@bobfrankston/npmglobalize 1.0.232 → 1.0.234

package/README.md

@@ -94,6 +94,8 @@ Errors abort (unless `--force`); warnings prompt to continue.
 
 An unscoped dependency with private intent is reported differently: it is not a question. npmglobalize never renames a dependency to add a scope (the name is what every consumer imports by, and changing it is the dep owner's own project), so the dep cannot reach npm and neither can the package that depends on it. The first run says so in full, names the dep and its path, records it under `unscopedDepsNoted` in the consumer's `.globalize.json5`, and stops. Later runs print one line per dep and stop. Nothing is asked, because no answer could change the outcome. Fix it in the dep: scope the name in its own `package.json`, or set `npmVisibility: "public"` or `noprefix: true` in its `.globalize.json5`; the note clears itself on the next run. If the cascade reaches such a dep anyway (`-no-prescan`), it stops there with the same message. The same holds when you run npmglobalize *in* an unscoped package: it used to ask "Add scope to package name?", and now it warns and assumes no, since a rename changes what every consumer imports. Publishing an unscoped package PUBLIC on purpose takes an explicit `-npm public` or `noprefix: true`. (2026-09-14)
 
+**Own-scope packages installed from npm instead of linked.** When a package in the `file:` graph depends on one of its own-scope packages by version range (`"@bobfrankston/miscassists": "^1.0.61"`) rather than `file:`, npm puts a registry copy in that package's `node_modules` instead of a link to the local source. The consumer is usually nested under other `file:` deps, where neither the `+` list nor the dependency tree shows it, so the prescan lists every such edge on every run: consumer → dep and range, the `package.json` that holds the range, and — when the same dep is linked as `file:` elsewhere in the graph — the directory of its local source (that package then exists twice). Each finding is repeated as one line in the end-of-run **Issues Summary**, because the prescan block has scrolled away by the time a cascade finishes. Nothing is asked and the run continues; a range can be deliberate. A package with `"files": false` in its `.globalize.json5` keeps npm refs on purpose and is not listed. npmglobalize does not rewrite the range: change it to a `file:` path in the named `package.json`, then run `npmglobalize` in that package. (2026-09-21)
+
 Skip the prescan with `-no-prescan` / `-nps`.
 
 #### Workspace skip prescan
@@ -347,6 +349,8 @@ For single-developer projects, this safely pulls remote changes before publishin
 
 **GitHub Push Protection (GH013)**: When GitHub's secret scanning blocks a push, `npmglobalize` detects the error and checks whether the flagged secrets are actually safe. For Google OAuth desktop/installed app credentials (where the "client_secret" is just a public app identifier, not a real secret), it automatically bypasses push protection via the GitHub API (`gh` CLI required) and retries the push. For other secret types, it displays the unblock URLs with guidance.
 
+**Stale git lock files**: A git that dies mid-write leaves its lock behind (`.git/config.lock`, `.git/index.lock`), and every later git refuses with `could not lock config file …: File exists` or `Unable to create '….lock': File exists`. When a git command fails that way and the lock is more than 10 seconds old, `npmglobalize` deletes the lock, names the file it deleted, and retries the command once. A younger lock may belong to a git that is writing right now, so it is left alone and the failure is reported with the lock's path and age. (2026-09-21)
+
 **Note:** This tool is designed for single-developer, single-branch workflows where automatic rebase and tag cleanup are safe operations.
 
 ### 📂 Git Repository Setup
@@ -804,8 +808,7 @@ npmglobalize --dry-run     # See what would happen
 
 ### Build Cascade
 
-Before anything is built, every project in the `file:` tree with missing deps gets an `npm install`. If one fails, the run **stops** there — the compiler/linker/npm lines that name the failure are printed (the full output goes to a log under `%TEMP%
-pmglobalize-logs`), the failure is repeated in the Issues Summary, and nothing is built, published, or installed on top of a broken tree. `-force` continues anyway. A stale-lockfile / junction failure offers a clean reinstall (delete `node_modules/` + `package-lock.json`, retry once); a compiler or linker error does not, since a reinstall would reach the same line.
+Before anything is built, every project in the `file:` tree with missing deps gets an `npm install`. If one fails, the run **stops** there — the compiler/linker/npm lines that name the failure are printed (the full output goes to a log under `%TEMP%\npmglobalize-logs`), the failure is repeated in the Issues Summary, and nothing is built, published, or installed on top of a broken tree. `-force` continues anyway. A stale-lockfile / junction failure offers a clean reinstall (delete `node_modules/` + `package-lock.json`, retry once); a compiler or linker error does not, since a reinstall would reach the same line.
 
