@bobfrankston/npmglobalize 1.0.237 → 1.0.239

package/README.md

@@ -94,7 +94,7 @@ Errors abort (unless `--force`); warnings prompt to continue.
 
 An unscoped dependency with private intent is reported differently: it is not a question. npmglobalize never renames a dependency to add a scope (the name is what every consumer imports by, and changing it is the dep owner's own project), so the dep cannot reach npm and neither can the package that depends on it. The first run says so in full, names the dep and its path, records it under `unscopedDepsNoted` in the consumer's `.globalize.json5`, and stops. Later runs print one line per dep and stop. Nothing is asked, because no answer could change the outcome. Fix it in the dep: scope the name in its own `package.json`, or set `npmVisibility: "public"` or `noprefix: true` in its `.globalize.json5`; the note clears itself on the next run. If the cascade reaches such a dep anyway (`-no-prescan`), it stops there with the same message. The same holds when you run npmglobalize *in* an unscoped package: it used to ask "Add scope to package name?", and now it warns and assumes no, since a rename changes what every consumer imports. Publishing an unscoped package PUBLIC on purpose takes an explicit `-npm public` or `noprefix: true`. (2026-09-14)
 
-**Own-scope packages installed from npm instead of linked.** When a package in the `file:` graph depends on one of its own-scope packages by version range (`"@bobfrankston/miscassists": "^1.0.61"`) rather than `file:`, npm puts a registry copy in that package's `node_modules` instead of a link to the local source. The consumer is usually nested under other `file:` deps, where neither the `+` list nor the dependency tree shows it, so the prescan lists every such edge on every run: consumer → dep and range, the `package.json` that holds the range, and — when the same dep is linked as `file:` elsewhere in the graph — the directory of its local source (that package then exists twice). Each finding is repeated as one line in the end-of-run **Issues Summary**, because the prescan block has scrolled away by the time a cascade finishes. Nothing is asked and the run continues; a range can be deliberate. A package with `"files": false` in its `.globalize.json5` keeps npm refs on purpose and is not listed. npmglobalize does not rewrite the range: change it to a `file:` path in the named `package.json`, then run `npmglobalize` in that package. (2026-09-21)
+**Own-scope packages installed from npm instead of linked.** When a package in the `file:` graph depends on one of its own-scope packages by version range (`"@bobfrankston/miscassists": "^1.0.61"`) rather than `file:`, npm puts a registry copy in that package's `node_modules` instead of a link to the local source. The consumer is usually nested under other `file:` deps, where neither the `+` list nor the dependency tree shows it, so the prescan finds every such edge. Since 2026-09-23 it **fixes** them: the range is rewritten to a `file:` path in the consumer's `package.json` and `npm install` runs in that consumer, so `node_modules` holds the link. The local source is the directory the same package is linked from elsewhere in the graph, or else the sibling directory named after the package (the `file:../<name>` convention), accepted only when its `package.json` carries that exact name. A range whose local source cannot be found either way is reported and left alone. Nothing is asked. A package with `"files": false` in its `.globalize.json5` keeps npm refs on purpose and is not touched. Each outcome (rewritten, or not found) is repeated as one line in the end-of-run **Issues Summary**. A failed `npm install` stops the run unless `-force`. `-dry-run` prints what would be rewritten. (2026-09-21, fixer 2026-09-23)
 
 Skip the prescan with `-no-prescan` / `-nps`.
 
@@ -351,6 +351,8 @@ For single-developer projects, this safely pulls remote changes before publishin
 
 **Stale git lock files**: A git that dies mid-write leaves its lock behind (`.git/config.lock`, `.git/index.lock`), and every later git refuses with `could not lock config file …: File exists` or `Unable to create '….lock': File exists`. When a git command fails that way and the lock is more than 10 seconds old, `npmglobalize` deletes the lock, names the file it deleted, and retries the command once. A younger lock may belong to a git that is writing right now, so it is left alone and the failure is reported with the lock's path and age. (2026-09-21)
 
