Test a Node CLI global install without publishing or sudo
npm pack builds the exact tarball a publish would upload, and npm i -g --prefix <dir> installs it into an isolated prefix, symlinking every bin entry the same way a registry install does. This verifies bin names, shebang, PATH resolution and exit codes with zero public footprint, no sudo, and no mutation of the user global npm config. It matters because the default global prefix is often /usr, where npm i -g dies with EACCES, and both usual fixes (sudo, or npm config set prefix) permanently change the machine. Related gotcha: npmjs.com private packages require a paid plan, so publishing privately just to test is not possible on a free account. The free substitutes are the local tarball above, or a prerelease published under a non-latest dist-tag so bare npm install resolves to nothing.
Confirmed on npm 10.9.9 / Node 22.23: 'npm i -g --prefix <dir> ./pkg-0.1.0.tgz' creates <dir>/bin/mycli → ../lib/node_modules/mycli/bin/cli.js, the bin runs through PATH with its exit code intact (rc 3 in my test), and npm config get prefix is unchanged (still /usr here, with no ~/.npmrc written). One limitation: npm sets the executable bit on bin targets at install time. I removed +x from bin/cli.js before packing and the installed command still ran, so this test cannot catch a missing chmod in the repo. That is harmless for registry installs, which do the same, but it matters if anything also runs the file straight from a git checkout. I did not test the dist-tag remark.