@bobfrankston/npmglobalize 1.0.174 → 1.0.176

package/cli.js

@@ -446,7 +446,7 @@ export async function main() {
     // Ensures consumers' tsc sees up-to-date `.d.ts` from sibling checkouts
     // whose source has changed since their last build.
     if (!cliOptions.cleanup) {
-        ensureFileDepModules(cwd, !!cliOptions.verbose);
+        await ensureFileDepModules(cwd, !!cliOptions.verbose);
         const depsOk = await buildFileDepsTopologically(cwd, { verbose: !!cliOptions.verbose, force: !!cliOptions.force });
         if (!depsOk && !cliOptions.force) {
             printBuildSummary();

package/lib.d.ts

@@ -293,7 +293,7 @@ export declare function missingDeps(pkgDir: string, pkg: any): string[];
  *  "fresh clone, no `node_modules/`" and "dep added but `npm install` not
  *  re-run" (partial-sync) cases. Also covers `cwd` itself on the first call.
  *  Cycle-safe via the shared `visited` set. */
-export declare function ensureFileDepModules(cwd: string, verbose?: boolean, visited?: Set<string>): void;
+export declare function ensureFileDepModules(cwd: string, verbose?: boolean, visited?: Set<string>): Promise<void>;
 /** Build a single project: detect tsconfig, prompt to add `build: tsc` if a
  *  TypeScript project lacks a build script, run `npm run build`, record
  *  failures. Returns true if build succeeded (or was skipped because no
@@ -319,7 +319,7 @@ export declare function buildFileDepsTopologically(cwd: string, opts?: {
 export declare function ensureWorkspaceDepModules(rootDir: string, members: Array<{
     dir: string;
     pkg: any;
-}>, verbose?: boolean): void;
+}>, verbose?: boolean): Promise<void>;
 /** Run a command and return success status */
 export declare function runCommand(cmd: string, args: string[], options?: {
     silent?: boolean;
@@ -331,15 +331,31 @@ export declare function runCommand(cmd: string, args: string[], options?: {
     output: string;
     stderr: string;
 };
+/** Async variant of `runCommand`: spawns the child via `child_process.spawn`
+ *  (not spawnSync) so the JS event loop keeps turning. Used for long-running
+ *  commands (npm install/pack/publish/build, git push/pull, gh, wsl) so that
+ *  a SIGINT pressed mid-command can fire its handler immediately, kill the
+ *  child, restore deps, and exit — instead of being queued behind spawnSync. */
+export declare function runCommandAsync(cmd: string, args: string[], options?: {
+    silent?: boolean;
+    verbose?: boolean;
+    showCommand?: boolean;
+    cwd?: string;
+}): Promise<{
+    success: boolean;
+    output: string;
+    stderr: string;
+    signal: NodeJS.Signals | null;
+}>;
 /** Install a package globally in WSL, auto-fixing the root-owned /usr/local/lib/node_modules
  *  EACCES case by switching npm to a user prefix (~/.npm-global) and retrying once.
  *  Output is captured (so we can scan for the error) and then mirrored to the terminal. */
 export declare function installInWsl(wslArgs: string[], opts?: {
     cwd?: string;
-}): {
+}): Promise<{
     success: boolean;
     fixed: boolean;
-};
+}>;
 /** Run a command and throw on failure */
 export declare function runCommandOrThrow(cmd: string, args: string[], options?: {
     silent?: boolean;
@@ -370,11 +386,11 @@ export declare function promptChoice(message: string, choices: string[]): Promis
 export declare function initGit(cwd: string, visibility: 'private' | 'public', dryRun: boolean, allowTs?: boolean): Promise<boolean>;
 /** Main globalize function */
 /** Run npm audit and optionally fix vulnerabilities */
-export declare function runNpmAudit(cwd: string, fix?: boolean, verbose?: boolean): {
+export declare function runNpmAudit(cwd: string, fix?: boolean, verbose?: boolean): Promise<{
     success: boolean;
     report: string;
     hasVulnerabilities: boolean;
-};
+}>;
 /** Get the version of npmglobalize itself */
 export declare function getToolVersion(): string;
 export declare function globalize(cwd: string, options?: GlobalizeOptions, configOptions?: Partial<GlobalizeOptions>): Promise<boolean>;

package/lib.js

@@ -12,7 +12,7 @@
 import fs from 'fs';
 import os from 'os';
 import path from 'path';
-import { execSync, spawnSync } from 'child_process';
+import { execSync, spawn, spawnSync } from 'child_process';
 import { readConfig as readUserConfig, writeConfig as writeUserConfig, configDir } from '@bobfrankston/userconfig';
 import { freezeDependencies } from '@bobfrankston/freezepak';
 import { importgen as runImportgen } from '@bobfrankston/importgen';
@@ -403,6 +403,29 @@ function emergencyRestoreDeps() {
     }
     dirtyPackageJsons.clear();
 }
+/** Children spawned by `runCommandAsync`. The SIGINT handler iterates and kills
+ *  these on abort so `npm` / `git` don't keep running and so cmd.exe doesn't
+ *  prompt "Terminate batch job (Y/N)?" after we exit. */
+const activeChildren = new Set();
+/** Force-terminate a child process (and on Windows, its whole tree, since
+ *  npm.cmd / gh.cmd are batch files that spawn node and won't be killed by a
+ *  bare child.kill). */
+function killChildTree(child) {
+    if (!child.pid || child.exitCode !== null || child.signalCode !== null)
+        return;
+    if (process.platform === 'win32') {
+        try {
+            spawnSync('taskkill', ['/T', '/F', '/PID', String(child.pid)], { stdio: 'ignore' });
+        }
+        catch { /* best-effort */ }
+    }
+    else {
+        try {
+            child.kill('SIGTERM');
+        }
+        catch { /* best-effort */ }
+    }
+}
 let cleanupHandlersInstalled = false;
 /** Install signal/exit handlers that restore `.dependencies` backups on abnormal exit. */
 export function installCleanupHandlers() {
@@ -421,6 +444,11 @@ export function installCleanupHandlers() {
         }
         aborting = true;
         console.error(colors.yellow(`\n${signal} received — aborting, restoring file: dependencies...`));
+        // Kill any in-flight child process (npm/git/etc.) so it stops promptly
+        // and Windows cmd.exe doesn't ask "Terminate batch job (Y/N)?".