+**Per-directory lock (parallel runs)**: two `npmglobalize` instances can reach the same package within seconds — one run in a package, another in a consumer whose cascade walks into it. Without a guard both bump and publish, and the second one's tag-conflict handler deletes the first one's tag and republishes (dbx10 and upsnarf, 2026-09-24: 1.0.8 then 1.0.9 of each). Every package a run works on is now locked for the duration under `<temp>/npmglobalize-locks/` (outside the package, so the pre-release `git add -A` never commits it). A second instance that meets a live lock **waits** — polling every second, printing `Waiting for npmglobalize PID … to finish with <dir>` every 10 s — and then re-reads the package and continues, which normally means it finds the version already published and does nothing. A lock whose owner PID is no longer running is stale: it is removed, named, and taken. The wait gives up after 15 minutes with the holder's PID, start time, command line and the lock path, so a process that is not an npmglobalize can be spotted and the file deleted by hand. The lock is reentrant within one process, so a diamond in the dependency graph does not deadlock on the shared dependency, and two instances take locks in the same consumer-then-dependency order, so they cannot deadlock on each other. (2026-09-24)
+
 **Note:** This tool is designed for single-developer, single-branch workflows where automatic rebase and tag cleanup are safe operations.
 
 ### 📂 Git Repository Setup

package/lib.d.ts

@@ -425,7 +425,7 @@ export interface PrescanIssue {
     /** 'unscoped': an unscoped file: dep with private intent. Not an error and not a
      *  question — globalize reports it once, remembers it, and stops.
      *  'registryRef': a package in the file: graph depends on one of its own-scope packages
-     *  by version range instead of file: — reported by reportRegistryRefs, nothing asked. */
+     *  by version range instead of file: — rewritten to file: by fixRegistryRefs (2026-09-23), nothing asked. */
     kind?: 'unscoped' | 'registryRef';
     package: string;
     /** For 'registryRef': the directory of the CONSUMER whose package.json holds the range. */
@@ -448,15 +448,23 @@ export declare function findUndeclaredImports(cwd: string, pkg: any): Undeclared
  *  user resolve all problems before starting the publish cascade instead of
  *  being interrupted mid-run. */
 export declare function prescanDepGraph(baseDir: string, visited?: Set<string>, verbose?: boolean, fileTargets?: Map<string, string>): PrescanIssue[];
-/** Report own-scope packages that some package in the file: graph takes from the registry
- *  (a version range) instead of from local source. Nothing is asked and the run continues: a
- *  range can be deliberate, and the fix is an edit to the CONSUMER's package.json, which is not
- *  npmglobalize's to make. It is printed on every run because the consumer is usually nested
- *  under other file: deps, where neither the `+` list nor the dependency tree shows it.
- *  `fileTargets` is the map prescanDepGraph filled: when the same package is linked as file:
- *  elsewhere in the graph, its directory is named — that package then exists twice, the linked
- *  source and the registry copy in the consumer's node_modules. */
-export declare function reportRegistryRefs(registryRefs: PrescanIssue[], fileTargets: Map<string, string>): void;
+/** Own-scope packages that some package in the file: graph takes from the registry (a version
+ *  range) instead of from local source get REWRITTEN to a file: path, and npm install runs in
+ *  that consumer so node_modules holds the link instead of the registry copy. The consumer is
+ *  usually nested under other file: deps, where neither the `+` list nor the dependency tree
+ *  shows it, which is why this runs in the prescan, before the cascade reads the consumer.
+ *  A range whose local source cannot be found (not linked elsewhere in the graph, no sibling
+ *  directory of that name) is reported as before and left alone. `"files": false` consumers
+ *  were never collected (see prescanDepGraph). Every outcome is also recorded for the
+ *  Issues Summary, since the prescan block has scrolled away by the end of a cascade.
+ *  2026-09-23 01:40 EDT — Claude Code (Fable 5.1), at Bob's direction: "you should also make
+ *  sure that package.json for local packages such as httppoly uses file: rather than the npm
+ *  version". Until now this only reported (v1.0.233), and certsupport kept
+ *  `miscassists: ^1.0.61` through three runs. Returns false if an npm install failed. */
+export declare function fixRegistryRefs(registryRefs: PrescanIssue[], fileTargets: Map<string, string>, opts?: {
+    dryRun?: boolean;
+    verbose?: boolean;
+}): Promise<boolean>;
 /** Report unscoped `file:` deps found by the prescan, without asking anything.
  *
  *  An unscoped dep with private intent cannot reach npm, and npmglobalize does not
@@ -852,6 +860,28 @@ export declare function runNpmAuditFix(cwd: string): Promise<void>;
 export declare function runNpmAudit(cwd: string): AuditResult;
 /** Get the version of npmglobalize itself */
 export declare function getToolVersion(): string;
+/** Where the lock for a package directory lives. Exported for the test. */
+export declare function dirLockPath(dir: string): string;
+/** Take the lock for `dir`, waiting for a live holder to finish. Returns the lock path to
+ *  hand back to releaseDirLock. Throws after `maxWaitMs` naming the holder and the lock file. */
+export declare function acquireDirLock(dir: string, opts?: {
+    maxWaitMs?: number;
+}): Promise<string>;
+/** Release a lock taken by acquireDirLock. The file goes only when the outermost holder in
+ *  this process releases, and only if it is still ours. */
+export declare function releaseDirLock(lockPath: string): void;
+/** For the exit handler: drop every lock this process holds, so a ^C leaves nothing behind
+ *  (a leftover would only cost the next run a "stale lock removed" line, but be tidy). */
+export declare function releaseAllDirLocks(): void;
+/**
+ * Publish one package (and, by default, its file: dependencies first). Holds the
+ * per-directory lock for the whole run so a second npmglobalize reaching the same
+ * package waits instead of double-bumping.
+ * @param cwd - the package directory
+ * @param options - CLI options for this run
+ * @param configOptions - values read from the package's .globalize.json5
+ * @returns true when the package was published (or needed nothing), false on failure
+ */
 export declare function globalize(cwd: string, options?: GlobalizeOptions, configOptions?: Partial<GlobalizeOptions>): Promise<boolean>;
 /** Orchestrate globalize across all packages in an npm workspace */
 export declare function globalizeWorkspace(rootDir: string, options?: GlobalizeOptions, configOptions?: Partial<GlobalizeOptions>): Promise<WorkspaceResult>;

