Issue: Bundled import "json5" fails strict ESM resolution; staging clobbers any local patches

Summary

OpenClaw 2026.4.29 bundled output uses bare-specifier import "json5" from ESM context. [email protected] (current latest) has no "exports" field in its package.json, so modern Node's strict ESM resolution rejects the bare specifier with:

Error [ERR_MODULE_NOT_FOUND]: Cannot find package 'json5' imported from
  /home/johnny/.openclaw/plugin-runtime-deps/openclaw-2026.4.29-<hash>/dist/frontmatter-Cc-V8aI2.js
Did you mean to import "json5/lib/index.js"?

This blocks the Telegram channel from starting on a fresh OpenClaw 4.29 install. The Telegram channel loader transitively imports frontmatter-Cc-V8aI2.js which uses bare import JSON5 from "json5".

Reproduction

1. Install OpenClaw 4.29 globally via pnpm
2. Configure a Telegram channel
3. Start the gateway
4. Watch journal: Telegram channel exits at startup with Cannot find package 'json5'
5. Auto-restart loop triggers but never recovers (same error every retry)

Affected files

15 files in dist/ use bare-specifier import "json5":

dist/register.setup-C0hIbv0J.js
dist/bundle-manifest-CcRc3pxB.js
dist/parse-json-compat-g9wpnFYm.js
dist/redact-vz8FmIJK.js
dist/frontmatter-Cc-V8aI2.js              ← Telegram-blocking path
dist/includes-scan-B8MfjWj8.js
dist/state-migrations-CbUcO0eO.js
dist/status.gather-CF0k_g9-.js
dist/facade-activation-check.runtime.js
dist/redact-snapshot-yy2L2LOA.js
dist/config-cli-CJmqioRD.js
dist/includes-hF8-lKny.js
dist/io-DaEsZ_NY.js
dist/exec-approvals-cli-CWPtNC6Z.js
plugin-sdk/src/config/io.d.ts

Why local patches don't help

Adding an "exports" field to the staged node_modules/json5/package.json works while it's there:

$ cd plugin-runtime-deps/openclaw-2026.4.29-<hash>/dist && \
  node --input-type=module -e 'import("json5").then(m => console.log("OK"))'
OK

But every gateway restart triggers [plugins] staging bundled runtime deps before gateway startup, which deletes node_modules/json5/ and reinstalls fresh from npm, clobbering the patch. So the issue cannot be worked around at the install layer.

Proposed fixes (in order of preference)

A. Stop bare-importing packages without exports fields

Change the bundled output to use explicit subpath imports for json5:

- import JSON5 from "json5";
+ import JSON5 from "json5/lib/index.js";

This works regardless of the package's exports field state. Same fix for the other 14 bundle files. Likely the bundler config (rollup/esbuild?) needs external: ["json5/lib/index.js"] or equivalent.

B. Run patch-package (or equivalent) post-stage

Have the plugin-staging step run a post-install patch that adds an "exports" field to known-bare-import-incompatible packages. Centralized. Survives staging cycles.

C. Track which deps need this in package.json

If openclaw bundler controls the package.json written for the runtime-deps install, set overrides for json5 (and similar packages) to a fork that includes the exports field.

Won't work

Pinning to an older json5 — version 1.x doesn't have exports either, and the underlying bug is the bare-import + missing-exports combination, not version-specific.

Environment

• OpenClaw: 2026.4.29 (a448042)
• Install: pnpm global at ~/.local/share/pnpm/global/5/.pnpm/[email protected].../node_modules/openclaw/
• Node: 22.22.0
• OS: Linux 6.8.0-110-generic (Ubuntu)
• VPS provider: Hostinger
• Telegram channel: @kansologic_v2bot, dmPolicy=pairing, groupPolicy=allowlist
• Discord channel: temporarily disabled to break unrelated CPU death-spiral
• json5 package version: 2.2.3 (current latest on npm)

Severity

High for users running with Telegram channel enabled on a fresh 4.29 install. Bot fails to start; auto-restart loop never recovers without upstream fix or persistent local patch (which gets clobbered on every gateway restart).

Related observations during diagnosis

• [plugins] document-extract, runway, tts-local-cli, acpx, memory-core all stage the same 46-spec dep tree on each gateway start. Repeated work / churn.
• JSON5: '
' in strings is not valid ECMAScript; consider escaping warnings appear at startup — possibly an unrelated issue with internal JSON5 parsing of ~/.openclaw/openclaw.json itself.