@bobfrankston/npmglobalize 1.0.227 → 1.0.228

package/README.md

@@ -92,6 +92,8 @@ Before any transform/publish, `npmglobalize` walks the full `file:` dep graph an
 
 Errors abort (unless `--force`); warnings prompt to continue.
 
+An unscoped dependency with private intent is reported differently: it is not a question. npmglobalize never renames a dependency to add a scope (the name is what every consumer imports by, and changing it is the dep owner's own project), so the dep cannot reach npm and neither can the package that depends on it. The first run says so in full, names the dep and its path, records it under `unscopedDepsNoted` in the consumer's `.globalize.json5`, and stops. Later runs print one line per dep and stop. Nothing is asked, because no answer could change the outcome. Fix it in the dep: scope the name in its own `package.json`, or set `npmVisibility: "public"` or `noprefix: true` in its `.globalize.json5`; the note clears itself on the next run. If the cascade reaches such a dep anyway (`-no-prescan`), it stops there with the same message. The rename offer still exists when you run npmglobalize *in* the unscoped package itself. (2026-09-14)
+
 Skip the prescan with `-no-prescan` / `-nps`.
 
 #### Workspace skip prescan
@@ -369,6 +371,11 @@ How would you like to set up git?
   5) Abort
 ```
 
+The "Use local install only" line appears only for a package with a `bin` field.
+A library has nothing for a global install to expose, so it is not offered the
+option and the remaining lines are numbered without a gap. The same applies to
+the "No git repository found" and "No git remote configured" menus.
+
 **Adopt** runs:
 
 ```bash
@@ -470,7 +477,8 @@ not what you meant to publish, so npmglobalize lists the conflicted files and st
 -update-deps, -ud        Update package.json to latest versions (safe: minor/patch)
 -update-major            Allow major version updates (breaking changes)
 -publish-deps            Auto-publish file: dependencies (default)
--pd                      Like -publish-deps, plus auto-yes to dep-cascade prompts (private only)
+-pd                      Like -publish-deps, plus auto-yes to dep-cascade prompts (private only;
+                         never adds a scope to a dep)
 -no-publish-deps, -npd   Skip auto-publishing file: dependencies
 -no-prescan, -nps        Skip upfront dep-graph prescan
 -force-publish           Republish dependencies even if version exists
@@ -914,6 +922,10 @@ consumed: it is appended to `npmchanges.md` under a
 lost. Several local entries may share one version number — the date tells them
 apart. No git commit is made for it; the next real publish carries it along.
 
+On a library (no `bin`) there is nothing to install, and the output says so: `Local mode:
+<pkg> — library, nothing to install`. The `file:` deps are still built and the `.commitmsg`
+is still consumed; only the install step does not exist. (2026-09-14)
+
 ### Private Packages
 
 Packages with `"private": true` in `package.json` skip the npm publish step. Dependencies are still transformed and restored — the publish is the only thing skipped.

package/lib.d.ts

@@ -91,7 +91,8 @@ export interface GlobalizeOptions {
     updateMajor?: boolean;
     /** Publish file: dependencies before converting them */
     publishDeps?: boolean;
-    /** Auto-yes to dep-cascade prompts (add scope to make private, etc.); does NOT auto-yes public prompts */
+    /** Auto-yes to dep-cascade prompts (git setup, prescan warnings); does NOT auto-yes public
+     *  prompts. Cannot add a scope to a dep: the cascade never renames a dependency (2026-09-14). */
     publishDepsYes?: boolean;
     /** Cascade npmVisibility:"public" to all transitive workspace/file: deps without prompting.
      *  In workspace mode: fixpoint-promotes every workspace member reachable from a public consumer.
