fix(windows): close two console-flash sites #53829's sweep missed (gateway gh/git probes)

[lpaiu-cs]

What does this PR do?

Hides the console window on two Windows console-flash sites the (now-reverted) sweep chain never reached: the gh auth token probe in hermes_cli/copilot_auth.py, and the Cmd-P file-finder's git probes in tui_gateway/server.py. Both flash a console from the windowless desktop gateway today.

Updated after #53853. The first cut routed these through the _subprocess_compat.run / popen chokepoint, but #53853 reverted #53791 / #53810 / #53829 and removed those wrappers — so as-written it would AttributeError on current main. This now passes creationflags=windows_hide_flags() directly (the helper that survived the revert), the same approach the sibling #53892 took. Net diff is just the two probe sites + a test.

Why these two were missed

capture_output is not a no-window boundary on a console-less parent (pythonw.exe) — a console-subsystem child still allocates (and flashes) a console. Even so, two sites wouldn't be caught by a call-site checker:

1. copilot_auth.py — lint-invisible. The call is subprocess.run(cmd, …) where cmd = [gh_path, "auth", "token"] is a variable, so a literal-argv rule can't tell it's gh.
2. tui_gateway/server.py — out of scan scope. tui_gateway/ isn't in the footgun checker's package roots, so it was never linted.

Fix

Pass creationflags=windows_hide_flags() (CREATE_NO_WINDOW on win32, 0/no-op on POSIX) to the gh probe and the two git probes. No new helper surface — uses what survived #53853.

Scope note

This targets the idle / periodic probe flash (constant cadence, no live session) — the same mechanism captured on Windows 11 while debugging #52310 (gateway gh/git probe → visible console window; the no-window flag removes it). It is not aimed at the hermes update → gateway-restart flurry that #53853 reset to baseline (that lives in the re-exec / launcher legs, not these call sites). Sibling #53892 covers the periodic git_probe leg + the re-exec phantom; this covers the gh and Cmd-P git sites it doesn't.

Verification — Windows 11

• pytest tests/hermes_cli/test_copilot_auth.py → 26 passed, including TestGhCliTokenHidesConsole::test_try_gh_cli_token_passes_no_window_flag, which asserts the gh lookup passes the no-window flag — the only regression guard for that lint-invisible site.

Related

• Survivor of the reverted stack fix(windows): stop subprocess console-window popups + add CI guard #53791 / fix(windows): stop terminal-window popups from background spawns #53810 / fix(windows): capture is not a no-window boundary; route flashing spawns through chokepoint #53829 (reverted by revert(windows): roll back terminal-popup PRs #53791 #53810 #53829 #53853). Sibling of fix(windows): hide backend console-flash legs main missed (Electron base-pythonw, ffmpeg, netstat) #53892. Closes the remaining gateway probe sites for [Bug]: Black console window flashes briefly whenever terminal spawns bash on Windows #52310 (canonical cluster issue Windows: terminal tool flashes cmd window on every command execution #42544).

Type of Change

• 🐛 Bug fix
• ✅ Tests

[alt-glitch]

This was generated by AI during triage.

Same Windows console-flash family as merged #53829 / #53810 / #53791 and the open #53123 / #53397 / #53781 -- but these two spawn sites (gh auth token in hermes_cli/copilot_auth.py and the Cmd-P git probes in tui_gateway/server.py) are disjoint from what those covered, so related, not duplicate. Flagging the cluster for the maintainer to sequence.

[lpaiu-cs]

Thanks — agreed, related not duplicate. To confirm the split: #53791 / #53810 / #53829 covered the rest of cluster B, including #53123, which I've since closed in favor of this PR (3 of its 5 sites were swept by that chain). The remaining two are disjoint precisely because they're structurally invisible to that sweep: copilot_auth.py's argv is a variable, so the literal-argv rule can't see it's gh; and tui_gateway/ isn't in the checker's --all roots, so server.py was never scanned (this PR adds it). No sequencing dependency — it applies cleanly on current main.

[tonydwb]

Code Review Summary

Verdict: Approved

Windows console-flash closure (5 files). Well-structured fix:

• Routes gh auth token subprocess through _subprocess_compat chokepoint
• Adds tui_gateway to the footgun checker's scan roots
• New test TestGhCliTokenHidesConsole verifies the routing
• Proper comment explaining why the footgun checker can't catch this site itself (variable program name)

Clean fix for a known Windows console-flash issue.

[lpaiu-cs]

Heads-up @tonydwb — I've updated this since your review, so it's worth a re-look.

The first version routed both probes through the _subprocess_compat.run chokepoint, but that helper was reverted out of main by #53853 (which rolled back #53791 / #53810 / #53829). As-written it would AttributeError on current main, even though the diff itself merges cleanly.

The new commit switches both sites to creationflags=windows_hide_flags() directly — that helper survived the revert (same approach the sibling #53892 uses post-revert). Net diff is now just the two probe sites + the test; the now-moot tui_gateway footgun-roots change is dropped since the console-spawn rule it relied on was reverted too.

[lpaiu-cs]

#53844 is covered all issue that I said, so I will close this PR. LGTM.

[LZL0]

The issue is still there on the latest version.