claude-dev-env 7.5.0 → 7.6.0

package/hooks/hooks_constants/test_subprocess_window.py

@@ -0,0 +1,128 @@
+"""Tests for the shared hidden-console creation flags."""
+
+import pathlib
+import subprocess
+import sys
+from typing import Any, Mapping
+
+import pytest
+
+_HOOKS_ROOT = pathlib.Path(__file__).resolve().parent.parent
+if str(_HOOKS_ROOT) not in sys.path:
+    sys.path.insert(0, str(_HOOKS_ROOT))
+
+from hooks_constants.subprocess_window import (
+    detached_hidden_window_creation_flags,
+    hidden_window_creation_flags,
+    inherited_stream_startup_info,
+)
+
+WINDOWS_NO_WINDOW_FLAG = 0x08000000
+WINDOWS_NEW_PROCESS_GROUP_FLAG = 0x00000200
+WINDOWS_ONLY = pytest.mark.skipif(
+    sys.platform != "win32", reason="subprocess.STARTUPINFO exists only on Windows"
+)
+
+
+def test_windows_reports_the_hidden_console_flag(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setattr(sys, "platform", "win32")
+    monkeypatch.setattr(subprocess, "CREATE_NO_WINDOW", WINDOWS_NO_WINDOW_FLAG, raising=False)
+    assert hidden_window_creation_flags() == WINDOWS_NO_WINDOW_FLAG
+
+
+def test_other_platforms_report_no_creation_flags(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setattr(sys, "platform", "linux")
+    assert hidden_window_creation_flags() == 0
+
+
+def test_windows_without_the_flag_attribute_reports_no_creation_flags(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    monkeypatch.setattr(sys, "platform", "win32")
+    monkeypatch.delattr(subprocess, "CREATE_NO_WINDOW", raising=False)
+    assert hidden_window_creation_flags() == 0
+
+
+def test_windows_detached_flags_add_a_new_process_group(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    monkeypatch.setattr(sys, "platform", "win32")
+    monkeypatch.setattr(subprocess, "CREATE_NO_WINDOW", WINDOWS_NO_WINDOW_FLAG, raising=False)
+    monkeypatch.setattr(
+        subprocess,
+        "CREATE_NEW_PROCESS_GROUP",
+        WINDOWS_NEW_PROCESS_GROUP_FLAG,
+        raising=False,
+    )
+    assert detached_hidden_window_creation_flags() == (
+        WINDOWS_NO_WINDOW_FLAG | WINDOWS_NEW_PROCESS_GROUP_FLAG
+    )
+
+
+def test_other_platforms_report_no_detached_creation_flags(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    monkeypatch.setattr(sys, "platform", "linux")
+    assert detached_hidden_window_creation_flags() == 0
+
+
+def _captured_run_options(monkeypatch: pytest.MonkeyPatch) -> Mapping[str, Any]:
+    """Run one command through a patched subprocess.run and return its options."""
+    all_captured_options: dict[str, Any] = {}
+
+    def fake_run(*_all_arguments: Any, **all_options: Any) -> None:
+        all_captured_options.update(all_options)
+
+    monkeypatch.setattr(subprocess, "run", fake_run)
+    subprocess.run(
+        ["git", "status"],
+        creationflags=hidden_window_creation_flags(),
+    )
+    return all_captured_options
+
+
+def test_a_call_site_passes_the_hidden_flag_on_windows(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    monkeypatch.setattr(sys, "platform", "win32")
+    monkeypatch.setattr(subprocess, "CREATE_NO_WINDOW", WINDOWS_NO_WINDOW_FLAG, raising=False)
+    assert _captured_run_options(monkeypatch)["creationflags"] == WINDOWS_NO_WINDOW_FLAG
+
+
+def test_a_call_site_passes_the_default_flags_off_windows(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    monkeypatch.setattr(sys, "platform", "linux")
+    assert _captured_run_options(monkeypatch)["creationflags"] == 0
+
+
+@WINDOWS_ONLY
+def test_windows_startup_info_asks_for_a_hidden_window(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    monkeypatch.setattr(sys, "platform", "win32")
+    startup_information = inherited_stream_startup_info()
+    assert startup_information is not None
+    assert startup_information.dwFlags & subprocess.STARTF_USESHOWWINDOW
+    assert startup_information.wShowWindow == subprocess.SW_HIDE
+
+
+def test_other_platforms_report_no_startup_info(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setattr(sys, "platform", "linux")
+    assert inherited_stream_startup_info() is None
+
+
+@WINDOWS_ONLY
+def test_a_stream_inheriting_call_site_passes_no_creation_flags(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    all_captured_options: dict[str, Any] = {}
+
+    def fake_run(*_all_arguments: Any, **all_options: Any) -> None:
+        all_captured_options.update(all_options)
+
+    monkeypatch.setattr(sys, "platform", "win32")
+    monkeypatch.setattr(subprocess, "run", fake_run)
+    subprocess.run(["python", "-m", "pytest"], startupinfo=inherited_stream_startup_info())
+    assert "creationflags" not in all_captured_options
+    assert all_captured_options["startupinfo"] is not None