+        for (const child of activeChildren)
+            killChildTree(child);
+        activeChildren.clear();
         emergencyRestoreDeps();
         process.exit(128 + (signal === 'SIGINT' ? 2 : signal === 'SIGTERM' ? 15 : 1));
     };
@@ -661,7 +689,7 @@ export async function cascadePublicVisibility(cwd, opts = {}) {
                             const access = checkNpmAccess(targetName);
                             if (access === 'restricted') {
                                 if (!dryRun) {
-                                    const r = runCommand('npm', ['access', 'set', 'status=public', targetName], { cwd: targetPath, silent: true });
+                                    const r = await runCommandAsync('npm', ['access', 'set', 'status=public', targetName], { cwd: targetPath, silent: true });
                                     if (r.success) {
                                         promoted.push(targetName);
                                         console.log(colors.green(`  ✓ Flipped ${targetName} to PUBLIC on npm`));
@@ -1624,7 +1652,7 @@ function formatMissingReason(missing) {
  *  "fresh clone, no `node_modules/`" and "dep added but `npm install` not
  *  re-run" (partial-sync) cases. Also covers `cwd` itself on the first call.
  *  Cycle-safe via the shared `visited` set. */
-export function ensureFileDepModules(cwd, verbose = false, visited = new Set()) {
+export async function ensureFileDepModules(cwd, verbose = false, visited = new Set()) {
     const abs = path.resolve(cwd);
     if (visited.has(abs))
         return;
@@ -1651,7 +1679,7 @@ export function ensureFileDepModules(cwd, verbose = false, visited = new Set())
             catch { /* best-effort */ }
         }
         console.log(colors.yellow(`↻ installing node_modules in ${pkg?.name || abs} (${formatMissingReason(cwdMissing)})`));
-        const r = runCommand('npm', ['install'], { cwd: abs, silent: !verbose });
+        const r = await runCommandAsync('npm', ['install'], { cwd: abs, silent: !verbose });
         if (!r.success) {
             console.error(colors.red(`  ✗ npm install failed in ${abs}`));
             if (r.stderr)
@@ -1688,14 +1716,14 @@ export function ensureFileDepModules(cwd, verbose = false, visited = new Set())
                     catch { /* best-effort */ }
                 }
                 console.log(colors.yellow(`↻ restoring node_modules in ${name} (${target}) (${formatMissingReason(targetMissing)})`));
-                const r = runCommand('npm', ['install'], { cwd: target, silent: !verbose });
+                const r = await runCommandAsync('npm', ['install'], { cwd: target, silent: !verbose });
                 if (!r.success) {
                     console.error(colors.red(`  ✗ npm install failed in ${target}`));
                     if (r.stderr)
                         console.error(colors.dim(r.stderr.split('\n').slice(0, 5).join('\n')));
                 }
             }
-            ensureFileDepModules(target, verbose, visited);
+            await ensureFileDepModules(target, verbose, visited);
         }
     }
 }
@@ -1732,7 +1760,7 @@ export async function buildProject(cwd, opts = {}) {
         }
     }
     console.log(`Building ${pkg.name || cwd}...`);
-    const buildResult = runCommand('npm', ['run', 'build'], { cwd, silent: true });
+    const buildResult = await runCommandAsync('npm', ['run', 'build'], { cwd, silent: true });
     if (buildResult.success) {
         console.log(colors.green(`✓ Build succeeded (${pkg.name || path.basename(cwd)})`));
         return true;
@@ -1796,7 +1824,7 @@ export async function buildFileDepsTopologically(cwd, opts = {}, visited = new S
  *  member `package.json` without a follow-up `npm install` at the root leaves
  *  the root `node_modules/` stale — the case where `member/` dirs exist but
  *  the actual package (e.g. `marked`) is not hoisted. */
-export function ensureWorkspaceDepModules(rootDir, members, verbose = false) {
+export async function ensureWorkspaceDepModules(rootDir, members, verbose = false) {
     const root = path.resolve(rootDir);
     let rootPkg;
     try {
@@ -1816,7 +1844,7 @@ export function ensureWorkspaceDepModules(rootDir, members, verbose = false) {
         return;
     const list = [...allMissing];
     console.log(colors.yellow(`↻ installing workspace node_modules in ${rootPkg?.name || path.basename(root)} (${formatMissingReason(list)})`));
-    const r = runCommand('npm', ['install'], { cwd: root, silent: !verbose });
+    const r = await runCommandAsync('npm', ['install'], { cwd: root, silent: !verbose });
     if (!r.success) {
         console.error(colors.red(`  ✗ npm install failed in ${root}`));
         if (r.stderr)
@@ -1827,14 +1855,14 @@ export function ensureWorkspaceDepModules(rootDir, members, verbose = false) {
  *  Brand-new packages (first-time publish) take much longer to become
  *  installable than version bumps, so we use longer waits and more
  *  attempts when `isNewPackage` is true. */
-function installGlobalWithRetry(pkgSpec, cwd, isNewPackage = false, maxRetries) {
+async function installGlobalWithRetry(pkgSpec, cwd, isNewPackage = false, maxRetries) {
     const retries = maxRetries ?? (isNewPackage ? 6 : 3);
     const delaySec = isNewPackage ? 30 : 10;
-    let result = runCommand('npm', ['install', '-g', pkgSpec], { cwd, silent: false, showCommand: true });
+    let result = await runCommandAsync('npm', ['install', '-g', pkgSpec], { cwd, silent: false, showCommand: true });