@@ -160,6 +161,12 @@ export interface GlobalizeOptions {
      *  following each entry's own .globalize.json5. FYI for now: recorded and
      *  displayed, nothing is updated automatically. */
     upstream?: UpstreamEntry[];
+    /** Bookkeeping, not a CLI option: unscoped `file:` deps this package was already told
+     *  about (dep name → date first noted). The first run explains why the dep, and this
+     *  package with it, will not reach npm until the dep's own package.json has a scope;
+     *  later runs print one line. Nothing is asked either time, since no answer could
+     *  change the outcome. Cleared automatically once the dep is scoped. (2026-09-14) */
+    unscopedDepsNoted?: Record<string, string>;
     /** Internal: signals this call is from workspace orchestrator */
     /** Skip the upfront dep-graph prescan */
     noPrescan?: boolean;
@@ -344,6 +351,9 @@ export declare function transformDeps(pkg: any, baseDir: string, verbose?: boole
 /** A problem discovered by the prescan. */
 export interface PrescanIssue {
     severity: 'error' | 'warning';
+    /** 'unscoped': an unscoped file: dep with private intent. Not an error and not a
+     *  question — globalize reports it once, remembers it, and stops. */
+    kind?: 'unscoped';
     package: string;
     path: string;
     message: string;
@@ -360,6 +370,17 @@ export declare function findUndeclaredImports(cwd: string, pkg: any): Undeclared
  *  user resolve all problems before starting the publish cascade instead of
  *  being interrupted mid-run. */
 export declare function prescanDepGraph(baseDir: string, visited?: Set<string>, verbose?: boolean): PrescanIssue[];
+/** Report unscoped `file:` deps found by the prescan, without asking anything.
+ *
+ *  An unscoped dep with private intent cannot reach npm, and npmglobalize does not
+ *  rename a dependency to fix that (the name is what every consumer imports by; scoping
+ *  it is the dep owner's own project). So the consumer in `cwd` cannot be published
+ *  either. Nothing the user could answer changes that, so there is no prompt: the first
+ *  run explains it in full, records the dep in `unscopedDepsNoted` in the consumer's
+ *  .globalize.json5, and later runs print one line per dep. Deps that have since been
+ *  scoped drop out of the record automatically.
+ *  2026-09-14 17:05 EDT — Claude Code (Fable 5.1), at Bob's direction. */
+export declare function reportUnscopedDeps(cwd: string, unscoped: PrescanIssue[]): void;
 /** Restore file: dependencies from .dependencies using a three-way merge that
  *  preserves any external modifications made since the last transform. */
 export declare function restoreDeps(pkg: any, verbose?: boolean): boolean;
@@ -677,6 +698,20 @@ export declare function promptText(message: string, defaultValue?: string): Prom
  * answer resolved null and every caller fell through to its default action, so a typo
  * silently did something. Now it says what it didn't understand and asks again.
  */
+/** One line of a numbered console menu. `action` is what the caller switches on;
+ *  the number the user types is assigned at display time, so lines can be
+ *  omitted without leaving gaps or shifting meanings. */
+export interface MenuOption {
+    label: string;
+    action: string;
+}
+/** Show `header` and the options numbered 1..N in display order, then read a
+ *  choice. Empty input takes the first option. Returns the chosen `action`.
+ *  2026-09-14 14:30 EDT — Claude Code (Fable 5.1), at Bob's direction. The git
+ *  setup menus were hand-numbered strings with a fixed "Use local install only"
+ *  line, so a library (no `bin`) was offered an install that doLocalInstall
+ *  would then skip. Options are now data, so a line can be left out. */
+export declare function promptMenu(header: string, options: MenuOption[]): Promise<string>;
 export declare function promptChoice(message: string, choices: string[]): Promise<string>;
 /** Initialize a local git repo by adopting history from an existing remote.
