@bobfrankston/npmglobalize 1.0.238 → 1.0.240

package/README.md

@@ -96,6 +96,8 @@ An unscoped dependency with private intent is reported differently: it is not a
 
 **Own-scope packages installed from npm instead of linked.** When a package in the `file:` graph depends on one of its own-scope packages by version range (`"@bobfrankston/miscassists": "^1.0.61"`) rather than `file:`, npm puts a registry copy in that package's `node_modules` instead of a link to the local source. The consumer is usually nested under other `file:` deps, where neither the `+` list nor the dependency tree shows it, so the prescan finds every such edge. Since 2026-09-23 it **fixes** them: the range is rewritten to a `file:` path in the consumer's `package.json` and `npm install` runs in that consumer, so `node_modules` holds the link. The local source is the directory the same package is linked from elsewhere in the graph, or else the sibling directory named after the package (the `file:../<name>` convention), accepted only when its `package.json` carries that exact name. A range whose local source cannot be found either way is reported and left alone. Nothing is asked. A package with `"files": false` in its `.globalize.json5` keeps npm refs on purpose and is not touched. Each outcome (rewritten, or not found) is repeated as one line in the end-of-run **Issues Summary**. A failed `npm install` stops the run unless `-force`. `-dry-run` prints what would be rewritten. (2026-09-21, fixer 2026-09-23)
 
+**A `file:` dependency declared under the wrong key.** `"ubntdefs": "file:../ubntdefs"` links fine locally even when that package's own `package.json` says `@bobfrankston/ubntdefs`, because npm links a `file:` dep under whatever key you wrote. But the published `package.json` carries the version range under that key, so the registry copy of the consumer says `"ubntdefs": "^1.0.5"`, a name that is not on npm, and every registry install of it or of anything depending on it dies with E404 (dbx10 → setcolor, 2026-09-24). The prescan compares every `file:` key with the target's own name and **fixes** a mismatch: the key is renamed to the real name in the consumer's `package.json` (the `file:` path is kept), `npm uninstall <old key>` drops the link under the old name, and `npm install` links it under the real one. Nothing is asked; `-dry-run` prints what would change; each rename and any failed uninstall is repeated in the **Issues Summary**; a failed install stops the run unless `-force`. Imports in the consumer's code are not touched, so if anything imported by the old key, fix that by hand. A run with `-no-prescan` that reaches such a key stops in the transform with the same explanation rather than publishing a broken `package.json`. (2026-09-24)
+
 Skip the prescan with `-no-prescan` / `-nps`.
 
 #### Workspace skip prescan
@@ -351,6 +353,8 @@ For single-developer projects, this safely pulls remote changes before publishin
 
 **Stale git lock files**: A git that dies mid-write leaves its lock behind (`.git/config.lock`, `.git/index.lock`), and every later git refuses with `could not lock config file …: File exists` or `Unable to create '….lock': File exists`. When a git command fails that way and the lock is more than 10 seconds old, `npmglobalize` deletes the lock, names the file it deleted, and retries the command once. A younger lock may belong to a git that is writing right now, so it is left alone and the failure is reported with the lock's path and age. (2026-09-21)
 
+**Per-directory lock (parallel runs)**: two `npmglobalize` instances can reach the same package within seconds — one run in a package, another in a consumer whose cascade walks into it. Without a guard both bump and publish, and the second one's tag-conflict handler deletes the first one's tag and republishes (dbx10 and upsnarf, 2026-09-24: 1.0.8 then 1.0.9 of each). Every package a run works on is now locked for the duration under `<temp>/npmglobalize-locks/` (outside the package, so the pre-release `git add -A` never commits it). A second instance that meets a live lock **waits** — polling every second, printing `Waiting for npmglobalize PID … to finish with <dir>` every 10 s — and then re-reads the package and continues, which normally means it finds the version already published and does nothing. A lock whose owner PID is no longer running is stale: it is removed, named, and taken. The wait gives up after 15 minutes with the holder's PID, start time, command line and the lock path, so a process that is not an npmglobalize can be spotted and the file deleted by hand. The lock is reentrant within one process, so a diamond in the dependency graph does not deadlock on the shared dependency, and two instances take locks in the same consumer-then-dependency order, so they cannot deadlock on each other. (2026-09-24)
+
 **Note:** This tool is designed for single-developer, single-branch workflows where automatic rebase and tag cleanup are safe operations.