     for (let attempt = 1; attempt < retries && !result.success; attempt++) {
         console.log(colors.yellow(`  Retrying install (attempt ${attempt + 1}/${retries}) in ${delaySec} seconds...`));
         sleepSync(delaySec * 1000);
-        result = runCommand('npm', ['install', '-g', pkgSpec], { cwd, silent: false, showCommand: true });
+        result = await runCommandAsync('npm', ['install', '-g', pkgSpec], { cwd, silent: false, showCommand: true });
     }
     return result;
 }
@@ -1876,6 +1904,58 @@ export function runCommand(cmd, args, options = {}) {
         return { success: false, output: '', stderr: error.message };
     }
 }
+/** Async variant of `runCommand`: spawns the child via `child_process.spawn`
+ *  (not spawnSync) so the JS event loop keeps turning. Used for long-running
+ *  commands (npm install/pack/publish/build, git push/pull, gh, wsl) so that
+ *  a SIGINT pressed mid-command can fire its handler immediately, kill the
+ *  child, restore deps, and exit — instead of being queued behind spawnSync. */
+export function runCommandAsync(cmd, args, options = {}) {
+    const { silent = false, verbose = false, showCommand = false, cwd } = options;
+    const needsShell = cmd === 'npm' || cmd === 'npm.cmd' || cmd === 'gh';
+    if (!silent && (showCommand || verbose)) {
+        console.log(colors.cyan(`> ${cmd} ${args.join(' ')}`));
+    }
+    return new Promise((resolve) => {
+        let child;
+        try {
+            const spawnOpts = {
+                stdio: silent ? 'pipe' : 'inherit',
+                cwd,
+                env: process.env,
+                shell: needsShell,
+            };
+            // Match spawnSafe's quoting when shell:true to avoid DEP0190
+            if (needsShell && args.length > 0) {
+                const cmdStr = [cmd, ...args].map(a => /[\s"&|<>^]/.test(a) ? `"${a.replace(/"/g, '\\"')}"` : a).join(' ');
+                child = spawn(cmdStr, spawnOpts);
+            }
+            else {
+                child = spawn(cmd, args, spawnOpts);
+            }
+        }
+        catch (err) {
+            resolve({ success: false, output: '', stderr: err.message, signal: null });
+            return;
+        }
+        activeChildren.add(child);
+        let stdout = '';
+        let stderr = '';
+        if (silent) {
+            child.stdout?.setEncoding('utf-8');
+            child.stderr?.setEncoding('utf-8');
+            child.stdout?.on('data', (d) => { stdout += d; });
+            child.stderr?.on('data', (d) => { stderr += d; });
+        }
+        child.on('error', (err) => {
+            activeChildren.delete(child);
+            resolve({ success: false, output: stdout, stderr: stderr || err.message, signal: null });
+        });
+        child.on('close', (code, signal) => {
+            activeChildren.delete(child);
+            resolve({ success: code === 0, output: stdout, stderr, signal });
+        });
+    });
+}
 /** Dump forensic info to a temp file when `npm pack` is killed by a spurious
  *  Ctrl+C. Goal: correlate the failure with whatever else was attached to the
  *  console (Claude Code wrapper, VS Code task, AV, etc.). Returns the log path. */
@@ -1918,9 +1998,9 @@ function dumpPackCtrlcDiagnostics(pkg, cwd, packOutput, packStderr) {
 /** Install a package globally in WSL, auto-fixing the root-owned /usr/local/lib/node_modules
  *  EACCES case by switching npm to a user prefix (~/.npm-global) and retrying once.
  *  Output is captured (so we can scan for the error) and then mirrored to the terminal. */
-export function installInWsl(wslArgs, opts = {}) {
+export async function installInWsl(wslArgs, opts = {}) {
     console.log(colors.cyan(`> wsl ${wslArgs.join(' ')}`));
-    let result = runCommand('wsl', wslArgs, { cwd: opts.cwd, silent: true });
+    let result = await runCommandAsync('wsl', wslArgs, { cwd: opts.cwd, silent: true });
     if (result.output)
         process.stdout.write(result.output);
     if (result.stderr)
@@ -1933,7 +2013,7 @@ export function installInWsl(wslArgs, opts = {}) {
         return { success: false, fixed: false };
     console.log(colors.yellow('Detected root-owned npm prefix in WSL — switching to ~/.npm-global and retrying...'));
     const fix = `set -e; npm config set prefix "$HOME/.npm-global"; mkdir -p "$HOME/.npm-global/bin"; if ! grep -q '\\.npm-global/bin' "$HOME/.bashrc" 2>/dev/null; then printf '\\n# npm user-prefix bin (added by npmglobalize)\\nexport PATH="$HOME/.npm-global/bin:$PATH"\\n' >> "$HOME/.bashrc"; fi`;
-    const fixResult = runCommand('wsl', ['bash', '-lc', fix], { silent: true });
+    const fixResult = await runCommandAsync('wsl', ['bash', '-lc', fix], { silent: true });
     if (!fixResult.success) {
         console.error(colors.red('Failed to apply WSL npm prefix fix:'));
         if (fixResult.stderr)
@@ -1942,7 +2022,7 @@ export function installInWsl(wslArgs, opts = {}) {
     }
     console.log(colors.green('✓ WSL npm prefix set to ~/.npm-global; PATH appended to ~/.bashrc'));
     console.log(colors.cyan(`> wsl ${wslArgs.join(' ')}`));
-    result = runCommand('wsl', wslArgs, { cwd: opts.cwd, silent: true });
+    result = await runCommandAsync('wsl', wslArgs, { cwd: opts.cwd, silent: true });
     if (result.output)
         process.stdout.write(result.output);
     if (result.stderr)
@@ -2547,11 +2627,11 @@ function parsePushProtection(errorOutput, cwd) {
 }
 /** Try to auto-bypass push protection for installed OAuth secrets via gh API.