package/hooks/lifecycle/enter_worktree_origin_prefetch.py

@@ -44,6 +44,8 @@ from hooks_constants.enter_worktree_prefetch_constants import (  # noqa: E402
 )
 from hooks_constants.pre_tool_use_stdin import read_hook_input_dictionary_from_stdin  # noqa: E402
 
+from hooks_constants.subprocess_window import hidden_window_creation_flags
+
 
 def is_enter_worktree_creation(payload_by_field: dict[str, object]) -> bool:
     """Return True when this hook invocation is an EnterWorktree creation call.
@@ -91,6 +93,7 @@ def _run_git_quietly(
             timeout=timeout_seconds,
             cwd=repo_directory,
             check=False,
+            creationflags=hidden_window_creation_flags(),
         )
     except (subprocess.TimeoutExpired, FileNotFoundError, OSError):
         return None

package/hooks/validation/mypy_validator.py

@@ -57,6 +57,8 @@ from hooks_constants.mypy_validator_cache_constants import (  # noqa: E402
 )
 from json_file_reader import read_json_object  # noqa: E402
 
+from hooks_constants.subprocess_window import hidden_window_creation_flags
+
 
 def load_notification_utils() -> ModuleType | None:
     try:
@@ -88,6 +90,7 @@ def discover_project_root(target_file: str) -> Path | None:
             text=True,
             timeout=GIT_COMMAND_TIMEOUT_SECONDS,
             cwd=str(Path(target_file).parent),
+            creationflags=hidden_window_creation_flags(),
         )
         if completed_process.returncode != 0:
             return None
@@ -493,6 +496,7 @@ def run_mypy(target_file: str, project_root: str) -> tuple[int, str]:
         env=os.environ.copy(),
         timeout=MYPY_TIMEOUT_SECONDS,
         cwd=project_root,
+        creationflags=hidden_window_creation_flags(),
     )
 
     stdout_output = completed_process.stdout.strip()

package/hooks/validators/README.md

@@ -31,6 +31,7 @@ The checks live in `python_style_checks.py`. Shared source-line splitting, funct
 | `ruff_integration.py` | Ruff lint integration |
 | `run_all_validators.py` | Pre-push validator orchestration and report |
 | `security_checks.py` | Hardcoded-secret, SQL injection, and XSS checks |
+| `subprocess_window_access.py` | Deployed-path shim re-exporting the hidden-window helpers |
 | `system_temporary_roots.py` | System temp-root membership for staged copies |
 | `todo_checks.py` | TODO/FIXME tracking with issue-reference requirement |
 | `type_safety_checks.py` | Missing type hints and Any usage checks |

package/hooks/validators/git_checks.py

@@ -6,6 +6,8 @@ import sys
 from dataclasses import dataclass
 from typing import List
 
+from hooks_constants.subprocess_window import hidden_window_creation_flags
+
 SUBPROCESS_TIMEOUT_SECONDS = 30
 
