Managed Shopify plugin validators ship without required runtime dependencies

[davetanguay-envision]

What issue are you seeing?

The official shopify@openai-curated managed plugin installs successfully and appears as enabled, but its Liquid and Hydrogen validator scripts cannot run from the clean managed-plugin installation because required npm dependencies are missing.

Environment:

• Codex Desktop on Windows
• Node.js v24.14.0
• Installation command: codex plugin add shopify@openai-curated
• Curated plugin manifest version: 1.3.3
• Shopify skill version: 1.9.1
• Installed snapshot: 2f1a8948

The Liquid validator fails immediately with:

Error [ERR_MODULE_NOT_FOUND]: Cannot find package '@shopify/theme-check-common'

The Hydrogen validator fails immediately with:

Error [ERR_MODULE_NOT_FOUND]: Cannot find package 'typescript'

The installed plugin contains the skill scripts and package manifests, but the required dependencies have not been included or installed in the managed plugin cache.

I tested dependency installation only in isolated temporary copies without modifying the managed cache. Installing the Liquid dependencies made its validator work. However, a normal Hydrogen dependency installation failed with an ERESOLVE conflict between @shopify/hydrogen@2026.1.3 and the pinned @react-router/dev version.

Forcing the Hydrogen installation with --legacy-peer-deps made the script execute, but it still did not recognize the core Hydrogen Money component as something it could validate.

This means the official managed plugin is installed and enabled, but important executable helpers included with its Liquid and Hydrogen skills are not usable from a clean installation.

What steps can reproduce the bug?

1. On Windows with Node.js installed, open PowerShell.

2. Install the official curated Shopify plugin:

   codex plugin add shopify@openai-curated

3. Confirm that the plugin is installed and enabled:

   codex plugin list

4. Define the installed plugin path:

   $pluginRoot = "$env:USERPROFILE\.codex\plugins\cache\openai-curated\shopify\2f1a8948"

5. Optionally disable validator instrumentation for the current PowerShell process:

   $env:OPT_OUT_INSTRUMENTATION = "true"

6. Run the Liquid validator script:

   node "$pluginRoot\skills\shopify-liquid\scripts\validate.mjs" --help

7. Observe that it exits with an ERR_MODULE_NOT_FOUND error for @shopify/theme-check-common.

8. Run the Hydrogen validator script:

   node "$pluginRoot\skills\shopify-hydrogen\scripts\validate.mjs" --help

9. Observe that it exits with an ERR_MODULE_NOT_FOUND error for typescript.

These failures occur immediately after a clean managed-plugin installation without making any changes to the plugin cache.

What is the expected behavior?

No response

Additional information

No response

[Itsollieyall]

Independent confirmation on macOS:

• Codex CLI: 0.154.0-alpha.6.2
• Curated plugin: shopify@openai-curated-remote, version 4.0.1
• Failing validator: ~/.codex/plugins/cache/openai-curated-remote/shopify/4.0.1/skills/shopify-liquid/scripts/validate.mjs

On a clean managed-plugin cache, running the Liquid validator failed before processing a Liquid file with:

Error [ERR_MODULE_NOT_FOUND]: Cannot find package '@shopify/theme-check-common' imported from ~/.codex/plugins/cache/openai-curated-remote/shopify/4.0.1/skills/shopify-liquid/scripts/validate.mjs

skills/shopify-liquid/package.json declares these runtime dependencies, but they were not present in the managed cache:

• @shopify/theme-check-common@3.24.0
• @shopify/theme-check-docs-updater@3.24.0
• @shopify/theme-check-node@3.24.0

Installing the declared production dependencies in the skills/shopify-liquid directory made the validator run successfully. This is only a temporary workaround because a managed plugin refresh can replace the cache. No user project or theme code was involved in reproducing the failure.