@bobfrankston/npmglobalize 1.0.91 → 1.0.93

package/.claude/settings.local.json

@@ -25,7 +25,12 @@
       "Bash(cmd.exe /c \"dir /a /b y:\\\\dev\\\\homecontrol\\\\utils\\\\addone\")",
       "Bash(icacls:*)",
       "Bash(npm install:*)",
-      "Bash(echo:*)"
+      "Bash(echo:*)",
+      "Bash(onboard --version:*)",
+      "Bash(onboard --help:*)",
+      "Bash(npmglobalize:*)",
+      "Bash(npm whoami:*)",
+      "Bash(where npmglobalize:*)"
     ]
   }
 }

package/cli.js

@@ -2,7 +2,7 @@
 /**
  * npmglobalize CLI - Transform file: dependencies to npm versions for publishing
  */
-import { globalize, globalizeWorkspace, readConfig, readPackageJson, writeConfig, writePackageJson, confirm } from './lib.js';
+import { globalize, globalizeWorkspace, readConfig, readPackageJson, readUserNpmConfig, writeConfig, writePackageJson, confirm } from './lib.js';
 import fs from 'fs';
 import path from 'path';
 import { styleText } from 'util';
@@ -402,11 +402,18 @@ export async function main() {
         writePackageJson(cwd, pkg);
         console.log(`Updated ${path.join(cwd, 'package.json')} scripts:`);
         changes.forEach(c => console.log(`  ${c}`));
-        process.exit(0);
+        // If no other flags need processing, exit; otherwise fall through
+        if (!cliOptions.install && !cliOptions.link && !cliOptions.local) {
+            process.exit(0);
+        }
     }
-    // Load config file and merge with CLI options (CLI takes precedence)
+    // Load config: global userconfig → per-project .globalize.json5 → CLI (each overrides previous)
+    const userNpmConfig = readUserNpmConfig();
+    const globalDefaults = {};
+    if (userNpmConfig.npmVisibility)
+        globalDefaults.npmVisibility = userNpmConfig.npmVisibility;
     const configOptions = readConfig(cwd);
-    const options = { ...configOptions, ...cliOptions };
+    const options = { ...globalDefaults, ...configOptions, ...cliOptions };
     // Persist explicitly set CLI flags to .globalize.json5
     if (cliOptions.explicitKeys.size > 0 && !cliOptions.once) {
         const persistable = { ...configOptions };

package/lib.d.ts

@@ -9,6 +9,7 @@
  * Current approach uses synchronous child_process calls for stability and simplicity.
  * Consider library-based approach if async operations or cross-platform issues arise.
  */
+import { NpmCommonConfig } from '@bobfrankston/userconfig';
 /** Options for the globalize operation */
 export interface GlobalizeOptions {
     /** Bump type: patch (default), minor, major */
@@ -94,6 +95,14 @@ export interface WorkspaceResult {
 }
 /** Read and parse package.json from a directory */
 export declare function readPackageJson(dir: string): any;
+/** Global npm config from %USERPROFILE%\.userconfig\npm.json5 — via @bobfrankston/userconfig */
+export type UserNpmConfig = NpmCommonConfig;
+/** Get the .userconfig directory path (%USERPROFILE%\.userconfig) */
+export declare function getUserConfigDir(): string;
+/** Read global npm config from %USERPROFILE%\.userconfig\npm.json5 */
+export declare function readUserNpmConfig(): UserNpmConfig;
+/** Write global npm config to %USERPROFILE%\.userconfig\npm.json5 */
+export declare function writeUserNpmConfig(config: UserNpmConfig): void;
 /** Read .globalize.json5 config file */
 export declare function readConfig(dir: string): Partial<GlobalizeOptions>;
 /** Write .globalize.json5 config file */
@@ -205,6 +214,8 @@ export declare function getGitStatus(cwd: string): GitStatus;
 export declare function validatePackageJson(pkg: any): string[];
 /** Prompt user for confirmation */
 export declare function confirm(message: string, defaultYes?: boolean): Promise<boolean>;
+/** Prompt user for free text input */
+export declare function promptText(message: string, defaultValue?: string): Promise<string>;
 /** Prompt user for multiple choice */
 export declare function promptChoice(message: string, choices: string[]): Promise<string | null>;
 /** Initialize git repository */

package/lib.js

@@ -12,6 +12,18 @@
 import fs from 'fs';
 import path from 'path';
 import { execSync, spawnSync } from 'child_process';
+import { readConfig as readUserConfig, writeConfig as writeUserConfig, configDir } from '@bobfrankston/userconfig';
+/** Wrapper for spawnSync that avoids DEP0190 (args + shell: true).