 
@@ -26,6 +28,7 @@ def get_current_branch() -> str:
             text=True,
             check=True,
             timeout=SUBPROCESS_TIMEOUT_SECONDS,
+            creationflags=hidden_window_creation_flags(),
         )
         return result.stdout.strip()
     except (FileNotFoundError, subprocess.CalledProcessError, subprocess.TimeoutExpired):
@@ -55,6 +58,7 @@ def check_draft_pr_state() -> List[Violation]:
             text=True,
             check=True,
             timeout=SUBPROCESS_TIMEOUT_SECONDS,
+            creationflags=hidden_window_creation_flags(),
         )
     except FileNotFoundError:
         return []

package/hooks/validators/health_check.py

@@ -16,6 +16,8 @@ from enum import StrEnum
 from pathlib import Path
 from typing import Dict, Optional
 
+from hooks_constants.subprocess_window import hidden_window_creation_flags
+
 VALIDATOR_FILES = [
     "python_style_checks.py",
     "test_safety_checks.py",
@@ -144,6 +146,7 @@ def check_optional_tool(tool_name: str) -> bool:
             check=False,
             capture_output=True,
             text=True,
+            creationflags=hidden_window_creation_flags(),
         )
         return result.returncode == 0
     except FileNotFoundError:

package/hooks/validators/hook_timing_harness.py

@@ -41,6 +41,8 @@ from pathlib import Path
 from types import ModuleType
 from typing import TextIO
 
+from subprocess_window_access import hidden_window_creation_flags
+
 
 def _load_module_from_path(module_name: str, module_path: Path) -> ModuleType:
     """Load and execute the module found at module_path, under module_name.
@@ -197,6 +199,7 @@ def run_hosted_command_once_milliseconds(
         text=True,
         timeout=_harness_constants.SUBPROCESS_TIMEOUT_SECONDS,
         check=False,
+        creationflags=hidden_window_creation_flags(),
     )
     finished_at = time.perf_counter()
     return (finished_at - started_at) * 1000.0

package/hooks/validators/mypy_integration.py

@@ -9,6 +9,8 @@ from collections.abc import Iterator
 from dataclasses import dataclass
 from pathlib import Path
 
+from hooks_constants.subprocess_window import hidden_window_creation_flags
+
 _validators_directory = str(Path(__file__).resolve().parent)
 _hooks_directory = str(Path(__file__).resolve().parent.parent)
 
@@ -66,6 +68,7 @@ def check_mypy_available() -> bool:
             check=False,
             capture_output=True,
             text=True,
+            creationflags=hidden_window_creation_flags(),
         )
         return result.returncode == 0
     except FileNotFoundError:
@@ -224,6 +227,7 @@ def _run_mypy_subprocess(
                 text=True,
                 cwd=working_directory,
                 timeout=timeout_seconds,
+                creationflags=hidden_window_creation_flags(),
             )
         except subprocess.TimeoutExpired:
             logger.warning(detached_timeout_skip_message)

package/hooks/validators/ruff_integration.py

@@ -6,6 +6,8 @@ import sys
 from dataclasses import dataclass
 from pathlib import Path
 
+from hooks_constants.subprocess_window import hidden_window_creation_flags
+
 _validators_directory = str(Path(__file__).resolve().parent)
 _hooks_directory = str(Path(__file__).resolve().parent.parent)
 
@@ -53,6 +55,7 @@ def check_ruff_available() -> bool:
             check=False,
             capture_output=True,
             text=True,
+            creationflags=hidden_window_creation_flags(),
         )
         return result.returncode == 0
     except FileNotFoundError:
@@ -201,6 +204,7 @@ def _staged_ruff_result(
         input=staged_content,
         cwd=str(resolved_pyproject.parent),
         env=_ruff_subprocess_environment(),
+        creationflags=hidden_window_creation_flags(),
     )
     return RuffResult(
         passed=result.returncode == 0,
@@ -247,6 +251,7 @@ def _run_native_ruff_check(
         capture_output=True,
         text=True,
         env=_ruff_subprocess_environment(),
+        creationflags=hidden_window_creation_flags(),
     )
     return RuffResult(
         passed=result.returncode == 0,
@@ -308,6 +313,7 @@ def run_ruff_fix(all_files: list[Path]) -> RuffResult:
         capture_output=True,
         text=True,
         env=_ruff_subprocess_environment(),
+        creationflags=hidden_window_creation_flags(),
     )
     return RuffResult(
         passed=result.returncode == 0,