package/lib.js

@@ -12,6 +12,7 @@
 import fs from 'fs';
 import os from 'os';
 import path from 'path';
+import { createHash } from 'crypto';
 import { execSync, spawn, spawnSync } from 'child_process';
 import { builtinModules } from 'module';
 import { readConfig as readUserConfig, writeConfig as writeUserConfig, configDir, configPath as userConfigPath } from '@bobfrankston/userconfig';
@@ -826,6 +827,7 @@ export function installCleanupHandlers() {
         return;
     cleanupHandlersInstalled = true;
     process.on('exit', emergencyRestoreDeps);
+    process.on('exit', releaseAllDirLocks); // 2026-09-24 per-directory lock: drop ours on ^C / process.exit
     // Idempotent abort: first ^C prints an immediate ack so the user doesn't
     // press again and accidentally kill the process mid-restore. Subsequent
     // signals while already aborting are absorbed (with a brief reminder).
@@ -2001,7 +2003,7 @@ export function findUndeclaredImports(cwd, pkg) {
  *  being interrupted mid-run. */
 // 2026-09-21 — Claude Code (Fable 5.1), at Bob's direction ("you need to warn about @installs
 // because they may be nested so I won't see them"). `fileTargets` added: every file: target the
-// walk resolves is recorded (package name → directory) so reportRegistryRefs can say where the
+// walk resolves is recorded (package name → directory) so fixRegistryRefs can say where the
 // local source of a registry-installed package is. Own-scope deps given as a version range are
 // collected as kind 'registryRef'. Seen in certsupport: `@bobfrankston/miscassists: ^1.0.61`
 // committed in its package.json, two levels under pserve, where no tree listing showed it.
@@ -2104,34 +2106,96 @@ export function prescanDepGraph(baseDir, visited = new Set(), verbose = false, f
     }
     return issues;
 }
-/** Report own-scope packages that some package in the file: graph takes from the registry
- *  (a version range) instead of from local source. Nothing is asked and the run continues: a
- *  range can be deliberate, and the fix is an edit to the CONSUMER's package.json, which is not
- *  npmglobalize's to make. It is printed on every run because the consumer is usually nested
- *  under other file: deps, where neither the `+` list nor the dependency tree shows it.
- *  `fileTargets` is the map prescanDepGraph filled: when the same package is linked as file:
- *  elsewhere in the graph, its directory is named — that package then exists twice, the linked
- *  source and the registry copy in the consumer's node_modules. */
-export function reportRegistryRefs(registryRefs, fileTargets) {
+/** Where the local source of an own-scope package is, or null. First the map prescanDepGraph
+ *  filled (the package is linked as file: elsewhere in the graph); then the sibling-directory
+ *  convention every file: ref in these trees follows (`file:../<name>`): a directory named
+ *  after the unscoped package name beside the consumer, accepted only when the package.json
+ *  there carries exactly that package name. Nothing else is searched. */
+function findLocalSource(consumerDir, packageName, fileTargets) {
+    const known = fileTargets.get(packageName);
+    if (known)
+        return known;
+    const unscopedName = packageName.includes('/') ? packageName.slice(packageName.indexOf('/') + 1) : packageName;
+    const sibling = path.join(path.dirname(consumerDir), unscopedName);
+    try {
+        if (readPackageJson(sibling).name === packageName)
+            return sibling;
+    }
+    catch (error) {
+        // Justified swallow: no package.json beside the consumer under that name is the
+        // ordinary "not a sibling" outcome. The caller reports "local source not found" on
+        // null, so the information becomes that message rather than being lost.
+    }
+    return null;
+}
+/** Own-scope packages that some package in the file: graph takes from the registry (a version
+ *  range) instead of from local source get REWRITTEN to a file: path, and npm install runs in