  *  Returns true if all bypasses succeeded and push should be retried. */
-function tryAutoBypassPushProtection(ppInfo, cwd) {
+async function tryAutoBypassPushProtection(ppInfo, cwd) {
     if (!ppInfo.allInstalledOAuth || ppInfo.secrets.length === 0)
         return false;
     // Check if gh CLI is available
-    const ghCheck = runCommand('gh', ['auth', 'status'], { cwd, silent: true });
+    const ghCheck = await runCommandAsync('gh', ['auth', 'status'], { cwd, silent: true });
     if (!ghCheck.success)
         return false;
     // Extract repo owner/name from unblock URLs or git remote
@@ -2581,7 +2661,7 @@ function tryAutoBypassPushProtection(ppInfo, cwd) {
         }
         const placeholderId = idMatch[1];
         console.log(colors.cyan(`  Bypassing push protection for: ${s.type} (false_positive — installed app ID)...`));
-        const bypassResult = runCommand('gh', [
+        const bypassResult = await runCommandAsync('gh', [
             'api', `repos/${repo}/secret-scanning/push-protection-bypasses`,
             '-X', 'POST',
             '-f', 'reason=false_positive',
@@ -2619,8 +2699,8 @@ function showPushProtectionGuidance(ppInfo) {
 }
 /** Push to git with push-protection detection and auto-bypass for installed OAuth.
  *  Returns true if push succeeded (possibly after auto-bypass). */
-function pushWithProtection(cwd, verbose) {
-    let pushResult = runCommand('git', ['push'], { cwd, silent: true });
+async function pushWithProtection(cwd, verbose) {
+    let pushResult = await runCommandAsync('git', ['push'], { cwd, silent: true });
     if (pushResult.success) {
         if (verbose)
             console.log(colors.green('  ✓ Pushed to remote'));
@@ -2641,7 +2721,7 @@ function pushWithProtection(cwd, verbose) {
         // Detect current branch name
         const branchResult = runCommand('git', ['rev-parse', '--abbrev-ref', 'HEAD'], { cwd, silent: true });
         const branch = branchResult.output.trim() || 'master';
-        pushResult = runCommand('git', ['push', '--set-upstream', 'origin', branch], { cwd, silent: true });
+        pushResult = await runCommandAsync('git', ['push', '--set-upstream', 'origin', branch], { cwd, silent: true });
         if (pushResult.success) {
             if (verbose)
                 console.log(colors.green('  ✓ Pushed to remote (set upstream)'));
@@ -2651,7 +2731,7 @@ function pushWithProtection(cwd, verbose) {
     // Transient network errors (HTTP 408, RPC failed, unexpected disconnect) — retry once
     if (/rpc failed|curl \d+|unexpected disconnect|hung up unexpectedly/i.test(pushResult.stderr)) {
         console.log(colors.yellow('Git push failed with transient error — retrying...'));
-        pushResult = runCommand('git', ['push'], { cwd, silent: true });
+        pushResult = await runCommandAsync('git', ['push'], { cwd, silent: true });
         if (pushResult.success) {
             if (verbose)
                 console.log(colors.green('  ✓ Pushed to remote (retry)'));
@@ -2672,9 +2752,9 @@ function pushWithProtection(cwd, verbose) {
         return false;
     }
     // Try auto-bypass for installed OAuth credentials
-    if (ppInfo.allInstalledOAuth && tryAutoBypassPushProtection(ppInfo, cwd)) {
+    if (ppInfo.allInstalledOAuth && await tryAutoBypassPushProtection(ppInfo, cwd)) {
         console.log(colors.green('  ✓ Auto-bypassed push protection (installed OAuth — not a real secret)'));
-        const retryPush = runCommand('git', ['push'], { cwd, silent: true });
+        const retryPush = await runCommandAsync('git', ['push'], { cwd, silent: true });
         if (retryPush.success) {
             if (verbose)
                 console.log(colors.green('  ✓ Pushed to remote'));
@@ -3065,7 +3145,7 @@ export async function initGit(cwd, visibility, dryRun, allowTs) {
     }
     // Create GitHub repo (or link to existing one)
     const visFlag = visibility === 'private' ? '--private' : '--public';
-    const createResult = runCommand('gh', ['repo', 'create', repoName, visFlag, '--source=.', '--push'], { cwd, silent: true });
+    const createResult = await runCommandAsync('gh', ['repo', 'create', repoName, visFlag, '--source=.', '--push'], { cwd, silent: true });
     if (!createResult.success) {
         const errText = createResult.stderr + createResult.output;
         // Check if repo was created but push failed (GitHub propagation delay)
@@ -3098,7 +3178,7 @@ export async function initGit(cwd, visibility, dryRun, allowTs) {
                     console.log(colors.yellow('  Retrying push...'));
                     spawnSafe(process.platform === 'win32' ? 'timeout' : 'sleep', process.platform === 'win32' ? ['\t', '3', '\nobreak'] : ['3'], { stdio: 'pipe' }); // brief delay for GitHub propagation
                 }
-                const pushRes = runCommand('git', ['push', '-u', 'origin', 'master'], { cwd, silent: true });
+                const pushRes = await runCommandAsync('git', ['push', '-u', 'origin', 'master'], { cwd, silent: true });
                 pushed = pushRes.success;
             }
             if (pushed) {
@@ -3130,9 +3210,9 @@ export async function initGit(cwd, visibility, dryRun, allowTs) {
 }
 /** Main globalize function */
 /** Run npm audit and optionally fix vulnerabilities */
-export function runNpmAudit(cwd, fix = false, verbose = false) {
+export async function runNpmAudit(cwd, fix = false, verbose = false) {
     if (fix) {
-        runCommand('npm', ['audit', 'fix'], { cwd, silent: true });
+        await runCommandAsync('npm', ['audit', 'fix'], { cwd, silent: true });
     }
     // Check remaining vulnerabilities
     const auditResult = spawnSafe('npm', ['audit', '--json'], {
@@ -3207,7 +3287,7 @@ async function doLocalInstall(cwd, options) {
             console.log('  [dry-run] Would run: wsl npm install -g .');
         return true;
     }
-    const result = runCommand('npm', ['install', '-g', '.'], { cwd, silent: false, showCommand: true });
+    const result = await runCommandAsync('npm', ['install', '-g', '.'], { cwd, silent: false, showCommand: true });
     if (result.success) {
         console.log(colors.green(`✓ Installed locally: ${pkgName}@${pkgVersion}`));
     }
@@ -3218,7 +3298,7 @@ async function doLocalInstall(cwd, options) {
     }
     if (wsl) {
         console.log(`Installing ${pkgName} in WSL (local)...`);
-        const wslResult = runCommand('wsl', ['npm', 'install', '-g', '.'], { cwd, silent: false, showCommand: true });
+        const wslResult = await runCommandAsync('wsl', ['npm', 'install', '-g', '.'], { cwd, silent: false, showCommand: true });
         if (wslResult.success) {
             console.log(colors.green(`✓ Installed in WSL: ${pkgName}@${pkgVersion}`));
