diff --git a/deps/npm/lib/cache/add-remote-git.js b/deps/npm/lib/cache/add-remote-git.js
diff --git a/deps/npm/lib/cache/add-remote-tarball.js b/deps/npm/lib/cache/add-remote-tarball.js
@@ -19,8 +19,8 @@ function addRemoteTarball (u, pkgData, shasum, auth, cb_) {
   function cb (er, data) {
     if (data) {
       data._from = u
-      data._shasum = data._shasum || shasum
       data._resolved = u
+      data._shasum = data._shasum || shasum
     }
     cb_(er, data)
   }

diff --git a/deps/npm/lib/cache/maybe-github.js b/deps/npm/lib/cache/maybe-github.js
@@ -1,27 +1,28 @@
 var assert = require("assert")
   , log = require("npmlog")
   , addRemoteGit = require("./add-remote-git.js")
+  , hosted = require("hosted-git-info")
 
 module.exports = function maybeGithub (p, cb) {
   assert(typeof p === "string", "must pass package name")
   assert(typeof cb === "function", "must pass callback")
 
-  var u = "git://github.com/" + p
-  log.info("maybeGithub", "Attempting %s from %s", p, u)
+  var parsed = hosted.fromUrl(p)
+  log.info("maybeGithub", "Attempting %s from %s", p, parsed.git())
 
-  return addRemoteGit(u, true, function (er, data) {
+  return addRemoteGit(parsed.git(), true, function (er, data) {
     if (er) {
-      var upriv = "ssh://git@github.com:" + p
-      log.info("maybeGithub", "Attempting %s from %s", p, upriv)
+      log.info("maybeGithub", "Couldn't clone %s", parsed.git())
+      log.info("maybeGithub", "Now attempting %s from %s", p, parsed.ssh())
 
-      return addRemoteGit(upriv, false, function (er, data) {
+      return addRemoteGit(parsed.ssh(), false, function (er, data) {
         if (er) return cb(er)
 
-        success(upriv, data)
+        success(parsed.ssh(), data)
       })
     }
 
-    success(u, data)
+    success(parsed.git(), data)
   })
 
   function success (u, data) {

diff --git a/deps/npm/lib/config/defaults.js b/deps/npm/lib/config/defaults.js
@@ -32,12 +32,6 @@ function validateSemver (data, k, val) {
   data[k] = semver.valid(val)
 }
 
-function validateTag (data, k, val) {
-  val = ("" + val).trim()
-  if (!val || semver.validRange(val)) return false
-  data[k] = val
-}
-
 function validateStream (data, k, val) {
   if (!(val instanceof Stream)) return false
   data[k] = val
@@ -47,10 +41,6 @@ nopt.typeDefs.semver = { type: semver, validate: validateSemver }
 nopt.typeDefs.Stream = { type: Stream, validate: validateStream }
 nopt.typeDefs.Umask = { type: Umask, validate: validateUmask }
 
-// Don't let --tag=1.2.3 ever be a thing
-var tag = {}
-nopt.typeDefs.tag = { type: tag, validate: validateTag }
-
 nopt.invalidHandler = function (k, val, type) {
   log.warn("invalid config", k + "=" + JSON.stringify(val))
 
@@ -60,9 +50,6 @@ nopt.invalidHandler = function (k, val, type) {
   }
 
   switch (type) {
-    case tag:
-      log.warn("invalid config", "Tag must not be a SemVer range")
-      break
     case Umask:
       log.warn("invalid config", "Must be umask, octal number in range 0000..0777")
       break
@@ -312,7 +299,7 @@ exports.types =
   , "sign-git-tag": Boolean
   , spin: ["always", Boolean]
   , "strict-ssl": Boolean
-  , tag : tag
+  , tag : String
   , tmp : path
   , unicode : Boolean
   , "unsafe-perm" : Boolean

diff --git a/deps/npm/lib/dedupe.js b/deps/npm/lib/dedupe.js
@@ -314,11 +314,28 @@ function readInstalled (dir, counter, parent, cb) {
   })
 
   fs.readdir(path.resolve(dir, "node_modules"), function (er, c) {
-    children = c || [] // error is ok, just means no children.
-    children = children.filter(function (p) {
-      return !p.match(/^[\._-]/)
-    })
-    next()
+    children = children || [] // error is ok, just means no children.
+    // check if there are scoped packages.
+    asyncMap(c || [], function (child, cb) {
+      if (child.indexOf('@') === 0) {
+        fs.readdir(path.resolve(dir, "node_modules", child), function (er, scopedChildren) {
+          // error is ok, just means no children.
+          (scopedChildren || []).forEach(function (sc) {
+            children.push(path.join(child, sc))
+          })
+          cb()
+        })
+      } else {
+        children.push(child)
+        cb()
+      }
+    }, function (er) {
+      if (er) return cb(er)
+      children = children.filter(function (p) {
+        return !p.match(/^[\._-]/)
+      })
+      next();
+    });
   })
 
   function next () {

diff --git a/deps/npm/lib/install.js b/deps/npm/lib/install.js
@@ -109,6 +109,7 @@ var npm = require("./npm.js")
   , locker = require("./utils/locker.js")
   , lock = locker.lock
   , unlock = locker.unlock
+  , warnStrict = require("./utils/warn-deprecated.js")("engineStrict")
   , warnPeers = require("./utils/warn-deprecated.js")("peerDependencies")
 
 function install (args, cb_) {
@@ -117,7 +118,7 @@ function install (args, cb_) {
   function cb (er, installed) {
     if (er) return cb_(er)
 
