Best possible solution:

Land one narrow Start-Process -FilePath branch after redacted Windows proof confirms the Dashboard or PowerShell opener path, and close the duplicate branch afterward.

Do we have a high-confidence way to reproduce the issue?

Yes, source inspection plus the Microsoft Start-Process contract gives a high-confidence reproduction path for the bad command token: current main emits an unsupported -LiteralPath parameter. This review did not run a live Windows Dashboard click-through.

Is this the best way to solve the issue?

Yes for the code shape: changing only the Windows command token to -FilePath is the narrowest maintainable fix because callers already route through resolveConfigOpenCommand, escaping remains unchanged, and sibling Windows launch code uses -FilePath. Merge readiness still depends on real Windows proof and choosing one duplicate branch.

AGENTS.md: found and applied where relevant.

Codex review notes: model gpt-5.5, reasoning high; reviewed against 79c6136a9e17.

Label justifications:

• P2: This is a normal-priority Windows Dashboard opener bug fix with limited blast radius.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🐚 platinum hermit.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR body lists only a unit-test command, so the contributor still needs redacted Windows PowerShell or Dashboard proof showing the patched opener path. Terminal output, logs, linked artifacts, recordings, screenshots, or videos are acceptable when they show the behavior; redact private details, update the PR body afterward, and ask a maintainer for @clawsweeper re-review if review does not refresh automatically.

PR surface:

Source 0, Tests 0. Total 0 across 2 files.

What I checked:

• Repository policy read: Root and scoped gateway AGENTS.md files were read; they require whole-path gateway review and dependency-backed proof for API/command behavior. (AGENTS.md:8, 79c6136a9e17)
• Current main behavior: Current main still emits Start-Process -LiteralPath for the Windows config.openFile command. (src/gateway/server-methods/config.ts:186, 79c6136a9e17)
• Adjacent test: The current Windows command test asserts Start-Process -LiteralPath while preserving the single-quote and metacharacter escaping case. (src/gateway/server-methods/config.test.ts:77, 79c6136a9e17)
• Runtime entry point: config.openFile resolves the config path, calls execConfigOpenCommand(resolveConfigOpenCommand(configPath)), and reports opener failures back to the Dashboard caller. (src/gateway/server-methods/config.ts:773, 79c6136a9e17)
• Dashboard caller: The Control UI controller sends config.openFile and only surfaces the gateway response, so the gateway command builder owns the Windows opener behavior. (ui/src/ui/controllers/config.ts:524, 79c6136a9e17)
• Sibling Windows usage: Current main already uses Start-Process -FilePath for the Windows gateway startup fallback. (src/cli/update-cli/restart-helper.ts:319, 79c6136a9e17)

Likely related people:

• mappel-nv: Available history shows Gateway: open config files without shell interpolation added the affected command builder and Windows opener test. (role: introduced behavior; confidence: medium; commits: 5cc0bc936c4d; files: src/gateway/server-methods/config.ts, src/gateway/server-methods/config.test.ts)
• steipete: Recent config/gateway history shows repeated refactors and hardening in the same files and surrounding config write/control-plane behavior. (role: recent area contributor; confidence: medium; commits: 533bd000018a, 97878b853ab3, b1dca644bc01; files: src/gateway/server-methods/config.ts, src/gateway/server-methods/config.test.ts)
• joshavant: Recent Control UI and RPC config work touches the caller-side behavior that surfaces config.openFile failures to users. (role: adjacent config UI contributor; confidence: medium; commits: 81b777c7687d; files: ui/src/ui/controllers/config.ts, ui/src/ui/controllers/config.test.ts, src/gateway/server-methods/config.ts)

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.