fix(windows): hide backend console-flash legs main missed (Electron base-pythonw, ffmpeg, netstat)

[OutThisLife]

Summary

Follow-up to the Windows console-flash fix that landed on main (cb982ad99). That commit wired windows_hide_flags() into the auxiliary git/gh/wmic/bash/powershell/taskkill legs (notably the dashboard Projects-tree git probe — the ~118-spawns/60s flurry, #53178). This PR covers the legs it didn't reach, using the same pattern.

Confirmed still-broken on main (native Windows)

A user on main (0c2e6c00) reports terminals still flashing every ~20s, only while the Desktop GUI is running (closing the app but leaving the gateway headless → no flashes). Their desktop.log shows the cause directly:

[boot] Using existing Hermes no-console Python at C:\Users\...\venv\Scripts\pythonw.exe
[boot] Starting Hermes backend via ...\venv\Scripts\pythonw.exe
Hermes backend exited (SIGTERM)   ← then relaunched, repeatedly

The desktop launches/relaunches its Python backend through the venv Scripts\pythonw.exe, a uv launcher shim that re-execs the base console python.exe and allocates a conhost CREATE_NO_WINDOW can't suppress. main's fix is Python-only and explicitly deferred this Electron leg ("needs a Windows-tested change of its own"). It is GUI-only because only the desktop spawns the backend this way; the standalone gateway already runs windowless.

(Why it relaunches on a ~20s cadence is a separate matter — likely a slow local Ollama model, ~20s/call, tripping a desktop health-check restart — but each relaunch flashes purely because of the shim. This PR makes the relaunch windowless regardless.)

What main left open (this PR)

• Electron backend launch (apps/desktop/electron/main.cjs) — getNoConsoleVenvPython now resolves the base pythonw.exe instead of the venv Scripts\pythonw.exe re-exec shim; both backend creators put the venv site-packages on PYTHONPATH so imports still resolve under the base interpreter. This is the exact line in the log above.
• ffmpeg in TTS / STT / Discord voice (tools/tts_tool.py, tools/transcription_tools.py, plugins/platforms/discord/adapter.py) — voice-note/speech conversions ran bare; now creationflags=windows_hide_flags().
• netstat + taskkill in the WhatsApp bridge-port cleanup (plugins/platforms/whatsapp/adapter.py).

All windows_hide_flags() returns 0 on POSIX, so every change is a no-op off Windows. This intentionally does not re-introduce a competing chokepoint primitive or a FreeConsole bootstrap — it matches the per-call-site windows_hide_flags() convention already on main.

Tests

• apps/desktop/electron/windows-child-process.test.cjs — asserts getNoConsoleVenvPython prefers base pythonw before the venv re-exec shim.
• tests/test_windows_subprocess_no_window_flags.py — TTS opus conversion and local-STT audio prep pass CREATE_NO_WINDOW.

Test plan

• Native Windows: rebuild the packaged desktop app, open Desktop, leave it running — no recurring backend-launch terminal flashes. (The Electron change requires the packaged app to be rebuilt to take effect.)

[github-actions]

🔎 Lint report: bb/windows-popup-spawn-legs vs origin/main

ruff

Total: 0 on HEAD, 0 on base (➖ 0)

🆕 New issues: none

✅ Fixed issues: none

Unchanged: 0 pre-existing issues carried over.

ty (type checker)

Total: 11664 on HEAD, 11662 on base (🆕 +2)

🆕 New issues (2):

Rule	Count
unresolved-attribute	2

First entries

run_agent.py:3040: [unresolved-attribute] unresolved-attribute: Object of type `Self@get_credits_spent_micros` has no attribute `_credits_session_start_micros`
tests/run_agent/test_credits_notices_toggle.py:76: [unresolved-attribute] unresolved-attribute: Unresolved attribute `_credits_session_start_micros` on type `AIAgent`

✅ Fixed issues (1):

Rule	Count
invalid-assignment	1

First entries

tests/run_agent/test_credits_notices_toggle.py:76: [invalid-assignment] invalid-assignment: Object of type `None` is not assignable to attribute `_credits_session_start_micros` of type `int`

Unchanged: 6123 pre-existing issues carried over.

Diagnostics are surfaced as warnings — this check never fails the build.

[alt-glitch]

This was generated by AI during triage.

Related: focused retry of the Windows console-flash family after the merged revert #53853 (which rolled back #53791/#53810/#53829). This PR targets only the two concrete spawn legs the revert called out — the periodic Projects-tree git probe (#53178) and the uv pythonw->python.exe re-exec phantom — rather than the rejected call-site sweep. Not a duplicate of the reverted work. Related open siblings: #53844, #44105. Flagging for the maintainer.

[tonydwb]

Code Review Summary

Verdict: Approved

Clean Windows-specific fixes for orphan console windows and git probe flashing.

Two well-separated concerns:

1. detach_orphan_console(): Frees a console auto-allocated by uv's pythonw->python re-exec. Uses GetConsoleProcessList() to distinguish phantom consoles (single process) from user-interactive consoles (multiple processes). Called from gateway, web_server, and cron scheduler — never from the interactive CLI.
2. Git probe hidden: run_git routes through windows_hide_flags() to prevent console flashing on the periodic Projects-tree probe.

Excellent test coverage:

• POSIX no-op, solo-owner console freed, shared console preserved, no-console no-op
• Import-time guard: FreeConsole only inside detach_orphan_console(), not in bootstrap
• run_git routes through windows_hide_flags()

The design is careful: the function is intentionally NOT wired into import-time bootstrap because the discriminator can't tell phantom consoles apart from interactive ones. Only known-background mains call it.

No concerns. Ready to merge.

---

Reviewed by Hermes Agent