Best possible solution:

Land the focused Windows Gmail helper fix after required checks finish, keeping the resolver scoped to helper spawn compatibility and the existing Windows-safe .cmd wrapper boundary.

Do we have a high-confidence way to reproduce the issue?

Yes, source-reproducible. The linked bug gives concrete native Windows PowerShell steps, and current main still invokes bare helper names in the documented Gmail setup/run and gateway watcher paths; I did not run a native Windows live repro in this read-only review.

Is this the best way to solve the issue?

Yes. The current PR direction is the narrowest maintainable fix I found: Windows-only filesystem PATH/PATHEXT resolution, no where.exe execution, coverage for setup/run/watcher helper paths, .cmd/.bat wrapping through pinned System32 cmd.exe, tests, and changelog.

What I checked:

• current_main_bare_gcloud_and_tailscale: Current main still calls runCommandWithTimeout(["gcloud", ...]) and runCommandWithTimeout(["tailscale", ...]) in the Gmail setup utility, matching the linked Windows PATHEXT failure surface. (src/hooks/gmail-setup-utils.ts:159, 6c8974f3f5a9)
• current_main_bare_gog_cli_path: The documented CLI run path still directly spawns gog and uses bare gog for watch renewal on current main. (src/hooks/gmail-ops.ts:361, 6c8974f3f5a9)
• current_main_bare_gog_watcher_path: The gateway Gmail watcher still invokes bare gog for both watch start and watch serve on current main. (src/hooks/gmail-watcher.ts:43, 6c8974f3f5a9)
• documented_cli_surface: Docs define openclaw webhooks gmail setup --account you@example.com and openclaw webhooks gmail run as supported user-facing commands. Public docs: docs/cli/webhooks.md. (docs/cli/webhooks.md:21, 6c8974f3f5a9)
• pr_patch_covers_prior_blockers: The public PR patch adds resolveExecutable, uses it for gcloud, tailscale, and both CLI/watcher gog paths, removes the prior where.exe lookup concern, and adds a single-line changelog fix entry. (cdcbad03b5c2)
• windows_cmd_wrapper_contract: Current process infrastructure already treats .cmd/.bat as requiring pinned System32 cmd.exe plus metacharacter rejection; the PR mirrors that boundary for direct long-lived spawn() calls. (src/process/exec.ts:20, 6c8974f3f5a9)

Likely related people:

• steipete: GitHub commit history shows the original Gmail hooks wizard and several later Gmail hook refactors/maintenance commits, plus adjacent exec infra trimming. (role: introduced behavior and recent maintainer; confidence: high; commits: 523d9ec3c2e4, 77db65d6692b, 7f3f108521f4; files: src/hooks/gmail-ops.ts, src/hooks/gmail-setup-utils.ts, src/hooks/gmail-watcher.ts)
• jverdi: GitHub commit history shows the gateway Gmail watcher startup behavior was introduced in Gmail watcher: start when gateway (re)starts. (role: introduced gateway watcher behavior; confidence: medium; commits: ca9b0dbc887d; files: src/hooks/gmail-watcher.ts)
• drobison00: Recent merged work hardened the Windows cmd.exe wrapper trust boundary that this PR reuses for .cmd/.bat helper shims. (role: recent Windows command-wrapper maintainer; confidence: high; commits: 982d123b8052; files: src/process/exec.ts, src/infra/windows-install-roots.ts)
• pgondhi987: Recent Gmail setup work changed the gcloud execution environment to block workspace CLOUDSDK_PYTHON override, directly adjacent to the helper spawn path touched here. (role: recent adjacent gcloud setup maintainer; confidence: medium; commits: 86251f43916d; files: src/hooks/gmail-setup-utils.ts)
• vincentkoc: Recent Windows process/runtime fixes touched command output decoding and Windows exec shim handling, which are adjacent to this spawn compatibility path. (role: adjacent Windows process maintainer; confidence: medium; commits: e6d2c9b08005, 25a3d3797075; files: src/process/exec.ts)

Remaining risk / open question:

• One GitHub check run, checks-node-core-runtime-media-ui, was still in progress for the reviewed head SHA at review time.
• This read-only review did not independently run a native Windows Gmail/Tailscale setup; it relies on the maintainer proof override, source inspection, and CI/check evidence.

Codex review notes: model gpt-5.5, reasoning high; reviewed against 6c8974f3f5a9.