+ *  that consumer so node_modules holds the link instead of the registry copy. The consumer is
+ *  usually nested under other file: deps, where neither the `+` list nor the dependency tree
+ *  shows it, which is why this runs in the prescan, before the cascade reads the consumer.
+ *  A range whose local source cannot be found (not linked elsewhere in the graph, no sibling
+ *  directory of that name) is reported as before and left alone. `"files": false` consumers
+ *  were never collected (see prescanDepGraph). Every outcome is also recorded for the
+ *  Issues Summary, since the prescan block has scrolled away by the end of a cascade.
+ *  2026-09-23 01:40 EDT — Claude Code (Fable 5.1), at Bob's direction: "you should also make
+ *  sure that package.json for local packages such as httppoly uses file: rather than the npm
+ *  version". Until now this only reported (v1.0.233), and certsupport kept
+ *  `miscassists: ^1.0.61` through three runs. Returns false if an npm install failed. */
+export async function fixRegistryRefs(registryRefs, fileTargets, opts = {}) {
     if (!registryRefs.length)
-        return;
+        return true;
+    const { dryRun = false, verbose = false } = opts;
     console.log(colors.yellow(`${registryRefs.length} own-scope dependenc${registryRefs.length === 1 ? 'y is' : 'ies are'} installed from npm, not linked with file: (a registry copy in node_modules, not the local source):`));
+    // One npm install per consumer, after all of its ranges are rewritten.
+    const rewrittenConsumers = new Map(); // consumer dir → consumer name
+    let ok = true;
     for (const ref of registryRefs) {
+        const pkgJsonPath = path.join(ref.path, 'package.json');
         console.log(`  ${colors.yellow('@')} ${ref.consumer} → ${ref.package} ${ref.range}`);
-        console.log(colors.dim(`       in ${path.join(ref.path, 'package.json')}`));
-        const localSource = fileTargets.get(ref.package);
-        if (localSource) {
-            console.log(colors.dim(`       local source, linked as file: elsewhere in this graph: ${localSource}`));
-        }
-        // 2026-09-21 — Claude Code (Fable 5.1), at Bob's direction ("it should summarize the
-        // findings at the end"). The block above prints before the cascade and scrolls away, so
-        // each finding also goes into the Issues Summary cli.ts prints on every exit path. One
-        // self-contained line: it has to make sense with the prescan output long gone.
-        recordBuildIssue(ref.consumer, 'warning', `${ref.package} ${ref.range} is installed from npm, not file: — ${path.join(ref.path, 'package.json')}`
-            + (localSource ? ` (local source: ${localSource})` : ''));
-    }
-    console.log(colors.dim(`  To link one, set it to a file: path in the package.json named above, then run npmglobalize in that package.`));
+        console.log(colors.dim(`       in ${pkgJsonPath}`));
+        const localSource = findLocalSource(ref.path, ref.package, fileTargets);
+        if (!localSource) {
+            console.log(colors.dim(`       local source not found (not linked as file: elsewhere in this graph, no sibling directory of that name) — left as is`));
+            recordBuildIssue(ref.consumer, 'warning', `${ref.package} ${ref.range} is installed from npm, not file: — ${pkgJsonPath} (local source not found, left as is)`);
+            continue;
+        }
+        let relative = path.relative(ref.path, localSource).split(path.sep).join('/');
+        if (!relative.startsWith('.'))
+            relative = './' + relative;
+        const fileSpec = `file:${relative}`;
+        if (dryRun) {
+            console.log(colors.dim(`       [dry-run] would set to ${fileSpec} (${localSource}) and run npm install in ${ref.consumer}`));
+            continue;
+        }
+        const pkg = readPackageJson(ref.path);
+        let rewrote = false;
+        for (const key of DEP_KEYS) {
+            // A `.dependencies` backup (left by an interrupted transform) is the file: truth;
