require specifying which agoric-sdk to install

[turadg]

What is the Problem Being Solved?

agoric install has an optional sdk version argument. Without any arguments it creates symlinks to a local agoric-sdk. This has surprised a number of developers.

Description of the Design

Require some specifier of what SDK to install. For backwards compatibility we can maintain the existing behavior of when an NPM tag is specified. The breaking change would be to error if nothing is specified.

To opt into the linking behavior (that is currently the default) we'll need some indicator. E.g. --link (which would be mutually exclusive with the tag argument) or a virtual version tag like local-checkout that skips NPM and triggers the linking behavior.

Cleaning this up could help with #9209

While we're at it and qualifying the changes, we might want to roll in upgrading Commander to its next breaking release, 12+

Security Considerations

Scaling Considerations

Test Plan

Upgrade Considerations

[mhofman]

To be more precise, I believe the linking behavior of install without arguments only happens when you use a linked CLI. I am actually not sure of the behavior of install when using a CLI from NPM, but it is not in a position to know how to link anything.

Since we're recommending to use yarn install, or ultimately your own package manager to actually install packages, maybe the better option would be to rename the command to agoric upgrade and require an argument to only perform a replacement of dependency versions.

At the same time we do this, we should also consider how to handle dependencies of the project shared with agoric packages, especially ones entrained in bundles such as Endo. This is something agoric install handles poorly today.

[turadg]

This would help but maybe not worth the effort. What would be worthwhile imo is to sunset agoric install. E.g. print a notice with what a user should do instead then allow them to continue by re-running with a flag like --ignore-deprecation