PR #72594: fix(runtime-deps): hide bundled npm staging windows

• Repository: openclaw/openclaw
• Author: chen-zhang-cs-code
• State: open | merged: False
• Link: https://github.com/openclaw/openclaw/pull/72594

Description (problem / solution / changelog)

Problem

On Windows 11, bundled plugin runtime dependency staging can flash visible npm command windows while installing Telegram grammY / Anthropic runtime dependencies. This is disruptive during gateway/postinstall/runtime staging and is tracked in #72315.

Root cause

The bundled runtime-deps npm child-process calls did not pass windowsHide: true, even though the npm runner already preserves Windows-specific shell / windowsVerbatimArguments behavior.

Complete fix boundary

This sets windowsHide: true on every bundled runtime dependency npm staging execution path found by tracing resolveNpmRunner / resolveBundledRuntimeDepsNpmRunner to actual spawn calls:

• src/plugins/bundled-runtime-deps.ts for runtime / doctor repair installs.
• scripts/postinstall-bundled-plugins.mjs for packaged postinstall eager installs.
• scripts/stage-bundled-plugin-runtime-deps.mjs for build/runtime-postbuild staging installs.

Regression coverage checks the runtime Windows npm shim path, the postinstall spawn helper, and a real stageBundledPluginRuntimeDeps() fallback install path that reaches the mocked npm spawn and materializes staged deps.

What intentionally did not change

• scripts/npm-runner.mjs is unchanged because it only resolves command/args/options metadata; it does not spawn npm.
• Active-plugin scoping, stale version detection, and temp cleanup behavior are unchanged because those are separate runtime-deps issues with existing open PRs.
• Other process-spawn callers are unchanged because this PR is scoped to bundled plugin runtime dependency npm staging.

Tests run

• pnpm install --frozen-lockfile --offline
• pnpm test src/plugins/bundled-runtime-deps.test.ts test/scripts/stage-bundled-plugin-runtime-deps.windows-hide.test.ts
• pnpm exec vitest run test/scripts/postinstall-bundled-plugins.test.ts -t "runs nested local installs with sanitized env when the sentinel package is missing"
• pnpm exec oxfmt --check scripts/postinstall-bundled-plugins.mjs scripts/stage-bundled-plugin-runtime-deps.mjs src/plugins/bundled-runtime-deps.ts src/plugins/bundled-runtime-deps.test.ts test/scripts/postinstall-bundled-plugins.test.ts test/scripts/stage-bundled-plugin-runtime-deps.windows-hide.test.ts
• pnpm check:changed
• git diff --check HEAD~1..HEAD

Local note: running the whole test/scripts/postinstall-bundled-plugins.test.ts file on this Windows worktree still fails in existing packaged-dist/symlink tests (unsafe dist entry, symlink EPERM, stale unlink expectation). The targeted postinstall regression for this diff passes, and the failures do not touch the npm spawn option path changed here.

CI status

Greptile passed with confidence 5/5 and no requested changes.

CI currently has unrelated red checks:

• check-additional-runtime-topology-architecture fails check:madge-import-cycles on an existing src/cli/argv.ts -> src/cli/program/... cycle. This PR does not touch src/cli/**.
• checks-node-core-fast-support fails src/cli/command-registration-policy.test.ts (matches plugin registration skip policy). This PR does not touch that test or command registration code.
• checks-node-agentic-commands fails src/cli/program/root-help.test.ts because a mock is missing CORE_CLI_COMMAND_DESCRIPTORS. This PR does not touch CLI root help or descriptor mocks.
• check-additional and checks-node-core are aggregate failures caused by the leaf jobs above.

The changed files are limited to bundled runtime-deps npm spawn options and their focused tests:

• scripts/postinstall-bundled-plugins.mjs
• scripts/stage-bundled-plugin-runtime-deps.mjs
• src/plugins/bundled-runtime-deps.ts
• src/plugins/bundled-runtime-deps.test.ts
• test/scripts/postinstall-bundled-plugins.test.ts
• test/scripts/stage-bundled-plugin-runtime-deps.windows-hide.test.ts

Linked issue

Fixes #72315

Changed files

• scripts/postinstall-bundled-plugins.mjs (modified, +1/-0)
• scripts/stage-bundled-plugin-runtime-deps.mjs (modified, +1/-0)
• src/plugins/bundled-runtime-deps.test.ts (modified, +1/-0)
• src/plugins/bundled-runtime-deps.ts (modified, +1/-0)
• test/scripts/postinstall-bundled-plugins.test.ts (modified, +1/-0)
• test/scripts/stage-bundled-plugin-runtime-deps.windows-hide.test.ts (added, +63/-0)