+            // prescanDepGraph read the range from it, so the rewrite goes there too.
+            for (const depsKey of ['.' + key, key]) {
+                const deps = pkg[depsKey];
+                if (deps && deps[ref.package] === ref.range) {
+                    deps[ref.package] = fileSpec;
+                    rewrote = true;
+                }
+            }
+        }
+        if (!rewrote) {
+            console.log(colors.dim(`       range not found in ${pkgJsonPath} any more — left as is`));
+            continue;
+        }
+        writePackageJson(ref.path, pkg);
+        console.log(colors.green(`       ✓ set to ${fileSpec} (${localSource})`));
+        recordBuildIssue(ref.consumer, 'warning', `${ref.package} ${ref.range} rewritten to ${fileSpec} in ${pkgJsonPath}`);
+        rewrittenConsumers.set(ref.path, ref.consumer);
+    }
+    for (const [consumerDir, consumerName] of rewrittenConsumers) {
+        console.log(colors.yellow(`↻ npm install in ${consumerName} (${consumerDir}) to replace the registry copy with the file: link`));
+        if (!await npmInstallWithCleanRetry(consumerDir, verbose, `fixRegistryRefs: ${consumerDir}`))
+            ok = false;
+    }
     console.log('');
+    return ok;
 }
 /** Report unscoped `file:` deps found by the prescan, without asking anything.
  *
@@ -7263,7 +7327,185 @@ async function doLocalInstall(cwd, options) {
     }
     return true;
 }
+// ─── Per-directory lock ──────────────────────────────────────────────────────────────────
+// 2026-09-24 15:55 EDT — Claude Code (Fable 5.1), at Bob's direction.
+// Two npmglobalize instances reached the same packages within seconds (a dbx10 run and a
+// setcolor run whose cascade walks into dbx10 and upsnarf): both bumped, both published, and
+// the second one's tag-conflict handler deleted the first one's v1.0.8 tag and republished as
+// v1.0.9. Nothing stopped it because nothing knew another instance was there. Every
+// globalize() call now holds a lock on its package directory for its whole duration. A second
+// instance that meets a live lock WAITS for it (polling, with a status line every 10 s), then
+// re-reads the directory and continues — normally to "already published, nothing to do". A
+// lock whose owner PID is dead is stale and is removed. Reentrant within one process, so a
+// diamond in the dependency graph (A→B→D, A→C→D) does not deadlock on D. Two instances cannot
+// deadlock on each other either: both take locks consumer-first, dependency-second, in the
+// same DAG order.
+//
+// The lock lives OUTSIDE the package directory, under the temp dir, because the pre-release
+// commit does `git add -A` and would commit a file placed in the package.
+const DIR_LOCK_POLL_MS = 1_000;
+const DIR_LOCK_STATUS_EVERY_MS = 10_000;
+/** How long to wait on a live lock before giving up. A whole cascade can take minutes on Y:. */
+const DIR_LOCK_MAX_WAIT_MS = 15 * 60_000;
+/** An unreadable lock (half-written or garbage) is given this many polls to become readable
+ *  before it is treated as stale. */
+const DIR_LOCK_UNREADABLE_POLLS = 3;
+/** Locks this process holds: lock file path → reentrancy count. */
+const heldDirLocks = new Map();
+/** Where the lock for a package directory lives. Exported for the test. */
+export function dirLockPath(dir) {
+    // Windows paths compare case-insensitively and npm/junctions mix y:/Y: (see
+    // .llm/arborist-trace.md), so fold case there so both spellings map to one lock.
+    let key = path.resolve(dir);
+    if (process.platform === 'win32')
+        key = key.toLowerCase();
+    const slug = key.replace(/[^a-z0-9]+/gi, '_').slice(-80);
+    const hash = createHash('sha1').update(key).digest('hex').slice(0, 8);
+    return path.join(os.tmpdir(), 'npmglobalize-locks', `${slug}-${hash}.lock`);
+}
+function isPidAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        // EPERM: the process exists but is not ours to signal — still alive.
+        return error.code === 'EPERM';
+    }
+}
