feat(pm): support shared install options in add by jong-kyung · Pull Request #2722 · voidzero-dev/vite-plus

jong-kyung · 2026-09-16T05:33:23Z

Summary

Extend vp add with ten options already available to vp install, using native equivalents where each package manager supports them.

This also fixes vp install <packages> silently dropping shared options when routing to add. For example, --lockfile-only could still create node_modules, and --offline could still allow network access.

Changes

Expose shared options on vp add:
- --no-optional, --frozen-lockfile, --no-frozen-lockfile, --lockfile-only
- --prefer-offline, --offline, --force, --no-lockfile
- --shamefully-hoist, --silent
Preserve these options when converting positional installs to add.
Warn and drop install-only options when adding packages, and add-only options when installing without package names.
Suppress Vite+ diagnostics and cached update notices with add --silent, and enable native silent mode where supported.

Unsupported options retain the existing warning-and-continue policy.

jong-kyung · 2026-09-16T05:33:32Z

@codex review

chatgpt-codex-connector · 2026-09-16T05:33:47Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-16T08:19:24.931043Z	`9ba2c96`	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3f1d004f3e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

jong-kyung · 2026-09-16T06:10:18Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8933963ac5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

jong-kyung · 2026-09-16T06:27:37Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d6ed532df0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

jong-kyung · 2026-09-16T07:16:12Z

@codex review

chatgpt-codex-connector · 2026-09-16T07:20:10Z

Codex Review: Didn't find any major issues. Nice work!

Reviewed commit: 287616f1bb

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

jong-kyung · 2026-09-16T07:35:00Z

@codex review

chatgpt-codex-connector · 2026-09-16T07:38:53Z

Codex Review: Didn't find any major issues. What shall we delve into next?

Reviewed commit: 16a0cba033

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

jong-kyung · 2026-09-16T08:13:19Z

@fengmk2 The Windows CI failure seems related to argument parsing in the PowerShell. Could you take a look? 🙇‍♂

fengmk2 · 2026-09-16T08:19:19Z

@jong-kyung Sure, let me take over

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9ba2c96b3c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Preserve common options when install with package names resolves to add, and map them to each package manager's supported flags. Diagnose options that do not apply to the selected install/add mode before conversion. Retain Yarn Classic's native frozen-lockfile behavior and warn for unsupported options without changing the warning-and-continue policy. Cover option forwarding and command modes with resolver tests and CLI snapshots.

Classic add accepts --frozen-lockfile without checking manifest and lockfile consistency. Reject this combination before execution for both add and install with package names. Preserve package-free frozen installs and other package managers. Verify rejected additions leave the manifest, lockfile, and installed dependency unchanged, while package-free installs still enforce the frozen lockfile.

Use the shared unsupported-option policy for all Yarn add versions instead of rejecting frozen additions only on Classic. Warn, drop the option, and continue with the add command. Preserve frozen-lockfile enforcement for package-free installs and Bun add. Cover both add entrypoints and package-free frozen installs in snapshots.

Include add's silent flag in the shared quiet-mode and diagnostics checks so Vite+ suppresses compatibility warnings and cached upgrade notices. Cover silent and normal add classification, and verify a silent add leaves the pending upgrade notice available for the next interactive command.

Use project npm configuration for the offline probe and isolate Berry's cache. Give the updated local dependency a distinct manifest size so Yarn Classic does not skip copying files with identical size and mtime. Refresh the add help and affected snapshots. Leave cross-platform Yarn hash normalization for a separate change.

Restore the npm offline probe and Berry cache settings, retaining only the help snapshot update and the Classic file-copy fixture correction. Regenerate snapshots without changing redaction.

Mask file locator hashes and checksums in Yarn immutable lockfile diffs while preserving package versions and diagnostics. Add redaction coverage and regenerate the affected snapshots.

Disable the global cache for yarn_berry_lockfile_only so its fetch summary does not depend on packages cached by other cases on Windows.

Explain that silent mode suppresses Vite+ output and enables native silent mode where supported. Refresh the global and local help snapshots without changing runtime behavior.

