claude-dev-env 7.5.0 → 7.6.1

package/hooks/blocking/test_code_rules_enforcer_exempt_marker_chained.py

@@ -156,6 +156,16 @@ def test_should_exempt_fixme_with_trailing_prose() -> None:
     assert _is_exempt_python_comment(token) is True
 
 
+def test_should_exempt_stealth_keep_with_trailing_reason() -> None:
+    token = _build_comment_token("# STEALTH: Keep bypass reviewed in incident 4021")
+    assert _is_exempt_python_comment(token) is True
+
+
+def test_should_flag_stealth_marker_missing_required_space_after_colon() -> None:
+    token = _build_comment_token("# STEALTH:Keep bypass reviewed in incident 4021")
+    assert _is_exempt_python_comment(token) is False
+
+
 def test_should_exempt_shebang_at_line_one_column_zero() -> None:
     token = tokenize.TokenInfo(
         type=tokenize.COMMENT,

package/hooks/git-hooks/git_hooks_constants/verification_notice_constants.py

@@ -111,6 +111,4 @@ ALL_RUNNER_FIELDS: frozenset[str] = frozenset(
 )
 AUTOMATIC_ADVISORY_DIRECTORY_NAME: str = "automatic_advisory"
 AUTOMATIC_ADVISORY_CLI_FILE_NAME: str = "cli.py"
-WINDOWS_PLATFORM: str = "win32"
-CREATE_NO_WINDOW_ATTRIBUTE: str = "CREATE_NO_WINDOW"
 POWERSHELL_CALL_OPERATOR: str = "& "

package/hooks/git-hooks/pull_request_handoff.py

@@ -9,6 +9,8 @@ from git_hooks_constants import (
     GH_PR_VIEW_TIMEOUT_SECONDS,
 )
 
+from subprocess_window_access import hidden_window_creation_flags
+
 
 def get_pull_request_url(repo_dir: Path) -> str | None:
     try:
@@ -19,6 +21,7 @@ def get_pull_request_url(repo_dir: Path) -> str | None:
             capture_output=True,
             text=True,
             timeout=GH_PR_VIEW_TIMEOUT_SECONDS,
+            creationflags=hidden_window_creation_flags(),
         )
     except (OSError, subprocess.SubprocessError):
         return None

package/hooks/git-hooks/subprocess_window_access.py

@@ -0,0 +1,41 @@
+"""Reach the hidden-window helpers from the scripts this directory deploys.
+
+The installer copies this directory into a profile that holds no installed
+Python distribution, and this repository's own tests run the deployed scripts
+under ``python -S -E``, which hides every installed package from the child
+process. On both routes ``hooks_constants`` is reachable only through the
+deployed ``hooks`` directory, so this module puts that directory on
+``sys.path`` and re-exports the helpers a caller asks for::
+
+    from subprocess_window_access import hidden_window_creation_flags
+
+The directory goes on the end of ``sys.path``. ``PathFinder`` runs ahead of
+every editable-install finder, so a trailing entry still selects the deployed
+copy, and the head of ``sys.path`` stays exactly as the caller left it. A
+caller that prepended its own roots keeps them first.
+"""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+_subprocess_window_hooks_directory = str(
+    Path(__file__).resolve().parents[2] / "hooks"
+)
+if _subprocess_window_hooks_directory not in sys.path:
+    sys.path.append(_subprocess_window_hooks_directory)
+
+from hooks_constants.subprocess_window import (
+    HiddenWindowStartupInfo,
+    detached_hidden_window_creation_flags,
+    hidden_window_creation_flags,
+    inherited_stream_startup_info,
+)
+
+__all__ = [
+    "HiddenWindowStartupInfo",
+    "detached_hidden_window_creation_flags",
+    "hidden_window_creation_flags",
+    "inherited_stream_startup_info",
+]

package/hooks/git-hooks/test_verification_start.py

@@ -15,6 +15,9 @@ from verification_notice import build_verification_notice
 from verification_notice_context import VerificationNoticeContext
 from verification_start import start_automatic_advisory
 