+function readDirLock(lockPath) {
+    try {
+        return JSON.parse(fs.readFileSync(lockPath, 'utf-8'));
+    }
+    catch (error) {
+        // Justified swallow: the lock vanished between our EEXIST and this read (its owner
+        // finished), or it is half-written / garbage. The caller treats null as "unreadable",
+        // re-polls a few times, and then removes the lock as stale — so an unreadable lock
+        // cannot hold anyone forever and nothing is lost by not reporting the parse error.
+        return null;
+    }
+}
+function fmtLockTime(iso) {
+    const time = new Date(iso);
+    return isNaN(time.getTime()) ? iso : time.toLocaleTimeString();
+}
+/** Take the lock for `dir`, waiting for a live holder to finish. Returns the lock path to
+ *  hand back to releaseDirLock. Throws after `maxWaitMs` naming the holder and the lock file. */
+export async function acquireDirLock(dir, opts = {}) {
+    const lockPath = dirLockPath(dir);
+    const held = heldDirLocks.get(lockPath);
+    if (held) { // reentrant: this process already holds it
+        heldDirLocks.set(lockPath, held + 1);
+        return lockPath;
+    }
+    fs.mkdirSync(path.dirname(lockPath), { recursive: true });
+    const info = {
+        pid: process.pid,
+        started: new Date().toISOString(),
+        dir: path.resolve(dir),
+        argv: process.argv.slice(1)
+    };
+    const maxWait = opts.maxWaitMs ?? DIR_LOCK_MAX_WAIT_MS;
+    const waitStart = Date.now();
+    let lastStatus = 0;
+    let announced = false;
+    let unreadablePolls = 0;
+    for (;;) {
+        try {
+            fs.writeFileSync(lockPath, JSON.stringify(info, null, 2), { flag: 'wx' }); // atomic create
+            heldDirLocks.set(lockPath, 1);
+            if (announced)
+                console.log(colors.green(`✓ ${info.dir} is free — continuing`));
+            return lockPath;
+        }
+        catch (error) {
+            if (error.code !== 'EEXIST')
+                throw error;
+        }
+        const holder = readDirLock(lockPath);
+        if (!holder) {
+            if (++unreadablePolls >= DIR_LOCK_UNREADABLE_POLLS) {
+                console.log(colors.yellow(`Removing unreadable npmglobalize lock ${lockPath}`));
+                removeLockFile(lockPath);
+                unreadablePolls = 0;
+                continue;
+            }
+        }
+        else if (!isPidAlive(holder.pid)) {
+            console.log(colors.yellow(`Removing stale npmglobalize lock for ${holder.dir}: PID ${holder.pid} (started ${fmtLockTime(holder.started)}) is no longer running`));
+            removeLockFile(lockPath);
+            continue;
+        }
+        else {
+            const waitedMs = Date.now() - waitStart;
+            if (waitedMs > maxWait) {
+                throw new Error(`Gave up after ${Math.round(waitedMs / 60_000)} min waiting for npmglobalize PID ${holder.pid} to finish with ${holder.dir}.\n` +
+                    `  It has held the lock since ${fmtLockTime(holder.started)} running: ${holder.argv.join(' ')}\n` +
+                    `  If PID ${holder.pid} is not an npmglobalize, delete ${lockPath} and rerun.`);
+            }
+            if (Date.now() - lastStatus >= DIR_LOCK_STATUS_EVERY_MS) {
+                lastStatus = Date.now();
+                announced = true;
+                const soFar = waitedMs >= DIR_LOCK_STATUS_EVERY_MS ? ` — ${Math.round(waitedMs / 1000)} s so far` : '';
+                console.log(colors.yellow(`Waiting for npmglobalize PID ${holder.pid} (started ${fmtLockTime(holder.started)}) to finish with ${holder.dir}${soFar}`));
+            }
+        }
+        await new Promise(resolve => setTimeout(resolve, DIR_LOCK_POLL_MS));
+    }
+}
+function removeLockFile(lockPath) {
+    try {
+        fs.unlinkSync(lockPath);
+    }
+    catch (error) {
+        // ENOENT means the owner removed it first — that is the outcome we wanted.
+        if (error.code !== 'ENOENT')
+            throw error;
+    }
+}