         }
@@ -3323,7 +3403,7 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
                 console.log('  [dry-run] Would run: wsl npm install -g .');
             return true;
         }
-        const result = runCommand('npm', ['install', '-g', '.'], { cwd, silent: false, showCommand: true });
+        const result = await runCommandAsync('npm', ['install', '-g', '.'], { cwd, silent: false, showCommand: true });
         if (result.success) {
             console.log(colors.green(`✓ Installed locally: ${pkgName}@${pkgVersion}`));
         }
@@ -3541,7 +3621,7 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
         }
         else {
             console.log(`Changing GitHub repo visibility to ${targetVis}...`);
-            const visResult = runCommand('gh', ['repo', 'edit', '--visibility', targetVis, '--accept-visibility-change-consequences'], { cwd, silent: true });
+            const visResult = await runCommandAsync('gh', ['repo', 'edit', '--visibility', targetVis, '--accept-visibility-change-consequences'], { cwd, silent: true });
             if (visResult.success) {
                 console.log(colors.green(`✓ GitHub repo is now ${targetVis.toUpperCase()}`));
             }
@@ -3625,7 +3705,7 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
         console.log(colors.yellow('Local branch is behind remote.'));
         if (rebase) {
             console.log('Rebasing local changes (--rebase)...');
-            const rebaseResult = runCommand('git', ['pull', '--rebase', 'origin', currentGitStatus.currentBranch], { cwd, silent: false });
+            const rebaseResult = await runCommandAsync('git', ['pull', '--rebase', 'origin', currentGitStatus.currentBranch], { cwd, silent: false });
             if (!rebaseResult.success) {
                 console.error(colors.red('ERROR: Rebase failed.'));
                 console.error('You may need to resolve conflicts manually.');
@@ -3659,7 +3739,7 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
     // with new declared deps still needs its own `npm install` even if it has
     // no build step. CLI entrypoint already ran this, so skip when _fromCli.
     if (!options._fromCli && !dryRun)
-        ensureFileDepModules(cwd, verbose);
+        await ensureFileDepModules(cwd, verbose);
     // Run build step if package.json has a build script (skip if CLI already built)
     if (pkg.scripts?.build && !options._fromCli) {
         console.log(`${timestamp()} Running build...`);
@@ -3670,7 +3750,7 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
             const restoreWorkspaces = reorderWorkspacesForBuild(cwd, pkg, verbose);
             try {
                 // Always capture output so we can extract tsc errors for the summary
-                const buildResult = runCommand('npm', ['run', 'build'], { cwd, silent: true });
+                const buildResult = await runCommandAsync('npm', ['run', 'build'], { cwd, silent: true });
                 if (!buildResult.success) {
                     const buildOutput = buildResult.stderr || buildResult.output;
                     if (buildOutput)
@@ -3837,7 +3917,7 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
         if (currentAccess === 'public') {
             console.log(colors.yellow(`Package '${pkg.name}' is currently PUBLIC on npm. Converting to private...`));
             if (!dryRun) {
-                const accessResult = runCommand('npm', ['access', 'set', 'status=restricted', pkg.name], { cwd, silent: false });
+                const accessResult = await runCommandAsync('npm', ['access', 'set', 'status=restricted', pkg.name], { cwd, silent: false });
                 if (accessResult.success) {
                     console.log(colors.green(`✓ Changed ${pkg.name} to PRIVATE on npm`));
                     currentAccess = 'restricted';
@@ -3860,7 +3940,7 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
         if (currentAccess === 'restricted') {
             console.log(colors.yellow(`Package '${pkg.name}' is currently PRIVATE on npm. Converting to public...`));
             if (!dryRun) {
-                const accessResult = runCommand('npm', ['access', 'set', 'status=public', pkg.name], { cwd, silent: false });
+                const accessResult = await runCommandAsync('npm', ['access', 'set', 'status=public', pkg.name], { cwd, silent: false });
                 if (accessResult.success) {
                     console.log(colors.green(`✓ Changed ${pkg.name} to PUBLIC on npm`));
                     currentAccess = 'public';
@@ -4278,7 +4358,7 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
     // Run npm audit if requested or if dependencies were transformed
     if ((fix || updateDeps) && (transformResult.transformed || alreadyTransformed || updateDeps)) {
         if (!dryRun) {
-            runNpmAudit(cwd, fix, verbose);
+            await runNpmAudit(cwd, fix, verbose);
         }
         else {
             console.log('  [dry-run] Would run npm audit');
@@ -4286,7 +4366,7 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
     }
     else if (fix && !dryRun) {
         // Run fix even if no deps changed
-        runNpmAudit(cwd, fix, verbose);
+        await runNpmAudit(cwd, fix, verbose);
     }
     if (noPublish) {
         console.log('Transform complete (--nopublish mode).');
@@ -4309,7 +4389,7 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
                 runCommand('git', ['add', 'package.json'], { cwd });
                 gitCommit('Restore file: dependencies', cwd);
                 if (currentGitStatus.hasRemote) {
-                    pushWithProtection(cwd, verbose);
+                    await pushWithProtection(cwd, verbose);
                 }
             }
         }
@@ -4367,7 +4447,7 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
                 runCommand('git', ['add', 'package.json'], { cwd });
                 gitCommit('Restore file: dependencies', cwd);
                 if (currentGitStatus.hasRemote) {
-                    pushWithProtection(cwd, verbose);
+                    await pushWithProtection(cwd, verbose);
                 }
             }
         }
@@ -4429,7 +4509,7 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
             // Push any unpushed commits (e.g., from a previous failed push)
             if (currentGitStatus.hasRemote && currentGitStatus.hasUnpushed && !dryRun) {
                 console.log(colors.yellow('Pushing unpushed commits...'));
-                pushWithProtection(cwd, verbose);
+                await pushWithProtection(cwd, verbose);
             }
             // If install/link flag is set, install globally
             if (install || link || wsl) {
