@bobfrankston/npmglobalize 1.0.227 → 1.0.229

package/README.md

@@ -92,6 +92,8 @@ Before any transform/publish, `npmglobalize` walks the full `file:` dep graph an
 
 Errors abort (unless `--force`); warnings prompt to continue.
 
+An unscoped dependency with private intent is reported differently: it is not a question. npmglobalize never renames a dependency to add a scope (the name is what every consumer imports by, and changing it is the dep owner's own project), so the dep cannot reach npm and neither can the package that depends on it. The first run says so in full, names the dep and its path, records it under `unscopedDepsNoted` in the consumer's `.globalize.json5`, and stops. Later runs print one line per dep and stop. Nothing is asked, because no answer could change the outcome. Fix it in the dep: scope the name in its own `package.json`, or set `npmVisibility: "public"` or `noprefix: true` in its `.globalize.json5`; the note clears itself on the next run. If the cascade reaches such a dep anyway (`-no-prescan`), it stops there with the same message. The same holds when you run npmglobalize *in* an unscoped package: it used to ask "Add scope to package name?", and now it warns and assumes no, since a rename changes what every consumer imports. Publishing an unscoped package PUBLIC on purpose takes an explicit `-npm public` or `noprefix: true`. (2026-09-14)
+
 Skip the prescan with `-no-prescan` / `-nps`.
 
 #### Workspace skip prescan
@@ -369,6 +371,11 @@ How would you like to set up git?
   5) Abort
 ```
 
+The "Use local install only" line appears only for a package with a `bin` field.
+A library has nothing for a global install to expose, so it is not offered the
+option and the remaining lines are numbered without a gap. The same applies to
+the "No git repository found" and "No git remote configured" menus.
+
 **Adopt** runs:
 
 ```bash
@@ -470,7 +477,8 @@ not what you meant to publish, so npmglobalize lists the conflicted files and st
 -update-deps, -ud        Update package.json to latest versions (safe: minor/patch)
 -update-major            Allow major version updates (breaking changes)
 -publish-deps            Auto-publish file: dependencies (default)
--pd                      Like -publish-deps, plus auto-yes to dep-cascade prompts (private only)
+-pd                      Like -publish-deps, plus auto-yes to dep-cascade prompts (private only;
+                         npmglobalize never adds a scope to any package)
 -no-publish-deps, -npd   Skip auto-publishing file: dependencies
 -no-prescan, -nps        Skip upfront dep-graph prescan
 -force-publish           Republish dependencies even if version exists
@@ -785,7 +793,7 @@ Before transforming or publishing anything, `npmglobalize` builds `file:` depend
 For each project visited (the target and every transitive `file:` dep):
 
 - If `tsconfig.json` is missing or has `"noEmit": true` → **skip** (not a TypeScript build), unless the `build` script runs `importgen` — a plain-JS browser app still needs its import map regenerated.
-- If `tsconfig.json` exists but `package.json` has no `"build"` script → **prompt** to add `"build": "tsc"` (plus a `tsc -p <dir>` per sub-project — see below). Decline and that project is skipped.
+- If `tsconfig.json` exists but `package.json` has no `"build"` script → **add** `"build": "tsc"` without asking (2026-09-14; it used to prompt) (plus a `tsc -p <dir>` per sub-project — see below). Decline and that project is skipped.
 - Otherwise → run `npm run build`. A failure halts the cascade unless `-force` is passed.
 
 Cycle-safe via a shared visited set; each project is built at most once per run.
@@ -914,6 +922,10 @@ consumed: it is appended to `npmchanges.md` under a
 lost. Several local entries may share one version number — the date tells them
 apart. No git commit is made for it; the next real publish carries it along.
 
+On a library (no `bin`) there is nothing to install, and the output says so: `Local mode:
+<pkg> — library, nothing to install`. The `file:` deps are still built and the `.commitmsg`
+is still consumed; only the install step does not exist. (2026-09-14)
+
 ### Private Packages
 
 Packages with `"private": true` in `package.json` skip the npm publish step. Dependencies are still transformed and restored — the publish is the only thing skipped.

package/lib.d.ts

@@ -91,7 +91,8 @@ export interface GlobalizeOptions {
     updateMajor?: boolean;
     /** Publish file: dependencies before converting them */
     publishDeps?: boolean;
-    /** Auto-yes to dep-cascade prompts (add scope to make private, etc.); does NOT auto-yes public prompts */
+    /** Auto-yes to dep-cascade prompts (git setup, prescan warnings); does NOT auto-yes public
+     *  prompts. Cannot add a scope to a dep: the cascade never renames a dependency (2026-09-14). */
     publishDepsYes?: boolean;
     /** Cascade npmVisibility:"public" to all transitive workspace/file: deps without prompting.