-    findPeerInvalid(where, function (er, problem) {
+    validateInstall(where, function (er, problem) {
       if (er) return cb_(er)
 
       if (problem) {
@@ -244,11 +245,24 @@ function install (args, cb_) {
   })
 }
 
-function findPeerInvalid (where, cb) {
-  readInstalled(where, { log: log.warn, dev: true }, function (er, data) {
-    if (er) return cb(er)
+function validateInstall (where, cb) {
+  readJson(path.resolve(where, 'package.json'), log.warn, function (er, data) {
+    if (er
+        && er.code !== 'ENOENT'
+        && er.code !== 'ENOTDIR') return cb(er)
+
+    if (data && data.engineStrict) {
+      warnStrict([
+        "Per-package engineStrict (found in this package's package.json) ",
+        "won't be used in npm 3+. Use the config setting `engine-strict` instead."
+      ], data.name)
+    }
+
+    readInstalled(where, { log: log.warn, dev: true }, function (er, data) {
+      if (er) return cb(er)
 
-    cb(null, findPeerInvalid_(data.dependencies, []))
+      cb(null, findPeerInvalid_(data.dependencies, []))
+    })
   })
 }
 
@@ -388,7 +402,6 @@ function readWrap (w) {
 
 // if the -S|--save option is specified, then write installed packages
 // as dependencies to a package.json file.
-// This is experimental.
 function save (where, installed, tree, pretty, hasArguments, cb) {
   if (!hasArguments ||
       !npm.config.get("save") &&
@@ -684,34 +697,72 @@ function installMany (what, where, context, cb) {
 
       if (er) return cb(er)
 
-      // each target will be a data object corresponding
-      // to a package, folder, or whatever that is in the cache now.
-      var newPrev = Object.create(context.family)
-        , newAnc = Object.create(context.ancestors)
+      var bundled = data.bundleDependencies || data.bundledDependencies || []
+      // only take the hit for readInstalled if there are probably bundled
+      // dependencies to read
+      if (bundled.length) {
+        readInstalled(where, { dev: true }, andBuildResolvedTree)
+      } else {
+        andBuildResolvedTree()
+      }
+
+      function andBuildResolvedTree (er, current) {
+        if (er) return cb(er)
+
+        // each target will be a data object corresponding
+        // to a package, folder, or whatever that is in the cache now.
+        var newPrev = Object.create(context.family)
+          , newAnc = Object.create(context.ancestors)
+
+        if (!context.root) {
+          newAnc[data.name] = data.version
+        }
+        bundled.forEach(function (bundle) {
+          var bundleData = current.dependencies[bundle]
+          if ((!bundleData || !bundleData.version) && current.devDependencies) {
+            log.verbose(
+              'installMany', bundle, 'was bundled with',
+              data.name + '@' + data.version +
+                ", but wasn't found in dependencies. Trying devDependencies"
+            )
+            bundleData = current.devDependencies[bundle]
+          }
 
-      if (!context.root) {
-        newAnc[data.name] = data.version
+          if (!bundleData || !bundleData.version) {
+            log.warn(
+              'installMany', bundle, 'was bundled with',
+              data.name + '@' + data.version +
+                ", but bundled package wasn't found in unpacked tree"
+            )
+          } else {
+            log.verbose(
+              'installMany', bundle + '@' + bundleData.version,
+              'was bundled with', data.name + '@' + data.version
+            )
+            newPrev[bundle] = bundleData.version
+          }
+        })
+        targets.forEach(function (t) {
+          newPrev[t.name] = t.version
+        })
+        log.silly("install resolved", targets)
+        targets.filter(function (t) { return t }).forEach(function (t) {
+          log.info("install", "%s into %s", t._id, where)
+        })
+        asyncMap(targets, function (target, cb) {
+          log.info("installOne", target._id)
+          var wrapData = wrap ? wrap[target.name] : null
+          var newWrap = wrapData && wrapData.dependencies
+                      ? wrap[target.name].dependencies || {}
+                      : null
+          var newContext = { family: newPrev
+                           , ancestors: newAnc
+                           , parent: parent
+                           , explicit: false
+                           , wrap: newWrap }
+          installOne(target, where, newContext, cb)
+        }, cb)
       }
-      targets.forEach(function (t) {
-        newPrev[t.name] = t.version
-      })
-      log.silly("install resolved", targets)
-      targets.filter(function (t) { return t }).forEach(function (t) {
-        log.info("install", "%s into %s", t._id, where)
-      })
-      asyncMap(targets, function (target, cb) {
-        log.info("installOne", target._id)
-        var wrapData = wrap ? wrap[target.name] : null
-        var newWrap = wrapData && wrapData.dependencies
-                    ? wrap[target.name].dependencies || {}
-                    : null
-        var newContext = { family: newPrev
-                         , ancestors: newAnc
-                         , parent: parent
-                         , explicit: false
-                         , wrap: newWrap }
-        installOne(target, where, newContext, cb)
-      }, cb)
     })
   })
 }
@@ -746,9 +797,9 @@ function targetResolver (where, context, deps) {
           // if it's a bundled dep, then assume that anything there is valid.
           // otherwise, make sure that it's a semver match with what we want.
           var bd = parent.bundleDependencies
-          if (bd && bd.indexOf(d.name) !== -1 ||
-              semver.satisfies(d.version, deps[d.name] || "*", true) ||
-              deps[d.name] === d._resolved) {
+          var isBundled = bd && bd.indexOf(d.name) !== -1
+          var currentIsSatisfactory = semver.satisfies(d.version, deps[d.name] || "*", true)
+          if (isBundled || currentIsSatisfactory || deps[d.name] === d._resolved) {
             return cb(null, d.name)
           }
 
