fix: add windowsHide to child_process calls to prevent terminal popup on Windows (#637)

- copilot-models.ts: add windowsHide to `gh auth token` call
- file-provider.ts: add shared execOpts with windowsHide for all
  docker/ssh/singularity calls

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>

packages/server/src/services/hermes/copilot-models.ts

@@ -125,7 +125,7 @@ export async function resolveCopilotOAuthTokenWithSource(
   const appsToken = await readGhAppsToken()
   if (appsToken) return { token: appsToken, source: 'apps-json' }
   try {
-    const { stdout } = await execFileAsync('gh', ['auth', 'token'], { timeout: 3000 })
+    const { stdout } = await execFileAsync('gh', ['auth', 'token'], { timeout: 3000, windowsHide: true })
     const v = stdout.trim()
     if (isUsableOAuthToken(v)) return { token: v, source: 'gh-cli' }
   } catch { /* ignore */ }

packages/server/src/services/hermes/file-provider.ts

@@ -8,6 +8,7 @@ import { config } from '../../config'
 import { getActiveProfileDir, getActiveEnvPath } from './hermes-profile'
 
 const execFileAsync = promisify(execFile)
+const execOpts = { windowsHide: true }
 
 // Max download file size (default 200MB)
 const MAX_DOWNLOAD_SIZE = parseInt(process.env.MAX_DOWNLOAD_SIZE || '', 10) || 200 * 1024 * 1024