+ *  When shell is true, joins cmd+args into a single command string. */
+function spawnSafe(cmd, args, options = {}) {
+    const opts = { ...options, encoding: 'utf-8' };
+    if (opts.shell && args.length > 0) {
+        // Join into a single command string to avoid DEP0190
+        const cmdStr = [cmd, ...args].map(a => /[\s"&|<>^]/.test(a) ? `"${a.replace(/"/g, '\\"')}"` : a).join(' ');
+        return spawnSync(cmdStr, opts);
+    }
+    return spawnSync(cmd, args, opts);
+}
 import readline from 'readline';
 import libversion from 'libnpmversion';
 import JSON5 from 'json5';
@@ -77,6 +89,20 @@ export function readPackageJson(dir) {
         throw new Error(`Failed to parse ${pkgPath}: ${error.message}`);
     }
 }
+/** Get the .userconfig directory path (%USERPROFILE%\.userconfig) */
+export function getUserConfigDir() {
+    return configDir;
+}
+/** Read global npm config from %USERPROFILE%\.userconfig\npm.json5 */
+export function readUserNpmConfig() {
+    return readUserConfig();
+}
+/** Write global npm config to %USERPROFILE%\.userconfig\npm.json5 */
+export function writeUserNpmConfig(config) {
+    const existing = readUserConfig();
+    const merged = { ...existing, ...config };
+    writeUserConfig(merged);
+}
 /** Read .globalize.json5 config file */
 export function readConfig(dir) {
     const configPath = path.join(dir, '.globalize.json5');
@@ -203,7 +229,7 @@ export function isFileRef(value) {
 /** Get the latest version of a package from npm */
 export function getLatestVersion(packageName) {
     try {
-        const result = spawnSync('npm', ['view', packageName, 'version'], {
+        const result = spawnSafe('npm', ['view', packageName, 'version'], {
             encoding: 'utf-8',
             stdio: 'pipe',
             shell: true // Required on Windows to find npm.cmd
@@ -220,7 +246,7 @@ export function getLatestVersion(packageName) {
 /** Check if a specific version of a package exists on npm */
 export function checkVersionExists(packageName, version) {
     try {
-        const result = spawnSync('npm', ['view', `${packageName}@${version}`, 'version'], {
+        const result = spawnSafe('npm', ['view', `${packageName}@${version}`, 'version'], {
             encoding: 'utf-8',
             stdio: 'pipe',
             shell: true // Required on Windows to find npm.cmd
@@ -234,7 +260,7 @@ export function checkVersionExists(packageName, version) {
 /** Check if a package exists on npm (any version) */
 export function checkPackageExists(packageName) {
     try {
-        const result = spawnSync('npm', ['view', packageName, 'version'], {
+        const result = spawnSafe('npm', ['view', packageName, 'version'], {
             encoding: 'utf-8',
             stdio: 'pipe',
             shell: true // Required on Windows to find npm.cmd
@@ -252,14 +278,14 @@ export function checkNpmAccess(packageName) {
         if (packageName.startsWith('@')) {
             // First check if the package actually exists on npm
             // npm access returns read-write for unpublished packages in owned scopes
-            const viewResult = spawnSync('npm', ['view', packageName, 'name'], {
+            const viewResult = spawnSafe('npm', ['view', packageName, 'name'], {
                 encoding: 'utf-8',
                 stdio: 'pipe',
                 shell: true
             });
             if (viewResult.status === 0 && viewResult.stdout && viewResult.stdout.trim()) {
                 // Package exists - check public/private status
-                const accessResult = spawnSync('npm', ['access', 'get', 'status', packageName], {
+                const accessResult = spawnSafe('npm', ['access', 'get', 'status', packageName], {
                     encoding: 'utf-8',