@@ -787,6 +838,7 @@ function targetResolver (where, context, deps) {
     // check for a version installed higher in the tree.
     // If installing from a shrinkwrap, it must match exactly.
     if (context.family[what]) {
+      log.verbose('install', what, 'is installed as', context.family[what])
       if (wrap && wrap[what].version === context.family[what]) {
         log.verbose("shrinkwrap", "use existing", what)
         return cb(null, [])
@@ -854,8 +906,11 @@ function targetResolver (where, context, deps) {
 function installOne (target, where, context, cb) {
   // the --link flag makes this a "link" command if it's at the
   // the top level.
+  var isGit = false
+  if (target && target._from) isGit = npa(target._from).type === 'git'
+
   if (where === npm.prefix && npm.config.get("link")
-      && !npm.config.get("global")) {
+      && !npm.config.get("global") && !isGit) {
     return localLink(target, where, context, cb)
   }
   installOne_(target, where, context, function (er, installedWhat) {
@@ -938,18 +993,12 @@ function installOne_ (target, where, context, cb_) {
   if (prettyWhere === ".") prettyWhere = null
 
   cb_ = inflight(target.name + ":" + where, cb_)
-  if (!cb_) return log.verbose(
-    "installOne",
-    "of", target.name,
-    "to", where,
-    "already in flight; waiting"
-  )
-  else log.verbose(
-    "installOne",
-    "of", target.name,
-    "to", where,
-    "not in flight; installing"
-  )
+  if (!cb_) {
+    return log.verbose("installOne", "of", target.name, "to", where, "already in flight; waiting")
+  }
+  else {
+    log.verbose("installOne", "of", target.name, "to", where, "not in flight; installing")
+  }
 
   function cb(er, data) {
     unlock(nm, target.name, function () { cb_(er, data) })
@@ -1109,8 +1158,9 @@ function prepareForInstallMany (packageData, depsKey, bundled, wrap, family) {
     // something in the "family" list, unless we're installing
     // from a shrinkwrap.
     if (wrap) return wrap
-    if (semver.validRange(family[d], true))
+    if (semver.validRange(family[d], true)) {
       return !semver.satisfies(family[d], packageData[depsKey][d], true)
+    }
     return true
   }).map(function (d) {
     var v = packageData[depsKey][d]

diff --git a/deps/npm/lib/link.js b/deps/npm/lib/link.js
@@ -8,7 +8,6 @@ var npm = require("./npm.js")
   , asyncMap = require("slide").asyncMap
   , chain = require("slide").chain
   , path = require("path")
-  , rm = require("./utils/gently-rm.js")
   , build = require("./build.js")
   , npa = require("npm-package-arg")
 
@@ -128,20 +127,17 @@ function linkPkg (folder, cb_) {
       return cb(er)
     }
     var target = path.resolve(npm.globalDir, d.name)
-    rm(target, function (er) {
+    symlink(me, target, function (er) {
       if (er) return cb(er)
-      symlink(me, target, function (er) {
+      log.verbose("link", "build target", target)
+      // also install missing dependencies.
+      npm.commands.install(me, [], function (er) {
         if (er) return cb(er)
-        log.verbose("link", "build target", target)
-        // also install missing dependencies.
-        npm.commands.install(me, [], function (er) {
+        // build the global stuff.  Don't run *any* scripts, because
+        // install command already will have done that.
+        build([target], true, build._noLC, true, function (er) {
           if (er) return cb(er)
-          // build the global stuff.  Don't run *any* scripts, because
-          // install command already will have done that.
-          build([target], true, build._noLC, true, function (er) {
-            if (er) return cb(er)
-            resultPrinter(path.basename(me), me, target, cb)
-          })
+          resultPrinter(path.basename(me), me, target, cb)
         })
       })
     })

diff --git a/deps/npm/lib/npm.js b/deps/npm/lib/npm.js
@@ -66,6 +66,7 @@ var commandCache = {}
               , "i" : "install"
               , "isntall" : "install"
               , "up" : "update"
+              , "upgrade" : "update"
               , "c" : "config"
               , "dist-tags" : "dist-tag"
               , "info" : "view"

diff --git a/deps/npm/lib/outdated.js b/deps/npm/lib/outdated.js
@@ -36,6 +36,7 @@ var path = require("path")
   , npa = require("npm-package-arg")
   , readInstalled = require("read-installed")
   , long = npm.config.get("long")
+  , log = require("npmlog")
 
 function outdated (args, silent, cb) {
   if (typeof cb !== "function") cb = silent, silent = false
@@ -300,7 +301,10 @@ function shouldUpdate (args, dir, dep, has, req, depth, cb, type) {
   }
 
   if (args.length && args.indexOf(dep) === -1) return skip()
-  if (npa(req).type === "git") return doIt("git", "git")
+  var parsed = npa(req)
+  if (parsed.type === "git" || (parsed.hosted && parsed.hosted.type === "github")) {
+    return doIt("git", "git")
+  }
 