@@ -4445,7 +4525,7 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
                 if (pkg.bin && (install || link || wsl)) {
                     if (link) {
                         console.log(`Installing ${pkgName} globally from local directory (link)...`);
-                        const localInstallResult = runCommand('npm', ['install', '-g', '.'], { cwd, silent: false, showCommand: true });
+                        const localInstallResult = await runCommandAsync('npm', ['install', '-g', '.'], { cwd, silent: false, showCommand: true });
                         if (localInstallResult.success) {
                             console.log(colors.green(`✓ Linked globally: ${pkgName}@${pkgVersion}`));
                         }
@@ -4460,7 +4540,7 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
                         // sibling imports. Local install handles workspace linking correctly.
                         if (pkg.workspaces) {
                             console.log(`Installing ${pkgName}@${pkgVersion} globally from local (workspace)...`);
-                            const localResult = runCommand('npm', ['install', '-g', '.'], { cwd, silent: false, showCommand: true });
+                            const localResult = await runCommandAsync('npm', ['install', '-g', '.'], { cwd, silent: false, showCommand: true });
                             if (localResult.success) {
                                 console.log(colors.green(`✓ Installed globally: ${pkgName}@${pkgVersion}`));
                             }
@@ -4479,7 +4559,7 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
                             const vOnNpm = vCheck.status === 0 && vCheck.stdout?.trim() === pkgVersion;
                             if (vOnNpm) {
                                 console.log(`Installing ${pkgName}@${pkgVersion} globally from registry...`);
-                                const registryInstallResult = installGlobalWithRetry(`${pkgName}@${pkgVersion}`, cwd);
+                                const registryInstallResult = await installGlobalWithRetry(`${pkgName}@${pkgVersion}`, cwd);
                                 if (registryInstallResult.success) {
                                     console.log(colors.green(`✓ Installed globally: ${pkgName}@${pkgVersion}`));
                                 }
@@ -4499,7 +4579,7 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
                             else {
                                 console.log(colors.yellow(`${pkgName}@${pkgVersion} not found on npm — installing from local directory.`));
                                 console.log(colors.dim('  Use -m "message" to publish this version to npm.'));
-                                const localResult = runCommand('npm', ['install', '-g', '.'], { cwd, silent: false, showCommand: true });
+                                const localResult = await runCommandAsync('npm', ['install', '-g', '.'], { cwd, silent: false, showCommand: true });
                                 if (localResult.success) {
                                     console.log(colors.green(`✓ Installed globally from local: ${pkgName}@${pkgVersion}`));
                                 }
@@ -4552,7 +4632,10 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
             if (nulCount > 0 && verbose) {
                 console.log(`  Removed ${nulCount} 'nul' file(s) (Windows reserved name)`);
             }
+            const addStart = Date.now();
+            process.stdout.write(`  git add -A ... `);
             let addResult = runCommand('git', ['add', '-A'], { cwd, silent: true });
+            process.stdout.write(`done (${((Date.now() - addStart) / 1000).toFixed(1)}s)\n`);
             if (!addResult.success) {
                 const errText = addResult.stderr + addResult.output;
                 const deniedFiles = parseDeniedFiles(errText);
@@ -4572,7 +4655,10 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
                         }
                         fs.writeFileSync(gitignorePath, gitignoreContent);
                         console.log(colors.green('✓ Updated .gitignore'));
+                        const retryStart = Date.now();
+                        console.log(`  ${timestamp()} git add -A (retry) ...`);
                         addResult = runCommand('git', ['add', '-A'], { cwd, silent: true });
+                        console.log(`  ${timestamp()} git add -A done (${((Date.now() - retryStart) / 1000).toFixed(1)}s)`);
                         if (addResult.success) {
                             console.log(colors.green('✓ git add succeeded after updating .gitignore'));
                         }
@@ -4589,7 +4675,10 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
                     console.log(colors.yellow('Continuing with --force...'));
                 }
             }
+            const commitStart = Date.now();
+            console.log(`  ${timestamp()} git commit ... (pre-commit hooks may run)`);
             let commitResult = gitCommit(commitMsg, cwd);
+            console.log(`  ${timestamp()} git commit done (${((Date.now() - commitStart) / 1000).toFixed(1)}s)`);
             if (!commitResult.success) {
                 // Check for corrupted git index ("invalid object" / "Error building trees")
                 const errText = commitResult.stderr + commitResult.output;
@@ -4614,7 +4703,15 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
     }
     // Pull latest from remote before version bump to avoid push rejection
     if (currentGitStatus.hasRemote && !dryRun) {
-        const pullResult = runCommand('git', ['pull', '--rebase', 'origin', currentGitStatus.currentBranch], { cwd, silent: true });
+        const pullStart = Date.now();
+        console.log(`  ${timestamp()} git pull --rebase origin ${currentGitStatus.currentBranch} ...`);
+        const heartbeat = setInterval(() => {
+            const elapsed = ((Date.now() - pullStart) / 1000).toFixed(0);
+            console.log(`  ${timestamp()} ... still pulling (${elapsed}s elapsed)`);
+        }, 10000);
+        const pullResult = await runCommandAsync('git', ['pull', '--rebase', 'origin', currentGitStatus.currentBranch], { cwd, silent: true });
+        clearInterval(heartbeat);
+        console.log(`  ${timestamp()} git pull done (${((Date.now() - pullStart) / 1000).toFixed(1)}s)`);
         if (!pullResult.success) {
             console.error(colors.yellow('Warning: git pull --rebase failed before version bump'));
             if (verbose) {
@@ -4715,12 +4812,12 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
                 // Version bump + tag succeeded locally; only the push failed.