@fengmk2

…2780) Vite+ now uses Vitest 5, and `vp migrate` helps Vitest 4 projects adopt the new APIs and defaults. Standalone installs and upgrades now require verified npm provenance for release binaries. ### Breaking Changes #### Vitest 5 `vp test` and the public `vite-plus/test*` exports now use `vitest@5.0.1` ([#2551](#2551)), by @fengmk2. | Area | Old | New | | --- | --- | --- | | Test runner | `vitest@4.1.11` | `vitest@5.0.1` | | CLI Node.js range | `^20.19.0 \|\| ^22.18.0 \|\| >=24.11.0` | `^22.18.0 \|\| ^24.11.0 \|\| >=26.0.0` | | `vite-plus/test/runners` and `vite-plus/test/suite` | Vite+ compatibility exports | Use supported APIs from `vite-plus/test`; review unsupported runner and expect plugins | | `vite-plus/test/browser-webdriverio` | Bundled export | Use the community `@vitest/browser-webdriverio` package | Run `vp migrate` from the workspace root before you install the new dependencies. The migrator updates supported config, source, benchmark, command, and import changes. It reports manual work as `BLOCK` or `REVIEW` items. See the [Vitest 5 migration guide](https://viteplus.dev/guide/vitest-v5) for the full process. Projects can stay on the prior release until their runtimes and tests are ready. #### `vp staged` runtime requirements `vp staged` now uses `lint-staged@17.5.1` ([#2754](#2754)), by @fengmk2. | Requirement | Old | New | | --- | --- | --- | | Node.js for `vp staged` | The Vite+ CLI runtime range | `^22.22.1 \|\| ^24.11.0 \|\| >=26.0.0` | | Git | No separate documented minimum | `>=2.32.0` | Update Node.js and Git on developer machines and CI runners that execute `vp staged` or its pre-commit hook. Other workflows do not use these extra requirements. ### Highlights - Standalone installers, `vp upgrade`, and `vp-setup.exe` now reject release binaries without supported SLSA provenance ([#2440](#2440)), by @kazupon. - Installers now show progress and the exact shell activation command. Download progress preserves earlier terminal output ([#2744](#2744), [#2741](#2741)), by @fengmk2. - System-first runtime and package-manager shims now use a fallback directory at the end of `PATH`. Setup restores missing package-manager preferences ([#2758](#2758), [#2763](#2763)), by @liangmiQwQ and @fengmk2. - `vp run` now finishes when background processes remain. Large file traces run without caching instead of killing the task ([#2767](#2767), [vite-task#675](voidzero-dev/vite-task#675)), by @wan9chi. ### Features - `vp add` now supports shared install options such as `--offline`, `--frozen-lockfile`, and `--lockfile-only` ([#2722](#2722)), by @jong-kyung. - `vp pm patch` and `vp pm patch-commit` now use the native commands in npm 12 and later ([#2736](#2736)), by @jong-kyung. - `vp rebuild` now supports Yarn Berry and forwards package names and extra arguments ([#2761](#2761)), by @jong-kyung. - The bundled tools update `oxlint` `1.83.0` -> `1.85.0`, `oxlint-tsgolint` `7.0.2001` -> `7.0.2002`, and `oxfmt` `0.68.0` -> `0.70.0` ([#2745](#2745), [#2773](#2773), [#2778](#2778)), by @voidzero-guard[bot]. These versions can flag or format code that passed before. Run `vp fmt` after upgrading if CI runs `vp check`. ### Fixes & Enhancements - `oxlint` and `oxfmt` no longer expose bin wrappers that conflict with upstream packages. Editors must use `vp lint --lsp`, `vp fmt --lsp`, or `vp fmt --stdin-filepath` ([#2672](#2672)), by @fengmk2. - `vp create vite:generator` now replaces catalog references for package managers that do not support catalogs ([#2720](#2720)), by @SaKaNa-Y. - Unpinned npm projects now use the npm version bundled with the selected Node.js runtime. The same policy works during migration ([#2742](#2742), [#2748](#2748)), by @liangmiQwQ. - The CLI now loads its local versions module through a file URL, including on Windows paths ([#2749](#2749)), by @YanChenBai. - Package-manager commands now use pnpm when the project has no detected package manager ([#2750](#2750)), by @liangmiQwQ. - `vp migrate` now removes unused `@oxlint/plugins` dependencies after it rewrites plugin imports ([#2751](#2751)), by @fengmk2. - `vp update --no-save` now warns that Yarn Classic and Yarn Berry do not support the option ([#2762](#2762)), by @jong-kyung. - `vp migrate` now explains its `tsdown@0.23` compatibility settings and links to removal guidance ([#2769](#2769)), by @fengmk2. - Environment setup now installs and diagnoses the official `pn` and `pnx` aliases for pnpm ([#2770](#2770)), by @iruoy. - Cached tasks now receive GitHub Actions OIDC variables, so npm Trusted Publishing works through `vp run` ([vite-task#691](voidzero-dev/vite-task#691)), by @naokihaba. - Automatic task input tracking now records file access from signal handlers ([vite-task#687](voidzero-dev/vite-task#687)), by @wan9chi. ### Refactor - `vp lint`, `vp fmt`, and `vp check` now use native config discovery. Package commands keep matching workspace-root settings, while explicit config flags take precedence ([#2731](#2731)), by @fengmk2. ### Chore - Generated workflows and `vp migrate` now use `setup-vp@v1.21.1`, including its installation fixes ([#2760](#2760), [#2772](#2772)), by @renovate[bot] and @fengmk2. ### Bundled Versions | Tool | Version | Source | | --- | --- | --- | | vite | `8.3.0` | [`434e8e9`](vitejs/vite@434e8e9) | | rolldown | `1.2.9` | [`5b4746e`](rolldown/rolldown@5b4746e) | | tsdown | `0.23.0` | [npm](https://npmx.dev/package/tsdown/v/0.23.0) | | vitest | `5.0.1` | [npm](https://npmx.dev/package/vitest/v/5.0.1) | | oxlint | `1.85.0` | [npm](https://npmx.dev/package/oxlint/v/1.85.0) | | oxlint-tsgolint | `7.0.2002` | [npm](https://npmx.dev/package/oxlint-tsgolint/v/7.0.2002) | | oxfmt | `0.70.0` | [npm](https://npmx.dev/package/oxfmt/v/0.70.0) | ### Upgrade ```bash vp upgrade ``` ### New Contributors @YanChenBai, @iruoy **Full Changelog**: v0.3.3...v1.0.0-rc.0 --- Merging this PR will trigger the release workflow. --------- Co-authored-by: voidzero-guard[bot] <278573678+voidzero-guard[bot]@users.noreply.github.com> Co-authored-by: MK (fengmk2) <fengmk2@gmail.com>