                     stdio: 'pipe',
                     shell: true
@@ -273,7 +299,7 @@ export function checkNpmAccess(packageName) {
                 return 'restricted'; // Exists but not publicly accessible
             }
             // Package not viewable - check if it's restricted or unpublished
-            const checkResult = spawnSync('npm', ['view', packageName, '--json'], {
+            const checkResult = spawnSafe('npm', ['view', packageName, '--json'], {
                 encoding: 'utf-8',
                 stdio: 'pipe',
                 shell: true
@@ -289,13 +315,36 @@ export function checkNpmAccess(packageName) {
             return 'restricted'; // Default for scoped
         }
         else {
-            // Unscoped packages are always public if they exist
-            const result = spawnSync('npm', ['view', packageName, 'name'], {
+            // Unscoped packages are always public if they exist — but only if we own them
+            const result = spawnSafe('npm', ['view', packageName, 'name'], {
                 encoding: 'utf-8',
                 stdio: 'pipe',
                 shell: true
             });
             if (result.status === 0 && result.stdout && result.stdout.trim()) {
+                // Package exists on npm — check if current user is a maintainer
+                const maintResult = spawnSafe('npm', ['view', packageName, 'maintainers', '--json'], {
+                    encoding: 'utf-8',
+                    stdio: 'pipe',
+                    shell: true
+                });
+                if (maintResult.status === 0 && maintResult.stdout) {
+                    const auth = checkNpmAuth();
+                    if (auth.username) {
+                        try {
+                            const maintainers = JSON.parse(maintResult.stdout.trim());
+                            const names = Array.isArray(maintainers)
+                                ? maintainers.map((m) => typeof m === 'string' ? m.replace(/ <.*/, '') : m.name)
+                                : [];
+                            if (!names.includes(auth.username)) {
+                                return null; // Exists but we don't own it
+                            }
+                        }
+                        catch {
+                            // Parse failed — fall through to return public
+                        }
+                    }
+                }
                 return 'public';
             }
             return null;
@@ -510,6 +559,55 @@ export function topologicalSort(graph) {
     }
     return result;
 }
+/** Check if a published npm package has broken deps (file: paths or unpublished transitive deps).
+ *  Also checks local file: deps for unpublished versions. */
+function hasUnpublishedTransitiveDeps(packageName, pkg, baseDir, verbose) {
+    // Check 1: Does the npm-published version have file: paths in its deps?
+    try {
+        const result = spawnSafe('npm', ['view', packageName, 'dependencies', '--json'], {
+            encoding: 'utf-8',
+            stdio: 'pipe',
+            shell: true
+        });
+        if (result.status === 0 && result.stdout.trim()) {
+            const npmDeps = JSON.parse(result.stdout.trim());
+            for (const [depName, depValue] of Object.entries(npmDeps)) {
+                if (isFileRef(depValue)) {
+                    if (verbose) {
+                        console.log(colors.yellow(`    npm copy has file: dep ${depName} → ${depValue}`));
+                    }
+                    return true;
+                }
+            }
+        }
+    }
+    catch {
+        // Can't check npm — fall through to local check
+    }
+    // Check 2: Do local file: deps have unpublished versions?
