Metadata under node_modules is skipped from deploys without warning

[jwoodwardcertinia]

Summary

Metadata under mode_modules is silently skipped when deploying. This can cause later errors when code depends on it. Pulling in code libraries through npm is a perfectly cromulent way to share SF metadata which has recently become broken.

Steps To Reproduce

I have created a repo which demonstrates the issue
https://github.com/jwoodwardcertinia/sf-cli-node_modules-repro
See the readme in there for all the details.

In short you need to have some code which you want to deploy inside a folder in node_modules, and then include that folder inside sfdx-project.json. When you deploy, that code is NOT deployed, but the command reports success.

Expected result

When a node_modules is explicitly added in sfdx-project.json that code should be deployed. E.g.
"path": "node_modules/demo-apex-pkg/sfdx-source/demo"

If you include a folder which contains a node_modules folder, it is ok to skip it in that case.
E.g.
"path": "libs/fun-code"
And nested inside libs/fun-code is a node_modules folder - it seems ok to skip in that case.

Actual result

Code is not deployed, the command reports success.

Additional information

System Information

Shell: zsh 5.9 (arm64-apple-darwin25.0)
OS: macOS 26.6.2 (arm64)
node: v22.12.0
npm: 10.9.0
sf version --verbose --json
{
"architecture": "darwin-arm64",
"cliVersion": "@salesforce/cli/2.150.6",
"nodeVersion": "node-v22.12.0",
"osVersion": "Darwin 25.6.0",
"rootPath": "/Users/jwoodward/git/nodemodulesdemo/node_modules/@salesforce/cli",
"shell": "zsh",
"pluginVersions": [
"@oclif/plugin-autocomplete 3.3.0 (core)",
"@oclif/plugin-commands 4.2.0 (core)",
"@oclif/plugin-help 6.3.0 (core)",
"@oclif/plugin-not-found 3.3.0 (core)",
"@oclif/plugin-plugins 5.5.1 (core)",
"@oclif/plugin-search 1.3.0 (core)",
"@oclif/plugin-update 4.8.0 (core)",
"@oclif/plugin-version 2.3.0 (core)",
"@oclif/plugin-warn-if-update-available 3.2.0 (core)",
"@oclif/plugin-which 3.3.0 (core)",
"@salesforce/cli 2.150.6 (core)",
"agent 2.0.5 (core)",
"apex 4.1.1 (core)",
"api 2.0.9 (core)",
"auth 5.0.6 (core)",
"code-analyzer 5.15.0 (user) published 49 days ago (Wed Jul 29 2026) (latest is 5.16.0)",
"data 5.1.7 (core)",
"deploy-retrieve 4.1.2 (core)",
"dev 2.5.1 (user) published 666 days ago (Tue Nov 19 2024) (latest is 2.5.10)",
"info 4.0.9 (core)",
"lightning-dev 3.5.0 (user) published 470 days ago (Mon Jun 02 2025) (latest is 6.2.18)",
"limits 4.0.4 (core)",
"marketplace 2.0.5 (core)",
"org 6.0.11 (core)",
"packaging 3.0.6 (core)",
"schema 4.0.6 (core)",
"settings 3.0.6 (core)",
"signups 3.0.3 (user) published 38 days ago (Sat Aug 08 2026) (latest is 3.0.6)",
"sobject 2.0.5 (core)",
"telemetry 4.0.6 (core)",
"templates 57.0.11 (core)",
"trust 4.0.10 (core)",
"user 5.0.2 (core)"
]
}

[github-actions]

Thank you for filing this issue. We appreciate your feedback and will review the issue as soon as possible. Remember, however, that GitHub isn't a mechanism for receiving support under any agreement or SLA. If you require immediate assistance, contact Salesforce Customer Support.

[jfeingold35]

@jwoodwardcertinia , thanks for logging this. We'll be looking into it, and we'll provide updates as they become available. If we need anything else from you, we'll ask. In the meantime, thanks for your patience.