postinstall repoints the global agent-browser symlink during local (non-global) installs

Summary

scripts/postinstall.js decides it is running in a global install only by checking whether $(npm prefix -g)/bin/agent-browser exists as a symlink (fixUnixSymlink, around lines 239–265 on main). It never checks whether npm is actually installing globally. So on any machine that already has a global agent-browser, a local install of any project that depends on agent-browser, run with lifecycle scripts enabled, replaces the user's global symlink with one pointing into that project's node_modules.

If that project directory is later deleted (a git worktree, a CI checkout, a temporary clone), the global agent-browser command is a dangling symlink and fails with command not found.

Reproduction (macOS, npm 11, agent-browser 0.39.2; steps follow the code path. We observed the same effect with npm ci in git worktrees.)

npm i -g agent-browser               # global link -> $(npm prefix -g)/lib/node_modules/agent-browser/bin/agent-browser-darwin-arm64
mkdir /tmp/p && cd /tmp/p && npm init -y >/dev/null
npm i agent-browser                  # local install, scripts enabled
readlink "$(npm prefix -g)/bin/agent-browser"
# -> /tmp/p/node_modules/agent-browser/bin/agent-browser-darwin-arm64   (global link now points into /tmp/p)
rm -rf /tmp/p
agent-browser --version              # command not found: dangling symlink

We hit this repeatedly on a shared dev machine: several agents create short-lived worktrees of a repo that depends on agent-browser, and each npm ci in a worktree took over the global command until the worktree was removed.

Suggested fix

Only patch the global bin entry on a real global install, for example:

const isGlobalInstall = process.env.npm_config_global === 'true';
if (!isGlobalInstall) return;

Or compare the realpath of the package directory against $(npm prefix -g)/lib/node_modules/agent-browser before touching $(npm prefix -g)/bin. The same guard applies to the Windows shim rewrite.

Workaround for affected users: npm ci --ignore-scripts for local installs.