 Before transforming or publishing anything, `npmglobalize` builds `file:` dependencies in topological order — deps before consumers — and then builds the target itself. This guarantees the target's `tsc` reads up-to-date `.d.ts` and `.js` from sibling checkouts even when a dep's source has changed since its last build.
 
@@ -815,6 +818,13 @@ For each project visited (the target and every transitive `file:` dep):
 - If `tsconfig.json` exists but `package.json` has no `"build"` script → **add** `"build": "tsc"` without asking (2026-09-14; it used to prompt) (plus a `tsc -p <dir>` per sub-project — see below). Decline and that project is skipped.
 - Otherwise → run `npm run build`. A failure halts the cascade unless `-force` is passed.
 
+When a build fails, every tsc diagnostic is printed with the file's **absolute path**
+(`Y:\dev\utils\pings\index.ts(23,27): error TS2307: …`) and the failure line names the
+directory the build ran in (`Build failed in @bobfrankston/pings (Y:\dev\utils\pings)`).
+tsc itself prints paths relative to its working directory, which in a cascade is one of
+many dep directories, so a bare `index.ts` would not say which package to open. The
+Issues Summary carries the same absolute path. (2026-09-14)
+
 Cycle-safe via a shared visited set; each project is built at most once per run.
 
 This complements the existing publish cascade (which ensures version refs are correct) by closing the build-freshness gap that `npm install` alone left open.
@@ -869,6 +879,24 @@ Before each build, when the global `tsc` is version 6 or newer, `npmglobalize` p
 
 If the patch can't be applied for some reason and the build still fails with `TS2591`, the failure summary prints a hint to add `"types": ["node"]` manually.
 
+### `nul` Files Are Deleted Before Staging
+
+A file literally named `nul` is a dropping from `>nul` run under a shell that creates the
+file instead of discarding the output. Git on Windows cannot index one — `git add` stops with
+`error: invalid path 'nul'` / `unable to add 'nul' to index` (or `short read while indexing nul`).
+
+Every `git add -A` that `npmglobalize` runs — the pre-release commit, `-init`, the index
+rebuild, and the pre-version cleanups — first deletes any `nul` file in the tree (any case;
+`node_modules/` is not searched) and names each one it deleted:
+
+```
+  Deleted 'nul' file Y:\dev\utils\pings\nul (Windows reserved name — git cannot add it)
+```
+
+A `nul` file that cannot be deleted is reported with the reason, since the `git add` that
+follows will fail on it. (2026-09-20; before that only the pre-release commit did the
+cleanup, silently.)
+
 ### The `.dependencies` Backup (Internal/Transient)
 
 **You should never see `.dependencies` in your `package.json` under normal operation.** It is a temporary internal backup that exists only during the brief publish cycle and is removed automatically when the cycle completes.