package/hooks/validators/run_all_validators.py

@@ -60,6 +60,8 @@ from hooks_constants.multi_edit_reconstruction import (
     edits_for_tool,
 )
 
+from hooks_constants.subprocess_window import hidden_window_creation_flags
+
 VALIDATORS_DIR = Path(__file__).parent
 hooks_dir = VALIDATORS_DIR.parent
 package_name = VALIDATORS_DIR.name
@@ -131,6 +133,7 @@ def invoke_validator_module(module_stem: str, forwarded_file_paths: List[str]) -
         text=True,
         cwd=working_directory_string,
         env=environment,
+        creationflags=hidden_window_creation_flags(),
     )
 
 
@@ -160,6 +163,7 @@ def run_validators_entrypoint_subprocess(
         cwd=working_directory_string,
         env=environment,
         input=stdin_text,
+        creationflags=hidden_window_creation_flags(),
     )
 
 
@@ -347,6 +351,7 @@ def get_project_root() -> Optional[Path]:
         ["git", "-C", str(hooks_dir), "rev-parse", "--show-toplevel"],
         capture_output=True,
         text=True,
+        creationflags=hidden_window_creation_flags(),
     )
     if completed_git_lookup.returncode == 0:
         return Path(completed_git_lookup.stdout.strip())
@@ -674,6 +679,7 @@ def get_changed_files() -> List[Path]:
         ["git", "diff", "--cached", "--name-only"],
         capture_output=True,
         text=True,
+        creationflags=hidden_window_creation_flags(),
     )
 
     files = result.stdout.strip().split("\n") if result.stdout.strip() else []
@@ -684,6 +690,7 @@ def get_changed_files() -> List[Path]:
             ["git", "diff", "--name-only", "HEAD~1"],
             capture_output=True,
             text=True,
+            creationflags=hidden_window_creation_flags(),
         )
         files = result.stdout.strip().split("\n") if result.stdout.strip() else []
 

package/hooks/validators/subprocess_window_access.py

@@ -0,0 +1,41 @@
+"""Reach the hidden-window helpers from the scripts this directory deploys.
+
+The installer copies this directory into a profile that holds no installed
+Python distribution, and this repository's own tests run the deployed scripts
+under ``python -S -E``, which hides every installed package from the child
+process. On both routes ``hooks_constants`` is reachable only through the
+deployed ``hooks`` directory, so this module puts that directory on
+``sys.path`` and re-exports the helpers a caller asks for::
+
+    from subprocess_window_access import hidden_window_creation_flags
+
+The directory goes on the end of ``sys.path``. ``PathFinder`` runs ahead of
+every editable-install finder, so a trailing entry still selects the deployed
+copy, and the head of ``sys.path`` stays exactly as the caller left it. A
+caller that prepended its own roots keeps them first.
+"""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+_subprocess_window_hooks_directory = str(
+    Path(__file__).resolve().parents[2] / "hooks"
+)
+if _subprocess_window_hooks_directory not in sys.path:
+    sys.path.append(_subprocess_window_hooks_directory)
+
+from hooks_constants.subprocess_window import (
+    HiddenWindowStartupInfo,
+    detached_hidden_window_creation_flags,
+    hidden_window_creation_flags,
+    inherited_stream_startup_info,
+)
+
+__all__ = [
+    "HiddenWindowStartupInfo",
+    "detached_hidden_window_creation_flags",
+    "hidden_window_creation_flags",
+    "inherited_stream_startup_info",
+]

package/hooks/workflow/auto_formatter.py

@@ -14,6 +14,12 @@ from collections.abc import Mapping
 from pathlib import Path
 from types import ModuleType
 