      *  In workspace mode: fixpoint-promotes every workspace member reachable from a public consumer.
@@ -160,6 +161,12 @@ export interface GlobalizeOptions {
      *  following each entry's own .globalize.json5. FYI for now: recorded and
      *  displayed, nothing is updated automatically. */
     upstream?: UpstreamEntry[];
+    /** Bookkeeping, not a CLI option: unscoped `file:` deps this package was already told
+     *  about (dep name → date first noted). The first run explains why the dep, and this
+     *  package with it, will not reach npm until the dep's own package.json has a scope;
+     *  later runs print one line. Nothing is asked either time, since no answer could
+     *  change the outcome. Cleared automatically once the dep is scoped. (2026-09-14) */
+    unscopedDepsNoted?: Record<string, string>;
     /** Internal: signals this call is from workspace orchestrator */
     /** Skip the upfront dep-graph prescan */
     noPrescan?: boolean;
@@ -344,6 +351,9 @@ export declare function transformDeps(pkg: any, baseDir: string, verbose?: boole
 /** A problem discovered by the prescan. */
 export interface PrescanIssue {
     severity: 'error' | 'warning';
+    /** 'unscoped': an unscoped file: dep with private intent. Not an error and not a
+     *  question — globalize reports it once, remembers it, and stops. */
+    kind?: 'unscoped';
     package: string;
     path: string;
     message: string;
@@ -360,6 +370,17 @@ export declare function findUndeclaredImports(cwd: string, pkg: any): Undeclared
  *  user resolve all problems before starting the publish cascade instead of
  *  being interrupted mid-run. */
 export declare function prescanDepGraph(baseDir: string, visited?: Set<string>, verbose?: boolean): PrescanIssue[];
+/** Report unscoped `file:` deps found by the prescan, without asking anything.
+ *
+ *  An unscoped dep with private intent cannot reach npm, and npmglobalize does not
+ *  rename a dependency to fix that (the name is what every consumer imports by; scoping
+ *  it is the dep owner's own project). So the consumer in `cwd` cannot be published
+ *  either. Nothing the user could answer changes that, so there is no prompt: the first
+ *  run explains it in full, records the dep in `unscopedDepsNoted` in the consumer's
+ *  .globalize.json5, and later runs print one line per dep. Deps that have since been
+ *  scoped drop out of the record automatically.
+ *  2026-09-14 17:05 EDT — Claude Code (Fable 5.1), at Bob's direction. */
+export declare function reportUnscopedDeps(cwd: string, unscoped: PrescanIssue[]): void;
 /** Restore file: dependencies from .dependencies using a three-way merge that
  *  preserves any external modifications made since the last transform. */
 export declare function restoreDeps(pkg: any, verbose?: boolean): boolean;
@@ -677,6 +698,20 @@ export declare function promptText(message: string, defaultValue?: string): Prom
  * answer resolved null and every caller fell through to its default action, so a typo
  * silently did something. Now it says what it didn't understand and asks again.
  */
+/** One line of a numbered console menu. `action` is what the caller switches on;
+ *  the number the user types is assigned at display time, so lines can be
+ *  omitted without leaving gaps or shifting meanings. */
+export interface MenuOption {
+    label: string;
+    action: string;
+}
+/** Show `header` and the options numbered 1..N in display order, then read a
+ *  choice. Empty input takes the first option. Returns the chosen `action`.
+ *  2026-09-14 14:30 EDT — Claude Code (Fable 5.1), at Bob's direction. The git
+ *  setup menus were hand-numbered strings with a fixed "Use local install only"
+ *  line, so a library (no `bin`) was offered an install that doLocalInstall
+ *  would then skip. Options are now data, so a line can be left out. */
+export declare function promptMenu(header: string, options: MenuOption[]): Promise<string>;
 export declare function promptChoice(message: string, choices: string[]): Promise<string>;
 /** Initialize a local git repo by adopting history from an existing remote.