+WINDOWS_NO_WINDOW_FLAG = 0x08000000
+EXPECTED_HIDDEN_WINDOW_FLAGS = WINDOWS_NO_WINDOW_FLAG if sys.platform == "win32" else 0
+
 
 def build_context(
     repository_root: Path,
@@ -102,6 +105,7 @@ def _assert_launch_matches_runner(
     assert launch_options["stdin"] is subprocess.DEVNULL
     assert launch_options["stdout"] is subprocess.DEVNULL
     assert launch_options["stderr"] is subprocess.DEVNULL
+    assert launch_options["creationflags"] == EXPECTED_HIDDEN_WINDOW_FLAGS
     assert "--once" not in command
 
 

package/hooks/git-hooks/verification_notice_context.py

@@ -36,6 +36,8 @@ from git_hooks_constants.verification_notice_constants import (
 )
 from local_verification.manifest import ManifestRunFatal, load_manifest
 
+from subprocess_window_access import hidden_window_creation_flags
+
 
 @dataclass(frozen=True)
 class VerificationNoticeContext:
@@ -202,6 +204,7 @@ def _run_git_query(
             encoding=GIT_OUTPUT_ENCODING_NAME,
             errors=GIT_OUTPUT_DECODE_ERRORS_POLICY,
             timeout=GIT_COMMAND_TIMEOUT_SECONDS,
+            creationflags=hidden_window_creation_flags(),
         )
     except (OSError, subprocess.SubprocessError, UnicodeError):
         return None

package/hooks/git-hooks/verification_start.py

@@ -13,7 +13,6 @@ from git_hooks_constants.verification_notice_constants import (
     ALL_RUNNER_FIELDS,
     AUTOMATIC_ADVISORY_CLI_FILE_NAME,
     AUTOMATIC_ADVISORY_DIRECTORY_NAME,
-    CREATE_NO_WINDOW_ATTRIBUTE,
     EXECUTOR_DIRECTORY_NAME,
     GIT_DIRECTORY_NAME,
     JSON_ENCODING,
@@ -22,10 +21,15 @@ from git_hooks_constants.verification_notice_constants import (
     RUNNER_PYTHON_FIELD,
     RUNNER_SETTINGS_FIELD,
     TARGET_REPOSITORY_REMOTE,
-    WINDOWS_PLATFORM,
 )
 from verification_notice_context import VerificationNoticeContext
 
+_subprocess_window_hooks_directory = str(Path(__file__).resolve().parents[2] / "hooks")
+if _subprocess_window_hooks_directory not in sys.path:
+    sys.path.append(_subprocess_window_hooks_directory)
+
+from hooks_constants.subprocess_window import hidden_window_creation_flags
+
 
 def start_automatic_advisory(context: VerificationNoticeContext) -> None:
     """Start the detached advisory poller when native metadata is valid."""
@@ -66,7 +70,7 @@ def _launch_advisory(
         stdin=subprocess.DEVNULL,
         stdout=subprocess.DEVNULL,
         stderr=subprocess.DEVNULL,
-        creationflags=_windows_creation_flags(),
+        creationflags=hidden_window_creation_flags(),
     )
 
 
@@ -93,8 +97,3 @@ def load_runner_configuration(
         return None
     return python_path, settings_path
 
-
-def _windows_creation_flags() -> int:
-    if sys.platform != WINDOWS_PLATFORM:
-        return 0
-    return getattr(subprocess, CREATE_NO_WINDOW_ATTRIBUTE, 0)

package/hooks/hooks_constants/code_rules_enforcer_constants.py

@@ -132,12 +132,14 @@ ALL_TOKEN_ANCHORED_EXEMPT_COMMENT_BODIES: tuple[str, ...] = (
     "pragma:",
 )
 ALL_TOKEN_ANCHORED_DIRECTIVE_BOUNDARY_CHARACTERS: frozenset[str] = frozenset({":"})
+STEALTH_KEEP_COMMENT_MARKER: str = "STEALTH: Keep"
 ALL_FREE_FORM_EXEMPT_COMMENT_BODIES: tuple[str, ...] = (
     "type:",
     "TODO",
     "FIXME",
     "HACK",
     "XXX",
+    STEALTH_KEEP_COMMENT_MARKER,
 )
 CHAINED_INLINE_COMMENT_PATTERN = re.compile(r"#")
 ALL_JAVASCRIPT_EXEMPT_COMMENT_PREFIXES: tuple[str, ...] = (

