Description

On Windows, the OpenClaw gateway (PID traced to the gateway process) spawns cmd.exe → arp.exe → findstr.exe approximately every 30 seconds. Each spawn briefly flashes a console window on screen.

Steps to Reproduce

1. Run OpenClaw gateway on Windows 11
2. Observe cmd.exe window flashing repeatedly (~30s interval)
3. Use Register-CimIndicationEvent -ClassName Win32_ProcessStartTrace to confirm ARP.EXE and findstr.exe spawning with PPID tracing back to the node.exe gateway process

Expected Behavior

• Network discovery/ARP scanning should use windowsHide: true on child_process.exec/spawn calls to prevent console window flash
• Or: ARP scanning interval should be configurable / less frequent

Environment

• OpenClaw version: 2026.2.12
• OS: Windows 11 (10.0.26200)
• Node.js: v24.13.0

Notes

• This was not happening in earlier versions (user reports regression)
• The cmd.exe processes die too fast to catch via polling — had to use WMI process creation events to identify the source
• Parent PID consistently traces to the OpenClaw gateway node.exe process