 
 ### 📂 Git Repository Setup

package/lib.d.ts

@@ -425,9 +425,13 @@ export interface PrescanIssue {
     /** 'unscoped': an unscoped file: dep with private intent. Not an error and not a
      *  question — globalize reports it once, remembers it, and stops.
      *  'registryRef': a package in the file: graph depends on one of its own-scope packages
-     *  by version range instead of file: — rewritten to file: by fixRegistryRefs (2026-09-23), nothing asked. */
-    kind?: 'unscoped' | 'registryRef';
+     *  by version range instead of file: — rewritten to file: by fixRegistryRefs (2026-09-23), nothing asked.
+     *  'nameMismatch': a file: dep declared under a key that is not the target's package.json name —
+     *  key renamed, old name uninstalled, reinstalled by fixDepKeyMismatches (2026-09-24), nothing asked. */
+    kind?: 'unscoped' | 'registryRef' | 'nameMismatch';
     package: string;
+    /** 'nameMismatch' only: the key as written in the consumer's package.json (`ubntdefs`). */
+    key?: string;
     /** For 'registryRef': the directory of the CONSUMER whose package.json holds the range. */
     path: string;
     /** 'registryRef' only: name of the package whose package.json declares the dep. */
@@ -465,6 +469,18 @@ export declare function fixRegistryRefs(registryRefs: PrescanIssue[], fileTarget
     dryRun?: boolean;
     verbose?: boolean;
 }): Promise<boolean>;
+/** Rename file: dependency keys that differ from the target package's own name, then
+ *  `npm uninstall` the old name and `npm install` so node_modules holds the link under the
+ *  real name. The published package.json carries the version range under the KEY, so a
+ *  wrong key publishes a dependency nobody can install (dbx10 → `"ubntdefs": "^1.0.5"`,
+ *  setcolor's install died with E404 on 2026-09-24). Nothing is asked; -dry-run prints what
+ *  would change; each outcome lands in the Issues Summary.
+ *  2026-09-24 16:20 EDT — Claude Code (Fable 5.1), at Bob's direction: "A check would be to
+ *  look at the file; to uninstall from the old name and reinstall with the new. This is safe." */
+export declare function fixDepKeyMismatches(mismatches: PrescanIssue[], opts?: {
+    dryRun?: boolean;
+    verbose?: boolean;
+}): Promise<boolean>;
 /** Report unscoped `file:` deps found by the prescan, without asking anything.
  *
  *  An unscoped dep with private intent cannot reach npm, and npmglobalize does not
@@ -860,6 +876,28 @@ export declare function runNpmAuditFix(cwd: string): Promise<void>;
 export declare function runNpmAudit(cwd: string): AuditResult;
 /** Get the version of npmglobalize itself */
 export declare function getToolVersion(): string;
+/** Where the lock for a package directory lives. Exported for the test. */
+export declare function dirLockPath(dir: string): string;
+/** Take the lock for `dir`, waiting for a live holder to finish. Returns the lock path to
+ *  hand back to releaseDirLock. Throws after `maxWaitMs` naming the holder and the lock file. */
+export declare function acquireDirLock(dir: string, opts?: {
+    maxWaitMs?: number;
+}): Promise<string>;
+/** Release a lock taken by acquireDirLock. The file goes only when the outermost holder in
+ *  this process releases, and only if it is still ours. */
+export declare function releaseDirLock(lockPath: string): void;
+/** For the exit handler: drop every lock this process holds, so a ^C leaves nothing behind
+ *  (a leftover would only cost the next run a "stale lock removed" line, but be tidy). */
+export declare function releaseAllDirLocks(): void;
+/**
+ * Publish one package (and, by default, its file: dependencies first). Holds the
+ * per-directory lock for the whole run so a second npmglobalize reaching the same
+ * package waits instead of double-bumping.
