Bug: Plugin dependency install fails on Windows with spawn EINVAL

Summary

When installing any plugin that has npm dependencies on Windows, OpenClaw fails to run npm install in the plugin directory. The error stack is:

Error: spawn EINVAL
    at ChildProcess.spawn (node:internal/child_process:421:11)
    at runCommandWithTimeout (.../dist/exec-*.js:201:16)
    at installPluginFromNpmSpec (.../dist/installs-*.js:339:20)

Root Cause

In dist/exec-X_fw5eJV.js (or equivalent in the built output), shouldSpawnWithShell unconditionally returns false:

function shouldSpawnWithShell(params) {
    return false;  // always false -- no platform check
}

On Windows, npm resolves to a .cmd script. Node.js cannot spawn .cmd files directly without shell: true — it throws EINVAL. The resolveCommand() function does attempt to append .cmd for bare npm, but this does not cover cases where npm is on a full path without the extension.

Fix

function shouldSpawnWithShell({ resolvedCommand, platform }) {
    if (platform === "win32") return true;
    return false;
}

Reproduction

1. Windows machine with Node.js and OpenClaw installed
2. Run: openclaw plugins install @sentinel-agents/openclaw-plugin
3. Observe spawn EINVAL at the dependency install step

Workaround (for users in the meantime)

After the failed install, manually run npm install in the plugin directory:

cd %APPDATA%\openclaw\plugins\sentinel
npm install

Then restart the gateway normally.

Evidence

Confirmed by inspecting dist/exec-X_fw5eJV.js in the locally installed openclaw package. shouldSpawnWithShell at line 144 unconditionally returns false with no platform check whatsoever. Reported by a user installing the @sentinel-agents/openclaw-plugin package on Windows.