+_subprocess_window_hooks_directory = str(Path(__file__).resolve().parents[2] / "hooks")
+if _subprocess_window_hooks_directory not in sys.path:
+    sys.path.append(_subprocess_window_hooks_directory)
+
+from hooks_constants.subprocess_window import hidden_window_creation_flags
+
 NOTIFICATION_UTILS_DIRECTORY = os.path.join(
     os.path.dirname(os.path.dirname(os.path.abspath(__file__))), "notification"
 )
@@ -118,6 +124,7 @@ def is_untracked_in_git(file_path: str) -> bool:
             cwd=containing_directory,
             timeout=GIT_LS_FILES_TIMEOUT_SECONDS,
             env=_build_git_command_environment(),
+            creationflags=hidden_window_creation_flags(),
         )
         return git_check.returncode != 0
     except (FileNotFoundError, subprocess.TimeoutExpired):
@@ -198,6 +205,7 @@ def _run_command(
             capture_output=True,
             text=True,
             timeout=timeout_seconds,
+            creationflags=hidden_window_creation_flags(),
         )
     except FileNotFoundError:
         return None, False

package/hooks/workflow/test_auto_formatter.py

@@ -35,6 +35,8 @@ HOOKS_JSON_PATH = os.path.join(HOOKS_DIRECTORY_PATH, "hooks.json")
 POST_TOOL_USE_DISPATCHER_COMMAND_FRAGMENT = "validation/post_tool_use_dispatcher.py"
 UNUSED_IMPORT_SOURCE = "import os\n\n\nVALUE = 1\n"
 HOOK_RUN_TIMEOUT_SECONDS = 60
+WINDOWS_NO_WINDOW_FLAG = 0x08000000
+EXPECTED_HIDDEN_WINDOW_FLAGS = WINDOWS_NO_WINDOW_FLAG if sys.platform == "win32" else 0
 
 
 def build_fixture_git_environment() -> dict[str, str]:
@@ -415,3 +417,40 @@ class TestPythonFormatTimeoutBudget:
         budgeted_total = auto_formatter_module.budgeted_python_format_seconds()
 
         assert budgeted_total < _registered_auto_formatter_timeout()
+
+
+def _record_creation_flags(
+    auto_formatter_module: ModuleType, monkeypatch: pytest.MonkeyPatch
+) -> dict[str, object]:
+    all_recorded_keyword_arguments: dict[str, object] = {}
+
+    def _record(*args: object, **kwargs: object) -> subprocess.CompletedProcess[str]:
+        del args
+        all_recorded_keyword_arguments.update(kwargs)
+        return subprocess.CompletedProcess([], 1, stdout="", stderr="")
+
+    monkeypatch.setattr(auto_formatter_module.subprocess, "run", _record)
+    return all_recorded_keyword_arguments
+
+
+def test_untracked_probe_should_start_without_a_console_window(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    auto_formatter_module = _load_auto_formatter_module()
+    all_recorded_keyword_arguments = _record_creation_flags(auto_formatter_module, monkeypatch)
+
+    assert auto_formatter_module.is_untracked_in_git(str(tmp_path / "module.py")) is True
+    assert all_recorded_keyword_arguments["creationflags"] == EXPECTED_HIDDEN_WINDOW_FLAGS
+
+
+def test_formatter_command_should_start_without_a_console_window(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    auto_formatter_module = _load_auto_formatter_module()
+    all_recorded_keyword_arguments = _record_creation_flags(auto_formatter_module, monkeypatch)
+
+    auto_formatter_module._run_command(
+        ["ruff", "format"], str(tmp_path / "module.py"), HOOK_RUN_TIMEOUT_SECONDS
+    )
+
+    assert all_recorded_keyword_arguments["creationflags"] == EXPECTED_HIDDEN_WINDOW_FLAGS