+ * @param cwd - the package directory
+ * @param options - CLI options for this run
+ * @param configOptions - values read from the package's .globalize.json5
+ * @returns true when the package was published (or needed nothing), false on failure
+ */
 export declare function globalize(cwd: string, options?: GlobalizeOptions, configOptions?: Partial<GlobalizeOptions>): Promise<boolean>;
 /** Orchestrate globalize across all packages in an npm workspace */
 export declare function globalizeWorkspace(rootDir: string, options?: GlobalizeOptions, configOptions?: Partial<GlobalizeOptions>): Promise<WorkspaceResult>;

package/lib.js

@@ -12,6 +12,7 @@
 import fs from 'fs';
 import os from 'os';
 import path from 'path';
+import { createHash } from 'crypto';
 import { execSync, spawn, spawnSync } from 'child_process';
 import { builtinModules } from 'module';
 import { readConfig as readUserConfig, writeConfig as writeUserConfig, configDir, configPath as userConfigPath } from '@bobfrankston/userconfig';
@@ -826,6 +827,7 @@ export function installCleanupHandlers() {
         return;
     cleanupHandlersInstalled = true;
     process.on('exit', emergencyRestoreDeps);
+    process.on('exit', releaseAllDirLocks); // 2026-09-24 per-directory lock: drop ours on ^C / process.exit
     // Idempotent abort: first ^C prints an immediate ack so the user doesn't
     // press again and accidentally kill the process mid-restore. Subsequent
     // signals while already aborting are absorbed (with a brief reminder).
@@ -1755,6 +1757,13 @@ export function transformDeps(pkg, baseDir, verbose = false, forcePublish = fals
                 console.log(colors.blue(`  + ${name} → ${value}`));
                 try {
                     const targetPkg = readPackageJson(targetPath);
+                    // 2026-09-24 — Claude Code (Fable 5.1), at Bob's direction: the range below goes
+                    // under the KEY, so a key that is not the target's name would publish a dep nobody
+                    // can install (dbx10's "ubntdefs": "^1.0.5"). The prescan renames such keys; this
+                    // is the stop for a run that skipped it (-no-prescan).
+                    if (targetPkg.name && targetPkg.name !== name) {
+                        throw new Error(`dependency key "${name}" names a package whose package.json says ${targetPkg.name}; published as "${name}" it could not be installed. Rerun without -no-prescan to have the key renamed, or rename it by hand`);
+                    }
                     const targetVersion = targetPkg.version;
                     const npmVersion = '^' + targetVersion;
                     // Check if this version exists on npm (or if force publish)
@@ -2073,6 +2082,21 @@ export function prescanDepGraph(baseDir, visited = new Set(), verbose = false, f
             }
             const depName = targetPkg.name || name;
             fileTargets.set(depName, targetPath);
+            // 2026-09-24 16:20 EDT — Claude Code (Fable 5.1), at Bob's direction. A file: dep
+            // declared under a key that is not the target's package.json name ("ubntdefs":
+            // file:… whose package.json says "@bobfrankston/ubntdefs") links fine locally, but
+            // transformDeps writes the version range under the KEY, so the published dbx10 said
+            // `"ubntdefs": "^1.0.5"` — a name that is not on npm — and every registry install of
+            // a consumer (setcolor) died with E404. Flagged here; fixDepKeyMismatches renames the
+            // key, uninstalls the old name and reinstalls. Bob: "uninstall from the old name and
+            // reinstall with the new. This is safe."