  *  Preserves the working tree — local files appear as uncommitted changes

package/lib.js

@@ -403,6 +403,9 @@ export function writeConfig(dir, config, explicitKeys) {
     if (config.upstream === undefined && existing.upstream !== undefined) {
         config = { ...config, upstream: existing.upstream };
     }
+    // unscopedDepsNoted is deliberately NOT carried across: reportUnscopedDeps clears it
+    // by omitting the key, and a publish-path writeConfig that drops it only means the
+    // full explanation prints once more. 2026-09-14
     const omitKeys = new Set(['cleanup', 'init', 'dryRun', 'message', 'conform', 'asis', 'help', 'error', 'updateDeps', 'updateMajor', 'publishDeps', 'publicDeps', 'forcePublish', 'once', 'cleanNestedModules']);
     for (const [key, value] of Object.entries(config)) {
         if (omitKeys.has(key))
@@ -480,7 +483,8 @@ export function writeConfig(dir, config, explicitKeys) {
         ['"usePaths": true', 'true = resolve file: deps from siblings; false = use latest npm version (standalone)'],
         ['"allowTs": false', 'true = include .ts source in npm tarball (auto-true for noEmit projects)'],
         ['"importgen": auto', 'Detected from .vscode/tasks.json / import map in HTML; false = never ask'],
-        ['"subProjects": auto', 'Sub-dirs with their own build script or tsconfig (e.g. ["client", "Sw"]); detected from .vscode/tasks.json; false = never ask']
+        ['"subProjects": auto', 'Sub-dirs with their own build script or tsconfig (e.g. ["client", "Sw"]); detected from .vscode/tasks.json; false = never ask'],
+        ['"unscopedDepsNoted": {}', 'Bookkeeping: unscoped file: deps already explained (name → date); cleared when the dep gets a scope']
     ];
     const refWidth = Math.max(...reference.map(([decl]) => decl.length));
     for (const [decl, note] of reference) {
@@ -1824,8 +1828,16 @@ export function prescanDepGraph(baseDir, visited = new Set(), verbose = false) {
                 continue;
             }
             const depName = targetPkg.name || name;
-            // Unscoped + private-intent: will trigger a mid-cascade scope prompt
-            if (!depName.startsWith('@')) {
+            // Unscoped + private-intent. This used to be a WARNING whose "continue" led
+            // into the cascade prompting to rename the dep by adding a scope. The cascade
+            // never renames a dependency now (see the _fromDep check in globalize), so it
+            // is flagged `kind: 'unscoped'` and globalize reports it without asking anything.
+            // Reported once per dep, not once per consumer edge: the recursion below
+            // dedupes via `visited`, but this check ran before it, so a dep shared by four
+            // packages printed four identical lines.
+            // 2026-09-14 16:40 EDT — Claude Code (Fable 5.1), at Bob's direction: "It
+            // shouldn't try to publish to a scope not in the package."
+            if (!depName.startsWith('@') && !visited.has(fs.realpathSync(targetPath))) {
                 const depConfig = readConfig(targetPath);
                 const depVis = depConfig.npmVisibility
                     ?? (targetPkg.publishConfig?.access === 'public' ? 'public' : undefined);
@@ -1833,10 +1845,11 @@ export function prescanDepGraph(baseDir, visited = new Set(), verbose = false) {
                 if (depVis !== 'public' && !noprefix) {
                     issues.push({
                         severity: 'warning',
+                        kind: 'unscoped',
                         package: depName,
                         path: targetPath,
-                        message: 'unscoped package — private publishing will prompt for a scope',
-                        suggestion: 'add a scope (e.g., @bobfrankston/) OR set npmVisibility="public" OR set noprefix=true in .globalize.json5'
+                        message: 'unscoped — not published to npm until its own package.json name has a scope',
+                        suggestion: 'scope it in ITS OWN package.json (e.g., @bobfrankston/), or set npmVisibility="public" or noprefix=true in its .globalize.json5'
                     });
                 }
             }
@@ -1846,6 +1859,60 @@ export function prescanDepGraph(baseDir, visited = new Set(), verbose = false) {
     }
     return issues;
 }
+/** Report unscoped `file:` deps found by the prescan, without asking anything.
+ *
+ *  An unscoped dep with private intent cannot reach npm, and npmglobalize does not
+ *  rename a dependency to fix that (the name is what every consumer imports by; scoping
+ *  it is the dep owner's own project). So the consumer in `cwd` cannot be published
+ *  either. Nothing the user could answer changes that, so there is no prompt: the first
+ *  run explains it in full, records the dep in `unscopedDepsNoted` in the consumer's
+ *  .globalize.json5, and later runs print one line per dep. Deps that have since been
+ *  scoped drop out of the record automatically.