   // search for the latest package
   mapToRegistry(dep, npm.config, function (er, uri, auth) {

diff --git a/deps/npm/lib/publish.js b/deps/npm/lib/publish.js
@@ -13,10 +13,12 @@ var npm = require("./npm.js")
   , cachedPackageRoot = require("./cache/cached-package-root.js")
   , createReadStream = require("graceful-fs").createReadStream
   , npa = require("npm-package-arg")
+  , semver = require('semver')
 
-publish.usage = "npm publish <tarball>"
-              + "\nnpm publish <folder>"
+publish.usage = "npm publish <tarball> [--tag <tagname>]"
+              + "\nnpm publish <folder> [--tag <tagname>]"
               + "\n\nPublishes '.' if no argument supplied"
+              + "\n\nSets tag `latest` if no --tag specified"
 
 publish.completion = function (opts, cb) {
   // publish can complete to a folder with a package.json
@@ -34,6 +36,13 @@ function publish (args, isRetry, cb) {
   if (args.length !== 1) return cb(publish.usage)
 
   log.verbose("publish", args)
+
+  var t = npm.config.get('tag').trim()
+  if (semver.validRange(t)) {
+    var er = new Error("Tag name must not be a valid SemVer range: " + t)
+    return cb(er)
+  }
+
   var arg = args[0]
   // if it's a local folder, then run the prepublish there, first.
   readJson(path.resolve(arg, "package.json"), function (er, data) {

diff --git a/deps/npm/lib/shrinkwrap.js b/deps/npm/lib/shrinkwrap.js
@@ -20,6 +20,12 @@ function shrinkwrap (args, silent, cb) {
     log.warn("shrinkwrap", "doesn't take positional args")
   }
 
+  // https://github.com/npm/npm/issues/7641
+  // introduced because `npm ls` can now show dev and prod depenednecy
+  // trees separately
+  if (npm.config.get("dev")) {
+    npm.config.set("production", true)
+  }
   npm.commands.ls([], true, function (er, _, pkginfo) {
     if (er) return cb(er)
     shrinkwrap_(pkginfo, silent, npm.config.get("dev"), cb)
@@ -45,7 +51,7 @@ function shrinkwrap_ (pkginfo, silent, dev, cb) {
             return
           }
 
-          log.warn("shrinkwrap", "Excluding devDependency: %s", dep)
+          log.warn("shrinkwrap", "Excluding devDependency: %s", dep, data.dependencies)
           delete pkginfo.dependencies[dep]
         })
       }

diff --git a/deps/npm/lib/stars.js b/deps/npm/lib/stars.js
@@ -9,6 +9,17 @@ var npm = require("./npm.js")
 function stars (args, cb) {
   npm.commands.whoami([], true, function (er, username) {
     var name = args.length === 1 ? args[0] : username
+
+    if (er) {
+      if (er.code === 'ENEEDAUTH' && !name) {
+        var needAuth = new Error("'npm stars' on your own user account requires auth")
+        needAuth.code = 'ENEEDAUTH'
+        return cb(needAuth)
+      }
+
+      if (er.code !== 'ENEEDAUTH') return cb(er)
+    }
+
     mapToRegistry("", npm.config, function (er, uri, auth) {
       if (er) return cb(er)
 

diff --git a/deps/npm/lib/update.js b/deps/npm/lib/update.js
@@ -22,10 +22,26 @@ update.completion = npm.commands.outdated.completion
 
 function update (args, cb) {
   npm.commands.outdated(args, true, function (er, outdated) {
-    log.info("outdated", "updating", outdated)
     if (er) return cb(er)
 
-    asyncMap(outdated, function (ww, cb) {
+    var wanted = outdated.filter(function (ww) {
+      var dep = ww[1]
+      var current = ww[2]
+      var wanted = ww[3]
+      var latest = ww[4]
+      if (current === wanted && wanted !== latest) {
+        log.verbose(
+          'outdated',
+          'not updating', dep,
+          "because it's currently at the maximum version that matches its specified semver range"
+        )
+      }
+      return current !== wanted
+    })
+    if (wanted.length === 0) return cb()
+
+    log.info('outdated', 'updating', wanted)
+    asyncMap(wanted, function (ww, cb) {
       // [[ dir, dep, has, want, req ]]
       var where = ww[0]
         , dep = ww[1]

