fix(browser): rm secrets from browser_exec subprocess; /browser off; hide windows console

hermes_cli/cli_commands_mixin.py

@@ -2213,22 +2213,14 @@ class CLICommandsMixin:
                 print("   Session reset. New tool configuration is active.")
                 print()
             else:
-                browser_cfg.pop("backend", None)
+                from tools.browser_use_cli import BACKEND_DISABLED
+
+                browser_cfg["backend"] = BACKEND_DISABLED
                 save_config(config)
                 invalidate_check_fn_cache()
                 self.new_session()
                 print()
                 print("🌐 Browser Use mode disabled — built-in browser tools restored")
-                try:
-                    from tools.browser_use_cli import is_browser_use_cli_mode
-                    if is_browser_use_cli_mode():
-                        print(
-                            "   ⚠ Still active via auto-detection: BROWSER_USE_API_KEY is set "
-                            "with no other cloud provider configured."
-                        )
-                        print("   Pick another provider via `hermes tools`, or unset the key.")
-                except Exception:
-                    pass
                 print("   Session reset. New tool configuration is active.")
                 print()
             return

tools/browser_use_cli.py

@@ -18,6 +18,7 @@ from utils import is_truthy_value
 logger = logging.getLogger(__name__)
 
 _BACKEND_KEY = "browser-use"
+BACKEND_DISABLED = "off"
 
 # Cloud daemon names become the BU_NAME env var
 _SESSION_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$")
@@ -34,6 +35,12 @@ _TASK_ID_SAFE_RE = re.compile(r"[^A-Za-z0-9._-]+")
 _IMAGE_PATH_RE = re.compile(r"(/[^\s\"']+?\.(?:png|jpe?g|webp))", re.IGNORECASE)
 
 
+def _base_subprocess_env() -> dict:
+    from tools.browser_tool import _build_browser_env
+
+    return _build_browser_env()
+
+
 def _read_browser_cfg() -> dict:
     """Return the ``browser:`` config section, or {} on any failure."""
     try:
@@ -177,7 +184,7 @@ def browser_exec(
             "to verify the setup."
         )
 
-    env = os.environ.copy()
+    env = _base_subprocess_env()
     if session:
         if not _SESSION_RE.match(session):
             return tool_error(
@@ -200,6 +207,19 @@ def browser_exec(
     except (TypeError, ValueError):
         timeout = _DEFAULT_TIMEOUT_S
 
+    # Windows: hide the console the .cmd shim would flash (as browser_tool does)
+    popen_extra: dict = {}
+    if os.name == "nt":
+        try:
+            from hermes_cli._subprocess_compat import windows_hide_flags
+
+            popen_extra["creationflags"] = windows_hide_flags()
+            _si = subprocess.STARTUPINFO()
+            _si.dwFlags |= subprocess.STARTF_USESHOWWINDOW
+            popen_extra["startupinfo"] = _si
+        except Exception as e:
+            logger.debug("Windows hide-flags unavailable: %s", e)
+
     started = time.time()
     try:
         proc = subprocess.run(
@@ -209,6 +229,7 @@ def browser_exec(
             text=True,
             timeout=timeout,
             env=env,
+            **popen_extra,
         )
     except subprocess.TimeoutExpired:
         return tool_error(