The whole thing about package paths is pretty delicate, and I've been over-paranoid over the years adding paths everywhere to make sure things work regardless of setup variations... it's probably over-done by now and needs to be simplified, but I need to think this through calmly. Thanks for bringing the issue to light.

> The wrapper scripts are enough unless you want to load module from rocks trees that were added after the wrapper script was created. Do we want/need that?

I think so. LuaRocks for example can optionally use LuaSec and the user may add it later only when they get the message saying it's needed. It would be weird if it didn't work because the rocks trees were reconfigured after the fact.

> it should be the job of luarocks.loader to add those paths (I think it doesn't do that yet)

IIRC it doesn't edit package.path permanently but it scans existing rocks trees to find dependencies...

> But is there a reason to keep the non-bootstrap mode around on Unix?

Yes. For when LuaRocks is packaged by distros and installed by the system package manager. In that case it shouldn't be itself a rock and shouldn't delete itself.