fix(core): set windowsHide: true on all child process spawns (#34894)

## Current Behavior

On Windows, the Nx daemon runs as a detached background process with no
console. When child processes are spawned without `windowsHide: true`
(Node.js) or `CREATE_NO_WINDOW` (Rust/Win32), Windows allocates a new
visible console window for each subprocess. This causes command prompt
windows to flash on screen during:

- Project graph creation (daemon spawn, plugin workers)
- Task hashing (runtime hashers)
- NX Console extension detection (`code.cmd --list-extensions`, etc.)
- AI agent configuration checks (`git ls-remote`, npm install)
- Machine ID retrieval, package manager version detection, git
operations, and more

The issue is especially noticeable "after a little bit" following daemon
startup, because background operations like the NX Console status check
and AI agents configuration check kick off after the initial project
graph is computed.

## Expected Behavior

No console windows should flash on Windows. All child process spawns use
`windowsHide: true` (Node.js) or `CREATE_NO_WINDOW` (Rust) to suppress
console windows.

## Root Causes Found

Investigation using a child_process interceptor in the daemon revealed
multiple sources:

1. **Rust native `ide/install.rs`** — `Command::new("code.cmd")` calls
for NX Console extension detection/installation were missing
`CREATE_NO_WINDOW`
2. **Rust native `hash_runtime.rs`** — Had its own `CREATE_NO_WINDOW`
handling but was duplicated
3. **`nx@latest` temp install** — The daemon downloads `nx@latest` to a
temp directory for NX Console and AI agent checks. The install process
(`pnpm add -D nx@latest`) and the downloaded code's `git ls-remote`
calls run without `windowsHide: true`
4. **~120 Node.js `child_process` calls** — Various
`spawn`/`exec`/`execSync` calls across the codebase were missing
`windowsHide: true`

## Changes

### Node.js child_process fixes
- Set `windowsHide: true` on all `spawn`/`exec`/`execSync`/`spawnSync`
calls across the codebase (~120 files)
- Added custom ESLint rule `@nx/workspace/require-windows-hide` that
errors when any spawn/exec call is missing `windowsHide: true`

### Rust native fixes
- **New shared util `native/utils/command.rs`** with `create_command()`
and `create_shell_command()` that set `CREATE_NO_WINDOW` on Windows —
centralizes the pattern so future Rust code gets it right by default
- **`ide/install.rs`** — Use `create_command()` for `code.cmd` calls
(list-extensions, install-extension, version check)
- **`hash_runtime.rs`** — Replaced local `create_command_builder()` with
shared `create_shell_command()`
- **`machine_id/mod.rs`** — Updated to use shared
`create_shell_command()`

### Daemon background operation fixes
- **`handle-configure-ai-agents.ts`** — Now respects `NX_USE_LOCAL` env
var to skip downloading `nx@latest`, avoiding the pnpm install that
opens windows. Once these fixes ship in a release, the downloaded
`nx@latest` will also have the fixes.

### Inlined node-machine-id
- Replaced the `node-machine-id` npm package with an inlined
implementation in `machine-id-cache.ts` that uses `windowsHide: true`
- The original package used `exec`/`execSync` without `windowsHide`

## Related Issue(s)

Supersedes #34455

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: nx-cloud[bot] <71083854+nx-cloud[bot]@users.noreply.github.com>
Co-authored-by: FrozenPandaz <FrozenPandaz@users.noreply.github.com>

Author: 3 people

.eslintrc.json

@@ -4,7 +4,7 @@
   "env": {
     "node": true
   },
-  "ignorePatterns": ["**/*.ts", "**/test-output"],
+  "ignorePatterns": ["**/*.ts", "**/test-output", "**/dist"],
   "plugins": ["@typescript-eslint", "@nx"],
   "extends": ["plugin:storybook/recommended"],
   "rules": {
@@ -76,7 +76,8 @@
             ]
           }
         ],
-        "@nx/workspace/valid-command-object": "error"
+        "@nx/workspace/valid-command-object": "error",
+        "@nx/workspace/require-windows-hide": "error"
       }
     },
     {