+    for (const key of DEP_KEYS) {
+        if (!pkg[key])
+            continue;
+        for (const [depName, depValue] of Object.entries(pkg[key])) {
+            if (!isFileRef(depValue))
+                continue;
+            try {
+                const depPath = resolveFilePath(depValue, baseDir);
+                const depPkg = readPackageJson(depPath);
+                if (!checkVersionExists(depName, depPkg.version)) {
+                    if (verbose) {
+                        console.log(colors.yellow(`    transitive dep ${depName}@${depPkg.version} not on npm`));
+                    }
+                    return true;
+                }
+            }
+            catch {
+                return true;
+            }
+        }
+    }
+    return false;
+}
 /** Transform file: dependencies to npm versions */
 export function transformDeps(pkg, baseDir, verbose = false, forcePublish = false) {
     let transformed = false;
@@ -564,8 +662,15 @@ export function transformDeps(pkg, baseDir, verbose = false, forcePublish = fals
                             console.log(colors.red(`  ⚠ ${name}@${targetVersion} not found on npm (local: ${value})`));
                         }
                     }
-                    else if (verbose) {
-                        console.log(colors.green(`  ✓ ${name}@${targetVersion} exists on npm`));
+                    else {
+                        if (verbose) {
+                            console.log(colors.green(`  ✓ ${name}@${targetVersion} exists on npm`));
+                        }
+                        // Check transitive file: deps — if any are unpublished, this dep needs republishing
+                        if (hasUnpublishedTransitiveDeps(name, targetPkg, targetPath, verbose)) {
+                            unpublished.push({ name, version: targetVersion, path: targetPath });
+                            console.log(colors.yellow(`  ⟳ ${name}@${targetVersion} has unpublished transitive deps — will republish`));
+                        }
                     }
                     pkg[key][name] = npmVersion;
                     if (verbose) {
@@ -604,7 +709,7 @@ export function hasBackup(pkg) {
 /** Get the latest git tag (if any) */
 export function getLatestGitTag(cwd) {
     try {
-        const result = spawnSync('git', ['describe', '--tags', '--abbrev=0'], {
+        const result = spawnSafe('git', ['describe', '--tags', '--abbrev=0'], {
             encoding: 'utf-8',
             stdio: 'pipe',
             cwd
@@ -621,7 +726,7 @@ export function getLatestGitTag(cwd) {
 /** Check if a git tag exists */
 export function gitTagExists(cwd, tag) {
     try {
-        const result = spawnSync('git', ['tag', '-l', tag], {
+        const result = spawnSafe('git', ['tag', '-l', tag], {
             encoding: 'utf-8',
             stdio: 'pipe',
             cwd
@@ -635,7 +740,7 @@ export function gitTagExists(cwd, tag) {
 /** Delete a git tag */
 export function deleteGitTag(cwd, tag) {
     try {
-        const result = spawnSync('git', ['tag', '-d', tag], {
+        const result = spawnSafe('git', ['tag', '-d', tag], {
             encoding: 'utf-8',
             stdio: 'pipe',
             cwd
@@ -649,7 +754,7 @@ export function deleteGitTag(cwd, tag) {
 /** Get all git tags */
 export function getAllGitTags(cwd) {
     try {
-        const result = spawnSync('git', ['tag', '-l'], {
+        const result = spawnSafe('git', ['tag', '-l'], {
             encoding: 'utf-8',
             stdio: 'pipe',
             cwd
@@ -733,7 +838,7 @@ function waitForNpmVersion(pkgName, version, maxWaitMs = 60000) {
     const maxAttempts = Math.ceil(maxWaitMs / interval);
     process.stdout.write(`Waiting for ${pkgName}@${version} on npm registry`);
     for (let i = 0; i < maxAttempts; i++) {
-        const result = spawnSync('npm', ['view', `${pkgName}@${version}`, 'version'], {
+        const result = spawnSafe('npm', ['view', `${pkgName}@${version}`, 'version'], {
             shell: process.platform === 'win32',
             stdio: ['pipe', 'pipe', 'pipe'],
             encoding: 'utf-8'
@@ -743,7 +848,7 @@ function waitForNpmVersion(pkgName, version, maxWaitMs = 60000) {
             return true;
         }
         process.stdout.write('.');
-        spawnSync(process.platform === 'win32' ? 'timeout' : 'sleep', process.platform === 'win32' ? ['/t', '3', '/nobreak'] : ['3'], { stdio: 'pipe', shell: process.platform === 'win32' });