diff --git a/deps/npm/lib/utils/error-handler.js b/deps/npm/lib/utils/error-handler.js
@@ -287,6 +287,7 @@ function errorHandler (er) {
   case "ECONNRESET":
   case "ENOTFOUND":
   case "ETIMEDOUT":
+  case "EAI_FAIL":
     log.error("network", [er.message
               ,"This is most likely not a problem with npm itself"
               ,"and is related to network connectivity."
@@ -354,7 +355,7 @@ function errorHandler (er) {
   default:
     log.error("", er.message || er)
     log.error("", ["", "If you need help, you may report this error at:"
-                  ,"    <http://github.com/npm/npm/issues>"
+                  ,"    <https://github.com/npm/npm/issues>"
                   ].join("\n"))
     break
   }

diff --git a/deps/npm/lib/utils/gently-rm.js b/deps/npm/lib/utils/gently-rm.js
@@ -3,19 +3,19 @@
 
 module.exports = gentlyRm
 
-var npm = require("../npm.js")
-  , log = require("npmlog")
-  , resolve = require("path").resolve
-  , dirname = require("path").dirname
-  , lstat = require("graceful-fs").lstat
-  , readlink = require("graceful-fs").readlink
-  , isInside = require("path-is-inside")
-  , vacuum = require("fs-vacuum")
-  , some = require("async-some")
-  , asyncMap = require("slide").asyncMap
-  , normalize = require("path").normalize
-
-function gentlyRm (path, gently, base, cb) {
+var npm = require('../npm.js')
+var log = require('npmlog')
+var resolve = require('path').resolve
+var dirname = require('path').dirname
+var lstat = require('graceful-fs').lstat
+var readlink = require('graceful-fs').readlink
+var isInside = require('path-is-inside')
+var vacuum = require('fs-vacuum')
+var some = require('async-some')
+var asyncMap = require('slide').asyncMap
+var normalize = require('path').normalize
+
+function gentlyRm (target, gently, base, cb) {
   if (!cb) {
     cb = base
     base = undefined
@@ -26,85 +26,110 @@ function gentlyRm (path, gently, base, cb) {
     gently = false
   }
 
-  // never rm the root, prefix, or bin dirs.
-  // just a safety precaution.
+  log.silly(
+    'gentlyRm',
+    target,
+    'is being', gently ? 'gently removed' : 'purged',
+    base ? 'from base ' + base : ''
+  )
+
+  // never rm the root, prefix, or bin dirs
+  //
+  // globals included because of `npm link` -- as far as the package requesting
+  // the link is concerned, the linked package is always installed globally
   var prefixes = [
-    npm.dir,       npm.root,       npm.bin,       npm.prefix,
-    npm.globalDir, npm.globalRoot, npm.globalBin, npm.globalPrefix
+    npm.prefix,
+    npm.globalPrefix,
+    npm.dir,
+    npm.root,
+    npm.globalDir,
+    npm.bin,
+    npm.globalBin
   ]
 
-  var resolved = normalize(resolve(path))
+  var resolved = normalize(resolve(npm.prefix, target))
   if (prefixes.indexOf(resolved) !== -1) {
-    log.verbose("gentlyRm", resolved, "is part of npm and can't be removed")
-    return cb(new Error("May not delete: "+resolved))
+    log.verbose('gentlyRm', resolved, "is part of npm and can't be removed")
+    return cb(new Error('May not delete: ' + resolved))
   }
 
-  var options = {log : log.silly.bind(log, "gentlyRm")}
-  if (npm.config.get("force") || !gently) options.purge = true
-  if (base) options.base = normalize(base)
+  var options = { log: log.silly.bind(log, 'vacuum-fs') }
+  if (npm.config.get('force') || !gently) options.purge = true
+  if (base) options.base = normalize(resolve(npm.prefix, base))
 
   if (!gently) {
-    log.verbose("gentlyRm", "vacuuming", resolved)
+    log.verbose('gentlyRm', "don't care about contents; nuking", resolved)
     return vacuum(resolved, options, cb)
   }
 
-  var parent = options.base = normalize(base ? base : npm.prefix)
-  log.verbose("gentlyRm", "verifying that", parent, "is managed by npm")
+  var parent = options.base = normalize(base ? resolve(npm.prefix, base) : npm.prefix)
+
+  // is the parent directory managed by npm?
+  log.silly('gentlyRm', 'verifying', parent, 'is an npm working directory')
   some(prefixes, isManaged(parent), function (er, matched) {
     if (er) return cb(er)
 
     if (!matched) {
-      log.verbose("gentlyRm", parent, "is not managed by npm")
+      log.error('gentlyRm', 'containing path', parent, "isn't under npm's control")
       return clobberFail(resolved, parent, cb)
     }
+    log.silly('gentlyRm', 'containing path', parent, "is under npm's control, in", matched)
 
-    log.silly("gentlyRm", parent, "is managed by npm")
-
+    // is the target directly contained within the (now known to be
+    // managed) parent?
     if (isInside(resolved, parent)) {
-      log.silly("gentlyRm", resolved, "is under", parent)
-      log.verbose("gentlyRm", "vacuuming", resolved, "up to", parent)
+      log.silly('gentlyRm', 'deletion target', resolved, 'is under', parent)
+      log.verbose('gentlyRm', 'vacuuming from', resolved, 'up to', parent)
       return vacuum(resolved, options, cb)
     }
+    log.silly('gentlyRm', resolved, 'is not under', parent)
 