  *  Preserves the working tree — local files appear as uncommitted changes

package/lib.js

@@ -403,6 +403,9 @@ export function writeConfig(dir, config, explicitKeys) {
     if (config.upstream === undefined && existing.upstream !== undefined) {
         config = { ...config, upstream: existing.upstream };
     }
+    // unscopedDepsNoted is deliberately NOT carried across: reportUnscopedDeps clears it
+    // by omitting the key, and a publish-path writeConfig that drops it only means the
+    // full explanation prints once more. 2026-09-14
     const omitKeys = new Set(['cleanup', 'init', 'dryRun', 'message', 'conform', 'asis', 'help', 'error', 'updateDeps', 'updateMajor', 'publishDeps', 'publicDeps', 'forcePublish', 'once', 'cleanNestedModules']);
     for (const [key, value] of Object.entries(config)) {
         if (omitKeys.has(key))
@@ -480,7 +483,8 @@ export function writeConfig(dir, config, explicitKeys) {
         ['"usePaths": true', 'true = resolve file: deps from siblings; false = use latest npm version (standalone)'],
         ['"allowTs": false', 'true = include .ts source in npm tarball (auto-true for noEmit projects)'],
         ['"importgen": auto', 'Detected from .vscode/tasks.json / import map in HTML; false = never ask'],
-        ['"subProjects": auto', 'Sub-dirs with their own build script or tsconfig (e.g. ["client", "Sw"]); detected from .vscode/tasks.json; false = never ask']
+        ['"subProjects": auto', 'Sub-dirs with their own build script or tsconfig (e.g. ["client", "Sw"]); detected from .vscode/tasks.json; false = never ask'],
+        ['"unscopedDepsNoted": {}', 'Bookkeeping: unscoped file: deps already explained (name → date); cleared when the dep gets a scope']
     ];
     const refWidth = Math.max(...reference.map(([decl]) => decl.length));
     for (const [decl, note] of reference) {
@@ -1824,8 +1828,16 @@ export function prescanDepGraph(baseDir, visited = new Set(), verbose = false) {
                 continue;
             }
             const depName = targetPkg.name || name;
-            // Unscoped + private-intent: will trigger a mid-cascade scope prompt
-            if (!depName.startsWith('@')) {
+            // Unscoped + private-intent. This used to be a WARNING whose "continue" led
+            // into the cascade prompting to rename the dep by adding a scope. The cascade
+            // never renames a dependency now (see the _fromDep check in globalize), so it
+            // is flagged `kind: 'unscoped'` and globalize reports it without asking anything.
+            // Reported once per dep, not once per consumer edge: the recursion below
+            // dedupes via `visited`, but this check ran before it, so a dep shared by four
+            // packages printed four identical lines.
+            // 2026-09-14 16:40 EDT — Claude Code (Fable 5.1), at Bob's direction: "It
+            // shouldn't try to publish to a scope not in the package."
+            if (!depName.startsWith('@') && !visited.has(fs.realpathSync(targetPath))) {
                 const depConfig = readConfig(targetPath);
                 const depVis = depConfig.npmVisibility
                     ?? (targetPkg.publishConfig?.access === 'public' ? 'public' : undefined);
@@ -1833,10 +1845,11 @@ export function prescanDepGraph(baseDir, visited = new Set(), verbose = false) {
                 if (depVis !== 'public' && !noprefix) {
                     issues.push({
                         severity: 'warning',
+                        kind: 'unscoped',
                         package: depName,
                         path: targetPath,
-                        message: 'unscoped package — private publishing will prompt for a scope',
-                        suggestion: 'add a scope (e.g., @bobfrankston/) OR set npmVisibility="public" OR set noprefix=true in .globalize.json5'
+                        message: 'unscoped — not published to npm until its own package.json name has a scope',
+                        suggestion: 'scope it in ITS OWN package.json (e.g., @bobfrankston/), or set npmVisibility="public" or noprefix=true in its .globalize.json5'
                     });
                 }
             }
@@ -1846,6 +1859,60 @@ export function prescanDepGraph(baseDir, visited = new Set(), verbose = false) {
     }
     return issues;
 }
+/** Report unscoped `file:` deps found by the prescan, without asking anything.
+ *
+ *  An unscoped dep with private intent cannot reach npm, and npmglobalize does not
+ *  rename a dependency to fix that (the name is what every consumer imports by; scoping
+ *  it is the dep owner's own project). So the consumer in `cwd` cannot be published
+ *  either. Nothing the user could answer changes that, so there is no prompt: the first
+ *  run explains it in full, records the dep in `unscopedDepsNoted` in the consumer's
+ *  .globalize.json5, and later runs print one line per dep. Deps that have since been
+ *  scoped drop out of the record automatically.