+        spawnSafe(process.platform === 'win32' ? 'timeout' : 'sleep', process.platform === 'win32' ? ['/t', '3', '/nobreak'] : ['3'], { stdio: 'pipe', shell: process.platform === 'win32' });
     }
     process.stdout.write(' timed out\n');
     return false;
@@ -758,7 +863,7 @@ export function runCommand(cmd, args, options = {}) {
         if (!silent) {
             console.log(colors.dim(`[DEBUG] Running: ${cmd} ${args.join(' ')}`));
         }
-        const result = spawnSync(cmd, args, {
+        const result = spawnSafe(cmd, args, {
             encoding: 'utf-8',
             stdio: silent ? 'pipe' : 'inherit',
             cwd,
@@ -811,7 +916,7 @@ function getGitHubRepo(pkg) {
 /** Run a command and throw on failure */
 export function runCommandOrThrow(cmd, args, options = {}) {
     const needsShell = cmd === 'npm' || cmd === 'npm.cmd' || cmd === 'gh';
-    const result = spawnSync(cmd, args, {
+    const result = spawnSafe(cmd, args, {
         encoding: 'utf-8',
         stdio: 'pipe',
         cwd: options.cwd,
@@ -826,7 +931,7 @@ export function runCommandOrThrow(cmd, args, options = {}) {
         if (cmd === 'git' && stderr.includes('dubious ownership')) {
             console.log(colors.yellow('Git "dubious ownership" error — directory owner SID differs from current user.'));
             console.log(colors.yellow('Adding safe.directory \'*\' to global git config...'));
-            const fix = spawnSync('git', ['config', '--global', '--add', 'safe.directory', '*'], {
+            const fix = spawnSafe('git', ['config', '--global', '--add', 'safe.directory', '*'], {
                 encoding: 'utf-8',
                 stdio: 'pipe',
                 shell: true
@@ -834,7 +939,7 @@ export function runCommandOrThrow(cmd, args, options = {}) {
             if (fix.status === 0) {
                 console.log(colors.green('✓ Fixed. Retrying...'));
                 // Retry the original command
-                const retry = spawnSync(cmd, args, {
+                const retry = spawnSafe(cmd, args, {
                     encoding: 'utf-8',
                     stdio: 'pipe',
                     cwd: options.cwd,
@@ -980,6 +1085,21 @@ export async function confirm(message, defaultYes = false) {
         });
     });
 }
+/** Prompt user for free text input */
+export async function promptText(message, defaultValue) {
+    const rl = readline.createInterface({
+        input: process.stdin,
+        output: process.stdout
+    });
+    const suffix = defaultValue ? ` [${defaultValue}]` : '';
+    return new Promise((resolve) => {
+        rl.question(`${message}${suffix} `, (answer) => {
+            rl.close();
+            const a = answer.trim();
+            resolve(a || defaultValue || '');
+        });
+    });
+}
 /** Prompt user for multiple choice */
 export async function promptChoice(message, choices) {
     const rl = readline.createInterface({
@@ -1004,7 +1124,7 @@ function checkNpmAuth() {
     try {
         // Must use shell:true on Windows to find npm.cmd in PATH
         // Must pass env: process.env to inherit NPM_TOKEN environment variable
-        const result = spawnSync('npm', ['whoami'], {
+        const result = spawnSafe('npm', ['whoami'], {
             encoding: 'utf-8',
             stdio: ['ignore', 'pipe', 'pipe'],
             env: process.env,
@@ -1323,7 +1443,7 @@ export async function initGit(cwd, visibility, dryRun) {
     // git init
     runCommandOrThrow('git', ['init'], { cwd });
     // Check for dubious ownership (git init succeeds but subsequent commands fail)
-    const ownerCheck = spawnSync('git', ['rev-parse', '--git-dir'], {
+    const ownerCheck = spawnSafe('git', ['rev-parse', '--git-dir'], {
         encoding: 'utf-8',
         stdio: 'pipe',
         cwd
@@ -1331,7 +1451,7 @@ export async function initGit(cwd, visibility, dryRun) {
     if (ownerCheck.stderr && ownerCheck.stderr.includes('dubious ownership')) {
         console.log(colors.yellow('Git "dubious ownership" error — directory owner SID differs from current user.'));
         console.log(colors.yellow('Adding safe.directory \'*\' to global git config...'));
-        const fix = spawnSync('git', ['config', '--global', '--add', 'safe.directory', '*'], {
+        const fix = spawnSafe('git', ['config', '--global', '--add', 'safe.directory', '*'], {
             encoding: 'utf-8',
             stdio: 'pipe',
             shell: true
@@ -1349,7 +1469,7 @@ export async function initGit(cwd, visibility, dryRun) {