-    log.silly("gentlyRm", resolved, "is not under", parent)
-    log.silly("gentlyRm", "checking to see if", resolved, "is a link")
-    lstat(resolved, function (er, stat) {
-      if (er) {
-        if (er.code === "ENOENT") return cb(null)
-        return cb(er)
-      }
+    // the target isn't directly within the parent, but is it itself managed?
+    log.silly('gentlyRm', 'verifying', resolved, 'is an npm working directory')
+    some(prefixes, isManaged(resolved), function (er, matched) {
+      if (er) return cb(er)
 
-      if (!stat.isSymbolicLink()) {
-        log.verbose("gentlyRm", resolved, "is outside", parent, "and not a link")
-        return clobberFail(resolved, parent, cb)
+      if (matched) {
+        log.silly('gentlyRm', resolved, "is under npm's control, in", matched)
+        options.base = matched
+        log.verbose('gentlyRm', 'removing', resolved, 'with base', options.base)
+        return vacuum(resolved, options, cb)
       }
+      log.verbose('gentlyRm', resolved, "is not under npm's control")
 
-      log.silly("gentlyRm", resolved, "is a link")
-      readlink(resolved, function (er, link) {
+      // the target isn't managed directly, but maybe it's a link...
+      log.silly('gentlyRm', 'checking to see if', resolved, 'is a link')
+      lstat(resolved, function (er, stat) {
         if (er) {
-          if (er.code === "ENOENT") return cb(null)
+          // race conditions are common when unbuilding
+          if (er.code === 'ENOENT') return cb(null)
           return cb(er)
         }
 
-        var source = resolve(dirname(resolved), link)
-        if (isInside(source, parent)) {
-          log.silly("gentlyRm", source, "inside", parent)
-          log.verbose("gentlyRm", "vacuuming", resolved)
-          return vacuum(resolved, options, cb)
+        if (!stat.isSymbolicLink()) {
+          log.error('gentlyRm', resolved, 'is outside', parent, 'and not a link')
+          return clobberFail(resolved, parent, cb)
         }
 
-        log.silly("gentlyRm", "checking to see if", source, "is managed by npm")
-        some(prefixes, isManaged(source), function (er, matched) {
-          if (er) return cb(er)
+        // ...and maybe the link source, when read...
+        log.silly('gentlyRm', resolved, 'is a link')
+        readlink(resolved, function (er, link) {
+          if (er) {
+            // race conditions are common when unbuilding
+            if (er.code === 'ENOENT') return cb(null)
+            return cb(er)
+          }
 
-          if (matched) {
-            log.silly("gentlyRm", source, "is under", matched)
-            log.verbose("gentlyRm", "removing", resolved)
-            vacuum(resolved, options, cb)
+          // ...is inside the managed parent
+          var source = resolve(dirname(resolved), link)
+          if (isInside(source, parent)) {
+            log.silly('gentlyRm', source, 'symlink target', resolved, 'is inside', parent)
+            log.verbose('gentlyRm', 'vacuuming', resolved)
+            return vacuum(resolved, options, cb)
           }
 
-          log.verbose("gentlyRm", source, "is not managed by npm")
-          return clobberFail(path, parent, cb)
+          log.error('gentlyRm', source, 'symlink target', resolved, 'is not controlled by npm', parent)
+          return clobberFail(target, parent, cb)
         })
       })
     })
@@ -115,28 +140,28 @@ var resolvedPaths = {}
 function isManaged (target) {
   return function predicate (path, cb) {
     if (!path) {
-      log.verbose("isManaged", "no path")
+      log.verbose('isManaged', 'no path passed for target', target)
       return cb(null, false)
     }
 
     asyncMap([path, target], resolveSymlink, function (er, results) {
       if (er) {
-        if (er.code === "ENOENT") return cb(null, false)
+        if (er.code === 'ENOENT') return cb(null, false)
 
         return cb(er)
       }
 
-      var path   = results[0]
+      var path = results[0]
       var target = results[1]
       var inside = isInside(target, path)
-      log.silly("isManaged", target, inside ? "is" : "is not", "inside", path)
+      if (!inside) log.silly('isManaged', target, 'is not inside', path)
 
       return cb(null, inside && path)
     })
   }
 
   function resolveSymlink (toResolve, cb) {
-    var resolved = resolve(toResolve)
+    var resolved = resolve(npm.prefix, toResolve)
 
     // if the path has already been memoized, return immediately
     var cached = resolvedPaths[resolved]
@@ -164,9 +189,9 @@ function isManaged (target) {
   }
 }
 
-function clobberFail (p, g, cb) {
-  var er = new Error("Refusing to delete: "+p+" not in "+g)
-  er.code = "EEXIST"
-  er.path = p
+function clobberFail (target, root, cb) {
+  var er = new Error('Refusing to delete: ' + target + ' not in ' + root)
+  er.code = 'EEXIST'
+  er.path = target
   return cb(er)
 }
diff --git a/deps/npm/lib/whoami.js b/deps/npm/lib/whoami.js
@@ -14,14 +14,6 @@ function whoami (args, silent, cb) {
   var registry = npm.config.get("registry")
   if (!registry) return cb(new Error("no default registry set"))
 
