npq-hero and npq behaving different for internal packages

[tkonsta]

I recently installed npq and set up an alias as described in the docs alias npm='npq-hero'.

However, I am seeing that running npq i and npq-hero i behaves different in the findings for the same project. If I run both tools in the same directory, which is the basedir of a Node-based project, then npq-hero doesn't find anything, but npq complains about an internal package not being found. I couldn't find a description regarding if the two tools are supposed to differ in their behavior, and why there's two scripts instead of just using npq for both scenarios. That's why I didn't file this as an issue, but rather a discussion point first. I'm also happy to create a PR to document the difference if someone can help to understand the rationale for having the two tools.

$ npq-hero i

up to date, audited 471 packages in 2s

81 packages are looking for funding
  run `npm fund` for details

found 0 vulnerabilities

$ npq i

Packages with issues found:

 ┌─
 │ >  @<internal-name-redacted>/<internal-name-redacted>@23.2.1
 │
 │ ✖ Package Health        · Package not found
 └─

Summary:

 - Total packages: 1
 - Total errors:   1
 - Total warnings: 0

Continue install ? (y/N) y

up to date, audited 471 packages in 1s

81 packages are looking for funding
  run `npm fund` for details

found 0 vulnerabilities

[lirantal]

Hey @tkonsta, thanks for sharing! Let me dig a bit deeper on the original question about the i flag difference and let you know.

With regards to your question about the difference between npq and npq-hero, so you need both CLIs because npq-hero acts as an alias for npm, which means it will transparently support all the original npm command-line flags. npq is more of a standalone program that has its own command-line flags and arguments. So when you run it, after all the checks, it will seamlessly drop to npm, but you can provide npq with its own CLI flags like --dry-run and things like that. However, if you use npq-hero and pass it the --dry-run or other npq specific flags (specific to the npq executable), it will just pass them over to npm which will discard them or report an error because the npm itself doesn't have those flags. Does that make sense?

[tkonsta]

Hi @lirantal, Thanks a lot for the explanation. It makes sense and now I understand why there are the two different scripts. I'll try to find some time in the next days to create a PR with a suggestion for the README to explain this.

[lirantal]

Sounds good thank you!