+ *  2026-09-14 17:05 EDT — Claude Code (Fable 5.1), at Bob's direction. */
+export function reportUnscopedDeps(cwd, unscoped) {
+    const config = readConfig(cwd);
+    const noted = { ...(config.unscopedDepsNoted ?? {}) };
+    if (unscoped.length === 0 && Object.keys(noted).length === 0)
+        return; // nothing to say, nothing to forget
+    let consumerName;
+    try {
+        consumerName = readPackageJson(cwd).name || path.basename(cwd);
+    }
+    catch {
+        consumerName = path.basename(cwd);
+    }
+    const today = new Date().toISOString().slice(0, 10);
+    let changed = false;
+    for (const issue of unscoped) {
+        const when = noted[issue.package];
+        if (when) {
+            console.log(colors.yellow(`${issue.package} still unscoped (noted ${when}) — ${consumerName} is not published to npm until ${issue.package} has a scope.`));
+            continue;
+        }
+        console.log(colors.yellow(`${issue.package} is unscoped, so it will not be published to npm until the name in its package.json has a scope.`));
+        console.log(colors.yellow(`${consumerName} depends on ${issue.package} and will not be published to npm either.`));
+        console.log(colors.dim(`  ${issue.package} is at ${issue.path}`));
+        console.log(colors.dim(`  → ${issue.suggestion}`));
+        console.log(colors.dim(`  Noted in ${path.join(cwd, '.globalize.json5')}; later runs print one line for ${issue.package}.`));
+        noted[issue.package] = today;
+        changed = true;
+    }
+    // Forget deps that are no longer reported: they were scoped (or made public) since.
+    const stillUnscoped = new Set(unscoped.map(i => i.package));
+    for (const name of Object.keys(noted)) {
+        if (stillUnscoped.has(name))
+            continue;
+        delete noted[name];
+        changed = true;
+    }
+    if (changed) {
+        const next = { ...config };
+        delete next.unscopedDepsNoted;
+        if (Object.keys(noted).length)
+            next.unscopedDepsNoted = noted;
+        writeConfig(cwd, next);
+    }
+}
 /** Restore file: dependencies from .dependencies using a three-way merge that
  *  preserves any external modifications made since the last transform. */
 export function restoreDeps(pkg, verbose = false) {
@@ -3537,12 +3604,17 @@ export async function ensureBuildScript(cwd) {
         const subs = await readySubProjects(cwd, readConfig(cwd));
         const tscParts = ['tsc', ...subs.map(subProjectBuildCommand)];
         const newScript = [...(existingBuild ? [existingBuild] : []), ...tscParts].join(' && ');
+        // No question here: a TypeScript project that emits needs a build script, and
+        // "tsc" is the only sensible one, so the answer was always yes. The prompt cost
+        // a keystroke per package for no decision. The importgen and sub-project prompts
+        // above stay, since those rewrite a build script that already works.
+        // 2026-09-14 18:05 EDT — Claude Code (Fable 5.1), at Bob's direction ("is there
+        // a command option to avoid having to answer questions like whether to update
+        // tsconfig?" — and "-yes is too general", so the question is gone instead).
         console.log(colors.yellow(`TypeScript project has no "build" script in ${pkg.name || cwd}`));
         for (const s of subs)
             console.log(colors.yellow(`  sub-project ${s.dir}/ — ${s.reason}`));
-        const addIt = await confirm(`Add "build": "${newScript}" to ${pkg.name || path.basename(cwd)}'s package.json?`, true);
-        if (!addIt)
-            return null;
+        console.log(colors.cyan(`  Adding "build": "${newScript}" to ${pkg.name || path.basename(cwd)}'s package.json`));
         if (!pkg.scripts)
             pkg.scripts = {};
         pkg.scripts.build = newScript;
@@ -5546,13 +5618,21 @@ export async function promptText(message, defaultValue) {
         });
     });
 }
-/**
- * Prompt user for multiple choice. Re-asks until the answer is one of `choices`.
- *
- * 2026-09-01 — Claude Code (Fable 5.1), at Bob's direction. Previously an unrecognized
- * answer resolved null and every caller fell through to its default action, so a typo
- * silently did something. Now it says what it didn't understand and asks again.
- */
+/** Show `header` and the options numbered 1..N in display order, then read a
+ *  choice. Empty input takes the first option. Returns the chosen `action`.
+ *  2026-09-14 14:30 EDT — Claude Code (Fable 5.1), at Bob's direction. The git
+ *  setup menus were hand-numbered strings with a fixed "Use local install only"
+ *  line, so a library (no `bin`) was offered an install that doLocalInstall
+ *  would then skip. Options are now data, so a line can be left out. */
+export function promptMenu(header, options) {
+    const lines = options.map((o, i) => `  ${i + 1}) ${o.label}`);
+    const message = `${header}\n${lines.join('\n')}\nChoice [1]:`;
+    const valid = options.map((_, i) => String(i + 1));
+    return promptChoice(message, [...valid, '']).then(choice => {
+        const index = choice === '' ? 0 : Number(choice) - 1;
+        return options[index].action;
+    });
+}
 export function promptChoice(message, choices) {
     const rl = readline.createInterface({
         input: process.stdin,
@@ -6711,15 +6791,21 @@ async function doLocalInstall(cwd, options) {
     const pkg = readPackageJson(cwd);
     const pkgName = pkg.name || path.basename(cwd);
     const pkgVersion = pkg.version || '0.0.0';
+    // A library has no bin, so there is nothing to install: say what actually happens
+    // (deps built, notes recorded, no publish) instead of announcing an install and
+    // then taking it back. 2026-09-14 17:50 EDT — Claude Code (Fable 5.1), at Bob's
+    // direction: "why mention local install when there is no install".