astro-docs/src/plugins/utils/nx-cli-generation.ts

@@ -43,6 +43,7 @@ export async function loadNxCliPackage(
       cwd: workspaceRoot,
       silent: true,
       stdio: ['inherit', 'inherit', 'inherit', 'ipc'],
+      windowsHide: true,
     });
 
     child.on('message', (message: any) => {

examples/angular-rspack/module-federation/remote/.eslintrc.json

@@ -1,3 +1,4 @@
 {
-  "extends": "../../../../.eslintrc.json"
+  "extends": "../../../../.eslintrc.json",
+  "ignorePatterns": ["dist/**"]
 }

package.json

@@ -389,7 +389,7 @@
     "license-checker": "^25.0.1",
     "next": "14.2.35",
     "next-seo": "^5.13.0",
-    "node-machine-id": "1.1.12",
+
     "npm-run-path": "^4.0.1",
     "picomatch": "catalog:",
     "preact": "10.25.4",

packages/create-nx-workspace/src/utils/child-process-utils.ts

@@ -25,7 +25,7 @@ export function spawnAndWait(command: string, args: string[], cwd: string) {
         ESLINT_USE_FLAT_CONFIG: process.env.ESLINT_USE_FLAT_CONFIG ?? 'true',
       },
       shell: true,
-      windowsHide: false,
+      windowsHide: true,
     });
 
     childProcess.on('exit', (code, signal) => {
@@ -50,7 +50,7 @@ export function execAndWait(
       {
         cwd,
         env: { ...process.env, NX_DAEMON: 'false' },
-        windowsHide: false,
+        windowsHide: true,
         maxBuffer: 1024 * 1024 * 10, // 10MB — default 1MB can be exceeded by verbose PM output
       },
       (error, stdout, stderr) => {

packages/create-nx-workspace/src/utils/git/default-base.ts

@@ -8,7 +8,7 @@ export function deduceDefaultBase(): string {
   const nxDefaultBase = 'main';
   try {
     return (
-      execSync('git config --get init.defaultBranch', { windowsHide: false })
+      execSync('git config --get init.defaultBranch', { windowsHide: true })
         .toString()
         .trim() || nxDefaultBase
     );

packages/create-nx-workspace/src/utils/git/git.ts

@@ -36,7 +36,7 @@ export async function checkGitVersion(): Promise<string | null | undefined> {
  */
 export function isGitAvailable(): boolean {
   try {
-    execSync('git --version', { stdio: 'ignore' });
+    execSync('git --version', { stdio: 'ignore', windowsHide: true });
     return true;
   } catch {
     return false;
@@ -49,7 +49,7 @@ export function isGitAvailable(): boolean {
  */
 export function isGhCliAvailable(): boolean {
   try {
-    execSync('gh --version', { stdio: 'ignore' });
+    execSync('gh --version', { stdio: 'ignore', windowsHide: true });
     return true;
   } catch {
     return false;

packages/create-nx-workspace/src/utils/nx/ab-testing.ts

@@ -370,7 +370,7 @@ function shouldRecordStats(): boolean {
     // Use npm to check registry - this works regardless of which package manager invoked us
     const stdout = execSync('npm config get registry', {
       encoding: 'utf-8',
-      windowsHide: false,
+      windowsHide: true,
     });
     const url = new URL(stdout.trim());
 

packages/create-nx-workspace/src/utils/package-manager.ts

@@ -266,7 +266,7 @@ export function getPackageManagerVersion(
     const version = execSync(`${packageManager} --version`, {
       cwd,
       encoding: 'utf-8',
-      windowsHide: false,
+      windowsHide: true,
     }).trim();
     pmVersionCache.set(packageManager, version);
     return version;

packages/cypress/plugins/cypress-preset.ts

@@ -77,14 +77,14 @@ function startWebServer(webServerCommand: string) {
     // Windows is fine so we leave it attached to this process
     detached: process.platform !== 'win32',
     stdio: 'inherit',
-    windowsHide: false,
+    windowsHide: true,
   });
 
   return async () => {
     if (process.platform === 'win32') {
       try {
         execSync('taskkill /pid ' + serverProcess.pid + ' /T /F', {
-          windowsHide: false,
+          windowsHide: true,
         });
       } catch (e) {
         if (process.env.NX_VERBOSE_LOGGING === 'true') {