+ *  2026-09-14 17:05 EDT — Claude Code (Fable 5.1), at Bob's direction. */
+export function reportUnscopedDeps(cwd, unscoped) {
+    const config = readConfig(cwd);
+    const noted = { ...(config.unscopedDepsNoted ?? {}) };
+    if (unscoped.length === 0 && Object.keys(noted).length === 0)
+        return; // nothing to say, nothing to forget
+    let consumerName;
+    try {
+        consumerName = readPackageJson(cwd).name || path.basename(cwd);
+    }
+    catch {
+        consumerName = path.basename(cwd);
+    }
+    const today = new Date().toISOString().slice(0, 10);
+    let changed = false;
+    for (const issue of unscoped) {
+        const when = noted[issue.package];
+        if (when) {
+            console.log(colors.yellow(`${issue.package} still unscoped (noted ${when}) — ${consumerName} is not published to npm until ${issue.package} has a scope.`));
+            continue;
+        }
+        console.log(colors.yellow(`${issue.package} is unscoped, so it will not be published to npm until the name in its package.json has a scope.`));
+        console.log(colors.yellow(`${consumerName} depends on ${issue.package} and will not be published to npm either.`));
+        console.log(colors.dim(`  ${issue.package} is at ${issue.path}`));
+        console.log(colors.dim(`  → ${issue.suggestion}`));
+        console.log(colors.dim(`  Noted in ${path.join(cwd, '.globalize.json5')}; later runs print one line for ${issue.package}.`));
+        noted[issue.package] = today;
+        changed = true;
+    }
+    // Forget deps that are no longer reported: they were scoped (or made public) since.
+    const stillUnscoped = new Set(unscoped.map(i => i.package));
+    for (const name of Object.keys(noted)) {
+        if (stillUnscoped.has(name))
+            continue;
+        delete noted[name];
+        changed = true;
+    }
+    if (changed) {
+        const next = { ...config };
+        delete next.unscopedDepsNoted;
+        if (Object.keys(noted).length)
+            next.unscopedDepsNoted = noted;
+        writeConfig(cwd, next);
+    }
+}
 /** Restore file: dependencies from .dependencies using a three-way merge that
  *  preserves any external modifications made since the last transform. */
 export function restoreDeps(pkg, verbose = false) {
@@ -5546,13 +5613,21 @@ export async function promptText(message, defaultValue) {
         });
     });
 }
-/**
- * Prompt user for multiple choice. Re-asks until the answer is one of `choices`.
- *
- * 2026-09-01 — Claude Code (Fable 5.1), at Bob's direction. Previously an unrecognized
- * answer resolved null and every caller fell through to its default action, so a typo
- * silently did something. Now it says what it didn't understand and asks again.
- */
+/** Show `header` and the options numbered 1..N in display order, then read a
+ *  choice. Empty input takes the first option. Returns the chosen `action`.
+ *  2026-09-14 14:30 EDT — Claude Code (Fable 5.1), at Bob's direction. The git
+ *  setup menus were hand-numbered strings with a fixed "Use local install only"
+ *  line, so a library (no `bin`) was offered an install that doLocalInstall
+ *  would then skip. Options are now data, so a line can be left out. */
+export function promptMenu(header, options) {
+    const lines = options.map((o, i) => `  ${i + 1}) ${o.label}`);
+    const message = `${header}\n${lines.join('\n')}\nChoice [1]:`;
+    const valid = options.map((_, i) => String(i + 1));
+    return promptChoice(message, [...valid, '']).then(choice => {
+        const index = choice === '' ? 0 : Number(choice) - 1;
+        return options[index].action;
+    });
+}
 export function promptChoice(message, choices) {
     const rl = readline.createInterface({
         input: process.stdin,
@@ -6711,15 +6786,21 @@ async function doLocalInstall(cwd, options) {
     const pkg = readPackageJson(cwd);
     const pkgName = pkg.name || path.basename(cwd);
     const pkgVersion = pkg.version || '0.0.0';
+    // A library has no bin, so there is nothing to install: say what actually happens
+    // (deps built, notes recorded, no publish) instead of announcing an install and
+    // then taking it back. 2026-09-14 17:50 EDT — Claude Code (Fable 5.1), at Bob's
+    // direction: "why mention local install when there is no install".
