add support for cloning non npm hosted deps into a repo

tar-stream would throw an error when trying to create the second entry in the transformed tarball (something about already writing to an entry). I am unsure why changing the thing it was streaming to caused it to break, since it thinks its still writing to a previous entry, maybe tar-stream is making bad assumptions about how fast the stream is being consumed? maybe a stream version error?