Summary

Fixes #81254.

openclaw node install currently writes the Windows node login task as a direct node.cmd target, which can leave a persistent command window open after login. The node host is expected to behave like a background service, so this PR opts node installs into a hidden Windows launcher while leaving the generated node.cmd script available for status/restart/script inspection.

This PR:

• adds a node-only hidden launcher opt-in through the service environment;
• stages the normal node.cmd script plus a sibling node.vbs launcher;
• points Windows scheduled-task and Startup-folder fallback entries at the hidden launcher when the opt-in is set;
• keeps the gateway scheduled-task path on the existing .cmd target unless it explicitly opts in.

Validation

• node scripts/test-projects.mjs src/daemon/schtasks.install.test.ts src/daemon/schtasks.startup-fallback.test.ts src/commands/node-daemon-install-helpers.test.ts src/cli/node-cli/register.test.ts src/daemon/service-env.test.ts --reporter=verbose
• node scripts/check-changed.mjs
• node scripts/run-tsgo.mjs -p test/tsconfig/tsconfig.core.test.json --incremental --tsBuildInfoFile .artifacts/tsgo-cache/core-test.tsbuildinfo
• ./node_modules/.bin/oxfmt.CMD --check --threads=1 CHANGELOG.md src/daemon/schtasks.ts src/daemon/schtasks.install.test.ts src/daemon/schtasks.startup-fallback.test.ts src/daemon/node-service.ts src/daemon/service-env.ts src/daemon/service-env.test.ts
• git diff --check

Real behavior proof

• Behavior or issue addressed: openclaw node install should opt the node service into a hidden Windows launcher, staging node.cmd plus node.vbs so the command host starts hidden instead of leaving a visible command window at login.
• Real environment tested: WSL Ubuntu-24.04 source worktrees created from upstream/main and PR head 1fa6b3aefbed39082252600bb862759e3b2d0de7, using OpenClaw's real node service environment builder and scheduled-task staging code.
• Exact steps or command run after this patch: created clean detached worktrees for upstream/main and fork/fix-windows-node-task-hidden; in each worktree ran node --import ./node_modules/tsx/dist/loader.mjs ./probe-hidden-node-task.mjs. The probe called buildNodeServiceEnvironment({ platform: "win32" }) and stageScheduledTask() with a temp state dir, then checked whether staging produced the hidden node.vbs launcher and whether it runs the generated node.cmd via WScript.Shell.Run(..., 0, False).
• Evidence after fix (screenshot, recording, terminal capture, console output, redacted runtime log, linked artifact, or copied live output):

Fresh proof artifact: https://raw.githubusercontent.com/giodl73-repo/openclaw/proof-artifacts/pr-81267-fresh/pr-81267/pr-81267-hidden-windows-node-task-launcher-before-after-proof.png
Proof summary: https://raw.githubusercontent.com/giodl73-repo/openclaw/proof-artifacts/pr-81267-fresh/pr-81267/summary.txt

BEFORE upstream/main:
ref=d533a65f56ad
nodeHiddenFlag=<missing>
taskScriptName=node.cmd
scriptExists=true
launcherExists=false
launcherUsesWscriptShell=false
launcherRunsHidden=false
ok=false

AFTER PR #81267 head:
ref=1fa6b3aefbed
nodeHiddenFlag=1
taskScriptName=node.cmd
scriptExists=true
launcherExists=true
launcherUsesWscriptShell=true
launcherRunsHidden=true
ok=true

• Observed result after fix: upstream/main stages only node.cmd and has no node hidden-launcher opt-in. PR head marks node installs with OPENCLAW_WINDOWS_TASK_HIDDEN_LAUNCHER=1, stages node.cmd plus node.vbs, and the generated launcher invokes node.cmd hidden with WScript.Shell.Run(..., 0, False).
• Additional local Windows proof: in a Windows source checkout where schtasks /Create /SC ONLOGON was denied, the Startup-folder fallback installed node.vbs; a directly registered Windows Task Scheduler proof also ran the generated node.vbs action successfully and completed without leaving matching cmd, conhost, wscript, or cscript processes behind.
• What was not tested: no actual sign-out/sign-in cycle was captured from this shell. The fresh proof covers OpenClaw's node service environment and scheduled-task staging boundary; the regression tests cover scheduled-task /TR node.vbs behavior.

Root cause

The shared Windows scheduled-task installer wrote direct .cmd task targets, and the node service reused that default even though node is expected to behave like a background service. There was no node-specific test requiring a hidden Windows launcher.

User-visible / Behavior changes

On Windows, openclaw node install launches the node host through a hidden launcher. Users should no longer see a persistent command window from the node login task.

Security impact

No new permissions, network access, secret handling, or data access. The generated launcher only invokes the existing generated task script in hidden mode.