install: stop bun add -g from walking above the global install dir

src/install/PackageManager.rs

@@ -1567,6 +1567,13 @@ pub fn init(
                 ) {
                     Ok(f) => break 'child f,
                     Err(e) if e.get_errno() == bun_sys::E::ENOENT => {
+                        // For global installs, the install dir is self-contained.
+                        // Don't walk above it — a stray package.json/package-lock.json
+                        // in a parent directory (e.g. $HOME) isn't the "root package"
+                        // bun should be acting on. See #30658.
+                        if cli.global {
+                            break;
+                        }
                         if let Some(parent) = bun_core::dirname(this_cwd) {
                             this_cwd = strings::without_trailing_slash(parent);
                             continue;
@@ -1637,7 +1644,9 @@ pub fn init(
         // PORT NOTE: reshaped — Zig uses withoutSuffixComptime(.., sep_str ++ "package.json")
 
         // Check if this is a workspace; if so, use root package
-        if subcommand.should_chdir_to_root() {
+        // Global installs are self-contained — don't hop up into a parent
+        // workspace that happens to live above the global dir. See #30658.
+        if subcommand.should_chdir_to_root() && !cli.global {
             if !created_package_json {
                 while let Some(parent) = bun_core::dirname(this_cwd) {
                     let parent_without_trailing_slash = strings::without_trailing_slash(parent);

src/install/PackageManager.zig

@@ -631,6 +631,13 @@ pub fn init(
                     .{ .mode = if (need_write) .read_write else .read_only },
                 ) catch |err| switch (err) {
                     error.FileNotFound => {
+                        // For global installs, the install dir is self-contained.
+                        // Don't walk above it — a stray package.json/package-lock.json
+                        // in a parent directory (e.g. $HOME) isn't the "root package"
+                        // bun should be acting on. See #30658.
+                        if (cli.global) {
+                            break;
+                        }
                         if (std.fs.path.dirname(this_cwd)) |parent| {
                             this_cwd = strings.withoutTrailingSlash(parent);
                             continue;
@@ -684,7 +691,9 @@ pub fn init(
 
         // Check if this is a workspace; if so, use root package
         var found = false;
-        if (subcommand.shouldChdirToRoot()) {
+        // Global installs are self-contained — don't hop up into a parent
+        // workspace that happens to live above the global dir. See #30658.
+        if (subcommand.shouldChdirToRoot() and !cli.global) {
             if (!created_package_json) {
                 while (std.fs.path.dirname(this_cwd)) |parent| : (this_cwd = parent) {
                     const parent_without_trailing_slash = strings.withoutTrailingSlash(parent);

test/cli/install/bun-add.test.ts

@@ -1,7 +1,16 @@
 import { file, spawn } from "bun";
 import { afterAll, afterEach, beforeAll, beforeEach, expect, it, setDefaultTimeout } from "bun:test";
 import { access, appendFile, copyFile, mkdir, readlink, rm, writeFile } from "fs/promises";
-import { bunExe, bunEnv as env, readdirSorted, tmpdirSync, toBeValidBin, toBeWorkspaceLink, toHaveBins } from "harness";
+import {
+  bunExe,
+  bunEnv as env,
+  readdirSorted,
+  tempDir,
+  tmpdirSync,
+  toBeValidBin,
+  toBeWorkspaceLink,
+  toHaveBins,
+} from "harness";
 import { join, relative, resolve } from "path";
 import {
   check_npm_auth_type,
@@ -2462,3 +2471,89 @@ it("should install tarball with tarball dependencies", async () => {
   await access(join(add_dir, "node_modules", "test-parent"));
   await access(join(add_dir, "node_modules", "test-child"));
 });
+
+// https://github.com/oven-sh/bun/issues/30658
+// `bun add -g` chdirs to <BUN_INSTALL>/install/global, which then used to
+// walk up the filesystem looking for a package.json. If a stray package.json
+// (with an old npm v1 package-lock.json next to it) existed in a parent
+// directory — typically $HOME on Windows — bun would treat that as the root
+// project and fail lockfile migration with
+// "Please upgrade package-lock.json to lockfileVersion 2 or 3".
+// Global installs must be self-contained and not reach outside the install dir.
+it("`bun add -g` ignores package.json/package-lock.json above the global dir", async () => {
+  using home = tempDir("bun-add-global-parent-lockfile", {
+    // stray files in the parent of <home>/.bun/install/global
+    "package.json": JSON.stringify({ name: "stray-root", version: "1.0.0" }),
+    "package-lock.json": JSON.stringify({
+      name: "stray-root",
+      version: "1.0.0",
+      lockfileVersion: 1,
+      requires: true,
+      dependencies: {},
+    }),
+    ".bun": { install: { global: {} } },
+  });
+
+  const { stdout, stderr, exited } = spawn({
+    // point at an unreachable registry so we never touch the real network,
+    // but still exercise the full init/walk-up code path that used to fail.
+    cmd: [bunExe(), "add", "-g", "--registry=http://127.0.0.1:1/", "chalk"],
+    cwd: `${home}`,
+    stdout: "pipe",
+    stdin: "pipe",
+    stderr: "pipe",
+    env: { ...env, BUN_INSTALL: join(`${home}`, ".bun") },
+  });
+
+  const err = await stderr.text();
+  // the bug: the stray lockfile used to get picked up and migration failed here.
+  expect(err).not.toContain("Please upgrade package-lock.json");
+  expect(err).not.toContain("lockfileVersion");
+  await stdout.text();
+  // The install itself fails (registry is unreachable on purpose) — but the
+  // failure must be *past* lockfile migration, not because of it.
+  expect(await exited).not.toBe(0);
+
+  // And the stray root's package.json must not have been mutated.
+  expect(await file(join(`${home}`, "package.json")).text()).toBe(
+    JSON.stringify({ name: "stray-root", version: "1.0.0" }),
+  );
+});
+
+// https://github.com/oven-sh/bun/issues/28247
+// Same walk-up problem, different symptom: if a parent directory's
+// package.json defines `workspaces` (plus any `workspace:*` deps), global
+// install used to hop onto it as the workspace root and then fail to
+// resolve those workspace-scoped deps:
+// "error: Workspace dependency \"…\" not found"
+// Global installs shouldn't participate in a parent workspace at all.
+it("`bun add -g` ignores a workspaces package.json above the global dir", async () => {
+  using home = tempDir("bun-add-global-parent-workspaces", {
+    // parent package.json declares workspaces + a workspace-protocol dep
+    // that doesn't actually exist on disk — same shape as the reports.
+    "package.json": JSON.stringify({
+      name: "stray-root",
+      version: "1.0.0",
+      workspaces: ["packages/*"],
+      dependencies: { "@scope/nonexistent": "workspace:*" },
+    }),
+    ".bun": { install: { global: {} } },
+  });
+
+  const { stdout, stderr, exited } = spawn({
+    cmd: [bunExe(), "add", "-g", "--registry=http://127.0.0.1:1/", "chalk"],
+    cwd: `${home}`,
+    stdout: "pipe",
+    stdin: "pipe",
+    stderr: "pipe",
+    env: { ...env, BUN_INSTALL: join(`${home}`, ".bun") },
+  });
+
+  const err = await stderr.text();
+  expect(err).not.toContain("Workspace dependency");
+  // If bun touches the parent workspace at all, its deps (this one in particular)
+  // would appear in the error output. They must not.
+  expect(err).not.toContain("@scope/nonexistent");
+  await stdout.text();
+  expect(await exited).not.toBe(0);
+});