+    if (!pkg.bin) {
+        console.log(colors.blue(`Local mode: ${pkgName}@${pkgVersion} — library, nothing to install`));
+        console.log(colors.dim('Not transformed or published; file: deps left as-is'));
+        console.log(colors.dim('  (switch back to the publish flow with -global)'));
+        recordLocalChange(cwd, pkgVersion, dryRun);
+        return true;
+    }
     console.log(colors.blue(`Local install: ${pkgName}@${pkgVersion}`));
     console.log(colors.dim('Skipping transform/publish — installing with file: deps as-is'));
     console.log(colors.dim('  (switch back to the publish flow with -global)'));
-    // Record before the bin check: a library's notes are history too.
     recordLocalChange(cwd, pkgVersion, dryRun);
-    if (!pkg.bin) {
-        console.log(colors.dim(`  (library — skipping global install)`));
-        return true;
-    }
     if (dryRun) {
         console.log('  [dry-run] Would run: npm install -g .');
         if (wsl)
@@ -6856,10 +6942,17 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
     // any transform/publish, so the user can fix them once and run clean.
     // Only run at the top level (not during recursive cascade or workspace).
     if (!noPrescan && !cleanup && !options._fromDep && !options._fromWorkspace) {
-        const issues = prescanDepGraph(cwd, new Set(), verbose);
+        const allIssues = prescanDepGraph(cwd, new Set(), verbose);
+        // Unscoped deps are handled apart from the error/warning prompt below: nothing the
+        // user answers could change the outcome, so nothing is asked. Report, remember,
+        // stop. See reportUnscopedDeps.
+        // 2026-09-14 17:05 EDT — Claude Code (Fable 5.1), at Bob's direction: "The message
+        // should simply point it out won't be published to npm till the scope is fixed and
+        // then remember I was warned. It shouldn't [need] a response because nothing would
+        // be done."
+        const unscoped = allIssues.filter(i => i.kind === 'unscoped');
+        const issues = allIssues.filter(i => i.kind !== 'unscoped');
         if (issues.length > 0) {
-            const errors = issues.filter(i => i.severity === 'error');
-            const warnings = issues.filter(i => i.severity === 'warning');
             console.log(colors.yellow(`Prescan found ${issues.length} issue(s) in the file: dep graph:`));
             for (const i of issues) {
                 const tag = i.severity === 'error' ? colors.red('ERROR') : colors.yellow('WARN');
@@ -6869,6 +6962,18 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
                     console.log(colors.dim(`       → ${i.suggestion}`));
             }
             console.log('');
+        }
+        // Always called: with nothing unscoped it only forgets deps that were noted
+        // earlier and have since been scoped.
+        reportUnscopedDeps(cwd, unscoped);
+        if (unscoped.length > 0) {
+            // The run stops here regardless of the other issues, so the continue prompt
+            // below is skipped: it would ask a question whose answer changes nothing.
+            return false;
+        }
+        if (issues.length > 0) {
+            const errors = issues.filter(i => i.severity === 'error');
+            const warnings = issues.filter(i => i.severity === 'warning');
             if (errors.length > 0 && !force) {
                 console.error(colors.red(`Prescan aborted: ${errors.length} error(s). Fix them or rerun with --force.`));
                 return false;
@@ -7016,6 +7121,19 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
     const gitStatus = getGitStatus(cwd);
     // Handle init mode
     let justInitialized = false;
+    // 2026-09-14 14:30 EDT — Claude Code (Fable 5.1), at Bob's direction. The git
+    // setup menus below offer "Use local install only" — a global npm install of
+    // this package. That is only meaningful for a CLI (a package with `bin`);
+    // doLocalInstall skips a library anyway, so a library is not offered the line.