package/lib.d.ts

@@ -29,6 +29,15 @@ export declare function extractFirstTscError(output: string): string | null;
  *  — in order, deduplicated, untruncated. For reports where the reader will act on each
  *  line (the imports a nodenext migration surfaces), as opposed to the one-line summary
  *  extractFirstTscError gives. (2026-09-14) */
+/** Rewrite tsc's cwd-relative file paths to absolute ones, in both of tsc's
+ *  diagnostic shapes: `index.ts(23,27): error TS2307: …` and the pretty form
+ *  `index.ts:23:27 - error TS2307: …`. tsc prints paths relative to the directory
+ *  it ran in, and in a cascade that is one of many dep directories, so a bare
+ *  `index.ts` says nothing about which package's file is broken.
+ *  2026-09-14 15:40 EDT — Claude Code (Fable 5.1), at Bob's direction: "the error
+ *  messages should be preceded by the path to look at" — a relative `index.ts:23`
+ *  from a dep build cost a long hunt across pings and its interfaces dep. */
+export declare function anchorTscPaths(output: string, cwd: string): string;
 export declare function extractTscErrors(output: string): string[];
 /** One relative import rewritten by fixImportExtensions. */
 export interface ImportExtensionFix {
@@ -86,6 +95,17 @@ export declare function fixImportExtensions(cwd: string, output: string, opts?:
  *  Recognize the shape and say what actually fixes it.
  *  Returns one diagnosis line per untyped module; empty when TS7016 has another cause. */
 export declare function diagnoseUntypedDeps(cwd: string, buildOutput: string): string[];
+/** Stage everything (`git add -A`), first deleting any 'nul' files in the tree.
+ *  A 'nul' file is a dropping from `>nul` run under a shell that creates it instead of discarding
+ *  it; git on Windows cannot index one ("invalid path 'nul'" / "short read while indexing nul").
+ *  Every `git add -A` goes through this one function so no staging path can miss the cleanup
+ *  (2026-09-20, Claude Code: only the pre-release commit did it; -init, the index rebuild and the
+ *  two pre-version cleanups did not). */
+export declare function gitAddAll(cwd: string): {
+    success: boolean;
+    output: string;
+    stderr: string;
+};
 /** One package that depends on this one, recorded in this package's
  *  .globalize.json5 when that package publishes. */
 export interface UpstreamEntry {
@@ -403,10 +423,17 @@ export declare function transformDeps(pkg: any, baseDir: string, verbose?: boole
 export interface PrescanIssue {
     severity: 'error' | 'warning';
     /** 'unscoped': an unscoped file: dep with private intent. Not an error and not a
-     *  question — globalize reports it once, remembers it, and stops. */
-    kind?: 'unscoped';
+     *  question — globalize reports it once, remembers it, and stops.
+     *  'registryRef': a package in the file: graph depends on one of its own-scope packages
+     *  by version range instead of file: — reported by reportRegistryRefs, nothing asked. */
+    kind?: 'unscoped' | 'registryRef';
     package: string;
+    /** For 'registryRef': the directory of the CONSUMER whose package.json holds the range. */
     path: string;
+    /** 'registryRef' only: name of the package whose package.json declares the dep. */
+    consumer?: string;
+    /** 'registryRef' only: the spec as written (`^1.0.61`). */
+    range?: string;
     message: string;
     suggestion?: string;
 }
@@ -420,7 +447,16 @@ export declare function findUndeclaredImports(cwd: string, pkg: any): Undeclared
  *  unresolvable paths, missing package.json, unpublished transitives. Lets the
  *  user resolve all problems before starting the publish cascade instead of
  *  being interrupted mid-run. */
-export declare function prescanDepGraph(baseDir: string, visited?: Set<string>, verbose?: boolean): PrescanIssue[];
+export declare function prescanDepGraph(baseDir: string, visited?: Set<string>, verbose?: boolean, fileTargets?: Map<string, string>): PrescanIssue[];
+/** Report own-scope packages that some package in the file: graph takes from the registry
+ *  (a version range) instead of from local source. Nothing is asked and the run continues: a
+ *  range can be deliberate, and the fix is an edit to the CONSUMER's package.json, which is not
+ *  npmglobalize's to make. It is printed on every run because the consumer is usually nested
+ *  under other file: deps, where neither the `+` list nor the dependency tree shows it.
+ *  `fileTargets` is the map prescanDepGraph filled: when the same package is linked as file:
+ *  elsewhere in the graph, its directory is named — that package then exists twice, the linked
+ *  source and the registry copy in the consumer's node_modules. */
+export declare function reportRegistryRefs(registryRefs: PrescanIssue[], fileTargets: Map<string, string>): void;
 /** Report unscoped `file:` deps found by the prescan, without asking anything.
  *
  *  An unscoped dep with private intent cannot reach npm, and npmglobalize does not

