npx lazycodex-ai@4.19.0 install fails: npm ci EUSAGE (package.json/package-lock out of sync after local file-dependency rewrite)

[innopoiesis]

Environment

• Windows 11 Pro (10.0.26200), Node v24.13.1, npm 11.12.1
• lazycodex-ai@4.19.0 via npx --yes lazycodex-ai@4.19.0 install --no-tui
• Codex CLI 0.144.1, CODEX_HOME pointing at a custom home (also reproduces with default)

Symptom

Install aborts every time (reproduced twice, fresh tmp dir each run):

npm error code EUSAGE
npm error `npm ci` can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync. Please update your lock file with `npm install` before continuing.
npm ci --omit=dev failed in <CODEX_HOME>\plugins\cache\sisyphuslabs\omo\.tmp-4.19.0-<pid>-<ts> with exit code 1

Root cause (from reading the published package)

In packages/omo-codex/src/install/codex-cache-install.ts (compiled: scripts/install-dist/install-local.mjs, ~L7520-7554), installCachedPlugin:

1. copies the plugin payload to a temp sibling dir,
2. calls rewriteCachedPackageLocalFileDependencies(tempPath, sourcePath) — this rewrites package.json (local file: dependency specifiers),
3. then runs npm ci --omit=dev in the temp dir.

After step 2 the package.json no longer matches the shipped package-lock.json, so npm ci (strict since npm 7+, and stricter messaging in npm 11) exits with EUSAGE before installing anything. The tmp dir is removed on error, so the failure repeats on every attempt.

Suggested fixes (any one)

• Run npm install --omit=dev --no-audit --no-fund instead of npm ci when the rewrite changed package.json, or
• regenerate the lock (npm install --package-lock-only) after the rewrite before npm ci, or
• perform the rewrite in a way that also patches package-lock.json.

Workaround that worked for us

Installing via the Codex plugin marketplace path (codex plugin add omo@...) from a git snapshot succeeds and the plugin loads fine (all omo:* skills visible in codex exec), so only the npx bootstrap path is affected.

[innopoiesis]

Follow-up with a verified root cause + fix PR: code-yeongyu/oh-my-openagent#6202

Root cause turned out to be two combined defects (confirmed by snapshotting the live failing .tmp before the installer deletes it):

1. packages/lsp-core/package.json is missing from the npm files list (the dev branch already ships packages/lsp-core/src, but npm's files globs don't auto-include a subpackage manifest), so the rewritten file: target for components/lsp → @oh-my-opencode/lsp-core has no readable manifest in the published tarball.
2. After rewriteCachedPackageLocalFileDependencies mutates the manifests to absolute source paths, the hand-moved lock keys don't match what npm computes (Missing: @oh-my-opencode/shared-skills@0.1.0 from lock file, etc.), so npm ci aborts with EUSAGE.

With both fixes applied to the published 4.19.0 payload, npx lazycodex-ai@4.19.0 install --no-tui completes end-to-end on the previously failing machine (Windows 11 / npm 11.12.1 / Node 24).