fix: add missing creationflags to subprocess calls (Windows console flash)

[JonthanaHanh]

Summary

Adds missing creationflags=windows_hide_flags() to three files where subprocess.run calls on Windows spawn visible console windows (cmd.exe / conhost.exe flash).

Changes

tools/browser_tool.py — Chromium auto-install (npx agent-browser install):

• The one-time ~170MB browser binary download subprocess was missing creationflags, causing a visible console window flash on every fresh install.

tools/tts_tool.py — Piper voice download:

• First-use voice model download via python -m piper.download_voices was missing creationflags.

plugins/platforms/whatsapp/adapter.py — Three call sites:

1. _terminate_bridge_process taskkill (line ~223) — Windows-only path to kill the bridge process tree
2. Node.js version probe (line ~349) — checks node --version during bridge setup
3. npm install (line ~548) — installs bridge dependencies during first connect

The file already imported windows_detach_popen_kwargs but not windows_hide_flags; added the import alongside it.

Why these are real bugs

On Windows, every subprocess.run/subprocess.Popen without CREATE_NO_WINDOW (0x08000000) spawns a visible console window that flashes briefly. The windows_hide_flags() helper returns this flag on Windows and 0 on other platforms, so it's safe to pass unconditionally.

Pattern coverage

Existing PRs cover most other subprocess sites:

• fix: add CREATE_NO_WINDOW to env_probe and lazy_deps subprocess calls on Windows #64081: env_probe, lazy_deps, tts_tool (lines 2002/2087)
• fix: add creationflags to tirith_security subprocess calls (Windows console flash) #65635: tirith_security
• fix: add creationflags to plugins subprocess calls (Windows console flash) #65660: telegram ffprobe, discord ffmpeg, raft bridge
• fix: add CREATE_NO_WINDOW to subprocess calls in tts_tool and vision_tools #66785: tts_tool taskkill, vision_tools

These three files were gaps in the coverage. No existing PR touches them.

Test plan

• Verify syntax: python3 -c "import ast; ast.parse(open(f).read())" for all 3 files
• windows_hide_flags() returns 0 on non-Windows — no behavioral change on Linux/macOS

[alt-glitch]

This was generated by AI during triage.

Related to #71792: both patch the three WhatsApp subprocesses, but this PR additionally covers browser/Piper and #71792 adds SimpleX/Mem0 sites. Neither current diff fully subsumes the other.

[teknium1]

Thanks for tracing the remaining browser, Piper, and WhatsApp subprocess sites and using the established helper consistently.

Automated hermes-sweeper review found the requested no-flash behavior is already implemented on current main through the parent-console root-cause fix:

• 0dbf639bc8d622efefea495636f38f4a449350a3 is on main and changes detached Windows launches to use a hidden console rather than a console-less pythonw/DETACHED_PROCESS process.
• hermes_cli/_subprocess_compat.py:105–120 documents the resulting guarantee: console-subsystem descendants inherit the hidden console and do not allocate visible flashing consoles.
• hermes_cli/gateway_windows.py:891–969 applies those flags to detached gateway launches, and apps/desktop/electron/main.ts:2170–2186 applies the same parent-console model to the desktop backend.
• The related WhatsApp overlap was already reviewed in fix: add CREATE_NO_WINDOW to subprocess calls in whatsapp, simplex, mem0 plugins #71792, whose maintainer comment identified this root-cause implementation as superseding per-call-site mitigations.

Closing as implemented on main.