[Borcioo]

On Windows, every background sync flashes a terminal window, and so does every Codex summarizer call. The SessionStart hook runs sync --background, which re-spawns itself with detached: true. On Windows a detached child gets no console. Any console program that child starts without windowsHide: true (codex --version, codex app-server) then gets a brand-new visible console window, which in Windows 11 is a Windows Terminal window. A session that resumes often, or a sync with many Codex transcripts to summarize, opens a steady stream of these windows.

This change adds windowsHide: true to the four spawn() calls in src/: the detached background sync in sync-cli.ts, the two Codex summarizer spawns in summarizer.ts (version check and app-server), and the app-server probe in codex-hook-trust.ts. On other platforms the option does nothing. The Claude summarizer path was already fine, because the Agent SDK passes windowsHide itself.

test/spawn-windows-hide.test.ts scans every spawn( call in src/ and fails if its options lack windowsHide: true, so a future spawn can't bring the windows back. Before the fix it failed on all four calls; after the fix it passes.

How it was checked, on Windows 11 with Node 24:

• I reproduced the window outside the plugin. A detached Node parent that spawns cmd /c timeout 2 without windowsHide opens a new Windows Terminal window, detected by enumerating visible top-level windows. The same spawn with windowsHide: true opens none.
• I applied the same four changes to an installed 1.6.0 and ran a real sync --background (copy, index, summaries) for 3 minutes. No new console window appeared.
• npm run build was run, and the rebuilt dist/ files for the three changed modules are committed alongside src/. I left dist/mcp-server.js as upstream has it. Without a lockfile my rebuild pulled newer dependencies and changed about 3k lines of that bundle, and the bundle contains none of these spawn calls.
• npm test: 4 tests fail both before and after this change on Windows: file-lock I/O propagation, the mcp-server-wrapper SIGTERM test, and two parser real-data path tests. They look Windows-specific and are unrelated to this change. No new failures.