+    if (!pkg.bin) {
+        console.log(colors.blue(`Local mode: ${pkgName}@${pkgVersion} — library, nothing to install`));
+        console.log(colors.dim('Not transformed or published; file: deps left as-is'));
+        console.log(colors.dim('  (switch back to the publish flow with -global)'));
+        recordLocalChange(cwd, pkgVersion, dryRun);
+        return true;
+    }
     console.log(colors.blue(`Local install: ${pkgName}@${pkgVersion}`));
     console.log(colors.dim('Skipping transform/publish — installing with file: deps as-is'));
     console.log(colors.dim('  (switch back to the publish flow with -global)'));
-    // Record before the bin check: a library's notes are history too.
     recordLocalChange(cwd, pkgVersion, dryRun);
-    if (!pkg.bin) {
-        console.log(colors.dim(`  (library — skipping global install)`));
-        return true;
-    }
     if (dryRun) {
         console.log('  [dry-run] Would run: npm install -g .');
         if (wsl)
@@ -6856,10 +6937,17 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
     // any transform/publish, so the user can fix them once and run clean.
     // Only run at the top level (not during recursive cascade or workspace).
     if (!noPrescan && !cleanup && !options._fromDep && !options._fromWorkspace) {
-        const issues = prescanDepGraph(cwd, new Set(), verbose);
+        const allIssues = prescanDepGraph(cwd, new Set(), verbose);
+        // Unscoped deps are handled apart from the error/warning prompt below: nothing the
+        // user answers could change the outcome, so nothing is asked. Report, remember,
+        // stop. See reportUnscopedDeps.
+        // 2026-09-14 17:05 EDT — Claude Code (Fable 5.1), at Bob's direction: "The message
+        // should simply point it out won't be published to npm till the scope is fixed and
+        // then remember I was warned. It shouldn't [need] a response because nothing would
+        // be done."
+        const unscoped = allIssues.filter(i => i.kind === 'unscoped');
+        const issues = allIssues.filter(i => i.kind !== 'unscoped');
         if (issues.length > 0) {
-            const errors = issues.filter(i => i.severity === 'error');
-            const warnings = issues.filter(i => i.severity === 'warning');
             console.log(colors.yellow(`Prescan found ${issues.length} issue(s) in the file: dep graph:`));
             for (const i of issues) {
                 const tag = i.severity === 'error' ? colors.red('ERROR') : colors.yellow('WARN');
@@ -6869,6 +6957,18 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
                     console.log(colors.dim(`       → ${i.suggestion}`));
             }
             console.log('');
+        }
+        // Always called: with nothing unscoped it only forgets deps that were noted
+        // earlier and have since been scoped.
+        reportUnscopedDeps(cwd, unscoped);
+        if (unscoped.length > 0) {
+            // The run stops here regardless of the other issues, so the continue prompt
+            // below is skipped: it would ask a question whose answer changes nothing.
+            return false;
+        }
+        if (issues.length > 0) {
+            const errors = issues.filter(i => i.severity === 'error');
+            const warnings = issues.filter(i => i.severity === 'warning');
             if (errors.length > 0 && !force) {
                 console.error(colors.red(`Prescan aborted: ${errors.length} error(s). Fix them or rerun with --force.`));
                 return false;
@@ -7016,6 +7116,19 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
     const gitStatus = getGitStatus(cwd);
     // Handle init mode
     let justInitialized = false;
+    // 2026-09-14 14:30 EDT — Claude Code (Fable 5.1), at Bob's direction. The git
+    // setup menus below offer "Use local install only" — a global npm install of
+    // this package. That is only meaningful for a CLI (a package with `bin`);
+    // doLocalInstall skips a library anyway, so a library is not offered the line.
+    const hasBin = !!readPackageJson(cwd).bin;
+    const localInstallOption = hasBin
+        ? [{ label: 'Use local install only (skip git/publish)', action: 'local' }]
+        : [];
+    const switchToLocalInstall = () => {
+        console.log(colors.dim('Switching to local-only mode...'));
+        writeConfig(cwd, { ...configOptions, localInstall: true }, new Set(['localInstall']));
+        return doLocalInstall(cwd, options);
+    };
     if (!gitStatus.isRepo) {
         console.log('No git repository found.');
         // Probe for an existing remote we could adopt history from.
