Regarding 1. As far as I know, npm says in it's docs you should add node_modules to your scm because there is no way to install the exact same version through npm on different machines. On the other hand, composer has a .lock file which specifies commit hashes it installed on the dev machine, so a composer install installs the exact same commit on every machine.

@OP: You didn't commit the composer.lock. That means that your code might run locally but breaks on another machine because there might be a new version of laravel 4.2