What

Two defects cause visible console windows during normal Buzz operation on Windows.

1. Missing CREATE_NO_WINDOW on background spawn sites

Every std::process::Command or tokio::process::Command spawn of a console-subsystem binary from a GUI (non-console) parent on Windows allocates a fresh, briefly-visible console window per child unless CREATE_NO_WINDOW (0x0800_0000) is set. Every probe, install, auth check, git command, agent launch, and MCP server spawn had unguarded spawns.

2. WSL app-execution-alias footgun (issue #2328)

Git Bash resolution (both desktop-side and inside buzz-dev-mcp) could select %LOCALAPPDATA%\Microsoft\WindowsApps\bash.exe, which is a WSL stub launcher. Running it spawns wsl.exe/wslhost.exe/conhost.exe trees instead of executing the intended shell command.

Fix

Per-crate configure_no_window helpers — one helper per crate, no cross-crate abstraction:

• desktop/src-tauri/src/util.rs: pub(crate) fn configure_no_window(command: &mut std::process::Command) — called at every background spawn site in the desktop crate
• crates/buzz-acp/src/acp.rs: fn configure_no_window(cmd: &mut tokio::process::Command) — applied to AcpClient::spawn
• crates/buzz-dev-mcp/src/lib.rs: configure_no_window (std) + configure_no_window_async (tokio) — applied to rg.rs and shell.rs respectively
• crates/buzz-agent/src/mcp.rs: fn configure_no_window(cmd: &mut Command) — applied to spawn_one() before TokioChildProcess::new, suppressing console flashes for Node-backed MCP server children

Desktop spawn sites covered (via crate::util::configure_no_window):

• commands/agent_auth.rs: ACP auth command, Claude subscription login
• commands/agent_discovery/managed_node.rs: managed-node version probe
• commands/agent_model_process.rs: ACP model-listing spawn
• commands/media_transcode.rs: ffmpeg invoke
• commands/project_git_exec.rs: git exec
• commands/relay_reconnect.rs: relay probe
• managed_agents/backend.rs: provider invoke
• managed_agents/discovery.rs: login-shell PATH probe, auth status probe, codex ACP version probe
• managed_agents/readiness/cli_probe.rs: CLI readiness probe

Explicitly excluded (legitimately want a visible console or platform-specific):

• commands/project_terminal.rs: launch_visible_terminal uses CREATE_NEW_CONSOLE on Windows
• commands/agent_auth.rs terminal launch sites: same
• commands/window_chrome.rs: macOS-only defaults read
• managed_agents/process_lifecycle.rs: taskkill already sets CREATE_NO_WINDOW
• shutdown.rs: macOS-only app relaunch (mesh-llm feature gate)
• managed_agents/agent_env.rs: Command::new("env") calls are test-only
• managed_agents/runtime.rs: agent spawn (PR 1 frozen, disjoint file set)

WSL bash alias rejection — both resolver paths protected:

Desktop (managed_agents/git_bash.rs):

• is_windows_apps_alias(path: &Path) -> bool — pure path-structural predicate, cfg(any(windows, test)), testable cross-host
• scan_path_for_bash filters resolved paths through the predicate before returning
• 6 cross-host tests covering: typical path, case-insensitivity, real Git Bash (not rejected), System32 (not rejected), partial-segment (not rejected), Unix path (not rejected)

buzz-dev-mcp (crates/buzz-dev-mcp/src/shell.rs):

• is_windows_apps_alias(path: &Path) -> bool — same pure predicate, cfg(any(windows, test))
• scan_path_for_bash now does inline iteration filtering both %SystemRoot% and WindowsApps — alias-first/real-bash-second ordering selects the real one; alias-only returns None
• 6 cross-host predicate tests + 2 Windows resolver tests (alias-first/real-second, alias-only)

Non-Windows impact

None. Every configure_no_window helper is a no-op off-Windows (#[cfg(not(windows))] let _ = cmd;). The is_windows_apps_alias functions are #[cfg(any(windows, test))]; scan_path_for_bash is Windows-only in production.

Fixes #2490, Fixes #2328, Fixes #2413
Supersedes #2493, #2416, #2488, #2541 (Will closes those; don't touch them)