fix(windows): disable bonjour by default to stop cmd flash

[Sid-Qin]

Summary

• Problem: on Windows, Bonjour advertising can trigger periodic cmd.exe -> arp.exe -> findstr.exe helper spawns that flash a console window.
• Why it matters: users see intrusive window flashing every ~30s while gateway runs.
• What changed: Bonjour advertiser is now disabled by default on Windows unless explicitly enabled via OPENCLAW_ENABLE_BONJOUR_WINDOWS=1.
• What did NOT change (scope boundary): non-Windows Bonjour behavior remains unchanged.

Change Type (select all)

• Bug fix
• Feature
• Refactor
• Docs
• Security hardening
• Chore/infra

Scope (select all touched areas)

• Gateway / orchestration
• Skills / tool execution
• Auth / tokens
• Memory / storage
• Integrations
• API / contracts
• UI / DX
• CI/CD / infra

Linked Issue/PR

• Closes Windows: cmd.exe window flashes every ~30s from ARP network scanning openclaw/openclaw#25856
• Related #

User-visible / Behavior Changes

• On Windows, Bonjour LAN advertisement is now opt-in using OPENCLAW_ENABLE_BONJOUR_WINDOWS=1.

Security Impact (required)

• New permissions/capabilities? (No)
• Secrets/tokens handling changed? (No)
• New/changed network calls? (No)
• Command/tool execution surface changed? (No)
• Data access scope changed? (No)
• If any Yes, explain risk + mitigation:

Repro + Verification

Environment

• OS: macOS (unit simulation with process.platform=win32)
• Runtime/container: Vitest
• Model/provider: N/A
• Integration/channel (if any): Bonjour advertiser
• Relevant config (redacted): env-based toggles

Steps

1. Simulate Windows platform.
2. Start Bonjour advertiser with default env.
3. Enable OPENCLAW_ENABLE_BONJOUR_WINDOWS=1 and start again.

Expected

• Default on Windows: no service advertiser startup.
• With opt-in env: advertiser starts normally.

Actual

• Previously advertiser always started and could trigger flashing helper windows.

Evidence

Attach at least one:

• Failing test/log before + passing after
• Trace/log snippets
• Screenshot/recording
• Perf numbers (if relevant)

Human Verification (required)

What you personally verified (not just CI), and how:

• Verified scenarios: bunx vitest run src/infra/bonjour.test.ts -t "disables Bonjour on win32 unless explicitly enabled" passes.
• Edge cases checked: explicit Windows opt-in restores previous startup behavior.
• What you did not verify: real Windows desktop runtime with process creation tracing.

Compatibility / Migration

• Backward compatible? (Yes)
• Config/env changes? (Yes)
• Migration needed? (No)
• If yes, exact upgrade steps:

Failure Recovery (if this breaks)

• How to disable/revert this change quickly: set OPENCLAW_ENABLE_BONJOUR_WINDOWS=1 or revert commit.
• Files/config to restore: src/infra/bonjour.ts, src/infra/bonjour.test.ts.
• Known bad symptoms reviewers should watch for: missing LAN discovery on Windows when env opt-in is not set.

Risks and Mitigations

• Risk: reduced zero-config LAN discovery on Windows.
  • Mitigation: explicit opt-in env keeps behavior available when needed.