Environment

• openclaw 2026.4.21 (commit f788c88), installed via brew install openclaw (/opt/homebrew/lib/node_modules/openclaw)
• @openclaw/feishu 2026.4.20 (bundled, dist/extensions/feishu/)
• node v25.6.1
• macOS 26.2 (Darwin 25.2.0)

Summary

A vanilla install of openclaw leaves the bundled feishu plugin with an unresolvable require('@larksuiteoapi/node-sdk'). Two upstream code paths still load the extension before honoring the enabled flag — the gateway request handler and the config-reload pipeline — so the error fires recurrently even when the user has never configured Feishu. Both openclaw plugins disable feishu and openclaw plugins uninstall feishu fail to fix it: disable itself crashes with the same MODULE_NOT_FOUND (its plugin-resolution path eagerly loads the api chain before writing the disable flag), and uninstall refuses because feishu is origin: bundled. The only working remediation is hand-editing openclaw.json to add plugins.entries.feishu = { enabled: false }.

Reproduction

1. Fresh install on a host that has never configured Feishu: brew install openclaw (or npm i -g openclaw).
2. Trigger any config reload (e.g. edit ~/.openclaw/openclaw.json, run openclaw doctor, or restart the gateway). gateway.err.log:

   [reload] config restart failed: Error: Cannot find module '@larksuiteoapi/node-sdk'
   - /opt/homebrew/lib/node_modules/openclaw/dist/extensions/feishu/client-yWGpoGkZ.js

3. Wait for an external WebSocket client to query channel capabilities (observed daily ~03:00–04:00 ET in production). gateway.err.log:

   [gateway] request handler failed: Error: Cannot find module '@larksuiteoapi/node-sdk'
   - /opt/homebrew/lib/node_modules/openclaw/dist/extensions/feishu/client-yWGpoGkZ.js: code=MODULE_NOT_FOUND

4. Try the documented fix: openclaw plugins disable feishu. Crashes with the same MODULE_NOT_FOUND — the disable command's plugin-resolution path loads feishu/api.js → drive → client → @larksuiteoapi/node-sdk before writing the disable flag.
5. Try removing it: openclaw plugins uninstall feishu. Refuses with Plugin 'feishu' is not managed by plugins config/install records and cannot be uninstalled because feishu is origin: bundled (not separately installed).

Observed behavior

• Recurring MODULE_NOT_FOUND in two production paths: the config-reload watcher (every openclaw.json rewrite/hot-reload) and the gateway request handler (any external capability probe). 7 occurrences in the local gateway.err.log over a 13-day window (the path only fires when triggered, not continuously, but every trigger fails).
• The plugins disable CLI crashes with the same error it is meant to silence. The CLI is structurally unable to fix this bug.
• The plugins uninstall CLI rejects bundled plugins by design.
• Workaround that works: hand-edit ~/.openclaw/openclaw.json and add plugins.entries.feishu = { enabled: false }. The config-reload watcher checks plugins.entries.<id>.enabled BEFORE requiring the extension api, so this disables cleanly. Verified via openclaw daemon restart + 30s tail of gateway.err.log: zero subsequent larksuiteoapi/feishu/MODULE_NOT_FOUND occurrences. openclaw plugins inspect feishu status changed from Error: bundled (disabled by default) to Error: disabled in config.

Expected behavior

A bundled plugin the user has never configured should not be able to crash the config-reload pipeline or the gateway request handler. openclaw plugins disable <id> should never fail with the same error it is meant to silence.