     console.log('  ✓ Configured git for LF line endings');
     runCommandOrThrow('git', ['add', '-A'], { cwd });
     // Only commit if there are staged changes (repo may already have commits)
-    const staged = spawnSync('git', ['diff', '--cached', '--quiet'], { cwd });
+    const staged = spawnSafe('git', ['diff', '--cached', '--quiet'], { cwd });
     if (staged.status !== 0) {
         runCommandOrThrow('git', ['commit', '-m', 'Initial commit'], { cwd });
     }
@@ -1389,7 +1509,7 @@ export function runNpmAudit(cwd, fix = false, verbose = false) {
         }
     }
     // Always run audit to report status
-    const auditResult = spawnSync('npm', ['audit', '--json'], {
+    const auditResult = spawnSafe('npm', ['audit', '--json'], {
         cwd,
         encoding: 'utf-8',
         stdio: 'pipe',
@@ -1475,6 +1595,67 @@ export function getToolVersion() {
         return 'unknown';
     }
 }
+/** Offer to add a bin field if missing — returns true if bin was added or already existed */
+async function offerAddBin(cwd, pkg) {
+    if (pkg.bin)
+        return true;
+    // Determine likely entry point
+    const mainFile = pkg.main || 'index.js';
+    const cmdName = (pkg.name || path.basename(cwd)).replace(/^@[^/]+\//, '');
+    console.log(colors.yellow('No bin field — this package won\'t install as a CLI command.'));
+    const choice = await promptChoice(`Add bin field to make it a CLI tool?\n  1) Yes, use "${cmdName}" → "${mainFile}" (default)\n  2) No, install as library link\n  3) Abort\nChoice:`, ['1', '2', '3', '']);
+    if (choice === '3')
+        return false;
+    if (choice === '2') {
+        console.log(colors.dim('Installing as library link (no bin)...'));
+        return true;
+    }
+    // choice is '1' or '' (default)
+    pkg.bin = { [cmdName]: mainFile };
+    writePackageJson(cwd, pkg);
+    console.log(colors.green(`✓ Added bin: { "${cmdName}": "${mainFile}" }`));
+    return true;
+}
+/** Perform local-only install (npm install -g .) — extracted for reuse from git-init prompts */
+async function doLocalInstall(cwd, options) {
+    const { dryRun = false, wsl = false } = options;
+    const pkg = readPackageJson(cwd);
+    const pkgName = pkg.name || path.basename(cwd);
+    const pkgVersion = pkg.version || '0.0.0';
+    console.log(colors.blue(`Local install: ${pkgName}@${pkgVersion}`));
+    console.log(colors.dim('Skipping transform/publish — installing with file: deps as-is'));
+    if (!pkg.bin) {
+        const proceed = await offerAddBin(cwd, pkg);
+        if (!proceed)
+            return false;
+    }
+    if (dryRun) {
+        console.log('  [dry-run] Would run: npm install -g .');
+        if (wsl)
+            console.log('  [dry-run] Would run: wsl npm install -g .');
+        return true;
+    }
+    const result = runCommand('npm', ['install', '-g', '.'], { cwd, silent: false });
+    if (result.success) {
+        console.log(colors.green(`✓ Installed locally: ${pkgName}@${pkgVersion}`));
+    }
+    else {
+        console.error(colors.red(`✗ Local install failed`));
+        console.error(colors.yellow('  Try running manually: npm install -g .'));
+        return false;
+    }
+    if (wsl) {
+        console.log(`Installing ${pkgName} in WSL (local)...`);
+        const wslResult = runCommand('wsl', ['npm', 'install', '-g', '.'], { cwd, silent: false });
+        if (wslResult.success) {
+            console.log(colors.green(`✓ Installed in WSL: ${pkgName}@${pkgVersion}`));
+        }
+        else {
+            console.error(colors.yellow('✗ WSL install failed (is npm installed in WSL?)'));
+        }
+    }
+    return true;
+}
 export async function globalize(cwd, options = {}, configOptions = {}) {
     const { bump = 'patch', noPublish = false, cleanup = false, install = false, link = false, wsl = false, force = false, files = true, dryRun = false, quiet = true, verbose = false, init = false, gitVisibility = 'private', npmVisibility = 'private', message, conform = false, asis = false, updateDeps = false, updateMajor = false, publishDeps = true, // Default to publishing deps for safety
     forcePublish = false, fix = false, fixTags = false, rebase = false, show = false, local = false } = options;
@@ -1547,8 +1728,9 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
         console.log(colors.blue(`Local install: ${pkgName}@${pkgVersion}`));
         console.log(colors.dim('Skipping transform/publish — installing with file: deps as-is'));