                 // Auto-pull --rebase and retry the push.
                 console.log(colors.yellow('\nLocal branch is behind remote — pulling with rebase...'));
-                const pullResult = runCommand('git', ['pull', '--rebase', 'origin', currentGitStatus.currentBranch], { cwd });
+                const pullResult = await runCommandAsync('git', ['pull', '--rebase', 'origin', currentGitStatus.currentBranch], { cwd });
                 if (pullResult.success) {
                     console.log(colors.green('  ✓ Rebased onto remote'));
-                    const pushResult = runCommand('git', ['push'], { cwd });
+                    const pushResult = await runCommandAsync('git', ['push'], { cwd });
                     if (pushResult.success) {
-                        const tagPush = runCommand('git', ['push', '--tags'], { cwd, silent: true });
+                        const tagPush = await runCommandAsync('git', ['push', '--tags'], { cwd, silent: true });
                         if (tagPush.success) {
                             console.log(colors.green('  ✓ Pushed with tags'));
                         }
@@ -4995,11 +5092,11 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
         // broadcast to the console group (e.g. from another tool sharing the
         // console) makes cmd.exe print "Terminate batch job (Y/N)?" and kill
         // npm.cmd. Our process survives, so a retry usually succeeds.
-        let packResult = runCommand('npm', ['pack'], { cwd, silent: true });
+        let packResult = await runCommandAsync('npm', ['pack'], { cwd, silent: true });
         if (!packResult.success && /Terminate batch job|\^C/.test(packResult.output + packResult.stderr)) {
             const logPath = dumpPackCtrlcDiagnostics(pkg, cwd, packResult.output, packResult.stderr);
             console.error(colors.yellow(`  npm pack interrupted by spurious Ctrl+C — retrying once... (diag: ${logPath})`));
-            packResult = runCommand('npm', ['pack'], { cwd, silent: true });
+            packResult = await runCommandAsync('npm', ['pack'], { cwd, silent: true });
         }
         // Restore stashed node_modules now that pack is done — must happen
         // before any subsequent install -g symlinks to these dep targets.
@@ -5035,7 +5132,7 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
             if (sizeMB > 50) {
                 console.error(colors.red(`\n⚠ Tarball is ${sizeMB.toFixed(0)}MB — something large is being included!`));
                 // Show biggest files in the tarball
-                const listResult = runCommand('npm', ['pack', '--dry-run'], { cwd, silent: true });
+                const listResult = await runCommandAsync('npm', ['pack', '--dry-run'], { cwd, silent: true });
                 if (listResult.success) {
                     const lines = listResult.output.trim().split('\n')
                         .filter(l => l.includes('B '))
@@ -5084,7 +5181,7 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
                 console.log(colors.yellow(`⏱ Waiting ${retryDelay} seconds before retry (attempt ${attempt + 1}/${maxRetries})...`));
                 await new Promise(resolve => setTimeout(resolve, retryDelay * 1000));
             }
-            publishResult = runCommand('npm', npmArgs, { cwd, silent: true });
+            publishResult = await runCommandAsync('npm', npmArgs, { cwd, silent: true });
             if (publishResult.success) {
                 break; // Success!