+            if (targetPkg.name && targetPkg.name !== name) {
+                issues.push({
+                    severity: 'warning', kind: 'nameMismatch',
+                    package: targetPkg.name, key: name, path: baseDir, consumer: consumerName, range: value,
+                    message: `${consumerName} declares ${targetPkg.name} under the key "${name}" (${value})`
+                });
+            }
             // Unscoped + private-intent. This used to be a WARNING whose "continue" led
             // into the cascade prompting to rename the dep by adding a scope. The cascade
             // never renames a dependency now (see the _fromDep check in globalize), so it
@@ -2195,6 +2219,72 @@ export async function fixRegistryRefs(registryRefs, fileTargets, opts = {}) {
     console.log('');
     return ok;
 }
+/** Rename file: dependency keys that differ from the target package's own name, then
+ *  `npm uninstall` the old name and `npm install` so node_modules holds the link under the
+ *  real name. The published package.json carries the version range under the KEY, so a
+ *  wrong key publishes a dependency nobody can install (dbx10 → `"ubntdefs": "^1.0.5"`,
+ *  setcolor's install died with E404 on 2026-09-24). Nothing is asked; -dry-run prints what
+ *  would change; each outcome lands in the Issues Summary.
+ *  2026-09-24 16:20 EDT — Claude Code (Fable 5.1), at Bob's direction: "A check would be to
+ *  look at the file; to uninstall from the old name and reinstall with the new. This is safe." */
+export async function fixDepKeyMismatches(mismatches, opts = {}) {
+    if (!mismatches.length)
+        return true;
+    const { dryRun = false, verbose = false } = opts;
+    console.log(colors.yellow(`${mismatches.length} file: dependenc${mismatches.length === 1 ? 'y is' : 'ies are'} declared under a key that is not the package's own name (published that way, npm would look for a name that does not exist):`));
+    // One uninstall + install per consumer, after all of its keys are renamed.
+    const touched = new Map();
+    for (const m of mismatches) {
+        const pkgJsonPath = path.join(m.path, 'package.json');
+        console.log(`  ${colors.yellow('≠')} ${m.consumer}: "${m.key}" → ${m.package} (${m.range})`);
+        console.log(colors.dim(`       in ${pkgJsonPath}`));
+        if (dryRun) {
+            console.log(colors.dim(`       [dry-run] would rename the key to ${m.package}, then npm uninstall ${m.key} and npm install in ${m.consumer}`));
+            continue;
+        }
+        const pkg = readPackageJson(m.path);
+        let rewrote = false;
+        for (const key of DEP_KEYS) {
+            // A `.dependencies` backup (left by an interrupted transform) is the file: truth;
+            // prescanDepGraph read the key from it, so the rename goes there too.
+            for (const depsKey of ['.' + key, key]) {
+                const deps = pkg[depsKey];
+                if (!deps || deps[m.key] !== m.range)
+                    continue;
+                delete deps[m.key];
+                deps[m.package] = m.range;
+                rewrote = true;
+            }
+        }
+        if (!rewrote) {
+            console.log(colors.dim(`       key not found in ${pkgJsonPath} any more — left as is`));
+            continue;
+        }
+        writePackageJson(m.path, pkg);
+        console.log(colors.green(`       ✓ renamed to ${m.package}`));
+        recordBuildIssue(m.consumer, 'warning', `dependency key "${m.key}" renamed to ${m.package} (the file: target's own name) in ${pkgJsonPath}`);
+        const entry = touched.get(m.path) ?? { consumer: m.consumer, oldKeys: [], newNames: [] };
+        entry.oldKeys.push(m.key);
+        entry.newNames.push(m.package);
+        touched.set(m.path, entry);
+    }
+    let ok = true;
+    for (const [dir, { consumer, oldKeys, newNames }] of touched) {
+        console.log(colors.yellow(`↻ npm uninstall ${oldKeys.join(' ')} in ${consumer} (${dir}) — drops the link under the old name`));
+        const uninstall = await runCommandAsync('npm', ['uninstall', ...oldKeys], { cwd: dir, silent: !verbose });
+        if (!uninstall.success) {
+            // Not fatal: the install below links the real name; a leftover link under the old
+            // name is inert (nothing imports it) and is named so it can be removed by hand.