package/hooks/hooks_constants/subprocess_window.py

@@ -0,0 +1,141 @@
+"""Creation flags that keep a spawned child off the operator's screen on Windows.
+
+A hook or script often runs with no console of its own. When such a process
+starts a child on Windows, the operating system gives that child a brand new
+console, and the operator sees a black window flash open and shut while agents
+work. ``CREATE_NO_WINDOW`` tells Windows to skip that console. Every child this
+package spawns passes the flag, so the desktop stays quiet::
+
+    subprocess.run(
+        ["git", "status"],
+        creationflags=hidden_window_creation_flags(),
+    )
+
+On Windows that call returns ``0x08000000`` and no window appears. On Linux and
+macOS it returns ``0``, which is the value ``subprocess`` already uses when a
+caller passes no ``creationflags`` at all, so behaviour there is unchanged.
+``CREATE_NO_WINDOW`` is absent from a non-Windows Python build, so the lookup
+reads the attribute at call time and falls back to ``0``.
+
+``CREATE_NO_WINDOW`` gives the child a console of its own. A child that writes
+to a stream the caller redirected is unaffected, because the redirected handle
+travels with it. A child that inherits the caller's terminal instead loses that
+terminal, and the operator stops seeing its output. A few call sites hand their
+streams straight to the operator, and those pass
+``startupinfo=inherited_stream_startup_info()`` instead. That startup record
+keeps the inherited streams and hides the console window, so the operator still
+reads the output and still sees no window.
+
+``subprocess.STARTUPINFO`` is a Windows-only name. Typeshed declares it under a
+``sys.platform == "win32"`` guard, so a type check that runs on Linux, as this
+repository's continuous integration does, cannot see the name at all. The
+startup record is therefore described here as a structural ``Protocol`` naming
+the two fields this module sets, and the record itself is fetched through
+``getattr`` at call time. Both moves match what the module already does for the
+creation flags, and they keep the runtime ``sys.platform`` test in one place, so
+one function serves every platform.
+"""
+
+from __future__ import annotations
+
+import subprocess
+import sys
+from typing import Protocol
+
+from hooks_constants.subprocess_window_constants import (
+    CREATE_NEW_PROCESS_GROUP_ATTRIBUTE,
+    CREATE_NO_WINDOW_ATTRIBUTE,
+    HIDE_WINDOW_COMMAND_ATTRIBUTE,
+    NO_CREATION_FLAGS,
+    SHOW_WINDOW_FLAG_ATTRIBUTE,
+    STARTUP_INFO_ATTRIBUTE,
+    WINDOWS_PLATFORM,
+)
+
+__all__ = [
+    "HiddenWindowStartupInfo",
+    "detached_hidden_window_creation_flags",
+    "hidden_window_creation_flags",
+    "inherited_stream_startup_info",
+]
+
+
+class HiddenWindowStartupInfo(Protocol):
+    """The two ``subprocess.STARTUPINFO`` fields that hide a child's console."""
+
+    dwFlags: int
+    wShowWindow: int
+
+
+def _windows_flag(flag_attribute_name: str) -> int:
+    """Return one Windows creation flag, or zero on any other platform.
+
+    Args:
+        flag_attribute_name: The name of a ``subprocess`` creation-flag constant.
+
+    Returns:
+        The flag value on Windows, and zero elsewhere or when the running
+        Python build does not define that constant.
+    """
+    if sys.platform != WINDOWS_PLATFORM:
+        return NO_CREATION_FLAGS
+    return int(getattr(subprocess, flag_attribute_name, NO_CREATION_FLAGS))
+
+
+def hidden_window_creation_flags() -> int:
+    """Return the creation flags that start a child without a console window.
+
+    Pass the result as the ``creationflags`` argument of ``subprocess.run``,
+    ``subprocess.Popen``, ``subprocess.check_output``, or ``subprocess.call``::
+
+        subprocess.run(["git", "rev-parse", "HEAD"],
+                       creationflags=hidden_window_creation_flags())
+
+    Returns:
+        The hidden-console flag on Windows, and zero on every other platform.
+    """
+    return _windows_flag(CREATE_NO_WINDOW_ATTRIBUTE)
+
+
+def detached_hidden_window_creation_flags() -> int:
+    """Return the creation flags for a long-lived child that outlives its parent.
+
+    A detached poller needs its own process group so a console interrupt aimed
+    at the parent never reaches it, and it needs the hidden console for the same
+    reason every other child does::
+
+        subprocess.Popen(argv,
+                         creationflags=detached_hidden_window_creation_flags())
+
+    Returns:
+        A new process group combined with the hidden-console flag on Windows,
+        and zero on every other platform.
+    """
+    return _windows_flag(CREATE_NEW_PROCESS_GROUP_ATTRIBUTE) | hidden_window_creation_flags()
+
+
+def inherited_stream_startup_info() -> HiddenWindowStartupInfo | None:
+    """Return a startup record that hides the console of a stream-inheriting child.
+
+    Use this at a call site that lets the child write straight to the operator's
+    terminal, where ``hidden_window_creation_flags`` would take that terminal
+    away::
+
+        subprocess.run(["python", "-m", "pytest"],
+                       startupinfo=inherited_stream_startup_info())
+
+    Returns:
+        A Windows startup record asking for a hidden window, and ``None`` on
+        every other platform, which is the value ``subprocess`` already uses
+        when a caller passes no ``startupinfo`` at all.
+    """
+    if sys.platform != WINDOWS_PLATFORM:
+        return None
+    startup_information = getattr(subprocess, STARTUP_INFO_ATTRIBUTE)()
+    startup_information.dwFlags |= getattr(
+        subprocess, SHOW_WINDOW_FLAG_ATTRIBUTE, NO_CREATION_FLAGS
+    )
+    startup_information.wShowWindow = getattr(
+        subprocess, HIDE_WINDOW_COMMAND_ATTRIBUTE, NO_CREATION_FLAGS
+    )
+    return startup_information

