shopify-liquid skill validate.mjs fails because package-lock.json resolves to private npm.shopify.io registry

[MikeNewXYZ]

Summary

validate.mjs can't run because required @shopify/theme-check-* dependencies are missing at runtime, and npm install fails because package-lock.json resolves those packages to Shopify's private registry.

Steps to reproduce

1. Install plugin via Claude Code marketplace
2. Trigger the shopify-liquid skill
3. Skill runs validate.mjs, which fails

What it looks like in Claude Code

The skill instructs the AI to validate every code block via validate.mjs. This is what happens:

⏺ Bash(cd skills/shopify-liquid && node scripts/validate.mjs --filename test.liquid --filetype sections --code '...')
  ⎿  Exit code 1
     Error [ERR_MODULE_NOT_FOUND]: Cannot find package '@shopify/theme-check-common'

The AI then tries npm install to fix it, which also fails, creating a loop of broken validation attempts.

Actual behavior

$ node scripts/validate.mjs --filename test.liquid --filetype sections --code '<div>test</div>'

Error [ERR_MODULE_NOT_FOUND]: Cannot find package '@shopify/theme-check-common'
    imported from skills/shopify-liquid/scripts/validate.mjs

npm install also fails:

$ cd skills/shopify-liquid && npm install

npm error code E401
npm error Incorrect or missing password.

package-lock.json points all @shopify/* packages to the private registry:

@shopify/theme-check-node@https://npm.shopify.io/node/...
@shopify/theme-check-common@https://npm.shopify.io/node/...
@shopify/liquid-html-parser@https://npm.shopify.io/node/...
@shopify/theme-check-docs-updater@https://npm.shopify.io/node/...

[davetanguay-envision]

I can reproduce the missing dependency problem with the official Shopify plugin for Codex.

Environment:

• Codex Desktop on Windows
• Node.js v24.14.0
• Installed with: codex plugin add shopify@openai-curated
• Curated plugin manifest version: 1.3.3
• Shopify skill version: 1.9.1
• Managed snapshot: 2f1a8948

Running the Liquid validator from the clean managed-plugin installation fails with:

Error [ERR_MODULE_NOT_FOUND]: Cannot find package '@shopify/theme-check-common'

The installed skill contains its package.json, but the required runtime packages are not included or hydrated in the managed plugin cache.

I copied only the Liquid skill into an isolated temporary directory and ran:

npm install --ignore-scripts --no-audit --no-fund --registry=https://registry.npmjs.org

That installed 34 packages, after which the same minimal Liquid validation passed. I did not modify the managed plugin cache.

This confirms that the current Codex failure is caused by the published skill not being self-contained. Codex installs the plugin files but does not automatically install each skill’s npm dependencies.

Could the Liquid validator dependencies be bundled or vendored with the published plugin so scripts/validate.mjs works immediately after installing the managed plugin? A managed, auto-updating plugin should not require users or agents to modify its versioned cache manually.

[thewholedonuts-beep]

Fix until running