package/lib.js

@@ -82,6 +82,23 @@ export function extractFirstTscError(output) {
  *  — in order, deduplicated, untruncated. For reports where the reader will act on each
  *  line (the imports a nodenext migration surfaces), as opposed to the one-line summary
  *  extractFirstTscError gives. (2026-09-14) */
+/** Rewrite tsc's cwd-relative file paths to absolute ones, in both of tsc's
+ *  diagnostic shapes: `index.ts(23,27): error TS2307: …` and the pretty form
+ *  `index.ts:23:27 - error TS2307: …`. tsc prints paths relative to the directory
+ *  it ran in, and in a cascade that is one of many dep directories, so a bare
+ *  `index.ts` says nothing about which package's file is broken.
+ *  2026-09-14 15:40 EDT — Claude Code (Fable 5.1), at Bob's direction: "the error
+ *  messages should be preceded by the path to look at" — a relative `index.ts:23`
+ *  from a dep build cost a long hunt across pings and its interfaces dep. */
+export function anchorTscPaths(output, cwd) {
+    if (!output)
+        return output;
+    return output.replace(/^(.+?)((?:\(\d+,\d+\):|:\d+:\d+ -) error TS\d+: )/gm, (whole, file, rest) => {
+        if (path.isAbsolute(file))
+            return whole;
+        return path.resolve(cwd, file) + rest;
+    });
+}
 export function extractTscErrors(output) {
     if (!output)
         return [];
@@ -364,34 +381,53 @@ export function diagnoseUntypedDeps(cwd, buildOutput) {
  * Remove 'nul' files from a directory tree (Windows reserved name issue).
  * These files break git and npm on Windows. Uses \\?\ prefix to bypass name validation.
  */
+// 2026-09-20 — Claude Code (Fable 5.1), at Bob's direction ("you should handle 'nul' droppings
+// gracefully by deleting them", after `error: invalid path 'nul'` / `unable to add 'nul' to index`
+// stopped a run). Returns the paths it deleted instead of a count so the caller can NAME them,
+// matches the name case-insensitively (NUL is reserved in any case), and a failed delete is now
+// reported instead of swallowed -- it is the reason the following `git add -A` will fail.
 function removeNulFiles(dir, visited = new Set()) {
     const resolved = path.resolve(dir);
     if (visited.has(resolved))
-        return 0;
+        return [];
     visited.add(resolved);
-    let count = 0;
+    const removed = [];
     try {
         const entries = fs.readdirSync(dir, { withFileTypes: true });
         for (const entry of entries) {
-            const full = path.join(dir, entry.name);
+            const full = path.resolve(dir, entry.name);
             if (entry.isDirectory() && !entry.isSymbolicLink() && entry.name !== 'node_modules') {
-                count += removeNulFiles(full, visited);
+                removed.push(...removeNulFiles(full, visited));
             }
-            else if (entry.name === 'nul') {
+            else if (entry.name.toLowerCase() === 'nul') {
                 try {
-                    fs.unlinkSync(path.join('\\\\?\\', path.resolve(full)));
-                    count++;
+                    fs.unlinkSync(path.join('\\\\?\\', full));
+                    removed.push(full);
                 }
-                catch {
-                    // Ignore deletion errors
+                catch (error) {
+                    console.error(colors.red(`Could not delete 'nul' file ${full}: ${error.message} — git add will fail on it`));
                 }
             }
         }
     }
-    catch {
-        // Ignore read errors (permissions, etc.)
+    catch (error) {
+        // Justified swallow: an unreadable directory cannot be searched for 'nul' files, and that
+        // loses nothing -- git walks the same tree next and reports the unreadable directory itself
+        // (the "Permission denied" handling at the git add call sites picks it up).
+    }
+    return removed;
+}
+/** Stage everything (`git add -A`), first deleting any 'nul' files in the tree.
+ *  A 'nul' file is a dropping from `>nul` run under a shell that creates it instead of discarding
+ *  it; git on Windows cannot index one ("invalid path 'nul'" / "short read while indexing nul").
+ *  Every `git add -A` goes through this one function so no staging path can miss the cleanup
+ *  (2026-09-20, Claude Code: only the pre-release commit did it; -init, the index rebuild and the
+ *  two pre-version cleanups did not). */
+export function gitAddAll(cwd) {
+    for (const nulFile of removeNulFiles(cwd)) {
+        console.log(colors.yellow(`  Deleted 'nul' file ${nulFile} (Windows reserved name — git cannot add it)`));
     }
-    return count;
+    return runCommand('git', ['add', '-A'], { cwd, silent: true });
 }
 /** Repair a corrupted git index by rebuilding it.
  *  Handles "invalid object" / "Error building trees" errors caused by
@@ -420,13 +456,8 @@ function repairGitIndex(cwd) {
             }
         }
         // Re-stage all files
-        const addResult = spawnSafe('git', ['add', '-A'], {
-            encoding: 'utf-8',
-            stdio: 'pipe',
-            cwd,
