make everything but npm a devDependency in package.json and be consistent about calling local bin