[Mikola Lysenko (mikolalysenko)]

LLM Description written by Claude Code:claude-opus-5-5

Fixes #444

#1719 taught global mode to crawl Deno's npm cache and left two parts of #444 open. This PR closes both.

What changes for users

1. --global-prefix $DENO_DIR and --global-prefix $DENO_DIR/npm now work. Before, they found nothing (package_not_installed); only the registry dir $DENO_DIR/npm/registry.npmjs.org did. They now expand to every registry dir below them, the same ones -g crawls (jsr.io stays out).
2. A Deno per-tool bin/.<tool>/node_modules that Deno never loads is refused. On Deno 2.7 and later, a tool installed from a local or JSR entrypoint gets that tree, but its deno.json sets no nodeModulesDir, so Deno loads the $DENO_DIR/npm copy. Pointing --global-prefix at it used to report applied and a VEX not_affected while the tool kept running the unpatched code. It's now a usage error (exit 2) like a nonexistent prefix, and the message points at -g / $DENO_DIR. A prefix inside the decoy, or a symlink to it, is refused too. rollback, remove, vendor --revert and repair still accept it, so files an earlier release patched there can be restored. Trees Deno does load are still accepted: an npm: entrypoint tool ("nodeModulesDir": "manual" + package.json), auto, or any tree with a sibling package.json.

Root cause

NpmCrawler::node_modules_paths_sync read a --global-prefix as either a Deno registry dir or a node_modules-shaped dir. It never expanded a Deno cache parent into its registry dirs, and nothing checked whether Deno would load a per-tool node_modules.

Implementation

• npm_crawler.rs: split the -g walk into deno_npm_registry_dirs(npm), and add deno_cache_parent_registry_dirs(prefix). It only fires for a prefix named npm, or one with an npm child, that is not a node_modules and has no package.json. So a global node_modules holding the npm CLI keeps its old walk (regression test included).
• deno_crawler.rs: is_unloaded_deno_tool_node_modules(path) matches only <..>/bin/.<tool>/node_modules with a plain-JSON deno.json/deno.jsonc whose nodeModulesDir is unset, "none" or false, and no package.json. A config that isn't plain JSON (JSONC comments) is not judged, so it fails open to the old behavior rather than refusing a live tree.
• args.rs: GlobalArgs::validate_paths refuses that prefix next to the existing "does not exist" check, so every command (scan/apply/rollback/vex/vendor/...) refuses it the same way.

No wrapper (npm/, pypi/, gem/) changes are needed: they only dispatch to the binary.

Tests (red → green)

#444 part	test	without fix	with fix
$DENO_DIR / $DENO_DIR/npm prefix	crawler_npm_e2e::deno_dir_and_npm_dir_prefixes_expand_to_registry_dirs	FAIL (roots = the prefix itself, 0 packages)	pass
control: npm package child keeps the walk	crawler_npm_e2e::prefix_with_npm_package_child_keeps_node_modules_walk	pass	pass
per-tool decoy refused on every command	cli_path_flags_validated::deno_tool_node_modules_deno_never_loads_is_a_usage_error	FAIL (not exit 2)	pass
control: live per-tool trees accepted	cli_path_flags_validated::deno_tool_node_modules_deno_loads_is_accepted	pass	pass
detector edge cases	deno_crawler::tests::unloaded_deno_tool_node_modules_matches_only_the_decoy	n/a (new fn)	pass

Local: cargo fmt --all -- --check OK, cargo clippy --workspace --all-features -- -D warnings OK, crawler_npm_e2e 118/118, cli_path_flags_validated 28/28, core deno unit tests 39/39. Full cargo test --workspace --all-features --no-fail-fast: 236 binaries ok. It caught one real issue, fixed in c786cc7: the crawler architecture test requires FIFO-safe reads, so deno.json is now read with read_regular_to_string_sync. The remaining 12 failures are sandbox-only and outside this diff: the sandbox runs as root, so chmod-based write-failure tests can't fail (in_process_redirect write failures, vlt_heal, copy_tree symlinked root, pypi_poetry/pypi_requirements wire failures, repair_* unremovable lock), and e2e_bun_lockb needs patches-api.socket.dev, which the sandbox proxy blocks. CI runs them unprivileged and online.

/code-review high (run on the diff; fixes in a197537)

• Fixed: an explicit nodeModulesDir: "none"/false beside a package.json now counts; the config is read as JSONC (comments, trailing comma, BOM) via strip_jsonc/strip_bom; nested paths inside the decoy and symlinks to it are caught (canonicalized + ancestor walk); restoring commands are exempt; a relative prefix (.) is made absolute; an npm dir holding node_modules (npm's Windows global prefix %APPDATA%\npm) is not read as Deno's cache; the error message now says "Deno config leaves nodeModulesDir unset or none". Each has a test.
• Not changed: "move the decoy check into the crawler". In the crawler it could only drop the root silently, which brings back the "0 packages, exit 0" signal Global mode can't see any Deno global install: the npm packages under $DENO_DIR/npm/registry.npmjs.org are never crawled, so scan -g misses them and Deno 2.9's per-tool node_modules gets patched and VEX-attested while the tool runs the unpatched copy #444 complains about. The CLI is the only consumer that takes a user-supplied prefix, and a usage error is the actionable outcome. validate_paths is where every other bad --global-prefix is already refused.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[cursor]

Stale Bugbot comment from a previous run.

[Mikola Lysenko (mikolalysenko)]

BugBot review

---

Generated by Claude Code

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit a197537. Configure here.}

[Mikola Lysenko (mikolalysenko)]

Ready for review at a197537.

• CI: 50/50 checks green on the current head (31 success, 19 skipped). No main-wide failures.
• Bugbot: reviewed a197537, no new issues. No unresolved review threads.
• Already approved by Tanmay Singla (@Tanmay182003) on this head. Mergeable, no conflicts, no CHANGELOG.md change.
• Worth a look: the --global-prefix Deno decoy check lives in validate_paths (CLI usage error) rather than the crawler. The PR description explains why.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

Ready for review at a197537.

• CI: 50/50 checks green (31 success, 19 skipped), no conflicts.
• Bugbot: reviewed a197537 with no new issues. The earlier review on c786cc7 is stale.
• Already approved on this head.
• For reviewers: the change is in deno_crawler.rs and npm_crawler.rs (--global-prefix now resolves Deno cache parent dirs and skips Deno's per-tool node_modules trees), plus FIFO-safe reads of Deno tool config.

---

Generated by Claude Code