+            console.log(colors.yellow(`  npm uninstall failed in ${dir}; node_modules/${oldKeys.join(', node_modules/')} may remain — continuing with npm install`));
+            recordBuildIssue(consumer, 'warning', `npm uninstall ${oldKeys.join(' ')} failed in ${dir}; the old link may remain in node_modules`);
+        }
+        console.log(colors.yellow(`↻ npm install in ${consumer} (${dir}) to link ${newNames.join(', ')} under the real name`));
+        if (!await npmInstallWithCleanRetry(dir, verbose, `fixDepKeyMismatches: ${dir}`))
+            ok = false;
+    }
+    console.log('');
+    return ok;
+}
 /** Report unscoped `file:` deps found by the prescan, without asking anything.
  *
  *  An unscoped dep with private intent cannot reach npm, and npmglobalize does not
@@ -7325,7 +7415,185 @@ async function doLocalInstall(cwd, options) {
     }
     return true;
 }
+// ─── Per-directory lock ──────────────────────────────────────────────────────────────────
+// 2026-09-24 15:55 EDT — Claude Code (Fable 5.1), at Bob's direction.
+// Two npmglobalize instances reached the same packages within seconds (a dbx10 run and a
+// setcolor run whose cascade walks into dbx10 and upsnarf): both bumped, both published, and
+// the second one's tag-conflict handler deleted the first one's v1.0.8 tag and republished as
+// v1.0.9. Nothing stopped it because nothing knew another instance was there. Every
+// globalize() call now holds a lock on its package directory for its whole duration. A second
+// instance that meets a live lock WAITS for it (polling, with a status line every 10 s), then
+// re-reads the directory and continues — normally to "already published, nothing to do". A
+// lock whose owner PID is dead is stale and is removed. Reentrant within one process, so a
+// diamond in the dependency graph (A→B→D, A→C→D) does not deadlock on D. Two instances cannot
+// deadlock on each other either: both take locks consumer-first, dependency-second, in the
+// same DAG order.
+//
+// The lock lives OUTSIDE the package directory, under the temp dir, because the pre-release
+// commit does `git add -A` and would commit a file placed in the package.
+const DIR_LOCK_POLL_MS = 1_000;
+const DIR_LOCK_STATUS_EVERY_MS = 10_000;
+/** How long to wait on a live lock before giving up. A whole cascade can take minutes on Y:. */
+const DIR_LOCK_MAX_WAIT_MS = 15 * 60_000;
+/** An unreadable lock (half-written or garbage) is given this many polls to become readable
+ *  before it is treated as stale. */
+const DIR_LOCK_UNREADABLE_POLLS = 3;
+/** Locks this process holds: lock file path → reentrancy count. */
+const heldDirLocks = new Map();
+/** Where the lock for a package directory lives. Exported for the test. */
+export function dirLockPath(dir) {
+    // Windows paths compare case-insensitively and npm/junctions mix y:/Y: (see
+    // .llm/arborist-trace.md), so fold case there so both spellings map to one lock.
+    let key = path.resolve(dir);
+    if (process.platform === 'win32')
+        key = key.toLowerCase();
+    const slug = key.replace(/[^a-z0-9]+/gi, '_').slice(-80);
+    const hash = createHash('sha1').update(key).digest('hex').slice(0, 8);
+    return path.join(os.tmpdir(), 'npmglobalize-locks', `${slug}-${hash}.lock`);
+}
+function isPidAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        // EPERM: the process exists but is not ours to signal — still alive.