         if (!pkg.bin) {
-            console.log(colors.yellow('Note: No bin field — this is a library, not a CLI tool.'));
-            console.log(colors.yellow('Running npm install -g . anyway (creates global link)...'));
+            const proceed = await offerAddBin(cwd, pkg);
+            if (!proceed)
+                return false;
         }
         if (dryRun) {
             console.log('  [dry-run] Would run: npm install -g .');
@@ -1658,11 +1840,17 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
             console.log('  [dry-run] Would initialize git repository');
         }
         else if (!init) {
-            const ok = await confirm('Initialize git repository?', true);
-            if (!ok) {
+            const choice = await promptChoice('No git repository found. What would you like to do?\n  1) Initialize git repository (default)\n  2) Use local install only (skip git/publish)\n  3) Abort\nChoice:', ['1', '2', '3', '']);
+            if (choice === '2') {
+                console.log(colors.dim('Switching to local-only mode...'));
+                writeConfig(cwd, { ...configOptions, local: true }, new Set(['local']));
+                return doLocalInstall(cwd, options);
+            }
+            if (choice === '3') {
                 console.log('Aborted. Run with --init to initialize.');
                 return false;
             }
+            // choice is '1' or '' (default)
             const success = await initGit(cwd, gitVisibility, dryRun);
             if (!success)
                 return false;
@@ -1678,8 +1866,13 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
     else if (!gitStatus.hasRemote) {
         // Git repo exists but no remote - need to create GitHub repo
         if (!init) {
-            const ok = await confirm('No git remote configured. Create GitHub repository?', true);
-            if (!ok) {
+            const choice = await promptChoice('No git remote configured. What would you like to do?\n  1) Create GitHub repository (default)\n  2) Use local install only (skip git/publish)\n  3) Abort\nChoice:', ['1', '2', '3', '']);
+            if (choice === '2') {
+                console.log(colors.dim('Switching to local-only mode...'));
+                writeConfig(cwd, { ...configOptions, local: true }, new Set(['local']));
+                return doLocalInstall(cwd, options);
+            }
+            if (choice === '3') {
                 console.log('Aborted. Run with --init to set up GitHub repository.');
                 return false;
             }
@@ -1885,8 +2078,40 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
     if (effectiveNpmVisibility === 'private') {
         // User explicitly wants private publication
         if (!isScoped) {
-            console.error(colors.red(`ERROR: Private packages must be scoped (e.g., @bobfrankston/${pkg.name})`));
-            return false;
+            // Offer to add scope — check .userconfig first, then npm whoami
+            const userConfig = readUserNpmConfig();
+            const auth = checkNpmAuth();
+            const defaultScope = userConfig.scope
+                || (auth.username ? `@${auth.username}` : undefined);
+            const scopedExample = defaultScope ? `${defaultScope}/${pkg.name}` : `@scope/${pkg.name}`;
+            console.log(colors.yellow(`Private packages must be scoped (e.g., ${scopedExample})`));
+            if (dryRun) {
+                console.log('  [dry-run] Would prompt to add scope');
+                return false;
+            }
+            const addScope = await confirm(`Add scope to package name?`, true);
+            if (!addScope) {
+                return false;
+            }
+            const scope = await promptText('Scope:', defaultScope);
+            if (!scope) {
+                console.error(colors.red('No scope provided. Aborting.'));
+                return false;
+            }
+            // Normalize: ensure it starts with @
+            const normalizedScope = scope.startsWith('@') ? scope : `@${scope}`;
+            const newName = `${normalizedScope}/${pkg.name}`;
+            pkg.name = newName;
+            writePackageJson(cwd, pkg);
+            console.log(colors.green(`✓ Renamed package to ${newName}`));
+            // Save scope to .userconfig if not already there
+            if (!userConfig.scope) {
+                const saveScope = await confirm(`Save scope "${normalizedScope}" to global config (${getUserConfigDir()}\\npm.json5)?`, true);
