What does this PR do?

Fixes Windows gateway install/start behavior so repeated hermes gateway install, hermes gateway start, and setup flows are idempotent and do not create duplicate gateway processes or leave visible console windows behind. Interactive window y/n on starting profile gateway after profile gateway installation, incorporating UAC priveledge escalation if need be

This PR addresses several Windows-native gateway lifecycle issues:

• Re-running gateway install should reconcile the Scheduled Task instead of preserving stale restart/repeat settings.
• Setup should respect the user's start now and start on login choices.
• Starting an already-running gateway should no-op instead of launching another poller.
• Scheduled Task / Startup fallback behavior should be explicit and safe.
• UAC/elevation should only be used after normal per-user Scheduled Task creation fails with access denied.
• Detached Windows gateway starts should use pythonw.exe / hidden subprocess flags to avoid flashing or stuck console windows.

The implementation keeps the normal Scheduled Task path as the preferred Windows login-start mechanism, uses schtasks /Create /F to replace stale task definitions without deleting the old task first, and falls back to the Startup folder only when Scheduled Task creation is unavailable or declined.

It also adds regression tests for the Windows gateway lifecycle behavior, including no duplicate start, UAC handoff, Startup fallback, direct detached spawn, and generated wrapper behavior.

Related Issue

#26487

Fixes #

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Security fix
• Documentation update
• Tests (adding or improving test coverage)
• Refactor (no behavior change)
• New skill (bundled or hub)

Changes Made

• hermes_cli/gateway_windows.py

  • Makes Windows gateway install/start behavior idempotent.
  • Uses schtasks /Create /F to reconcile the Scheduled Task definition.
  • Tries normal per-user Scheduled Task creation before UAC/fallback.
  • Prompts for UAC only when Scheduled Task creation/removal is blocked by access denied.
  • Uses Startup-folder fallback only when appropriate.
  • Avoids spawning duplicate gateways when a gateway process is already running.
  • Uses pythonw.exe and hidden process flags for detached gateway starts.

• hermes_cli/gateway.py

  • Passes setup choices through to Windows install.
  • Avoids double-starting Windows gateway from setup.
  • Honors start/startup choices in Linux systemd install path.
  • Avoids installing macOS launchd when login auto-start is declined.

• hermes_cli/main.py

  • Adds hidden internal flags used for elevated Windows install handoff:
    • --start-now
    • --no-start-now
    • --start-on-login
    • --no-start-on-login
    • --elevated-handoff

• tools/environments/local.py

  • Applies Windows no-window subprocess creation flags for local terminal commands.

• tools/process_registry.py

  • Applies Windows no-window subprocess creation flags for background terminal processes.

• tests/hermes_cli/test_gateway_windows.py

  • Adds Windows gateway lifecycle regression coverage.

• tests/hermes_cli/test_gateway.py

  • Updates setup/systemd tests for the explicit start/startup lifecycle choices.

How to Test

Targeted tests:

pytest tests/hermes_cli/test_gateway_windows.py tests/hermes_cli/test_gateway.py -q

Expected result:

45 passed

Additional checks:

git diff --check upstream/main..HEAD
# passed

security scan
# findings=0

Manual Windows behavior to verify:

1. Run hermes gateway install.
2. Confirm it asks whether to start now and whether to start on login.
3. Confirm declining login auto-start does not create a Scheduled Task.
4. Confirm re-running install does not create duplicate gateway processes.
5. Confirm hermes gateway start no-ops when the gateway is
6. Confirm no visible cmd.exe, powershell.exe, or hermes.exe windows flash/stick during gateway start or background subprocesses.

Checklist

Code

• I've read the Contributing Guide: https://github.com/NousResearch/hermes-agent/blob/main/CONTRIBUTING.md
• My commit messages follow Conventional Commits: https://www.conventionalcommits.org/
• I searched existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes
• I've tested on my platform: Windows 11, Windows PowerShell 5.1 / PowerShell 7 context

Documentation & Housekeeping

• I've updated relevant documentation — N/A
• I've updated cli-config.yaml.example if I added/changed config keys — N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — N/A
• I've considered cross-platform impact: Windows, Linux systemd, macOS launchd
• I've updated tool descriptions/schemas if I changed tool behavior — N/A