npm & npx

npm and npx are real, in-VM commands. They fetch actual packages from the npm registry, install them into the box's filesystem, and make their binaries runnable — the same node_modules layout a package expects.

Installing#

npm install          # install from package.json
npm install react    # add a dependency
npx create-vite@latest my-app

Under the hood:

• Registry fetch — package metadata and tarballs are fetched from the registry (through the proxy when a tab can't reach it directly), then unpacked into node_modules.
• Hoisting installer — dependencies are installed with a hoist-with-nesting strategy: shared versions hoist to the top, conflicting versions nest under the dependent. (A naive flat dedupe-by-name breaks on version conflicts like glob@7 vs glob@10.)
• Version resolution — semver ranges, partial x-ranges, and bare-major ranges resolve the way npm's do, and prereleases are excluded from a caret range unless explicitly requested (so ^6.1.2 won't grab 6.2.0-canary).
• npm: aliases — alias specs like "pg-mem": "npm:@tinbase/pg-mem@^3" are resolved and installed under the alias name.

Running binaries#

Installing a package registers its bin entries so scripts and npx can run them. npm run <script> executes a package.json script — resolving local node_modules/.bin first, then falling back to the command registry. Simple scripts (a single command, no shell operators) are invoked directly to keep stack traces shallow.

npm run build        # runs the "build" script
npm run dev          # long-running dev servers work — see Live previews

npx#

npx <pkg> fetches a package (if not already present), resolves its bin, and runs it — the path most scaffolders take:

npx create-expo-app@latest my-app --template blank

This exercises a lot of the stack at once: registry fetch, install, the Node runtime's completion model (so the CLI returns to the prompt on its own), interactive prompts, and child_process shelling out to the in-VM npm install.

The lifo package runtime#

Alongside npm, Lifo has its own lightweight package mechanism (lifo) for VM tools and dev-linking local packages (linkPackage / loadDevLinks). It's how Lifo-native tools are distributed and hot-linked during development.