Metadata under node_modules is skipped from deploys without warning

Read the linked reproduction repository's README and inspect the sfdx-project.json paths used by the deploy command. Reproduce the case with an explicitly included node_modules/demo-apex-pkg/sfdx-source/demo path, then verify that its metadata deploys while a nested node_modules under libs/fun-code remains skipped.

Summary

Metadata under mode_modules is silently skipped when deploying. This can cause later errors when code depends on it. Pulling in code libraries through npm is a perfectly cromulent way to share SF metadata which has recently become broken.

Steps To Reproduce

I have created a repo which demonstrates the issue
https://github.com/jwoodwardcertinia/sf-cli-node_modules-repro
See the readme in there for all the details.

In short you need to have some code which you want to deploy inside a folder in node_modules, and then include that folder inside sfdx-project.json. When you deploy, that code is NOT deployed, but the command reports success.

Expected result

When a node_modules is explicitly added in sfdx-project.json that code should be deployed. E.g.
"path": "node_modules/demo-apex-pkg/sfdx-source/demo"

If you include a folder which contains a node_modules folder, it is ok to skip it in that case.
E.g.
"path": "libs/fun-code"
And nested inside libs/fun-code is a node_modules folder - it seems ok to skip in that case.

Actual result

Code is not deployed, the command reports success.

Additional information

System Information

Shell: zsh 5.9 (arm64-apple-darwin25.0)
OS: macOS 26.6.2 (arm64)
node: v22.12.0
npm: 10.9.0
sf version --verbose --json
{
"architecture": "darwin-arm64",
"cliVersion": "@salesforce/cli/2.150.6",
"nodeVersion": "node-v22.12.0",
"osVersion": "Darwin 25.6.0",
"rootPath": "/Users/jwoodward/git/nodemodulesdemo/node_modules/@salesforce/cli",
"shell": "zsh",
"pluginVersions": [
"@oclif/plugin-autocomplete 3.3.0 (core)",
"@oclif/plugin-commands 4.2.0 (core)",
"@oclif/plugin-help 6.3.0 (core)",
"@oclif/plugin-not-found 3.3.0 (core)",
"@oclif/plugin-plugins 5.5.1 (core)",
"@oclif/plugin-search 1.3.0 (core)",
"@oclif/plugin-update 4.8.0 (core)",
"@oclif/plugin-version 2.3.0 (core)",
"@oclif/plugin-warn-if-update-available 3.2.0 (core)",
"@oclif/plugin-which 3.3.0 (core)",
"@salesforce/cli 2.150.6 (core)",
"agent 2.0.5 (core)",
"apex 4.1.1 (core)",
"api 2.0.9 (core)",
"auth 5.0.6 (core)",
"code-analyzer 5.15.0 (user) published 49 days ago (Wed Jul 29 2026) (latest is 5.16.0)",
"data 5.1.7 (core)",
"deploy-retrieve 4.1.2 (core)",
"dev 2.5.1 (user) published 666 days ago (Tue Nov 19 2024) (latest is 2.5.10)",
"info 4.0.9 (core)",
"lightning-dev 3.5.0 (user) published 470 days ago (Mon Jun 02 2025) (latest is 6.2.18)",
"limits 4.0.4 (core)",
"marketplace 2.0.5 (core)",
"org 6.0.11 (core)",
"packaging 3.0.6 (core)",
"schema 4.0.6 (core)",
"settings 3.0.6 (core)",
"signups 3.0.3 (user) published 38 days ago (Sat Aug 08 2026) (latest is 3.0.6)",
"sobject 2.0.5 (core)",
"telemetry 4.0.6 (core)",
"templates 57.0.11 (core)",
"trust 4.0.10 (core)",
"user 5.0.2 (core)"
]
}