Auggie auto-update uses 'npm install --prefix <dir>' and prunes unrelated global npm packages in the same directory

[Vaclav-Zuna]

Summary

Auggie's interactive-mode auto-update reinstalls itself with npm install --prefix <dir> @augmentcode/auggie@<version> instead of npm install -g @augmentcode/auggie. Because --prefix <dir> makes npm treat that directory as a single owned project root, npm reifies the tree to contain only @augmentcode/auggie and its dependencies, and removes every other package living in that directory as "extraneous". When Auggie is installed (via the documented npm install -g) into a prefix shared with other global tools, the auto-update silently deletes those unrelated tools.

This exited 0 / info ok — npm did exactly what --prefix semantics require. The defect is Auggie's choice of --prefix <shared-dir> over -g.

Impact

An unattended auto-update destroyed unrelated globally-installed CLI tools sharing the install directory. In my case the auto-update removed:

• agent-browser (an auth helper for other tooling — its loss broke unrelated workflows)
• @modelcontextprotocol/server-everything
• the bundled npm in that directory

Nothing warned the user; nothing failed loudly. The packages were simply gone after Auggie started.

Evidence (from the npm debug log of the update run)

The exact command Auggie's auto-updater invoked:

verbose argv "install" "--prefix" "/opt/homebrew/lib" "@augmentcode/auggie@0.33.0"

npm marked the following top-level packages "retired" and then removed them:

silly reify   .../node_modules/npm
silly reify   .../node_modules/@augmentcode/auggie
silly reify   .../node_modules/agent-browser
silly reify   .../node_modules/@modelcontextprotocol/server-everything

Totals for the run:

REMOVE operations: 259
additions:         0
verbose exit 0
info ok

Environment:

os   Darwin 25.5.0
node v25.8.1
npm  v11.11.0

Why this happens

• npm install -g <pkg> treats the global tree as independently-installed top-level packages and touches only <pkg>.
• npm install --prefix <dir> <pkg> treats <dir> as a single project root and prunes anything in it that isn't <pkg> or a dependency of <pkg>.

Auggie uses the second form pointed at the directory where it currently lives. If that directory is shared (e.g. a Homebrew-managed node's .../lib, which also contains the bundled npm and any other -g-installed tools), the neighbors are collateral.

Steps to reproduce

1. Install Auggie the documented way: npm install -g @augmentcode/auggie, using a node whose global prefix is a directory shared with other global npm packages (e.g. Homebrew's node → /opt/homebrew/lib/node_modules).
2. Ensure at least one other global package is installed in that same directory.
3. Start Auggie in interactive mode with auto-update enabled and let it perform an update.
4. Observe that the other global package(s) in that directory have been removed.

Expected behavior

The auto-updater should update only Auggie without affecting any other package. It should either:

• run npm install -g @augmentcode/auggie (global semantics, touches only Auggie), or
• if --prefix is required for some reason, point it at an Auggie-dedicated directory, never a shared prefix.

Suggested fix

• Switch the update invocation to npm install -g @augmentcode/auggie (or npm update -g), or
• Guard against reifying a shared directory: detect when the install directory contains packages other than Auggie and refuse the destructive --prefix reify, falling back to -g.

Docs note

The install docs recommend only npm install -g @augmentcode/auggie with no mention of prefix isolation, nvm, or a Homebrew caveat, and the autoupgrade docs don't disclose the update command or warn that unrelated packages could be removed. Even with a fix, a short note about isolation would help.