             }
@@ -5202,7 +5299,7 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
                 if (logResult.success) {
                     console.log(colors.green(`  ✓ Appended to npmchanges.md and removed .commitmsg`));
                     if (currentGitStatus.hasRemote)
-                        pushWithProtection(cwd, verbose);
+                        await pushWithProtection(cwd, verbose);
                 }
             }
             catch (err) {
@@ -5219,8 +5316,8 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
             console.log(`${timestamp()} Pushing to git...`);
         }
         if (!dryRun) {
-            if (pushWithProtection(cwd, verbose)) {
-                const tagResult = runCommand('git', ['push', '--tags'], { cwd, silent: true });
+            if (await pushWithProtection(cwd, verbose)) {
+                const tagResult = await runCommandAsync('git', ['push', '--tags'], { cwd, silent: true });
                 if (verbose && tagResult.success)
                     console.log(colors.green('  ✓ Pushed tags'));
             }
@@ -5242,7 +5339,7 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
         if (link) {
             console.log(`Linking globally: ${pkgName}@${pkgVersion}...`);
             if (!dryRun) {
-                const installResult = runCommand('npm', ['install', '-g', '.'], { cwd, silent: false, showCommand: true });
+                const installResult = await runCommandAsync('npm', ['install', '-g', '.'], { cwd, silent: false, showCommand: true });
                 if (installResult.success) {
                     globalInstallOk = true;
                     console.log(colors.green(`✓ Linked globally: ${pkgName}@${pkgVersion}`));
@@ -5262,7 +5359,7 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
                 // Workspace packages: install from local for proper workspace linking
                 console.log(`Installing ${pkgName}@${pkgVersion} globally from local (workspace)...`);
                 if (!dryRun) {
-                    const installResult = runCommand('npm', ['install', '-g', '.'], { cwd, silent: false, showCommand: true });
+                    const installResult = await runCommandAsync('npm', ['install', '-g', '.'], { cwd, silent: false, showCommand: true });
                     if (installResult.success) {
                         globalInstallOk = true;
                         console.log(colors.green(`✓ Installed globally: ${pkgName}@${pkgVersion}`));
@@ -5281,7 +5378,7 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
                 console.log(`${timestamp()} Installing globally from registry: ${pkgName}@${pkgVersion}...`);
                 if (!dryRun) {
                     waitForNpmVersion(pkgName, pkgVersion, wasNewPackage);
-                    const installResult = installGlobalWithRetry(`${pkgName}@${pkgVersion}`, cwd, wasNewPackage);
+                    const installResult = await installGlobalWithRetry(`${pkgName}@${pkgVersion}`, cwd, wasNewPackage);
                     if (installResult.success) {
                         globalInstallOk = true;
                         console.log(colors.green(`✓ Installed globally: ${pkgName}@${pkgVersion}`));
@@ -5313,7 +5410,7 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
                 waitForNpmVersion(pkgName, pkgVersion, wasNewPackage);
             console.log(`Installing in WSL${useLocalWsl ? ' (local)' : ' from registry'}: ${pkgName}@${pkgVersion}...`);
             if (!dryRun) {
-                const wslResult = installInWsl(wslArgs, { cwd });
+                const wslResult = await installInWsl(wslArgs, { cwd });
                 if (wslResult.success) {
                     wslInstallOk = true;
                     console.log(colors.green(`✓ Installed in WSL: ${pkgName}@${pkgVersion}${wslResult.fixed ? ' (after prefix fix)' : ''}`));
@@ -5353,7 +5450,7 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
             runCommand('git', ['add', 'package.json'], { cwd });
             gitCommit('Restore file: dependencies', cwd);
             if (currentGitStatus.hasRemote) {
-                pushWithProtection(cwd, verbose);
+                await pushWithProtection(cwd, verbose);
             }
         }
     }
@@ -5364,7 +5461,7 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
     // Run final audit report if not already run
     const auditAlreadyRun = (fix || updateDeps) && (transformResult.transformed || alreadyTransformed || updateDeps);
     if (!auditAlreadyRun && (fix || updateDeps || transformResult.transformed) && !dryRun) {
-        runNpmAudit(cwd, false, verbose); // Just report, don't fix again
+        await runNpmAudit(cwd, false, verbose); // Just report, don't fix again
     }
     // Print summary
     console.log('');
@@ -5627,7 +5724,7 @@ export async function globalizeWorkspace(rootDir, options = {}, configOptions =
     // the case where a dep was added to a member package.json but `npm install`
     // wasn't re-run — the builds would otherwise fail resolving the new dep.
     if (!options.dryRun) {
-        ensureWorkspaceDepModules(rootDir, packages.map(p => ({ dir: p.dir, pkg: p.pkg })), !!options.verbose);
+        await ensureWorkspaceDepModules(rootDir, packages.map(p => ({ dir: p.dir, pkg: p.pkg })), !!options.verbose);
     }
     // Prescan: decide which packages actually need processing so we don't waste
     // time rebuilding+republishing ones with no relevant changes.
@@ -5821,7 +5918,7 @@ export async function globalizeWorkspace(rootDir, options = {}, configOptions =
             // Workspace root is private — always install from local directory
             console.log(`Installing ${pkgName}@${pkgVersion} globally from local directory...`);
             if (!dryRun) {
-                const installResult = runCommand('npm', ['install', '-g', '.'], { cwd: rootDir, silent: false, showCommand: true });
+                const installResult = await runCommandAsync('npm', ['install', '-g', '.'], { cwd: rootDir, silent: false, showCommand: true });
                 if (installResult.success) {
                     console.log(colors.green(`✓ Installed globally: ${pkgName}@${pkgVersion}`));
                 }
@@ -5838,7 +5935,7 @@ export async function globalizeWorkspace(rootDir, options = {}, configOptions =
         if (wsl) {
             console.log(`Installing ${pkgName} in WSL (local)...`);
             if (!dryRun) {
-                const wslResult = installInWsl(['npm', 'install', '-g', '.'], { cwd: rootDir });
+                const wslResult = await installInWsl(['npm', 'install', '-g', '.'], { cwd: rootDir });
                 if (wslResult.success) {
                     console.log(colors.green(`✓ Installed in WSL: ${pkgName}@${pkgVersion}${wslResult.fixed ? ' (after prefix fix)' : ''}`));
                 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/npmglobalize",
-  "version": "1.0.174",
+  "version": "1.0.176",
   "description": "Transform file: dependencies to npm versions for publishing",
   "main": "index.js",
   "type": "module",
@@ -36,7 +36,7 @@
     "@bobfrankston/mailx": "^1.0.466",
     "@bobfrankston/npmglobalize": "^1.0.153",
     "@bobfrankston/themecolors": "^0.1.6",
-    "@bobfrankston/userconfig": "^1.0.8",
+    "@bobfrankston/userconfig": "^1.0.9",
     "@npmcli/package-json": "^7.0.4",
     "json5": "^2.2.3",
     "libnpmversion": "^8.0.3",
@@ -68,7 +68,7 @@
       "@bobfrankston/mailx": "^1.0.466",
       "@bobfrankston/npmglobalize": "^1.0.153",
       "@bobfrankston/themecolors": "^0.1.6",
-      "@bobfrankston/userconfig": "^1.0.8",
+      "@bobfrankston/userconfig": "^1.0.9",
       "@npmcli/package-json": "^7.0.4",
       "json5": "^2.2.3",
       "libnpmversion": "^8.0.3",