package/hooks/hooks_constants/subprocess_window_constants.py

@@ -0,0 +1,9 @@
+"""Configuration constants for the shared hidden-console creation flags."""
+
+WINDOWS_PLATFORM: str = "win32"
+CREATE_NO_WINDOW_ATTRIBUTE: str = "CREATE_NO_WINDOW"
+CREATE_NEW_PROCESS_GROUP_ATTRIBUTE: str = "CREATE_NEW_PROCESS_GROUP"
+STARTUP_INFO_ATTRIBUTE: str = "STARTUPINFO"
+SHOW_WINDOW_FLAG_ATTRIBUTE: str = "STARTF_USESHOWWINDOW"
+HIDE_WINDOW_COMMAND_ATTRIBUTE: str = "SW_HIDE"
+NO_CREATION_FLAGS: int = 0

package/hooks/hooks_constants/test_code_rules_enforcer_constants.py

@@ -17,6 +17,7 @@ if str(_HOOKS_ROOT) not in sys.path:
     sys.path.insert(0, str(_HOOKS_ROOT))
 
 from hooks_constants.code_rules_enforcer_constants import (
+    ALL_FREE_FORM_EXEMPT_COMMENT_BODIES,
     ALL_VALIDATION_PHASES,
     CONFIG_DIRECTORY_SEGMENT,
     CONSTANTS_MODULE_SUFFIX,
@@ -26,6 +27,7 @@ from hooks_constants.code_rules_enforcer_constants import (
     JSDOC_RETURNS_STRUCTURED_OBJECT_PROMISE_PATTERN,
     RETURN_CALL_OPENING_PARENTHESIS_PATTERN,
     SCHEMA_OPTIONS_PROPERTY_KEY_PATTERN,
+    STEALTH_KEEP_COMMENT_MARKER,
     UNKNOWN_VALIDATION_PHASE_MESSAGE_TEMPLATE,
     apply_edits,
     edits_for_tool,
@@ -106,6 +108,10 @@ def test_constants_module_suffix_and_config_directory_segment_are_defined() -> N
     assert CONFIG_DIRECTORY_SEGMENT == "config"
 