-            env: process.env
-        });
-        if (addResult.status !== 0) {
+        const addResult = gitAddAll(cwd);
+        if (!addResult.success) {
             console.error(colors.red('Failed to re-add files after index rebuild:'), (addResult.stderr || '').trim());
             return false;
         }
@@ -1968,7 +1999,13 @@ export function findUndeclaredImports(cwd, pkg) {
  *  unresolvable paths, missing package.json, unpublished transitives. Lets the
  *  user resolve all problems before starting the publish cascade instead of
  *  being interrupted mid-run. */
-export function prescanDepGraph(baseDir, visited = new Set(), verbose = false) {
+// 2026-09-21 — Claude Code (Fable 5.1), at Bob's direction ("you need to warn about @installs
+// because they may be nested so I won't see them"). `fileTargets` added: every file: target the
+// walk resolves is recorded (package name → directory) so reportRegistryRefs can say where the
+// local source of a registry-installed package is. Own-scope deps given as a version range are
+// collected as kind 'registryRef'. Seen in certsupport: `@bobfrankston/miscassists: ^1.0.61`
+// committed in its package.json, two levels under pserve, where no tree listing showed it.
+export function prescanDepGraph(baseDir, visited = new Set(), verbose = false, fileTargets = new Map()) {
     const issues = [];
     let realDir;
     try {
@@ -1987,13 +2024,29 @@ export function prescanDepGraph(baseDir, visited = new Set(), verbose = false) {
     catch {
         return issues;
     }
+    // Own scope = the scope of the package declaring the dep ('@bobfrankston/'), the same
+    // definition ownScopePackages uses. An unscoped consumer has none, so nothing is flagged.
+    const consumerName = pkg.name || '';
+    const ownScope = consumerName.startsWith('@') && consumerName.includes('/')
+        ? consumerName.slice(0, consumerName.indexOf('/') + 1) : '';
+    // `"files": false` in .globalize.json5 means this package keeps npm refs in package.json on
+    // purpose (server deploys copy package.json as is), so its ranges are not a finding.
+    const keepsNpmRefs = readConfig(baseDir).files === false;
     for (const key of DEP_KEYS) {
         if (!pkg[key])
             continue;
         const deps = pkg['.' + key] || pkg[key];
         for (const [name, value] of Object.entries(deps)) {
-            if (!isFileRef(value))
+            if (!isFileRef(value)) {
+                if (ownScope && name.startsWith(ownScope) && !keepsNpmRefs) {
+                    issues.push({
+                        severity: 'warning', kind: 'registryRef',
+                        package: name, path: baseDir, consumer: consumerName, range: value,
+                        message: `${consumerName} depends on ${name} as ${value}, not file:`
+                    });
+                }
                 continue;
+            }
             let targetPath;
             try {
                 targetPath = resolveFilePath(value, baseDir);
@@ -2019,6 +2072,7 @@ export function prescanDepGraph(baseDir, visited = new Set(), verbose = false) {
                 continue;
             }
             const depName = targetPkg.name || name;
+            fileTargets.set(depName, targetPath);
             // Unscoped + private-intent. This used to be a WARNING whose "continue" led
             // into the cascade prompting to rename the dep by adding a scope. The cascade
             // never renames a dependency now (see the _fromDep check in globalize), so it
@@ -2045,11 +2099,40 @@ export function prescanDepGraph(baseDir, visited = new Set(), verbose = false) {
                 }
             }
             // Recurse into the dep
-            issues.push(...prescanDepGraph(targetPath, visited, verbose));
+            issues.push(...prescanDepGraph(targetPath, visited, verbose, fileTargets));
         }
     }
     return issues;
 }
+/** Report own-scope packages that some package in the file: graph takes from the registry
+ *  (a version range) instead of from local source. Nothing is asked and the run continues: a
+ *  range can be deliberate, and the fix is an edit to the CONSUMER's package.json, which is not
+ *  npmglobalize's to make. It is printed on every run because the consumer is usually nested
+ *  under other file: deps, where neither the `+` list nor the dependency tree shows it.
+ *  `fileTargets` is the map prescanDepGraph filled: when the same package is linked as file:
+ *  elsewhere in the graph, its directory is named — that package then exists twice, the linked
+ *  source and the registry copy in the consumer's node_modules. */
+export function reportRegistryRefs(registryRefs, fileTargets) {
+    if (!registryRefs.length)
+        return;
+    console.log(colors.yellow(`${registryRefs.length} own-scope dependenc${registryRefs.length === 1 ? 'y is' : 'ies are'} installed from npm, not linked with file: (a registry copy in node_modules, not the local source):`));
+    for (const ref of registryRefs) {