+/** Release a lock taken by acquireDirLock. The file goes only when the outermost holder in
+ *  this process releases, and only if it is still ours. */
+export function releaseDirLock(lockPath) {
+    const held = heldDirLocks.get(lockPath);
+    if (!held)
+        return;
+    if (held > 1) {
+        heldDirLocks.set(lockPath, held - 1);
+        return;
+    }
+    heldDirLocks.delete(lockPath);
+    const current = readDirLock(lockPath);
+    if (current && current.pid !== process.pid)
+        return; // someone else's now; leave it
+    removeLockFile(lockPath);
+}
+/** For the exit handler: drop every lock this process holds, so a ^C leaves nothing behind
+ *  (a leftover would only cost the next run a "stale lock removed" line, but be tidy). */
+export function releaseAllDirLocks() {
+    for (const lockPath of [...heldDirLocks.keys()]) {
+        heldDirLocks.set(lockPath, 1);
+        releaseDirLock(lockPath);
+    }
+}
+/**
+ * Publish one package (and, by default, its file: dependencies first). Holds the
+ * per-directory lock for the whole run so a second npmglobalize reaching the same
+ * package waits instead of double-bumping.
+ * @param cwd - the package directory
+ * @param options - CLI options for this run
+ * @param configOptions - values read from the package's .globalize.json5
+ * @returns true when the package was published (or needed nothing), false on failure
+ */
 export async function globalize(cwd, options = {}, configOptions = {}) {
+    const lockPath = await acquireDirLock(cwd);
+    try {
+        return await globalizeUnderLock(cwd, options, configOptions);
+    }
+    finally {
+        releaseDirLock(lockPath);
+    }
+}
+async function globalizeUnderLock(cwd, options = {}, configOptions = {}) {
     const { bump = 'patch', noPublish = false, cleanup = false, install = false, link = false, wsl = false, force = false, files = true, dryRun = false, quiet = true, verbose = false, init = false, gitVisibility = 'private', npmVisibility = 'private', message, conform = false, asis = false, updateDeps = false, updateMajor = false, publishDeps = true, // Default to publishing deps for safety
     publishDepsYes = false, // -pd: auto-yes to dep-cascade prompts (private only)
     publicDeps = false, // -public-deps: cascade public visibility to all deps
@@ -7366,9 +7608,15 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
         const fileTargets = new Map();
         const scanned = prescanDepGraph(cwd, new Set(), verbose, fileTargets);
         // 2026-09-21 — Claude Code (Fable 5.1), at Bob's direction: registry refs to own-scope
-        // packages are reported apart from the prompt below, like unscoped deps — a warning
-        // with no question, since no answer would change what this run does.
-        reportRegistryRefs(scanned.filter(i => i.kind === 'registryRef'), fileTargets);
+        // packages are handled apart from the prompt below, like unscoped deps — no question.
+        // 2026-09-23 — Claude Code (Fable 5.1), at Bob's direction: they are now FIXED (rewritten
+        // to file: and npm-installed), not just reported. A failed install stops the run like
+        // ensureFileDepModules does, unless -force.
+        const refsOk = await fixRegistryRefs(scanned.filter(i => i.kind === 'registryRef'), fileTargets, { dryRun, verbose });
+        if (!refsOk && !force) {
+            console.error(colors.red('npm install failed while linking own-scope deps as file: (see above). Stopping; use -force to continue anyway.'));
+            return false;
+        }
         const allIssues = scanned.filter(i => i.kind !== 'registryRef');
         // Unscoped deps are handled apart from the error/warning prompt below: nothing the
         // user answers could change the outcome, so nothing is asked. Report, remember,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/npmglobalize",
-  "version": "1.0.237",
+  "version": "1.0.239",
   "description": "Transform file: dependencies to npm versions for publishing",
   "main": "index.js",
   "type": "module",