 
+def test_free_form_exempt_comment_bodies_include_stealth_keep_marker() -> None:
+    assert STEALTH_KEEP_COMMENT_MARKER in ALL_FREE_FORM_EXEMPT_COMMENT_BODIES
+
+
 def test_validation_phase_constants_are_reexported_and_render() -> None:
     assert ALL_VALIDATION_PHASES == {EDIT_LANE_PHASE, FULL_GATE_PHASE}
     rendered_message = UNKNOWN_VALIDATION_PHASE_MESSAGE_TEMPLATE.format(

package/hooks/hooks_constants/test_subprocess_window.py

@@ -0,0 +1,128 @@
+"""Tests for the shared hidden-console creation flags."""
+
+import pathlib
+import subprocess
+import sys
+from typing import Any, Mapping
+
+import pytest
+
+_HOOKS_ROOT = pathlib.Path(__file__).resolve().parent.parent
+if str(_HOOKS_ROOT) not in sys.path:
+    sys.path.insert(0, str(_HOOKS_ROOT))
+
+from hooks_constants.subprocess_window import (
+    detached_hidden_window_creation_flags,
+    hidden_window_creation_flags,
+    inherited_stream_startup_info,
+)
+
+WINDOWS_NO_WINDOW_FLAG = 0x08000000
+WINDOWS_NEW_PROCESS_GROUP_FLAG = 0x00000200
+WINDOWS_ONLY = pytest.mark.skipif(
+    sys.platform != "win32", reason="subprocess.STARTUPINFO exists only on Windows"
+)
+
+
+def test_windows_reports_the_hidden_console_flag(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setattr(sys, "platform", "win32")
+    monkeypatch.setattr(subprocess, "CREATE_NO_WINDOW", WINDOWS_NO_WINDOW_FLAG, raising=False)
+    assert hidden_window_creation_flags() == WINDOWS_NO_WINDOW_FLAG
+
+
+def test_other_platforms_report_no_creation_flags(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setattr(sys, "platform", "linux")
+    assert hidden_window_creation_flags() == 0
+
+
+def test_windows_without_the_flag_attribute_reports_no_creation_flags(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    monkeypatch.setattr(sys, "platform", "win32")
+    monkeypatch.delattr(subprocess, "CREATE_NO_WINDOW", raising=False)
+    assert hidden_window_creation_flags() == 0
+
+
+def test_windows_detached_flags_add_a_new_process_group(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    monkeypatch.setattr(sys, "platform", "win32")
+    monkeypatch.setattr(subprocess, "CREATE_NO_WINDOW", WINDOWS_NO_WINDOW_FLAG, raising=False)
+    monkeypatch.setattr(
+        subprocess,
+        "CREATE_NEW_PROCESS_GROUP",
+        WINDOWS_NEW_PROCESS_GROUP_FLAG,
+        raising=False,
+    )
+    assert detached_hidden_window_creation_flags() == (
+        WINDOWS_NO_WINDOW_FLAG | WINDOWS_NEW_PROCESS_GROUP_FLAG
+    )
+
+
+def test_other_platforms_report_no_detached_creation_flags(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    monkeypatch.setattr(sys, "platform", "linux")
+    assert detached_hidden_window_creation_flags() == 0
+
+
+def _captured_run_options(monkeypatch: pytest.MonkeyPatch) -> Mapping[str, Any]:
+    """Run one command through a patched subprocess.run and return its options."""
+    all_captured_options: dict[str, Any] = {}
+
+    def fake_run(*_all_arguments: Any, **all_options: Any) -> None:
+        all_captured_options.update(all_options)
+
+    monkeypatch.setattr(subprocess, "run", fake_run)
+    subprocess.run(
+        ["git", "status"],
+        creationflags=hidden_window_creation_flags(),
+    )
+    return all_captured_options
+
+
+def test_a_call_site_passes_the_hidden_flag_on_windows(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    monkeypatch.setattr(sys, "platform", "win32")
+    monkeypatch.setattr(subprocess, "CREATE_NO_WINDOW", WINDOWS_NO_WINDOW_FLAG, raising=False)
+    assert _captured_run_options(monkeypatch)["creationflags"] == WINDOWS_NO_WINDOW_FLAG
+
+
+def test_a_call_site_passes_the_default_flags_off_windows(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    monkeypatch.setattr(sys, "platform", "linux")
+    assert _captured_run_options(monkeypatch)["creationflags"] == 0
+
+
+@WINDOWS_ONLY
+def test_windows_startup_info_asks_for_a_hidden_window(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    monkeypatch.setattr(sys, "platform", "win32")
+    startup_information = inherited_stream_startup_info()
+    assert startup_information is not None
+    assert startup_information.dwFlags & subprocess.STARTF_USESHOWWINDOW
+    assert startup_information.wShowWindow == subprocess.SW_HIDE
+
+
+def test_other_platforms_report_no_startup_info(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setattr(sys, "platform", "linux")
+    assert inherited_stream_startup_info() is None
+
+
+@WINDOWS_ONLY
+def test_a_stream_inheriting_call_site_passes_no_creation_flags(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    all_captured_options: dict[str, Any] = {}
+
+    def fake_run(*_all_arguments: Any, **all_options: Any) -> None:
+        all_captured_options.update(all_options)
+
+    monkeypatch.setattr(sys, "platform", "win32")
+    monkeypatch.setattr(subprocess, "run", fake_run)
+    subprocess.run(["python", "-m", "pytest"], startupinfo=inherited_stream_startup_info())
+    assert "creationflags" not in all_captured_options
+    assert all_captured_options["startupinfo"] is not None