-  function noUser () {
-    // At this point, if they have a credentials object, it doesn't have a
-    // token or auth in it.  Probably just the default registry.
-    var msg = "Not authed.  Run 'npm adduser'"
-    if (!silent) console.log(msg)
-    cb(null, msg)
-  }
-
   var auth = npm.config.getCredentialsByURI(registry)
   if (auth) {
     if (auth.username) {
@@ -31,13 +23,25 @@ function whoami (args, silent, cb) {
     else if (auth.token) {
       return npm.registry.whoami(registry, { auth : auth }, function (er, username) {
         if (er) return cb(er)
-        if (!username) return noUser()
+        if (!username) {
+          var needNewSession = new Error(
+            "Your auth token is no longer valid. Please log in again."
+          )
+          needNewSession.code = 'ENEEDAUTH'
+          return cb(needNewSession)
+        }
 
         if (!silent) console.log(username)
         cb(null, username)
       })
     }
   }
 
-  process.nextTick(noUser)
+  // At this point, if they have a credentials object, it doesn't have a token
+  // or auth in it.  Probably just the default registry.
+  var needAuth = new Error(
+    "'npm whoami' requires you to be logged in."
+  )
+  needAuth.code = 'ENEEDAUTH'
+  process.nextTick(cb.bind(this, needAuth))
 }
diff --git a/deps/npm/man/man1/npm-install.1 b/deps/npm/man/man1/npm-install.1
@@ -182,8 +182,8 @@ fetch the package by name if it is not valid\.
 .RE
 .IP \(bu 2
 \fBnpm install <githubname>/<githubrepo>\fR:
-  Install the package at \fBhttps://github\.com/githubname/githubrepo" by
-  attempting to clone it using\fRgit`\.
+  Install the package at \fBhttps://github\.com/githubname/githubrepo\fR by
+  attempting to clone it using \fBgit\fR\|\.
   Example:
 .P
 .RS 2

diff --git a/deps/npm/man/man1/npm-link.1 b/deps/npm/man/man1/npm-link.1
@@ -45,7 +45,8 @@ npm link redis              # link\-install the package
 .RE
 .P
 Now, any changes to ~/projects/node\-redis will be reflected in
-~/projects/node\-bloggy/node_modules/node\-redis/
+~/projects/node\-bloggy/node_modules/node\-redis/\. Note that the link should
+be to the package name, not the directory name for that package\.
 .P
 You may also shortcut the two steps in one\.  For example, to do the
 above use\-case in a shorter way:

diff --git a/deps/npm/man/man1/npm-ls.1 b/deps/npm/man/man1/npm-ls.1
@@ -23,7 +23,7 @@ For example, running \fBnpm ls promzard\fR in npm's source tree will show:
 .P
 .RS 2
 .nf
-npm@2.7.0 /path/to/npm
+npm@2.7.4 /path/to/npm
 └─┬ init\-package\-json@0\.0\.4
   └── promzard@0\.1\.5
 .fi

diff --git a/deps/npm/man/man1/npm-run-script.1 b/deps/npm/man/man1/npm-run-script.1
@@ -35,6 +35,13 @@ The \fBenv\fR script is a special built\-in command that can be used to list
 environment variables that will be available to the script at runtime\. If an
 "env" command is defined in your package it will take precedence over the
 built\-in\.
+.P
+In addition to the shell's pre\-existing \fBPATH\fR, \fBnpm run\fR adds
+\fBnode_modules/\.bin\fR to the \fBPATH\fR provided to scripts\. Any binaries provided by
+locally\-installed dependencies can be used without the \fBnode_modules/\.bin\fR
+prefix\. For example, if there is a \fBdevDependency\fR on \fBtap\fR in your package,
+you should write \fB"scripts": {"test": "tap test/\\*\.js"}\fR instead of \fB"scripts":
+{"test": "node_modules/\.bin/tap test/\\*\.js"}\fR to run your tests\.
 .SH SEE ALSO
 .RS 0
 .IP \(bu 2

diff --git a/deps/npm/man/man1/npm.1 b/deps/npm/man/man1/npm.1
@@ -10,7 +10,7 @@ npm <command> [args]
 .RE
 .SH VERSION
 .P
-2.7.0
+2.7.4
 .SH DESCRIPTION
 .P
 npm is the package manager for the Node JavaScript platform\.  It puts

diff --git a/deps/npm/man/man3/npm.3 b/deps/npm/man/man3/npm.3
@@ -20,7 +20,7 @@ npm\.load([configObject, ]function (er, npm) {
 .RE
 .SH VERSION
 .P
-2.7.0
+2.7.4
 .SH DESCRIPTION
 .P
 This is the API documentation for npm\.