+        console.log(`  ${colors.yellow('@')} ${ref.consumer} → ${ref.package} ${ref.range}`);
+        console.log(colors.dim(`       in ${path.join(ref.path, 'package.json')}`));
+        const localSource = fileTargets.get(ref.package);
+        if (localSource) {
+            console.log(colors.dim(`       local source, linked as file: elsewhere in this graph: ${localSource}`));
+        }
+        // 2026-09-21 — Claude Code (Fable 5.1), at Bob's direction ("it should summarize the
+        // findings at the end"). The block above prints before the cascade and scrolls away, so
+        // each finding also goes into the Issues Summary cli.ts prints on every exit path. One
+        // self-contained line: it has to make sense with the prescan output long gone.
+        recordBuildIssue(ref.consumer, 'warning', `${ref.package} ${ref.range} is installed from npm, not file: — ${path.join(ref.path, 'package.json')}`
+            + (localSource ? ` (local source: ${localSource})` : ''));
+    }
+    console.log(colors.dim(`  To link one, set it to a file: path in the package.json named above, then run npmglobalize in that package.`));
+    console.log('');
+}
 /** Report unscoped `file:` deps found by the prescan, without asking anything.
  *
  *  An unscoped dep with private intent cannot reach npm, and npmglobalize does not
@@ -3953,7 +4036,8 @@ export async function buildProject(cwd, opts = {}) {
         // ago is worse than leaving the deprecation in place. So put the
         // tsconfigs back, and if that restores a working build, hand the user
         // the errors plus the command that migrates for real.
-        const migratedOutput = (buildResult.stderr || '') + (buildResult.output || '');
+        // 2026-09-14 — Claude Code (Fable 5.1): paths anchored to `cwd` (see anchorTscPaths).
+        const migratedOutput = anchorTscPaths((buildResult.stderr || '') + (buildResult.output || ''), cwd);
         const migratedTexts = readTsconfigTexts(tsconfigSnapshot.keys());
         if (restoreTsconfigTexts(tsconfigSnapshot)) {
             const retry = await runCommandAsync('npm', ['run', 'build'], { cwd, silent: true });
@@ -3990,10 +4074,12 @@ export async function buildProject(cwd, opts = {}) {
         console.log(colors.green(`✓ Build succeeded (${pkg.name || path.basename(cwd)})`));
         return true;
     }
-    const buildOutput = (buildResult.stderr || '') + (buildResult.output || '');
+    // 2026-09-14 — Claude Code (Fable 5.1): tsc lines anchored to this build's
+    // directory, and the directory named on the failure line (see anchorTscPaths).
+    const buildOutput = anchorTscPaths((buildResult.stderr || '') + (buildResult.output || ''), cwd);
     if (buildOutput)
         console.error(buildOutput);
-    console.error(colors.red(`Build failed in ${pkg.name || cwd}`));
+    console.error(colors.red(`Build failed in ${pkg.name || path.basename(cwd)} (${cwd})`));
     const label = pkg.name || path.basename(cwd);
     // tsc reports a missing-declarations failure against the file that imports the
     // dep, and suggests an @types package that does not exist for private scopes.
@@ -4254,8 +4340,10 @@ export async function fixTs7Deprecations(cwd) {
             result = await runCommandAsync('tsc', ['-p', '.', '--noEmit'], { cwd: dir, silent: true });
         }
         if (!result.success) {
-            const errs = extractTscErrors((result.stderr || '') + (result.output || ''));
-            typeErrors.set(dir, errs.length ? errs : [(result.stderr || result.output || '').trim().split('\n')[0] || 'tsc failed with no output']);
+            // 2026-09-14 — Claude Code (Fable 5.1): paths anchored to `dir` (see anchorTscPaths).
+            const tscOut = anchorTscPaths((result.stderr || '') + (result.output || ''), dir);
+            const errs = extractTscErrors(tscOut);
+            typeErrors.set(dir, errs.length ? errs : [tscOut.trim().split('\n')[0] || 'tsc failed with no output']);
         }
     }
     // Drop ignoreDeprecations wherever nothing deprecated remains in that package.
@@ -5591,6 +5679,31 @@ export function runCommandOrThrow(cmd, args, options = {}) {
                 throw new Error(`Command failed after git index repair: ${cmd} ${args.join(' ')}`);
             }
         }
+        // 2026-09-21 — Claude Code (Fable 5.1), at Bob's direction ("you should automatically fix").
+        // A git that dies mid-write leaves its `<file>.lock` behind, and every later git refuses
+        // with "File exists". Seen in Y:\photos\utils\photodb: a `git init` died at 00:02 leaving a
+        // 0-byte .git/config.lock; the 00:29 cascade then failed `git init` on it. An abandoned
+        // lock is removed (named in the output) and the command retried once.
+        if (cmd === 'git') {
+            const lockPath = gitLockFromError(stderr, options.cwd);
+            if (lockPath && removeStaleGitLock(lockPath)) {
+                const retry = spawnSafe(cmd, args, {
+                    encoding: 'utf-8',