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "claude-dev-env",
-    "version": "7.5.0",
+    "version": "7.6.0",
     "description": "Claude Code development standards — rules, hooks, agents, commands, and skills",
     "type": "module",
     "bin": {

package/rules/pstack-models.md

@@ -28,9 +28,10 @@ The file contains this shape:
 ```
 
 Offer only model IDs the active native tool accepts. Keep the user's order.
-Treat `inherit-parent` and `auto` as parent inheritance, not model IDs. A
-different host starts with its own confirmed choices. It never copies the Codex
-preference file.
+Treat `inherit-parent` and `auto` as parent inheritance, not model IDs. A full
+install seeds the Claude file and the Codex file from the package when a host
+file is absent, and leaves an existing file untouched. A different host never
+copies another host's preference file.
 
 ## Selection before every delegation
 

package/scripts/automatic_advisory/checkout.py

@@ -10,7 +10,14 @@ from .config.constants import (
     GIT_EXECUTABLE,
 )
 from .model import AdvisoryRegistration, LocalCheckout
-from .window_flags import hidden_window_creation_flags
+
+import sys
+
+_subprocess_window_hooks_directory = str(Path(__file__).resolve().parents[2] / "hooks")
+if _subprocess_window_hooks_directory not in sys.path:
+    sys.path.append(_subprocess_window_hooks_directory)
+
+from hooks_constants.subprocess_window import hidden_window_creation_flags
 
 
 def read_local_checkout(checkout_path: Path) -> LocalCheckout:

package/scripts/automatic_advisory/cli.py

@@ -38,7 +38,14 @@ from automatic_advisory.runner import (
     AdvisoryGitHub,
     AutomaticAdvisoryRunner,
 )
-from automatic_advisory.window_flags import detached_poller_creation_flags
+
+_subprocess_window_hooks_directory = str(Path(__file__).resolve().parents[2] / "hooks")
+if _subprocess_window_hooks_directory not in sys.path:
+    sys.path.append(_subprocess_window_hooks_directory)
+
+from hooks_constants.subprocess_window import (
+    detached_hidden_window_creation_flags,
+)
 
 
 def build_parser() -> argparse.ArgumentParser:
@@ -134,7 +141,6 @@ def start_polling(settings_path: Path) -> int:
     Returns:
         Zero after the child process starts.
     """
-    process_flags = detached_poller_creation_flags()
     resolved_settings_path = settings_path.resolve()
     subprocess.Popen(
         (
@@ -148,7 +154,7 @@ def start_polling(settings_path: Path) -> int:
         stdin=subprocess.DEVNULL,
         stdout=subprocess.DEVNULL,
         stderr=subprocess.DEVNULL,
-        creationflags=process_flags,
+        creationflags=detached_hidden_window_creation_flags(),
         start_new_session=True,
     )
     return SUCCESS_EXIT_CODE

package/scripts/automatic_advisory/config/constants.py

@@ -75,8 +75,6 @@ WINDOWS_EXTENDED_LIMIT_INFORMATION_CLASS = 9
 WINDOWS_JOB_KILL_ON_CLOSE_LIMIT = 0x2000
 DEFAULT_CLONE_URL_SUFFIX = ".git"
 POLL_LOCK_DIRECTORY_NAME = ".poll-process"
-CREATE_NEW_PROCESS_GROUP_ATTRIBUTE = "CREATE_NEW_PROCESS_GROUP"
-CREATE_NO_WINDOW_ATTRIBUTE = "CREATE_NO_WINDOW"
 CHILD_MANIFEST_FLAG = "--manifest"
 CHILD_REPOSITORY_FLAG = "--repo"
 CHILD_BASE_FLAG = "--base"

package/scripts/automatic_advisory/execution.py

@@ -26,7 +26,6 @@ from .config.constants import (
 )
 from .config.timing import CHILD_CLEANUP_TIMEOUT_SECONDS
 from .model import AdvisoryRegistration, ChildOutcome
-from .window_flags import hidden_window_creation_flags
 from .windows_job import (
     _assign_process,
     _close_handle,
@@ -34,6 +33,12 @@ from .windows_job import (
     _terminate_job,
 )
 