diff --git a/deps/npm/node_modules/fstream-npm/.npmignore b/deps/npm/node_modules/fstream-npm/.npmignore
diff --git a/deps/npm/node_modules/fstream-npm/example/dir-tar.js b/deps/npm/node_modules/fstream-npm/example/dir-tar.js
diff --git a/deps/npm/node_modules/fstream-npm/example/dir.js b/deps/npm/node_modules/fstream-npm/example/dir.js
diff --git a/deps/npm/node_modules/fstream-npm/example/example.js b/deps/npm/node_modules/fstream-npm/example/example.js
diff --git a/deps/npm/node_modules/fstream-npm/example/ig-tar.js b/deps/npm/node_modules/fstream-npm/example/ig-tar.js
diff --git a/deps/npm/node_modules/fstream-npm/example/tar.js b/deps/npm/node_modules/fstream-npm/example/tar.js
diff --git a/deps/npm/node_modules/fstream-npm/fstream-npm.js b/deps/npm/node_modules/fstream-npm/fstream-npm.js
diff --git a/deps/npm/node_modules/fstream-npm/node_modules/fstream-ignore/package.json b/deps/npm/node_modules/fstream-npm/node_modules/fstream-ignore/package.json
diff --git a/deps/npm/node_modules/fstream-npm/package.json b/deps/npm/node_modules/fstream-npm/package.json
diff --git a/deps/npm/node_modules/glob/README.md b/deps/npm/node_modules/glob/README.md
diff --git a/deps/npm/node_modules/glob/common.js b/deps/npm/node_modules/glob/common.js
diff --git a/deps/npm/node_modules/glob/glob.js b/deps/npm/node_modules/glob/glob.js
diff --git a/deps/npm/node_modules/glob/package.json b/deps/npm/node_modules/glob/package.json
diff --git a/deps/npm/node_modules/glob/sync.js b/deps/npm/node_modules/glob/sync.js
diff --git a/deps/npm/node_modules/graceful-fs/package.json b/deps/npm/node_modules/graceful-fs/package.json
diff --git a/deps/npm/node_modules/graceful-fs/polyfills.js b/deps/npm/node_modules/graceful-fs/polyfills.js
diff --git a/...g/node_modules/hosted-git-info/.npmignore → ...m/node_modules/hosted-git-info/.npmignore b/...g/node_modules/hosted-git-info/.npmignore → ...m/node_modules/hosted-git-info/.npmignore
diff --git a/.../node_modules/hosted-git-info/.travis.yml → .../node_modules/hosted-git-info/.travis.yml b/.../node_modules/hosted-git-info/.travis.yml → .../node_modules/hosted-git-info/.travis.yml
diff --git a/...rg/node_modules/hosted-git-info/README.md → ...pm/node_modules/hosted-git-info/README.md b/...rg/node_modules/hosted-git-info/README.md → ...pm/node_modules/hosted-git-info/README.md
diff --git a/deps/npm/node_modules/hosted-git-info/README.md~ b/deps/npm/node_modules/hosted-git-info/README.md~
diff --git a/...arg/node_modules/hosted-git-info/index.js → ...npm/node_modules/hosted-git-info/index.js b/...arg/node_modules/hosted-git-info/index.js → ...npm/node_modules/hosted-git-info/index.js
diff --git a/...node_modules/hosted-git-info/package.json → ...node_modules/hosted-git-info/package.json b/...node_modules/hosted-git-info/package.json → ...node_modules/hosted-git-info/package.json
diff --git a/...ode_modules/hosted-git-info/test/basic.js → ...ode_modules/hosted-git-info/test/basic.js b/...ode_modules/hosted-git-info/test/basic.js → ...ode_modules/hosted-git-info/test/basic.js
diff --git a/...modules/hosted-git-info/test/bitbucket.js → ...modules/hosted-git-info/test/bitbucket.js b/...modules/hosted-git-info/test/bitbucket.js → ...modules/hosted-git-info/test/bitbucket.js
diff --git a/...node_modules/hosted-git-info/test/gist.js → ...node_modules/hosted-git-info/test/gist.js b/...node_modules/hosted-git-info/test/gist.js → ...node_modules/hosted-git-info/test/gist.js
diff --git a/...de_modules/hosted-git-info/test/github.js → ...de_modules/hosted-git-info/test/github.js b/...de_modules/hosted-git-info/test/github.js → ...de_modules/hosted-git-info/test/github.js
diff --git a/...de_modules/hosted-git-info/test/gitlab.js → ...de_modules/hosted-git-info/test/gitlab.js b/...de_modules/hosted-git-info/test/gitlab.js → ...de_modules/hosted-git-info/test/gitlab.js
diff --git a/...osted-git-info/test/lib/standard-tests.js → ...osted-git-info/test/lib/standard-tests.js b/...osted-git-info/test/lib/standard-tests.js → ...osted-git-info/test/lib/standard-tests.js
diff --git a/deps/npm/node_modules/inflight/.eslintrc b/deps/npm/node_modules/inflight/.eslintrc
diff --git a/...ient/node_modules/npm-package-arg/LICENSE → ...it-package-json/node_modules/glob/LICENSE b/...ient/node_modules/npm-package-arg/LICENSE → ...it-package-json/node_modules/glob/LICENSE
diff --git a/deps/npm/node_modules/init-package-json/node_modules/glob/README.md b/deps/npm/node_modules/init-package-json/node_modules/glob/README.md
diff --git a/deps/npm/node_modules/init-package-json/node_modules/glob/common.js b/deps/npm/node_modules/init-package-json/node_modules/glob/common.js