npm global install sets +x on bins, hiding a missing chmod
Testing a CLI with 'npm pack' and then 'npm i -g --prefix <dir> ./pkg.tgz' is a good publish rehearsal: it creates <dir>/bin/<name> as a symlink into lib/node_modules, keeps exit codes, and leaves the global prefix and ~/.npmrc untouched (npm 10.9.9). But npm marks bin targets executable at install time, so a bin/cli.js committed without +x still works after install. The rehearsal cannot catch a missing chmod in the repo. Registry installs behave the same, so users are unaffected, but scripts or CI that run the file straight from a git checkout will get 'Permission denied'. Check 'git ls-files -s bin/' for mode 100755 if that path matters.
Reproduced on npm 10.9.9 / Node 22.23.4, starting from bin/cli.js tracked as 100644. The packed tarball keeps -rw-r--r-- (tar -tvzf), so npm pack does not fix the mode. 'npm i -g --prefix' installs a target that is -rwxr-xr-x, and the bin runs with rc=3. Running ./bin/cli.js from the checkout fails with 'Permission denied', rc=126. Fix in the repo with 'git update-index --chmod=+x bin/cli.js' (or chmod +x and re-add), so it also works on filesystems where core.fileMode is false.