@@ -7069,55 +7182,54 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
             // a reader who wanted the second line typed 2 and got something else. Bob:
             // "I type 2 when I mean a because that's what humans do." Options are now
             // numbered in display order; the ALL variant is 2, directly under the single.
-            let choice;
+            // 2026-09-14 — Claude Code (Fable 5.1): menus are now promptMenu option
+            // lists; the local-install line is present only for a package with `bin`.
+            // The "No git repository found." header is printed once, above.
+            let action;
             if (adoptable) {
-                choice = await promptChoice('How would you like to set up git?\n'
-                    + '  1) Adopt history from existing remote (recommended)\n'
-                    + '  2) Adopt for ALL remaining deps (don\'t ask again)\n'
-                    + '  3) Initialize fresh git repository\n'
-                    + '  4) Use local install only (skip git/publish)\n'
-                    + '  5) Abort\nChoice [1]:', ['1', '2', '3', '4', '5', '']);
-                if (choice === '4') {
-                    console.log(colors.dim('Switching to local-only mode...'));
-                    writeConfig(cwd, { ...configOptions, localInstall: true }, new Set(['localInstall']));
-                    return doLocalInstall(cwd, options);
-                }
-                if (choice === '5') {
+                action = await promptMenu('How would you like to set up git?', [
+                    { label: 'Adopt history from existing remote (recommended)', action: 'adopt' },
+                    { label: 'Adopt for ALL remaining deps (don\'t ask again)', action: 'adopt-all' },
+                    { label: 'Initialize fresh git repository', action: 'init' },
+                    ...localInstallOption,
+                    { label: 'Abort', action: 'abort' },
+                ]);
+                if (action === 'local')
+                    return switchToLocalInstall();
+                if (action === 'abort') {
                     console.log('Aborted. Run with --init to initialize.');
                     return false;
                 }
-                if (choice === '2')
+                if (action === 'adopt-all')
                     options.autoInit = true;
-                if (choice === '3') {
+                if (action === 'init') {
                     const success = await initGit(cwd, gitVisibility, dryRun, allowTs);
                     if (!success)
                         return false;
                 }
                 else {
-                    // '1', '2', '' default → adopt
+                    // 'adopt' or 'adopt-all'
                     const success = await adoptExistingRemote(cwd, adoptable.url, adoptable.defaultBranch, dryRun);
                     if (!success)
                         return false;
                 }
             }
             else {
-                choice = await promptChoice('No git repository found. What would you like to do?\n'
-                    + '  1) Initialize git repository\n'
-                    + '  2) Initialize for ALL remaining deps (don\'t ask again)\n'
-                    + '  3) Use local install only (skip git/publish)\n'
-                    + '  4) Abort\nChoice [1]:', ['1', '2', '3', '4', '']);
-                if (choice === '3') {
-                    console.log(colors.dim('Switching to local-only mode...'));
-                    writeConfig(cwd, { ...configOptions, localInstall: true }, new Set(['localInstall']));
-                    return doLocalInstall(cwd, options);
-                }
-                if (choice === '4') {
+                action = await promptMenu('What would you like to do?', [
+                    { label: 'Initialize git repository', action: 'init' },
+                    { label: 'Initialize for ALL remaining deps (don\'t ask again)', action: 'init-all' },
+                    ...localInstallOption,
+                    { label: 'Abort', action: 'abort' },
+                ]);
+                if (action === 'local')
+                    return switchToLocalInstall();
+                if (action === 'abort') {
                     console.log('Aborted. Run with --init to initialize.');
                     return false;
                 }
-                if (choice === '2')
+                if (action === 'init-all')
                     options.autoInit = true;
-                // choice is '1', '2', or '' (default) → init
+                // 'init' or 'init-all'
                 const success = await initGit(cwd, gitVisibility, dryRun, allowTs);
                 if (!success)
                     return false;
@@ -7143,22 +7255,21 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
     else if (!gitStatus.hasRemote) {
         // Git repo exists but no remote - need to create GitHub repo
         if (!init && !options.autoInit && !publishDepsYes) {
-            // 2026-09-01 — Claude Code (Fable 5.1): renumbered from "1 a 2 3" (see note above).