+    const hasBin = !!readPackageJson(cwd).bin;
+    const localInstallOption = hasBin
+        ? [{ label: 'Use local install only (skip git/publish)', action: 'local' }]
+        : [];
+    const switchToLocalInstall = () => {
+        console.log(colors.dim('Switching to local-only mode...'));
+        writeConfig(cwd, { ...configOptions, localInstall: true }, new Set(['localInstall']));
+        return doLocalInstall(cwd, options);
+    };
     if (!gitStatus.isRepo) {
         console.log('No git repository found.');
         // Probe for an existing remote we could adopt history from.
@@ -7069,55 +7187,54 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
             // a reader who wanted the second line typed 2 and got something else. Bob:
             // "I type 2 when I mean a because that's what humans do." Options are now
             // numbered in display order; the ALL variant is 2, directly under the single.
-            let choice;
+            // 2026-09-14 — Claude Code (Fable 5.1): menus are now promptMenu option
+            // lists; the local-install line is present only for a package with `bin`.
+            // The "No git repository found." header is printed once, above.
+            let action;
             if (adoptable) {
-                choice = await promptChoice('How would you like to set up git?\n'
-                    + '  1) Adopt history from existing remote (recommended)\n'
-                    + '  2) Adopt for ALL remaining deps (don\'t ask again)\n'
-                    + '  3) Initialize fresh git repository\n'
-                    + '  4) Use local install only (skip git/publish)\n'
-                    + '  5) Abort\nChoice [1]:', ['1', '2', '3', '4', '5', '']);
-                if (choice === '4') {
-                    console.log(colors.dim('Switching to local-only mode...'));
-                    writeConfig(cwd, { ...configOptions, localInstall: true }, new Set(['localInstall']));
-                    return doLocalInstall(cwd, options);
-                }
-                if (choice === '5') {
+                action = await promptMenu('How would you like to set up git?', [
+                    { label: 'Adopt history from existing remote (recommended)', action: 'adopt' },
+                    { label: 'Adopt for ALL remaining deps (don\'t ask again)', action: 'adopt-all' },
+                    { label: 'Initialize fresh git repository', action: 'init' },
+                    ...localInstallOption,
+                    { label: 'Abort', action: 'abort' },
+                ]);
+                if (action === 'local')
+                    return switchToLocalInstall();
+                if (action === 'abort') {
                     console.log('Aborted. Run with --init to initialize.');
                     return false;
                 }
-                if (choice === '2')
+                if (action === 'adopt-all')
                     options.autoInit = true;
-                if (choice === '3') {
+                if (action === 'init') {
                     const success = await initGit(cwd, gitVisibility, dryRun, allowTs);
                     if (!success)
                         return false;
                 }
                 else {
-                    // '1', '2', '' default → adopt
+                    // 'adopt' or 'adopt-all'
                     const success = await adoptExistingRemote(cwd, adoptable.url, adoptable.defaultBranch, dryRun);
                     if (!success)
                         return false;
                 }
             }
             else {
-                choice = await promptChoice('No git repository found. What would you like to do?\n'
-                    + '  1) Initialize git repository\n'
-                    + '  2) Initialize for ALL remaining deps (don\'t ask again)\n'
-                    + '  3) Use local install only (skip git/publish)\n'
-                    + '  4) Abort\nChoice [1]:', ['1', '2', '3', '4', '']);
-                if (choice === '3') {
-                    console.log(colors.dim('Switching to local-only mode...'));
-                    writeConfig(cwd, { ...configOptions, localInstall: true }, new Set(['localInstall']));
-                    return doLocalInstall(cwd, options);
-                }
-                if (choice === '4') {
+                action = await promptMenu('What would you like to do?', [
+                    { label: 'Initialize git repository', action: 'init' },
+                    { label: 'Initialize for ALL remaining deps (don\'t ask again)', action: 'init-all' },
+                    ...localInstallOption,
+                    { label: 'Abort', action: 'abort' },
+                ]);
+                if (action === 'local')
+                    return switchToLocalInstall();
+                if (action === 'abort') {
                     console.log('Aborted. Run with --init to initialize.');
                     return false;
                 }
-                if (choice === '2')
+                if (action === 'init-all')
                     options.autoInit = true;
-                // choice is '1', '2', or '' (default) → init
+                // 'init' or 'init-all'
                 const success = await initGit(cwd, gitVisibility, dryRun, allowTs);
                 if (!success)
                     return false;
@@ -7143,22 +7260,21 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
     else if (!gitStatus.hasRemote) {
         // Git repo exists but no remote - need to create GitHub repo
         if (!init && !options.autoInit && !publishDepsYes) {
-            // 2026-09-01 — Claude Code (Fable 5.1): renumbered from "1 a 2 3" (see note above).
