fix(cli): suppress gh auth token console flash on Windows

[konsisumer]

What does this PR do?

This fixes the Windows console-window flash caused by the gh auth token fallback in hermes_cli/copilot_auth.py. The Copilot credential lookup now uses the shared windows_hide_flags() helper so Hermes can poll GitHub CLI credentials without spawning a visible console window on native Windows.

Related Issue

Fixes #53370

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✅ Tests (adding or improving test coverage)
• 🔒 Security fix
• ✨ New feature (non-breaking change that adds functionality)
• 📝 Documentation update
• ♻️ Refactor (no behavior change)
• 🎯 New skill (bundled or hub)

Changes Made

• hermes_cli/copilot_auth.py: pass creationflags=windows_hide_flags() to the synchronous gh auth token subprocess so Windows hides the transient console window while preserving captured stdout.
• tests/hermes_cli/test_copilot_auth.py: add a regression test asserting _try_gh_cli_token() forwards the Windows hide flags into subprocess.run().

How to Test

1. On Windows, configure GitHub CLI auth so gh auth token returns a valid token, then trigger a Copilot credential lookup path that falls back to _try_gh_cli_token() and confirm no console window flashes.
2. Run pytest tests/hermes_cli/test_copilot_auth.py tests/hermes_cli/test_api_key_providers.py -q.
3. Run python scripts/check-windows-footguns.py --diff HEAD and git diff --check.

What platforms tested on

• macOS 15 / darwin-arm64 (local sandbox)

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: macOS 15 / darwin-arm64

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — or N/A
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A

Screenshots / Logs

• Local direct coverage: pytest tests/hermes_cli/test_copilot_auth.py tests/hermes_cli/test_api_key_providers.py -q → 191 passed.
• python scripts/check-windows-footguns.py --diff HEAD → no Windows footguns found.
• ruff check hermes_cli/copilot_auth.py tests/hermes_cli/test_copilot_auth.py → clean.
• Broad local suite caveat: the required bounded full-suite command stopped during unrelated collection because this sandbox lacks fastapi / uvicorn; broader importer subsets also exposed unrelated pre-existing failures in tests/run_agent/test_run_agent_codex_responses.py, tests/hermes_cli/test_auth_commands.py, and tests/agent/test_credential_pool.py.

[alt-glitch]

This was generated by AI during triage.

Related to #53123 (also patches the gh auth token spawn site in copilot_auth.py plus other disjoint Windows console-flash probes) and is part of the Windows console-flash family (#53370 target, #52981 anchor, merged #52340). Both this PR and #53123 are open and overlap on this spawn site — not a duplicate (disjoint/overlapping spawn-site fixes); a maintainer should pick one or consolidate.

[tonydwb]

Code Review Summary

Verdict: Comment (competing fix)

This PR and #53397 are duplicate fixes for the same issue (suppress console flash in copilot_auth gh token lookup). Both add the identical change: import windows_hide_flags and pass it as creationflags. The changes are functionally identical.

Recommendation: Close one in favor of the other. Both are small, clean fixes. The author should coordinate to avoid merge conflicts.

Looks Good

• Clean, focused fix
• Uses the correct windows_hide_flags() utility
• Includes test coverage
• No security concerns

---

Reviewed by Hermes Agent

[teknium1]

Closing as superseded by the consolidated Windows console-flash work tracked in #54220.

The relevant pieces from this PR/cluster have now landed through the targeted follow-up PRs #54236, #53892, and #54417, or are recorded in the umbrella tracker for any remaining native-Windows verification. Keeping this separate PR open would duplicate the tracker and the merged follow-up work.

Thanks for digging into this — the reports and PRs in this cluster helped identify the remaining spawn legs.