repeatedly during normal operation.

This was originally tracked down from pyright-langserver.CMD being launched via cmd.exe /c by the LSP client (npm shims are .cmd files), but the same gap exists in several other gateway-reachable spawn sites.

Changes

Console-flash suppression (CREATE_NO_WINDOW):

File	Spawn	Trigger
agent/lsp/client.py	.cmd-wrapped language servers (pyright etc.)	LSP diagnostics
agent/lsp/install.py	npm / pip / go LSP auto-install	first use of a server
tools/checkpoint_manager.py	shadow-git snapshot	every file edit
agent/coding_context.py	per-turn git status/branch	every turn
agent/context_references.py	git / rg for @-file refs	@ references

All pass creationflags gated on sys.platform == 'win32' so the value is an inert 0 on POSIX (still a valid Popen kwarg — no behavior change off Windows). capture_output is preserved (we hide the window, not detach the process), reusing the existing windows_hide_flags() helper where imported.

Performance:

• agent/lsp/workspace.py: memoize nearest_root. It previously did an uncached upward filesystem walk (markers × parent dirs of .exists() stat calls) and is invoked ~5× per file write (via enabled_for, _get_or_spawn, _mark_broken_for_file, and the typescript double-resolve). Adds _root_cache mirroring the existing _workspace_cache, cleared in clear_cache() — same staleness profile as the git-worktree cache (reset on shutdown / hermes lsp restart).

Testing

• All 6 modules import cleanly.
• tests/agent/lsp/ suites pass (workspace, service, install, broken-set, backend-gate): 42 passed. The one pre-existing failure test_normalize_path_expands_tilde is an unrelated Windows HOME/USERPROFILE quirk present on main and untouched here.
• Added a manual functional check confirming nearest_root cache hit/miss consistency, population, and clear_cache() reset.

Notes

• No behavior change on Linux/macOS (the flag resolves to 0).
• The LSP client architecture already pools language-server clients by (server_id, root) and reuses them — there is no per-write process churn; the window-flash was purely a spawn-flag omission.

[teknium1]

Thanks for identifying the LSP-specific Windows subprocess gap. The core issue remains on current main, but this branch needs a focused salvage rather than a clean cherry-pick.

Problems

• agent/lsp/client.py:273-282 now contains start_new_session=True, added by 18a9467fc for a TUI process-group safety fix. Preserve it when adding the no-window flag.
• agent/lsp/install.py:351-356 now delegates pip installation to hermes_cli/tools_config.py::_pip_install; its subprocess calls at hermes_cli/tools_config.py:640-677 do not yet pass no-window flags. The original direct pip hunk no longer reaches the runtime path.
• No regression tests cover the LSP client/install flags or nearest_root cache invalidation. Existing Windows checks cover the already-landed coding-context, context-reference, and checkpoint paths (tests/test_windows_subprocess_no_window_flags.py:97-153, :341-356).

Suggested changes

• Re-scope to the remaining LSP client/install paths and retain start_new_session=True.
• Add focused Windows-flag and nearest_root cache/reset tests.
• Omit the three paths already covered by cb1bb1a48 and cb982ad997.

Automated hermes-sweeper review.

[teknium1]

Please add a regression test that proves a repeated identical lookup avoids a second filesystem walk and that clear_cache() restores lookup behavior. Current tests/agent/lsp/test_workspace.py covers root resolution but not this new cache contract.

[teknium1]

Merged via PR #70263 — your commit was cherry-picked onto current main with authorship preserved (rebase-merge). The LSP client + npm/go installer hunks landed; we converted the hand-rolled constant to the shared windows_hide_flags() helper and added regression tests on top. The other hunks were dropped as already-fixed on main (bounded_git_probe / existing flags), the pip path routes through a helper that already applies flags internally, and the nearest_root cache deserves its own review — feel free to re-cut that separately if you'd like it considered. Thanks for finding the one flash class that survives the daemon-level fix.