+        return error.code === 'EPERM';
+    }
+}
+function readDirLock(lockPath) {
+    try {
+        return JSON.parse(fs.readFileSync(lockPath, 'utf-8'));
+    }
+    catch (error) {
+        // Justified swallow: the lock vanished between our EEXIST and this read (its owner
+        // finished), or it is half-written / garbage. The caller treats null as "unreadable",
+        // re-polls a few times, and then removes the lock as stale — so an unreadable lock
+        // cannot hold anyone forever and nothing is lost by not reporting the parse error.
+        return null;
+    }
+}
+function fmtLockTime(iso) {
+    const time = new Date(iso);
+    return isNaN(time.getTime()) ? iso : time.toLocaleTimeString();
+}
+/** Take the lock for `dir`, waiting for a live holder to finish. Returns the lock path to
+ *  hand back to releaseDirLock. Throws after `maxWaitMs` naming the holder and the lock file. */
+export async function acquireDirLock(dir, opts = {}) {
+    const lockPath = dirLockPath(dir);
+    const held = heldDirLocks.get(lockPath);
+    if (held) { // reentrant: this process already holds it
+        heldDirLocks.set(lockPath, held + 1);
+        return lockPath;
+    }
+    fs.mkdirSync(path.dirname(lockPath), { recursive: true });
+    const info = {
+        pid: process.pid,
+        started: new Date().toISOString(),
+        dir: path.resolve(dir),
+        argv: process.argv.slice(1)
+    };
+    const maxWait = opts.maxWaitMs ?? DIR_LOCK_MAX_WAIT_MS;
+    const waitStart = Date.now();
+    let lastStatus = 0;
+    let announced = false;
+    let unreadablePolls = 0;
+    for (;;) {
+        try {
+            fs.writeFileSync(lockPath, JSON.stringify(info, null, 2), { flag: 'wx' }); // atomic create
+            heldDirLocks.set(lockPath, 1);
+            if (announced)
+                console.log(colors.green(`✓ ${info.dir} is free — continuing`));
+            return lockPath;
+        }
+        catch (error) {
+            if (error.code !== 'EEXIST')
+                throw error;
+        }
+        const holder = readDirLock(lockPath);
+        if (!holder) {
+            if (++unreadablePolls >= DIR_LOCK_UNREADABLE_POLLS) {
+                console.log(colors.yellow(`Removing unreadable npmglobalize lock ${lockPath}`));
+                removeLockFile(lockPath);
+                unreadablePolls = 0;
+                continue;
+            }
+        }
+        else if (!isPidAlive(holder.pid)) {
+            console.log(colors.yellow(`Removing stale npmglobalize lock for ${holder.dir}: PID ${holder.pid} (started ${fmtLockTime(holder.started)}) is no longer running`));
+            removeLockFile(lockPath);
+            continue;
+        }
+        else {
+            const waitedMs = Date.now() - waitStart;
+            if (waitedMs > maxWait) {
+                throw new Error(`Gave up after ${Math.round(waitedMs / 60_000)} min waiting for npmglobalize PID ${holder.pid} to finish with ${holder.dir}.\n` +
+                    `  It has held the lock since ${fmtLockTime(holder.started)} running: ${holder.argv.join(' ')}\n` +
+                    `  If PID ${holder.pid} is not an npmglobalize, delete ${lockPath} and rerun.`);
+            }
+            if (Date.now() - lastStatus >= DIR_LOCK_STATUS_EVERY_MS) {
+                lastStatus = Date.now();
+                announced = true;
+                const soFar = waitedMs >= DIR_LOCK_STATUS_EVERY_MS ? ` — ${Math.round(waitedMs / 1000)} s so far` : '';
+                console.log(colors.yellow(`Waiting for npmglobalize PID ${holder.pid} (started ${fmtLockTime(holder.started)}) to finish with ${holder.dir}${soFar}`));
+            }
+        }
+        await new Promise(resolve => setTimeout(resolve, DIR_LOCK_POLL_MS));
+    }
+}
+function removeLockFile(lockPath) {
+    try {
+        fs.unlinkSync(lockPath);
+    }
+    catch (error) {
+        // ENOENT means the owner removed it first — that is the outcome we wanted.