+                    stdio: 'pipe',
+                    cwd: options.cwd,
+                    env: process.env,
+                    shell: needsShell
+                });
+                if (retry.status === 0) {
+                    return (retry.stdout || '') + (retry.stderr || '');
+                }
+                const retryStderr = retry.stderr || '';
+                if (retryStderr.trim()) {
+                    console.error(colors.red(retryStderr.trim()));
+                }
+                throw new Error(`Command failed after removing stale git lock ${lockPath}: ${cmd} ${args.join(' ')}`);
+            }
+        }
         // Show the error output
         if (stderr.trim()) {
             console.error(colors.red(stderr.trim()));
@@ -5602,6 +5715,47 @@ export function runCommandOrThrow(cmd, args, options = {}) {
     }
     return output;
 }
+/** A git `*.lock` older than this is taken to be abandoned. Git holds config.lock / index.lock
+ *  for the duration of one write, so a lock this old has no live owner; a younger one may belong
+ *  to a git that is writing right now (VS Code's background git, a parallel run) and is left alone. */
+const STALE_GIT_LOCK_MS = 10_000;
+/** Pull the lock file path out of git's "File exists" lock errors; null when stderr is not one.
+ *  Two wordings: `could not lock config file <file>: File exists` (the lock is `<file>.lock`)
+ *  and `Unable to create '<file>.lock': File exists.` (index.lock, HEAD.lock, refs). */
+function gitLockFromError(stderr, cwd) {
+    const configLock = stderr.match(/could not lock config file (.+?): File exists/);
+    const otherLock = stderr.match(/Unable to create '(.+?\.lock)': File exists/);
+    const reported = configLock ? `${configLock[1]}.lock` : otherLock ? otherLock[1] : null;
+    if (!reported)
+        return null;
+    return path.resolve(cwd || '.', reported); // git may report the path relative to cwd
+}
+/** Delete an abandoned git lock file, naming it. Returns true only when the lock is gone. */
+function removeStaleGitLock(lockPath) {
+    let ageMs;
+    try {
+        ageMs = Date.now() - fs.statSync(lockPath).mtimeMs;
+    }
+    catch (error) {
+        // Justified swallow: the lock git complained about is already gone (its owner finished
+        // between git's error and this stat). Nothing to remove; returning false sends the caller
+        // to its normal path, which prints git's stderr and throws.
+        return false;
+    }
+    if (ageMs < STALE_GIT_LOCK_MS) {
+        console.log(colors.yellow(`Git lock ${lockPath} is only ${Math.round(ageMs / 1000)}s old — another git may be writing; not removed.`));
+        return false;
+    }
+    try {
+        fs.unlinkSync(lockPath);
+    }
+    catch (error) {
+        console.error(colors.red(`Could not delete stale git lock ${lockPath}: ${error.message}`));
+        return false;
+    }
+    console.log(colors.yellow(`Removed stale git lock ${lockPath} (${Math.round(ageMs / 60000)} min old, left by a git that never finished). Retrying...`));
+    return true;
+}
 export function getGitStatus(cwd) {
     const status = {
         isRepo: false,
@@ -6733,7 +6887,7 @@ export async function initGit(cwd, visibility, dryRun, allowTs) {
     runCommandOrThrow('git', ['config', 'core.autocrlf', 'false'], { cwd });
     runCommandOrThrow('git', ['config', 'core.eol', 'lf'], { cwd });
     console.log('  ✓ Configured git for LF line endings');
-    let initAddResult = runCommand('git', ['add', '-A'], { cwd, silent: true });
+    let initAddResult = gitAddAll(cwd);
     if (!initAddResult.success) {
         const errText = initAddResult.stderr + initAddResult.output;
         const deniedFiles = parseDeniedFiles(errText);
@@ -6753,7 +6907,7 @@ export async function initGit(cwd, visibility, dryRun, allowTs) {
                 }
                 fs.writeFileSync(gitignorePath, gitignoreContent);
                 console.log(colors.green('  ✓ Updated .gitignore'));
-                initAddResult = runCommand('git', ['add', '-A'], { cwd, silent: true });
+                initAddResult = gitAddAll(cwd);
             }
             if (!initAddResult.success) {
                 console.error(colors.red('  git add still failing. Fix manually and retry.'));
@@ -7191,7 +7345,13 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
     // any transform/publish, so the user can fix them once and run clean.
     // Only run at the top level (not during recursive cascade or workspace).
     if (!noPrescan && !cleanup && !options._fromDep && !options._fromWorkspace) {
-        const allIssues = prescanDepGraph(cwd, new Set(), verbose);
+        const fileTargets = new Map();
+        const scanned = prescanDepGraph(cwd, new Set(), verbose, fileTargets);
+        // 2026-09-21 — Claude Code (Fable 5.1), at Bob's direction: registry refs to own-scope
+        // packages are reported apart from the prompt below, like unscoped deps — a warning
+        // with no question, since no answer would change what this run does.