-            const choice = await promptChoice('No git remote configured. What would you like to do?\n'
-                + '  1) Create GitHub repository\n'
-                + '  2) Create for ALL remaining deps (don\'t ask again)\n'
-                + '  3) Use local install only (skip git/publish)\n'
-                + '  4) Abort\nChoice [1]:', ['1', '2', '3', '4', '']);
-            if (choice === '3') {
-                console.log(colors.dim('Switching to local-only mode...'));
-                writeConfig(cwd, { ...configOptions, localInstall: true }, new Set(['localInstall']));
-                return doLocalInstall(cwd, options);
-            }
-            if (choice === '4') {
+            // 2026-09-14 — Claude Code (Fable 5.1): promptMenu option list; local-install
+            // line only for a package with `bin` (see hasBin above).
+            const action = await promptMenu('No git remote configured. What would you like to do?', [
+                { label: 'Create GitHub repository', action: 'create' },
+                { label: 'Create for ALL remaining deps (don\'t ask again)', action: 'create-all' },
+                ...localInstallOption,
+                { label: 'Abort', action: 'abort' },
+            ]);
+            if (action === 'local')
+                return switchToLocalInstall();
+            if (action === 'abort') {
                 console.log('Aborted. Run with --init to set up GitHub repository.');
                 return false;
             }
-            if (choice === '2') {
+            if (action === 'create-all') {
                 options.autoInit = true;
             }
         }
@@ -7417,6 +7528,21 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
             publicConfirmed = true;
         }
     }
+    // A dependency reached through the cascade is never renamed. Adding a scope changes the
+    // name every consumer imports by, which is the dep owner's project, not a publish-time
+    // side effect. Refuse and say what to fix; the top-level run on the package itself may
+    // still offer the rename below, because there the user chose to work on that package.
+    // 2026-09-14 16:40 EDT — Claude Code (Fable 5.1), at Bob's direction: "It shouldn't try
+    // to publish to a scope not in the package. I need to fix the package and that's a
+    // separate and messy project."
+    // noprefix in the dep's .globalize.json5 is the same escape hatch the prescan honors.
+    if (!isScoped && options._fromDep && effectiveNpmVisibility !== 'public' && currentAccess !== 'public'
+        && readConfig(cwd).noprefix !== true) {
+        console.error(colors.red(`Dependency '${pkg.name}' is unscoped and cannot be published privately.`));
+        console.error(colors.red(`  npmglobalize does not rename dependencies. Scope it in ${path.join(cwd, 'package.json')},`));
+        console.error(colors.red(`  or set npmVisibility="public" or noprefix=true in its .globalize.json5.`));
+        return false;
+    }
     if (effectiveNpmVisibility === 'private') {
         // User explicitly wants private publication
         if (!isScoped) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/npmglobalize",
-  "version": "1.0.227",
+  "version": "1.0.228",
   "description": "Transform file: dependencies to npm versions for publishing",
   "main": "index.js",
   "type": "module",
@@ -34,7 +34,7 @@
     "@bobfrankston/freezepak": "^0.1.9",
     "@bobfrankston/importgen": "^0.1.43",
     "@bobfrankston/themecolors": "^0.1.10",
-    "@bobfrankston/userconfig": "^1.0.13",
+    "@bobfrankston/userconfig": "^1.0.15",
     "@npmcli/package-json": "^7.0.4",
     "json5": "^2.2.3",
     "libnpmversion": "^8.0.3",
@@ -62,7 +62,7 @@
       "@bobfrankston/freezepak": "^0.1.9",
       "@bobfrankston/importgen": "^0.1.43",
       "@bobfrankston/themecolors": "^0.1.10",
-      "@bobfrankston/userconfig": "^1.0.13",
+      "@bobfrankston/userconfig": "^1.0.15",
       "@npmcli/package-json": "^7.0.4",
       "json5": "^2.2.3",
       "libnpmversion": "^8.0.3",