Best possible solution:

Merge the remaining windowsHide coverage only after redacted native Windows proof shows the direct spawn paths no longer flash, and keep any PTY-specific failure in the linked issue or a narrower follow-up.

Do we have a high-confidence way to reproduce the issue?

No high-confidence live reproduction was performed. Source inspection shows current main still has direct production spawn sites without windowsHide, but the visible Windows desktop behavior needs native proof.

Is this the best way to solve the issue?

Yes for the remaining direct child_process.spawn sites: adding windowsHide: true matches existing OpenClaw spawn patterns. It is not proven as a complete fix for the PTY path, so merge should wait on Windows proof or an explicit follow-up split.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 4a2a97777e35.

Label justifications:

• P2: The PR targets a disruptive but platform-specific Windows exec/spawn regression rather than a security issue, data loss, or total runtime outage.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🐚 platinum hermit.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR body only says the modified options were checked; it needs redacted native Windows after-fix proof such as a screenshot, recording, terminal output, copied live output, or logs, with private details redacted before posting. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

PR surface:

Source +7. Total +7 across 8 files.

What I checked:

• Repository policy applied: Root AGENTS.md was read fully, and its PR review/proof guidance applies because the PR touches core agent/process spawn behavior. (AGENTS.md:10, 4a2a97777e35)
• Scoped agent policy applied: The scoped agent guide was read fully; its guidance affected the review depth for agent runtime spawn paths. (src/agents/AGENTS.md:1, 4a2a97777e35)
• PR still changes real spawn paths: The live PR diff adds windowsHide: true to direct production spawn calls, including fd/rg tool spawns and SSH/SCP/local-service helpers that current main still lacks. (src/agents/sessions/tools/find.ts:274, 4783158b3221)
• Current main still lacks the option on remaining sites: Current main starts provider local services and SSH sandbox processes without windowsHide, so the PR is not fully redundant with main. (src/agents/provider-local-service.ts:264, 4a2a97777e35)
• Current main already fixed adjacent central exec paths: Current main already sets windowsHide: true in the session exec helper and built-in bash session tool, which means the PR is a partial remaining-coverage fix rather than the only exec-window fix. (src/agents/sessions/exec.ts:88, 4a2a97777e35)
• Existing OpenClaw hidden-window pattern: The process supervisor child adapter already sets windowsHide: true, so the PR follows an established internal pattern for hidden Windows child processes. (src/process/supervisor/adapters/child.ts:83, 4a2a97777e35)

Likely related people:

• vincentkoc: Recent live history shows multiple commits on provider local-service and process exec/respawn paths adjacent to the touched spawn behavior. (role: recent area contributor; confidence: medium; commits: 80805ad7a583, 5d6ac2308657, d7866fc89b98; files: src/agents/provider-local-service.ts, src/process/exec.ts, src/process/respawn-child-runner.ts)
• lawrence3699: Authored the earlier merged Windows exec console-window fix that established windowsHide coverage in core exec behavior. (role: prior Windows exec hidden-window contributor; confidence: medium; commits: 2fd7f7ca5275; files: src/process/exec.ts, src/process/exec.windows.test.ts)
• steipete: Recent GitHub path history shows broad agent runtime and process-helper refactors around the session/runtime surfaces touched by this PR. (role: adjacent runtime owner; confidence: medium; commits: bb46b79d3c14, f03d7c5a4c40, a628a66e4d1e; files: src/agents/sessions/exec.ts, src/agents/provider-local-service.ts, src/process/exec.ts)

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.