-            const choice = await promptChoice('No git remote configured. What would you like to do?\n'
-                + '  1) Create GitHub repository\n'
-                + '  2) Create for ALL remaining deps (don\'t ask again)\n'
-                + '  3) Use local install only (skip git/publish)\n'
-                + '  4) Abort\nChoice [1]:', ['1', '2', '3', '4', '']);
-            if (choice === '3') {
-                console.log(colors.dim('Switching to local-only mode...'));
-                writeConfig(cwd, { ...configOptions, localInstall: true }, new Set(['localInstall']));
-                return doLocalInstall(cwd, options);
-            }
-            if (choice === '4') {
+            // 2026-09-14 — Claude Code (Fable 5.1): promptMenu option list; local-install
+            // line only for a package with `bin` (see hasBin above).
+            const action = await promptMenu('No git remote configured. What would you like to do?', [
+                { label: 'Create GitHub repository', action: 'create' },
+                { label: 'Create for ALL remaining deps (don\'t ask again)', action: 'create-all' },
+                ...localInstallOption,
+                { label: 'Abort', action: 'abort' },
+            ]);
+            if (action === 'local')
+                return switchToLocalInstall();
+            if (action === 'abort') {
                 console.log('Aborted. Run with --init to set up GitHub repository.');
                 return false;
             }
-            if (choice === '2') {
+            if (action === 'create-all') {
                 options.autoInit = true;
             }
         }
@@ -7417,45 +7533,33 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
             publicConfirmed = true;
         }
     }
+    // An unscoped name cannot be published privately, and npmglobalize does not rename a
+    // package to fix that: the name is what every consumer imports by, so adding a scope
+    // is the package owner's own project, not a publish-time side effect. This used to
+    // ask "Add scope to package name?"; now it warns and assumes no, for a dependency in
+    // the cascade and for the package itself alike. Publishing unscoped as PUBLIC takes an
+    // explicit -npm public, or noprefix: true in .globalize.json5 (the escape hatch the
+    // prescan honors too).
+    // 2026-09-14 18:10 EDT — Claude Code (Fable 5.1), at Bob's direction: "It shouldn't try
+    // to publish to a scope not in the package" and, on the prompt in the package itself,
+    // "For libraries that is problematic since other programs are affected so just warn
+    // and assume no."
+    const unscopedAllowed = readConfig(cwd).noprefix === true;
+    if (!isScoped && effectiveNpmVisibility !== 'public' && currentAccess !== 'public' && !unscopedAllowed) {
+        const scopeHint = readUserNpmConfig().scope || '@scope';
+        console.log(colors.yellow(`${pkg.name} is unscoped, so it cannot be published privately. Not publishing until the name in ${path.join(cwd, 'package.json')} has a scope (e.g., ${scopeHint}/${pkg.name}).`));
+        console.log(colors.dim(`  npmglobalize does not rename packages. To publish it unscoped and PUBLIC on purpose: -npm public, or noprefix: true in .globalize.json5.`));
+        return false;
+    }
     if (effectiveNpmVisibility === 'private') {
         // User explicitly wants private publication
         if (!isScoped) {
-            // Offer to add scope — check .userconfig first, then npm whoami
-            const userConfig = readUserNpmConfig();
-            const auth = checkNpmAuth();
-            const defaultScope = userConfig.scope
-                || (auth.username ? `@${auth.username}` : undefined);
-            const scopedExample = defaultScope ? `${defaultScope}/${pkg.name}` : `@scope/${pkg.name}`;
-            console.log(colors.yellow(`Private packages must be scoped (e.g., ${scopedExample})`));
-            if (dryRun) {
-                console.log('  [dry-run] Would prompt to add scope');
-                return false;
-            }
-            const addScope = await confirm(`Add scope to package name?`, true);
-            if (!addScope) {
-                return false;
-            }
-            const scope = await promptText('Scope:', defaultScope);
-            if (!scope) {
-                console.error(colors.red('No scope provided. Aborting.'));
-                return false;
-            }
-            // Normalize: ensure it starts with @
-            const normalizedScope = scope.startsWith('@') ? scope : `@${scope}`;
-            const newName = `${normalizedScope}/${pkg.name}`;
-            pkg.name = newName;
-            isScoped = true;
-            currentAccess = checkNpmAccess(newName);
-            writePackageJson(cwd, pkg);
-            console.log(colors.green(`✓ Renamed package to ${newName}`));
-            // Save scope to .userconfig if not already there
-            if (!userConfig.scope) {
-                const saveScope = await confirm(`Save scope "${normalizedScope}" to global config (${getUserConfigDir()}\\npm.json5)?`, true);
-                if (saveScope) {
-                    writeUserNpmConfig({ scope: normalizedScope });
-                    console.log(colors.green(`✓ Saved default scope to ${getUserConfigDir()}\\npm.json5`));
-                }
-            }
+            // Only reachable with noprefix: true (the unscoped guard above returned
+            // otherwise). noprefix says "publish unscoped", private says "restricted",
+            // and npm cannot do both. The rename prompt that used to live here is gone
+            // (2026-09-14, see the guard above).
