openclaw - 💡(How to fix) Fix Race condition: bundled runtime dep json5 missing when Telegram providers start [2 comments, 2 participants]

Bug Description

When OpenClaw gateway starts, multiple plugins stage and install their bundled runtime dependencies in parallel. A race condition can cause one plugin (e.g. memory-core, which is smaller and finishes faster) to write its node_modules manifest first, and another plugin (e.g. telegram) to then incorrectly reuse that partial install — skipping packages that it declared but that hadn't been installed yet.

The visible result is that all Telegram providers (seery, hacker, researcher, trader, shuri) immediately crash with:

Cannot find package 'json5' imported from .../dist/frontmatter-Cc-V8aI2.js
Did you mean to import "json5/lib/index.js"?

This is NOT a missing package in the OpenClaw bundle — json5 is correctly declared and staged. The issue is that the staging/materialization logic does not properly isolate between plugins running in parallel, causing one plugin to observe another's incomplete node_modules.

Environment

• OpenClaw: 2026.4.29
• Runtime deps path: ~/.openclaw/plugin-runtime-deps/openclaw-2026.4.29-9172097018db/
• macOS LaunchAgent managed gateway
• Node.js 24.13.0

Steps to Reproduce

1. Stop the gateway
2. Delete the runtime deps: rm -rf ~/.openclaw/plugin-runtime-deps/openclaw-2026.4.29-9172097018db/
3. Start the gateway
4. Observe: journalctl -f (or tail /tmp/openclaw/openclaw-YYYY-MM-DD.log) shows providers immediately exiting and entering the auto-restart loop with the json5 error above.

What's Happening (Timeline)

1. Gateway starts → plugins initialize in parallel
2. memory-core finishes first (small deps), writes its node_modules manifest
3. telegram plugin starts staging, sees existing node_modules from memory-core, skips re-installing
4. Telegram providers launch with incomplete node_modules (missing json5)
5. All bots crash at ~09:09:29
6. Auto-restart loop forces reinstall of 45 specs
7. By ~09:12, everything self-heals

Suggested Fixes

1. Add post-install validation: After staging completes, assert that all logged/counted packages are actually present in node_modules before marking the install done and allowing provider startup.
2. Per-plugin staging isolation: Each plugin should stage into its own subdirectory and only atomically swap into the shared location after the install is fully complete.
3. Staging-then-swapping: Stage to a temp location, then atomic-move into plugin-runtime-deps/<hash>/ so concurrent plugins never observe a partial install.
4. Add json5 to critical deps check: As a hotfix, any package listed in openclaw.bundle.mirroredRootRuntimeDependencies should be explicitly checked before provider startup.

Workaround

A pre-flight script can be run before gateway starts to ensure critical packages are present:

#!/usr/bin/env bash
RUNTIME_DEPS_BASE="$HOME/.openclaw/plugin-runtime-deps"
TARGET_DIR="$RUNTIME_DEPS_BASE/openclaw-2026.4.29-9172097018db"
cd "$TARGET_DIR"
for pkg in json5; do
  if [ ! -d "node_modules/$pkg" ]; then
    npm install --save "$pkg"
  fi
done

Logs

See attached: openclaw-telegram-json5-runtime-issue---a3e2572a-8fc1-4e9e-ac8e-1936c7f15bf4.md

Full timeline from log:

• 09:09:03 — memory-core installs 32 specs in 33ms
• 09:09:29 — all 5 Telegram providers crash with json5 error
• 09:09:35 — auto-restart attempt 2/10
• 09:09:55 — gateway forces reinstall of 45 specs
• 09:12:47 — bots restart and send messages successfully