npm ci fails: package-lock.json missing after the agent deleted it - how to fix

TL;DR

npm ci refuses to run without a lockfile; it never resolves versions on its own. If the agent deleted package-lock.json, restore it from git or regenerate it with npm install, then verify with npm ci before committing. The lockfile is a build input, so it goes back into version control.

Error

npm ci fails: package-lock.json missing after the agent deleted it  -  how to fix

Steps

1. Check whether the lockfile still exists in git: run git status and git log --oneline -3 -- package-lock.json. Expected output: You see the deletion as an uncommitted change, or the file was never committed.

2. If it was committed, restore it: git checkout HEAD -- package-lock.json. Expected output: The file reappears in the working tree with the last committed content.

3. If it was never committed, regenerate it: rm -rf node_modules then npm install. Expected output: npm writes a fresh package-lock.json; review the resolved versions with git diff or npm ls.

4. Verify the CI path: npm ci. Expected output: The install completes from the lockfile with no network resolution surprises.

5. Commit the lockfile and, if versions shifted during regeneration, note the changes in the PR. Expected output: CI runs npm ci green on the committed lockfile.

When to use

• npm ci fails because package-lock.json is absent from the repo or the working tree
• An agent deleted the lockfile during cleanup and the next CI run broke
• You need to decide between restoring from git and regenerating from scratch

When not to use

• The lockfile exists but is out of sync with package.json; run npm install to refresh it instead of restoring
• npm ci fails on checksum or registry errors with the lockfile present; the file is not the problem
• You want to change resolved versions on purpose; that is a deliberate npm update, not a restore

Variant phrasings

npm ci errors with lockfile not found after cleanup

Covers agents that remove the lockfile as generated clutter and then break the deterministic install.

Restore package-lock.json from git after accidental deletion

For the case where the file was committed before; checkout from HEAD is faster and safer than regenerating.

Regenerate package-lock.json when it was never committed

For repos that relied on floating installs; npm install creates the lockfile, and from then on npm ci is the CI command.

Why it happens

npm ci is deliberately strict: it installs exactly what the lockfile records and deletes node_modules first, so without a lockfile it has nothing deterministic to install from. Agents sometimes delete the file thinking it is a build artifact, or a bad merge drops it. Restoring from git keeps every resolved version identical; regenerating re-resolves everything, which can silently move versions.

Edge cases

• If package.json changed since the lockfile was deleted, restoring the old lockfile then running npm install merges the two; check the diff.
• npm install during regeneration needs registry access; in an offline environment restore from git instead.
• Workspaces need the single root lockfile; do not create per-package lockfiles.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_-3MtKcRPO7AVgS5K3qCPHw