Open Ethan-Arrowood opened 1 year ago
And to top it off the npm package has no visual readme or anything. Its very distrustful.
Hi @Ethan-Arrowood thanks for reporting! Currently, we're working on higher-priority issues, but we'll come back to this one soon
It is confusing that the npm package is titled differently from the source code repo. Furthermore, since you are not publishing the CLI under the
@microsoft
scope, a bad-actor could publish something bad under the currently availabletfs-cli
name. Similarly confused users may accidentally installtfs-cli
instead oftfx-cli
, and run into major issues.Since the documentation throughout this references
tfx-cli
, I recommend renaming the repo totfs-cli
. GitHub will handle redirects automatically.If that is not possible for whatever reason, you should at least publish something to the
tfs-cli
package on npm that maybe just prints a message like "This package name is incorrect. Installtfx-cli
instead". Furthermore, since the CLI is invoked astfx
you may want to consider publishing to that name too (but you'd need to reach out to its current package author to get access to the name). This matches what TypeScript does with thetsc
pacakge. Since that is how you invoke the typescript command line, sometimes users willnpm i -g tsc
instead ofnpm i -g typescript
.Also, all of this is improved if you use a scope like
@microsoft
or@azure-devops
. Just the scope alone will provide an improved layer of trust to this tool.