+_subprocess_window_hooks_directory = str(Path(__file__).resolve().parents[2] / "hooks")
+if _subprocess_window_hooks_directory not in sys.path:
+    sys.path.append(_subprocess_window_hooks_directory)
+
+from hooks_constants.subprocess_window import hidden_window_creation_flags
+
 
 @dataclass(frozen=True)
 class OwnedChildProcess:
@@ -165,6 +170,7 @@ def _start_posix_child(
             text=True,
             env=all_child_environment,
             start_new_session=True,
+            creationflags=hidden_window_creation_flags(),
         )
     except OSError:
         return None

package/scripts/automatic_advisory/git.py

@@ -17,7 +17,15 @@ from .config.constants import (
 )
 from .config.timing import GIT_FETCH_TIMEOUT_SECONDS
 from .model import AdvisoryRegistration
-from .window_flags import hidden_window_creation_flags
+
+import sys
+from pathlib import Path
+
+_subprocess_window_hooks_directory = str(Path(__file__).resolve().parents[2] / "hooks")
+if _subprocess_window_hooks_directory not in sys.path:
+    sys.path.append(_subprocess_window_hooks_directory)
+
+from hooks_constants.subprocess_window import hidden_window_creation_flags
 
 
 def _fetch_base(

package/scripts/automatic_advisory/process_host.py

@@ -8,6 +8,8 @@ from pr_verification.config.constants import INCOMPLETE_EXIT_CODE
 
 from .config.constants import WINDOWS_PROCESS_START_SIGNAL
 
+from subprocess_window_access import inherited_stream_startup_info
+
 
 def run_owned_child(all_arguments: Sequence[str]) -> int:
     """Wait for ownership, then run the advisory child.
@@ -24,6 +26,7 @@ def run_owned_child(all_arguments: Sequence[str]) -> int:
         tuple(all_arguments),
         shell=False,
         check=False,
+        startupinfo=inherited_stream_startup_info(),
     )
     return completed_process.returncode
 

package/scripts/claude_chain_runner.py

@@ -131,6 +131,8 @@ from dev_env_scripts_constants.claude_chain_constants import (
     UTF8_ENCODING,
 )
 
+from subprocess_window_access import hidden_window_creation_flags
+
 
 def _decode_captured_stream(raw_bytes: bytes, encoding: str, errors: str) -> str:
     """Decode captured *raw_bytes* with ``text=True`` universal-newline semantics.
@@ -222,6 +224,7 @@ def _run_captured_subprocess(
                     else None
                 ),
                 input=input_bytes,
+                creationflags=hidden_window_creation_flags(),
             )
         except subprocess.TimeoutExpired as timeout_error:
             _attach_partial_timeout_streams(

package/scripts/gh_artifact_upload.py

@@ -41,6 +41,8 @@ from dev_env_scripts_constants.gh_artifact_upload_constants import (
     UTF8_ENCODING,
 )
 
+from subprocess_window_access import hidden_window_creation_flags
+
 
 class ArtifactUploadError(Exception):
     """Raised when creating the release or uploading the asset fails."""
@@ -53,6 +55,7 @@ def _run_gh(all_arguments: list[str]) -> subprocess.CompletedProcess[str]:
         text=True,
         encoding=UTF8_ENCODING,
         check=False,
+        creationflags=hidden_window_creation_flags(),
     )
 
 

package/scripts/grok_headless_runner.py

@@ -85,6 +85,8 @@ from process_tree_kill import (  # noqa: E402
     terminate_process_tree,
 )
 
+from subprocess_window_access import hidden_window_creation_flags
+
 runner_popen = subprocess.Popen
 
 
@@ -361,6 +363,7 @@ def _invoke_process(
             encoding=UTF8_ENCODING,
             errors=UTF8_DECODE_ERRORS,
             start_new_session=should_start_new_session(),
+            creationflags=hidden_window_creation_flags(),
         )
     except FileNotFoundError:
         return _missing_binary_outcome()