package/hooks/lifecycle/enter_worktree_origin_prefetch.py

@@ -44,6 +44,8 @@ from hooks_constants.enter_worktree_prefetch_constants import (  # noqa: E402
 )
 from hooks_constants.pre_tool_use_stdin import read_hook_input_dictionary_from_stdin  # noqa: E402
 
+from hooks_constants.subprocess_window import hidden_window_creation_flags
+
 
 def is_enter_worktree_creation(payload_by_field: dict[str, object]) -> bool:
     """Return True when this hook invocation is an EnterWorktree creation call.
@@ -91,6 +93,7 @@ def _run_git_quietly(
             timeout=timeout_seconds,
             cwd=repo_directory,
             check=False,
+            creationflags=hidden_window_creation_flags(),
         )
     except (subprocess.TimeoutExpired, FileNotFoundError, OSError):
         return None

package/hooks/validation/mypy_validator.py

@@ -57,6 +57,8 @@ from hooks_constants.mypy_validator_cache_constants import (  # noqa: E402
 )
 from json_file_reader import read_json_object  # noqa: E402
 
+from hooks_constants.subprocess_window import hidden_window_creation_flags
+
 
 def load_notification_utils() -> ModuleType | None:
     try:
@@ -88,6 +90,7 @@ def discover_project_root(target_file: str) -> Path | None:
             text=True,
             timeout=GIT_COMMAND_TIMEOUT_SECONDS,
             cwd=str(Path(target_file).parent),
+            creationflags=hidden_window_creation_flags(),
         )
         if completed_process.returncode != 0:
             return None
@@ -493,6 +496,7 @@ def run_mypy(target_file: str, project_root: str) -> tuple[int, str]:
         env=os.environ.copy(),
         timeout=MYPY_TIMEOUT_SECONDS,
         cwd=project_root,
+        creationflags=hidden_window_creation_flags(),
     )
 
     stdout_output = completed_process.stdout.strip()

package/hooks/validators/README.md

@@ -31,6 +31,7 @@ The checks live in `python_style_checks.py`. Shared source-line splitting, funct
 | `ruff_integration.py` | Ruff lint integration |
 | `run_all_validators.py` | Pre-push validator orchestration and report |
 | `security_checks.py` | Hardcoded-secret, SQL injection, and XSS checks |
+| `subprocess_window_access.py` | Deployed-path shim re-exporting the hidden-window helpers |
 | `system_temporary_roots.py` | System temp-root membership for staged copies |
 | `todo_checks.py` | TODO/FIXME tracking with issue-reference requirement |
 | `type_safety_checks.py` | Missing type hints and Any usage checks |

package/hooks/validators/git_checks.py

@@ -6,6 +6,8 @@ import sys
 from dataclasses import dataclass
 from typing import List
 
+from hooks_constants.subprocess_window import hidden_window_creation_flags
+
 SUBPROCESS_TIMEOUT_SECONDS = 30
 