jong-kyung self-assigned this Sep 16, 2026

chatgpt-codex-connector Bot reviewed Sep 16, 2026

View reviewed changes

Comment thread crates/vp_pm_cli/src/resolution/commands/add.rs Outdated

chatgpt-codex-connector Bot reviewed Sep 16, 2026

View reviewed changes

Comment thread crates/vp_pm_cli/src/resolution/commands/add.rs Outdated

chatgpt-codex-connector Bot reviewed Sep 16, 2026

View reviewed changes

Comment thread crates/vp_pm_cli/src/resolution/commands/add.rs Outdated

jong-kyung marked this pull request as ready for review September 16, 2026 08:12

jong-kyung requested a review from fengmk2 September 16, 2026 08:13

chatgpt-codex-connector Bot reviewed Sep 16, 2026

View reviewed changes

Comment thread crates/vp_pm_cli/src/resolution/commands/add.rs

jong-kyung changed the title ~~fix(pm): preserve install options when adding packages~~ feat(pm): support shared install options in add Sep 17, 2026

jong-kyung and others added 10 commits September 22, 2026 00:25

test(pm): defer Windows-specific fixture fixes

2590c2c

Restore the npm offline probe and Berry cache settings, retaining only the help snapshot update and the Classic file-copy fixture correction. Regenerate snapshots without changing redaction.

test(pm): normalize platform-dependent Yarn snapshot hashes

c5d9384

Mask file locator hashes and checksums in Yarn immutable lockfile diffs while preserving package versions and diagnostics. Add redaction coverage and regenerate the affected snapshots.

test(pm): isolate Yarn lockfile-only snapshot cache

2c6d58f

Disable the global cache for yarn_berry_lockfile_only so its fetch summary does not depend on packages cached by other cases on Windows.

docs(pm): clarify add silent mode in help

331731d

Explain that silent mode suppresses Vite+ output and enables native silent mode where supported. Refresh the global and local help snapshots without changing runtime behavior.

test: stabilize install option and workspace pack snapshots

a2117c1

fengmk2 force-pushed the fix/install-package-options branch from effe9ee to a2117c1 Compare September 21, 2026 16:26

refactor(pm): simplify install option handling and fixtures

2e0f186

fix(pm): require Yarn 3 for lockfile-only add

21edaab

fengmk2 approved these changes Sep 22, 2026

View reviewed changes

fengmk2 merged commit 85905a7 into voidzero-dev:main Sep 22, 2026
101 of 104 checks passed

jong-kyung deleted the fix/install-package-options branch September 22, 2026 01:46

fengmk2 mentioned this pull request Sep 22, 2026

release: v1.0.0-rc.0: Vitest 5 migration and npm provenance checks #2780

Merged

Conversation

jong-kyung commented Sep 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Uh oh!

jong-kyung commented Sep 16, 2026

Uh oh!

chatgpt-codex-connector Bot commented Sep 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

jong-kyung commented Sep 16, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

jong-kyung commented Sep 16, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

jong-kyung commented Sep 16, 2026

Uh oh!

chatgpt-codex-connector Bot commented Sep 16, 2026

Uh oh!

jong-kyung commented Sep 16, 2026

Uh oh!

chatgpt-codex-connector Bot commented Sep 16, 2026

Uh oh!

jong-kyung commented Sep 16, 2026

Uh oh!

fengmk2 commented Sep 16, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

jong-kyung commented Sep 16, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Sep 16, 2026 •

edited

Loading