+            console.log(colors.yellow(`${pkg.name} is unscoped (noprefix) and npm cannot restrict an unscoped package. Not publishing; use -npm public to publish it unscoped and PUBLIC.`));
+            return false;
         }
         if (currentAccess === 'public') {
             console.log(colors.yellow(`Package '${pkg.name}' is currently PUBLIC on npm. Converting to private...`));
@@ -7527,47 +7631,10 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
                 console.log(colors.dim(`  Use --npm public to make it public`));
             }
             else {
-                // Unscoped new package — prompt to add scope (same as explicit-private path)
-                const ucfg = readUserNpmConfig();
-                const auth2 = checkNpmAuth();
-                const defaultScope = ucfg.scope
-                    || (auth2.username ? `@${auth2.username}` : undefined);
-                const scopedExample = defaultScope ? `${defaultScope}/${pkg.name}` : `@scope/${pkg.name}`;
-                console.log(colors.yellow(`WARNING: Package '${pkg.name}' is unscoped and will be PUBLIC.`));
-                console.log(colors.yellow(`  Unscoped packages cannot be private on npm.`));
-                if (dryRun) {
-                    console.log(`  [dry-run] Would prompt to add scope (e.g., ${scopedExample})`);
-                }
-                else {
-                    const addScope = await confirm(`Add scope to make it private (e.g., ${scopedExample})?`, true);
-                    if (addScope) {
-                        const scope = await promptText('Scope:', defaultScope);
-                        if (scope) {
-                            const normalizedScope = scope.startsWith('@') ? scope : `@${scope}`;
-                            const newName = `${normalizedScope}/${pkg.name}`;
-                            pkg.name = newName;
-                            isScoped = true;
-                            currentAccess = checkNpmAccess(newName);
-                            writePackageJson(cwd, pkg);
-                            console.log(colors.green(`✓ Renamed package to ${newName}`));
-                            if (!ucfg.scope) {
-                                const saveScope = await confirm(`Save scope "${normalizedScope}" to global config (${getUserConfigDir()}\\npm.json5)?`, true);
-                                if (saveScope) {
-                                    writeUserNpmConfig({ scope: normalizedScope });
-                                    console.log(colors.green(`✓ Saved default scope to ${getUserConfigDir()}\\npm.json5`));
-                                }
-                            }
-                        }
-                        else {
-                            console.log(colors.yellow(`  No scope provided. Continuing as public.`));
-                            console.log(colors.yellow(`  Use --npm public to suppress this prompt.`));
-                        }
-                    }
-                    else {
-                        console.log(colors.yellow(`  Continuing as public.`));
-                        console.log(colors.yellow(`  Use --npm public to suppress this prompt.`));
-                    }
-                }
+                // Unscoped new package. Only reachable with noprefix: true (the unscoped
+                // guard above returned otherwise), so publishing it PUBLIC is the stated
+                // intent. The rename prompt that used to live here is gone (2026-09-14).
+                console.log(colors.yellow(`Package '${pkg.name}' is unscoped (noprefix) and will publish as PUBLIC — npm cannot restrict an unscoped package.`));
             }
         }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/npmglobalize",
-  "version": "1.0.227",
+  "version": "1.0.229",
   "description": "Transform file: dependencies to npm versions for publishing",
   "main": "index.js",
   "type": "module",
@@ -34,7 +34,7 @@
     "@bobfrankston/freezepak": "^0.1.9",
     "@bobfrankston/importgen": "^0.1.43",
     "@bobfrankston/themecolors": "^0.1.10",
-    "@bobfrankston/userconfig": "^1.0.13",
+    "@bobfrankston/userconfig": "^1.0.15",
     "@npmcli/package-json": "^7.0.4",
     "json5": "^2.2.3",
     "libnpmversion": "^8.0.3",
@@ -62,7 +62,7 @@
       "@bobfrankston/freezepak": "^0.1.9",
       "@bobfrankston/importgen": "^0.1.43",
       "@bobfrankston/themecolors": "^0.1.10",
-      "@bobfrankston/userconfig": "^1.0.13",
+      "@bobfrankston/userconfig": "^1.0.15",
       "@npmcli/package-json": "^7.0.4",
       "json5": "^2.2.3",
       "libnpmversion": "^8.0.3",