Evidence

dist/extensions/feishu/package.json declares the SDK as a runtime dep:

{
  "name": "@openclaw/feishu",
  "version": "2026.4.20",
  "dependencies": {
    "@larksuiteoapi/node-sdk": "^1.60.0",
    "@sinclair/typebox": "0.34.49",
    "qrcode-terminal": "^0.12.0"
  },
  "openclaw": {
    "bundle": { "stageRuntimeDependencies": true },
    ...
  }
}

The manifest's bundle.stageRuntimeDependencies: true flag suggests intent to ship runtime deps; the publish pipeline does not act on it.

openclaw root package.json files array (lines 23–51) explicitly excludes per-extension node_modules:

"files": [
  "CHANGELOG.md",
  "LICENSE",
  "openclaw.mjs",
  "README.md",
  "assets/",
  "dist/",
  "!dist/**/*.map",
  "!dist/plugin-sdk/.tsbuildinfo",
  "!dist/extensions/node_modules/**",
  "!dist/extensions/*/node_modules/**",
  ...
]

Result: dist/extensions/feishu/node_modules/ does not exist on a vanilla install. The SDK is declared but never published to disk.

Load chain api.js → drive → client → @larksuiteoapi/node-sdk (this is what the disable command resolves before honoring the flag):

dist/extensions/feishu/api.js:1:

import { n as listEnabledFeishuAccounts } from "./accounts-C32zclXX.js";

dist/extensions/feishu/api.js:7:

import { ... } from "./drive-CqL2E2AR.js";

dist/extensions/feishu/drive-CqL2E2AR.js:2:

import { r as createFeishuClient } from "./client-yWGpoGkZ.js";

dist/extensions/feishu/client-yWGpoGkZ.js:3:

import * as Lark from "@larksuiteoapi/node-sdk";

Production log evidence (recurring over 10+ days):

2026-04-25T12:20:55-04:00 [reload] config restart failed: Error: Cannot find module '@larksuiteoapi/node-sdk'
2026-04-27T04:00:39-04:00 [gateway] request handler failed: Error: Cannot find module '@larksuiteoapi/node-sdk'
2026-05-03T19:28:29-04:00 [reload] config restart failed: Error: Cannot find module '@larksuiteoapi/node-sdk'
2026-05-04T04:00:40-04:00 [gateway] request handler failed: Error: Cannot find module '@larksuiteoapi/node-sdk'
2026-05-04T13:42:37-04:00 [reload] config restart failed: Error: Cannot find module '@larksuiteoapi/node-sdk'
2026-05-05T12:59:28-04:00 [reload] config restart failed: Error: Cannot find module '@larksuiteoapi/node-sdk'
2026-05-05T17:06:51-04:00 [reload] config restart failed: Error: Cannot find module '@larksuiteoapi/node-sdk'

Each error referenced dist/extensions/feishu/client-yWGpoGkZ.js as the failing require site.

openclaw plugins inspect feishu before workaround:

Status: Error: bundled (disabled by default)
Error: Cannot find module '@larksuiteoapi/node-sdk'

Suggested fix directions (any one closes the bug)

• (a) Honor the enabled flag earlier — the highest-leverage path. Make both the gateway request handler and the CLI's plugins disable resolve plugins.entries.<id>.enabled BEFORE doing any require() of the extension's api. The config-reload watcher already does this — generalize the pattern. This also fixes the broken plugins disable CLI.
• (b) Mark the SDK optional — move @larksuiteoapi/node-sdk to peerDependenciesMeta.optional = true and gate the import behind a runtime feature check (lazy await import() inside an async setup path that's only called when a feishu channel is actually wired in plugins.entries).
• (c) Ship the dep — drop !dist/extensions/*/node_modules/** from the root files array, OR hoist @larksuiteoapi/node-sdk into the openclaw root dependencies. The bundle.stageRuntimeDependencies: true flag in the feishu manifest already signals intent; honor it in the publish pipeline.

(a) is the most defensive — it makes the host robust to any bundled plugin's missing-dep failure, not just feishu's. (c) is the narrowest fix for this specific plugin.

Notes for upstream

• The bundle.stageRuntimeDependencies: true flag is present in the feishu manifest but appears to be unused by the current publish step. If it is intended to drive the include logic for dist/extensions/<id>/node_modules/, the negation rule in openclaw/package.json files (!dist/extensions/*/node_modules/**) overrides it.
• The same class of bug likely affects any bundled extension with a runtime dep that isn't in openclaw's root dependencies. A scan for other import ... from "<external-pkg>" lines in dist/extensions/*/ would surface peers.