Bug type

Behavior bug (incorrect output/state without crash)

Beta release blocker

No

Summary

On Windows, package-openclaw-for-docker.mjs does not use OpenClaw's portable npm/pnpm command-shim runners and does not terminate the full command tree when a package step times out.

Steps to reproduce

1. Run the package helper on Windows with a pnpm.cmd shim that launches a long-lived Node child.
2. Give the package command a bounded timeout.
3. Observe the package command reject on timeout while the descendant Node process can remain alive when only the direct shim process is killed.

The focused regression test uses a real pnpm.cmd -> node process tree and records the descendant PID independently.

Expected behavior

The helper should resolve npm/pnpm through the repository's cross-platform runners and terminate the complete managed process tree on timeout.

Actual behavior

The helper directly spawns the requested command and falls back to killing the direct child. This is not a reliable lifecycle boundary for Windows .cmd shims and their descendants.

OpenClaw version

main@e2bb04328f5c4f45c63202a5ad2bc77dced28551 (package.json version 2026.7.2)

Operating system

Windows 11

Install method

Source checkout with the repository-pinned Node/pnpm toolchain

Model

Not applicable

Provider / routing chain

Not applicable

Logs

Focused managed-child tests: 8 passed, 1 platform skip
Package helper E2E tests: 30 passed, 1 platform skip
The Windows E2E records the spawned Node PID, forces a 500 ms timeout, and proves the PID becomes absent.

Screenshots, recordings, and evidence

The proposed regression test is self-contained and exercises a real Windows command-shim descendant rather than a mocked child.kill call.

Impact and severity

• Affected: Windows developers and release/CI workflows using the Docker package helper.
• Severity: moderate; a timed-out package step can leave a descendant process running and make subsequent packaging or cleanup unreliable.
• Frequency: deterministic under the reproduced pnpm.cmd -> node timeout path.
• Consequence: leaked processes, delayed cleanup, and package commands that do not honor their timeout contract.

Additional information

The repository already owns the required cross-platform boundaries in scripts/npm-runner.mjs, scripts/pnpm-runner.mjs, and scripts/lib/managed-child-process.mjs. The proposed fix reuses those helpers rather than adding another process implementation.