 
@@ -26,6 +28,7 @@ def get_current_branch() -> str:
             text=True,
             check=True,
             timeout=SUBPROCESS_TIMEOUT_SECONDS,
+            creationflags=hidden_window_creation_flags(),
         )
         return result.stdout.strip()
     except (FileNotFoundError, subprocess.CalledProcessError, subprocess.TimeoutExpired):
@@ -55,6 +58,7 @@ def check_draft_pr_state() -> List[Violation]:
             text=True,
             check=True,
             timeout=SUBPROCESS_TIMEOUT_SECONDS,
+            creationflags=hidden_window_creation_flags(),
         )
     except FileNotFoundError:
         return []

package/hooks/validators/health_check.py

@@ -16,6 +16,8 @@ from enum import StrEnum
 from pathlib import Path
 from typing import Dict, Optional
 
+from hooks_constants.subprocess_window import hidden_window_creation_flags
+
 VALIDATOR_FILES = [
     "python_style_checks.py",
     "test_safety_checks.py",
@@ -144,6 +146,7 @@ def check_optional_tool(tool_name: str) -> bool:
             check=False,
             capture_output=True,
             text=True,
+            creationflags=hidden_window_creation_flags(),
         )
         return result.returncode == 0
     except FileNotFoundError:

package/hooks/validators/hook_timing_harness.py

@@ -41,6 +41,8 @@ from pathlib import Path
 from types import ModuleType
 from typing import TextIO
 
+from subprocess_window_access import hidden_window_creation_flags
+
 
 def _load_module_from_path(module_name: str, module_path: Path) -> ModuleType:
     """Load and execute the module found at module_path, under module_name.
@@ -197,6 +199,7 @@ def run_hosted_command_once_milliseconds(
         text=True,
         timeout=_harness_constants.SUBPROCESS_TIMEOUT_SECONDS,
         check=False,
+        creationflags=hidden_window_creation_flags(),
     )
     finished_at = time.perf_counter()
     return (finished_at - started_at) * 1000.0

package/hooks/validators/mypy_integration.py

@@ -9,6 +9,8 @@ from collections.abc import Iterator
 from dataclasses import dataclass
 from pathlib import Path
 
+from hooks_constants.subprocess_window import hidden_window_creation_flags
+
 _validators_directory = str(Path(__file__).resolve().parent)
 _hooks_directory = str(Path(__file__).resolve().parent.parent)
 
@@ -66,6 +68,7 @@ def check_mypy_available() -> bool:
             check=False,
             capture_output=True,
             text=True,
+            creationflags=hidden_window_creation_flags(),
         )
         return result.returncode == 0
     except FileNotFoundError:
@@ -224,6 +227,7 @@ def _run_mypy_subprocess(
                 text=True,
                 cwd=working_directory,
                 timeout=timeout_seconds,
+                creationflags=hidden_window_creation_flags(),
             )
         except subprocess.TimeoutExpired:
             logger.warning(detached_timeout_skip_message)

package/hooks/validators/ruff_integration.py

@@ -6,6 +6,8 @@ import sys
 from dataclasses import dataclass
 from pathlib import Path
 
+from hooks_constants.subprocess_window import hidden_window_creation_flags
+
 _validators_directory = str(Path(__file__).resolve().parent)
 _hooks_directory = str(Path(__file__).resolve().parent.parent)
 
@@ -53,6 +55,7 @@ def check_ruff_available() -> bool:
             check=False,
             capture_output=True,
             text=True,
+            creationflags=hidden_window_creation_flags(),
         )
         return result.returncode == 0
     except FileNotFoundError:
@@ -201,6 +204,7 @@ def _staged_ruff_result(
         input=staged_content,
         cwd=str(resolved_pyproject.parent),
         env=_ruff_subprocess_environment(),
+        creationflags=hidden_window_creation_flags(),
     )
     return RuffResult(
         passed=result.returncode == 0,
@@ -247,6 +251,7 @@ def _run_native_ruff_check(
         capture_output=True,
         text=True,
         env=_ruff_subprocess_environment(),
+        creationflags=hidden_window_creation_flags(),
     )
     return RuffResult(
         passed=result.returncode == 0,
@@ -308,6 +313,7 @@ def run_ruff_fix(all_files: list[Path]) -> RuffResult:
         capture_output=True,
         text=True,
         env=_ruff_subprocess_environment(),
+        creationflags=hidden_window_creation_flags(),
     )
     return RuffResult(
         passed=result.returncode == 0,