+        reportRegistryRefs(scanned.filter(i => i.kind === 'registryRef'), fileTargets);
+        const allIssues = scanned.filter(i => i.kind !== 'registryRef');
         // Unscoped deps are handled apart from the error/warning prompt below: nothing the
         // user answers could change the outcome, so nothing is asked. Report, remember,
         // stop. See reportUnscopedDeps.
@@ -7658,10 +7818,12 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
                 // Always capture output so we can extract tsc errors for the summary
                 const buildResult = await runCommandAsync('npm', ['run', 'build'], { cwd, silent: true });
                 if (!buildResult.success) {
-                    const buildOutput = buildResult.stderr || buildResult.output;
+                    // 2026-09-14 — Claude Code (Fable 5.1): tsc lines anchored to `cwd`
+                    // and the directory named on the failure line (see anchorTscPaths).
+                    const buildOutput = anchorTscPaths(buildResult.stderr || buildResult.output, cwd);
                     if (buildOutput)
                         console.error(buildOutput);
-                    console.error(colors.red('ERROR: Build failed'));
+                    console.error(colors.red(`ERROR: Build failed in ${cwd}`));
                     diagnoseBuildFailure(buildOutput || '', cwd);
                     const firstErr = extractFirstTscError(buildOutput || '');
                     recordBuildIssue(pkg.name || path.basename(cwd), 'error', firstErr || 'Build failed');
@@ -8511,15 +8673,15 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
         const commitMsg = effectiveMessage || 'Pre-release commit';
         console.log(`${timestamp()} Committing changes: ${commitMsg}`);
         if (!dryRun) {
-            // Remove 'nul' files that break git on Windows
-            const nulCount = removeNulFiles(cwd);
-            if (nulCount > 0 && verbose) {
-                console.log(`  Removed ${nulCount} 'nul' file(s) (Windows reserved name)`);
-            }
+            // 'nul' files that break git on Windows are deleted inside gitAddAll (2026-09-20,
+            // Claude Code: moved there from this spot so every `git add -A` gets the cleanup).
+            // 2026-09-20 — Claude Code (Fable 5.1): start and finish are separate lines (same
+            // shape as the retry below). They were one line written in two halves, and
+            // gitAddAll's "Deleted 'nul' file …" report landed in the middle of it.
             const addStart = Date.now();
-            process.stdout.write(`  git add -A ... `);
-            let addResult = runCommand('git', ['add', '-A'], { cwd, silent: true });
-            process.stdout.write(`done (${((Date.now() - addStart) / 1000).toFixed(1)}s)\n`);
+            console.log(`  git add -A ...`);
+            let addResult = gitAddAll(cwd);
+            console.log(`  git add -A done (${((Date.now() - addStart) / 1000).toFixed(1)}s)`);
             if (!addResult.success) {
                 const errText = addResult.stderr + addResult.output;
                 const deniedFiles = parseDeniedFiles(errText);
@@ -8541,7 +8703,7 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
                         console.log(colors.green('✓ Updated .gitignore'));
                         const retryStart = Date.now();
                         console.log(`  ${timestamp()} git add -A (retry) ...`);
-                        addResult = runCommand('git', ['add', '-A'], { cwd, silent: true });
+                        addResult = gitAddAll(cwd);
                         console.log(`  ${timestamp()} git add -A done (${((Date.now() - retryStart) / 1000).toFixed(1)}s)`);
                         if (addResult.success) {
                             console.log(colors.green('✓ git add succeeded after updating .gitignore'));
@@ -8611,7 +8773,7 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
             if (verbose) {
                 console.log('Committing stray changes before version bump...');
             }
-            runCommand('git', ['add', '-A'], { cwd, silent: true });
+            gitAddAll(cwd);
             gitCommit('Pre-version cleanup', cwd);
         }
     }
@@ -8800,7 +8962,7 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
                 }
                 // Commit stray changes and retry
                 console.log(colors.yellow('  Committing stray changes and retrying...'));
-                const addRes = runCommand('git', ['add', '-A'], { cwd, silent: true });
+                const addRes = gitAddAll(cwd);
                 if (addRes.success) {
                     const commitRes = gitCommit('Pre-version cleanup', cwd);
                     if (commitRes.success) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/npmglobalize",
-  "version": "1.0.232",
+  "version": "1.0.234",
   "description": "Transform file: dependencies to npm versions for publishing",
   "main": "index.js",
   "type": "module",