+        if (error.code !== 'ENOENT')
+            throw error;
+    }
+}
+/** Release a lock taken by acquireDirLock. The file goes only when the outermost holder in
+ *  this process releases, and only if it is still ours. */
+export function releaseDirLock(lockPath) {
+    const held = heldDirLocks.get(lockPath);
+    if (!held)
+        return;
+    if (held > 1) {
+        heldDirLocks.set(lockPath, held - 1);
+        return;
+    }
+    heldDirLocks.delete(lockPath);
+    const current = readDirLock(lockPath);
+    if (current && current.pid !== process.pid)
+        return; // someone else's now; leave it
+    removeLockFile(lockPath);
+}
+/** For the exit handler: drop every lock this process holds, so a ^C leaves nothing behind
+ *  (a leftover would only cost the next run a "stale lock removed" line, but be tidy). */
+export function releaseAllDirLocks() {
+    for (const lockPath of [...heldDirLocks.keys()]) {
+        heldDirLocks.set(lockPath, 1);
+        releaseDirLock(lockPath);
+    }
+}
+/**
+ * Publish one package (and, by default, its file: dependencies first). Holds the
+ * per-directory lock for the whole run so a second npmglobalize reaching the same
+ * package waits instead of double-bumping.
+ * @param cwd - the package directory
+ * @param options - CLI options for this run
+ * @param configOptions - values read from the package's .globalize.json5
+ * @returns true when the package was published (or needed nothing), false on failure
+ */
 export async function globalize(cwd, options = {}, configOptions = {}) {
+    const lockPath = await acquireDirLock(cwd);
+    try {
+        return await globalizeUnderLock(cwd, options, configOptions);
+    }
+    finally {
+        releaseDirLock(lockPath);
+    }
+}
+async function globalizeUnderLock(cwd, options = {}, configOptions = {}) {
     const { bump = 'patch', noPublish = false, cleanup = false, install = false, link = false, wsl = false, force = false, files = true, dryRun = false, quiet = true, verbose = false, init = false, gitVisibility = 'private', npmVisibility = 'private', message, conform = false, asis = false, updateDeps = false, updateMajor = false, publishDeps = true, // Default to publishing deps for safety
     publishDepsYes = false, // -pd: auto-yes to dep-cascade prompts (private only)
     publicDeps = false, // -public-deps: cascade public visibility to all deps
@@ -7437,7 +7705,15 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
             console.error(colors.red('npm install failed while linking own-scope deps as file: (see above). Stopping; use -force to continue anyway.'));
             return false;
         }
-        const allIssues = scanned.filter(i => i.kind !== 'registryRef');
+        // 2026-09-24 — Claude Code (Fable 5.1), at Bob's direction: file: deps declared under a
+        // key that is not the target's name are renamed + reinstalled the same way (see
+        // fixDepKeyMismatches); a failed install stops the run unless -force.
+        const mismatchOk = await fixDepKeyMismatches(scanned.filter(i => i.kind === 'nameMismatch'), { dryRun, verbose });
+        if (!mismatchOk && !force) {
+            console.error(colors.red('npm install failed after renaming a dependency key to the package\'s own name (see above). Stopping; use -force to continue anyway.'));
+            return false;
+        }
+        const allIssues = scanned.filter(i => i.kind !== 'registryRef' && i.kind !== 'nameMismatch');
         // Unscoped deps are handled apart from the error/warning prompt below: nothing the
         // user answers could change the outcome, so nothing is asked. Report, remember,
         // stop. See reportUnscopedDeps.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/npmglobalize",
-  "version": "1.0.238",
+  "version": "1.0.240",
   "description": "Transform file: dependencies to npm versions for publishing",
   "main": "index.js",
   "type": "module",