Best possible solution:

Finish maintainer review, undraft when ready, let the normal required checks run, and land the narrow argv/docs/tests/changelog fix for #78514.

Do we have a high-confidence way to reproduce the issue?

Yes. Current main still runs managed-root npm commands with both cwd and --prefix ., and the PR body reports Windows Crabbox before/after proof for Node v22.20.0/npm v10.9.3.

Is this the best way to solve the issue?

Yes. Removing --prefix . from commands already executed inside the managed npm root is the narrowest maintainable fix, and the PR updates the corresponding tests, docs, and changelog.

Acceptance criteria:

• pnpm exec oxfmt --check --threads=1 src/plugins/install.ts src/plugins/uninstall.ts src/infra/npm-managed-root.ts src/plugins/install.npm-spec.test.ts src/plugins/uninstall.test.ts src/infra/npm-managed-root.test.ts
• pnpm test:serial src/infra/npm-managed-root.test.ts src/plugins/install.npm-spec.test.ts src/plugins/uninstall.test.ts
• pnpm check:changed after the PR is undrafted and current

What I checked:

• Current main still has affected install argv: Managed npm installs already run with cwd: npmRoot while also passing --prefix ., which is the redundant command shape this PR removes. (src/plugins/install.ts:502, af49c09d1320)
• Repair and uninstall paths share the same pattern: Managed-root repair and plugin uninstall cleanup also pass --prefix . while setting cwd to the managed npm root. (src/infra/npm-managed-root.ts:248, af49c09d1320)
• PR diff is narrow and aligned: The diff removes only the redundant argv pair from the four managed npm command paths and updates assertions/docs/changelog for that command shape. (src/plugins/install.ts:497, d23b670126ca)
• Real Windows proof is reported in the PR discussion: The PR body reports Windows Crabbox proof on Node v22.20.0/npm 10.9.3: the OpenClaw-shaped invocation with --prefix . reproduced the Arborist spec crash, while the same cwd/env without --prefix . passed. (d23b670126ca)
• Fresh head remains draft with skipped full checks: The head commit has 54 check runs; 7 are successful and 47 are skipped, consistent with the PR still being draft. (d23b670126ca)
• Related bug remains paired with this PR: The linked Windows WhatsApp install regression is still open and assigned to Vincent Koc, so this PR is the active implementation candidate rather than a cleanup-close target.

Likely related people:

• vincentkoc: Recent GitHub history for src/plugins/install.ts and src/infra/npm-managed-root.ts shows repeated managed npm-root fixes, including legacy peer mode, overrides, rollback, and peer-resolution changes; Vincent is also assigned to the linked Windows install regression. (role: recent managed npm-root maintainer; confidence: high; commits: e302353d6187, ba3c0fc78e83, 0ddbf2e258d9; files: src/plugins/install.ts, src/infra/npm-managed-root.ts, src/plugins/install.npm-spec.test.ts)
• Peter Steinberger: Current checkout blame for the affected argv blocks points to Peter's recent function-shape assertion commit, and GitHub path history shows adjacent repair, npm-pack, and uninstall cleanup work in the same managed-root surface. (role: recent adjacent maintainer and current-line maintainer; confidence: high; commits: 8af475d9be9c, 8e533490ab0a, 2eaf8ad7126b; files: src/plugins/install.ts, src/plugins/uninstall.ts, src/infra/npm-managed-root.ts)

Remaining risk / open question:

• The PR is still draft, so most normal CI checks on the fresh head are skipped until a maintainer undrafts it.

Codex review notes: model gpt-5.5, reasoning high; reviewed against af49c09d1320.