+                if (saveScope) {
+                    writeUserNpmConfig({ scope: normalizedScope });
+                    console.log(colors.green(`✓ Saved default scope to ${getUserConfigDir()}\\npm.json5`));
+                }
+            }
         }
         if (currentAccess === 'public') {
             console.error(colors.red(`ERROR: Package '${pkg.name}' is currently PUBLIC on npm.`));
@@ -1941,10 +2166,45 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
                 console.log(colors.dim(`  Use --npm public to make it public`));
             }
             else {
+                // Unscoped new package — prompt to add scope (same as explicit-private path)
+                const ucfg = readUserNpmConfig();
+                const auth2 = checkNpmAuth();
+                const defaultScope = ucfg.scope
+                    || (auth2.username ? `@${auth2.username}` : undefined);
+                const scopedExample = defaultScope ? `${defaultScope}/${pkg.name}` : `@scope/${pkg.name}`;
                 console.log(colors.yellow(`WARNING: Package '${pkg.name}' is unscoped and will be PUBLIC.`));
                 console.log(colors.yellow(`  Unscoped packages cannot be private on npm.`));
-                console.log(colors.yellow(`  Consider using a scoped name: @bobfrankston/${pkg.name}`));
-                console.log(colors.yellow(`  Or use --npm public to confirm public publishing`));
+                if (dryRun) {
+                    console.log(`  [dry-run] Would prompt to add scope (e.g., ${scopedExample})`);
+                }
+                else {
+                    const addScope = await confirm(`Add scope to make it private (e.g., ${scopedExample})?`, true);
+                    if (addScope) {
+                        const scope = await promptText('Scope:', defaultScope);
+                        if (scope) {
+                            const normalizedScope = scope.startsWith('@') ? scope : `@${scope}`;
+                            const newName = `${normalizedScope}/${pkg.name}`;
+                            pkg.name = newName;
+                            writePackageJson(cwd, pkg);
+                            console.log(colors.green(`✓ Renamed package to ${newName}`));
+                            if (!ucfg.scope) {
+                                const saveScope = await confirm(`Save scope "${normalizedScope}" to global config (${getUserConfigDir()}\\npm.json5)?`, true);
+                                if (saveScope) {
+                                    writeUserNpmConfig({ scope: normalizedScope });
+                                    console.log(colors.green(`✓ Saved default scope to ${getUserConfigDir()}\\npm.json5`));
+                                }
+                            }
+                        }
+                        else {
+                            console.log(colors.yellow(`  No scope provided. Continuing as public.`));
+                            console.log(colors.yellow(`  Use --npm public to suppress this prompt.`));
+                        }
+                    }
+                    else {
+                        console.log(colors.yellow(`  Continuing as public.`));
+                        console.log(colors.yellow(`  Use --npm public to suppress this prompt.`));
+                    }
+                }
             }
         }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/npmglobalize",
-  "version": "1.0.91",
+  "version": "1.0.93",
   "description": "Transform file: dependencies to npm versions for publishing",
   "main": "index.js",
   "type": "module",
@@ -22,7 +22,7 @@
   "author": "Bob Frankston",
   "license": "MIT",
   "devDependencies": {
-    "@types/node": "^25.2.1",
+    "@types/node": "^25.3.0",
     "@types/npm-package-arg": "^6.1.4",
     "@types/pacote": "^11.1.8"
   },
@@ -31,6 +31,7 @@
     "url": "https://github.com/BobFrankston/npmglobalize.git"
   },
   "dependencies": {
+    "@bobfrankston/userconfig": "^1.0.3",
     "@npmcli/package-json": "^7.0.4",
     "json5": "^2.2.3",
     "libnpmversion": "^8.0.3",
@@ -40,5 +41,14 @@
   },
   "publishConfig": {
     "access": "public"
+  },
+  ".dependencies": {
+    "@bobfrankston/userconfig": "file:../userconfig",
+    "@npmcli/package-json": "^7.0.4",
+    "json5": "^2.2.3",
+    "libnpmversion": "^8.0.3",
+    "npm-registry-fetch": "^19.1.1",
+    "pacote": "^21.0.4",
+    "simple-git": "^3.30.0"
   }
 }