CLI flag --only is overridden by NODE_ENV

[dylancwood]

Background

Here's my understanding of how this new feature should work: npm@3.3.0 includes a new CLI flag --only={prod[uction]|dev[elopment]}. When this flag is used, only the dependencies or devDependencies listed in package.json should be installed (and devDependencies will not be installed recursively 👍 ).

This behavior was arrived at in issue #9024.

Here is what the docs say about the --only flag:

The --only={prod[uction]|dev[elopment]} argument will cause either only devDependencies or only non-devDependencies to be installed.

Problem

Using the --only=dev flag when NODE_ENV is set to production, only the non-devDependencies are installed.

Solution(s):

Just some ideas for more intuitive behavior (in order of preference):

1. Make it so that the --only flag trumps the environment variable (haven't looked at how this could be implemented).
2. If the --only flag is used when NODE_ENV === 'production' display a warning, or exit with error.
3. Update the docs to explain that NODE_ENV trumps the --only flag.

Test-case

Use this package.json:

  {
    "dependencies": {
      "lodash": "^3.10.1"
    },
    "devDependencies": {
      "jshint": "^2.8.0"
    }
  }

Test --only behavior with NODE_ENV as development (works as expected):

  export NODE_ENV=development
  npm i --only=dev
  npm i --only=prod

Delete node_modules, and re-test with NODE_ENV as production:

rm -rf node_modules
export NODE_ENV=production
npm i --only=dev

Expected output

npm WARN prefer global jshint@2.8.0 should be installed with -g
npmtest@1.0.0 /coins/npmtest
└─┬ jshint@2.8.0
  ...

Actual output

npmtest@1.0.0 /coins/npmtest
└── lodash@3.10.1

[dylancwood]

Update

I just realized that I can use the following command to achieve the results that I want:

npm i --production=false

However, I do think that specifying --only=dev should override the environment var as well.

Thoughts?

[othiym23]

If you want to put together a patch to allow --only=dev to take precedence over NODE_ENV, I'd be happy to work with you to get it landed. The current behavior is an edge case that comes from the fact that we're using a bunch of different names for the same thing, and dealing with all the overlapping synonyms and configuration behavior is fairly tricky. I'm happy to call it a bug, but fixing it is pretty low on the CLI team's list of priorities right now.

[hellboy81]

I have npm 3.3.3 globally installed. How can I install only dev dependencies?

As I mentioned test should have dependencies only on devDependencies.