feat(env): add corepack to the default shims tool list by fengmk2 · Pull Request #1808 · voidzero-dev/vite-plus

fengmk2 · 2026-06-10T13:22:13Z

Closes #1309
Closes #858

Without a system Node.js, corepack is unreachable under Vite+ even though Node.js <= 24 bundles it, and Node.js 25+ removed it entirely. This adds corepack to the default shims created by vp env setup.

How it works

Resolution order: vp-managed global install (vp install -g corepack) > Node-bundled corepack (Node.js <= 24) > auto-install as a managed global package (Node.js 25+). The auto-install links only the corepack bin, so it never conflicts with an existing vp install -g pnpm (the corepack package also declares pnpm/yarn launcher bins).
corepack enable/disable without an explicit --install-directory get --install-directory ~/.vite-plus/bin injected, so the created pnpm/yarn launchers land on PATH and still resolve the project Node.js version. Vite+-owned shims (npm/npx, vp install -g binaries) are restored with a warning if corepack removes or replaces them.
vp remove -g corepack keeps the default shim; vp env doctor and vp env which corepack cover the new shim.

RFC updates in rfcs/env-command.md (new Corepack Shim section), rfcs/trampoline-exe-for-shims.md, and rfcs/upgrade-command.md describe the design.

Testing

New snap tests: shim-corepack-bundled (real bundled corepack via Node 20.18.0) and shim-corepack-enable-install-directory (hermetic test for the install-directory injection and npm shim restore).
Verified manually: bundled dispatch, auto-install on Node 25 (corepack 0.34.7, only corepack bin linked), managed-first precedence, vp remove -g corepack fallback, and a real corepack enable/disable cycle (yarn --version works through the launcher, vp-managed pnpm restored).

Note: just lint currently fails on main due to a pre-existing clippy::unused_async_trait_impl warning in js_executor.rs from the nightly-2026-06-10 bump, unrelated to this change.

Note

Medium Risk
Changes shim dispatch, bin-dir ownership, and global install metadata—high-impact paths for every Node/npm/pnpm workflow, but behavior is heavily documented and covered by new snap tests.

Overview
corepack becomes a default env shim alongside node, npm, and npx (vp env setup, install scripts, doctor/which/help). Dispatch uses a dedicated path (not the core node/npm/npx recursion flow): vp-managed global corepack wins, then Node-bundled corepack (≤24), then auto-install as a managed global on Node 25+ with only the corepack bin linked.

For corepack enable / disable, the shim injects --install-directory into ~/.vite-plus/bin when omitted so pnpm/yarn launchers land on PATH, then restores Vite+-owned shims (default tools, vp install -g, npm-linked bins) if corepack clobbered them. Setup also drops stale npm BinConfig for default shim names and removes leftover .ps1 on Windows.

Global install gains optional only_bins and bins_restricted metadata so auto-install and vp update -g cannot re-expose filtered bins; is_protected_shim keeps default shims from being removed by package uninstall/npm cleanup. E2E varlet uses corepack enable instead of vp i -g pnpm.

^{Reviewed by Cursor Bugbot for commit f3abd36. Configure here.}

github-actions · 2026-06-10T13:24:14Z

✅ Staging deployment successful!

Preview: https://viteplus-staging.void.app/
Commit: 4b4fd16

netlify · 2026-06-10T13:33:13Z

✅ Deploy Preview for viteplus-preview canceled.

Name	Link
🔨 Latest commit	`4b4fd16`
🔍 Latest deploy log	https://app.netlify.com/projects/viteplus-preview/deploys/6a2ad928a314690008451168

fengmk2 · 2026-06-11T01:05:41Z

Manual verification checklist

Shim creation and upgrade paths

Fresh install via install.sh: ~/.vite-plus/bin/corepack symlink exists and corepack --version works without a system Node.js
Upgrade from a pre-corepack vp (vp upgrade): corepack shim is created by the automatic env setup --refresh
Plain vp env setup (no --refresh) on an existing install: corepack shim is created while node/npm/npx are reported as skipped
vp env doctor: corepack listed under Shims and under PATH checks
Windows: vp env setup creates corepack.exe trampoline; corepack --version works from PowerShell, cmd.exe, and Git Bash

Resolution order

Node <= 24 project (e.g. .node-version 20.18.0): corepack --version runs the bundled corepack (0.29.3); vp env which corepack shows the js_runtime path
vp install -g corepack: managed copy wins afterwards on every Node version; vp env which corepack shows the package path
Node 25+ project, no managed corepack: first corepack --version auto-installs (notice on stderr, Bins: corepack only); second invocation runs without reinstalling
Known limitation to confirm acceptable: during the one-time auto-install, vp install progress lines still go to stdout, so the very first captured $(corepack --version) on Node 25+ is not clean
Corrupt ~/.vite-plus/bins/corepack.json (e.g. truncate it): corepack warns about unusable managed state and falls back to the bundled copy instead of exiting 1
Node 25+ offline with no managed corepack: clear error with the vp install -g corepack hint

corepack enable / disable

corepack enable: pnpm/yarn launchers land in ~/.vite-plus/bin (injected --install-directory); yarn --version works and resolves the project Node.js
corepack enable --install-directory /custom/dir: explicit directory respected, nothing written to vp bin
corepack disable: launchers removed again
With vp install -g pnpm present: corepack enable restores vp-managed pnpm/pnpx shims with a warning; corepack disable preserves them. On Unix this may restore with a warning, while on Windows the .exe trampolines remain intact without a warning
With a pnpm link created via npm install -g pnpm interception: corepack disable restores the link with a warning
After deliberately deleting ~/.vite-plus/bin/npm: corepack enable does NOT resurrect it and prints no restore warning
corepack enable npm: npm shim is restored with a warning; npm --version still resolves per project
corepack enable --help: prints help, touches no files
Windows PowerShell: after corepack enable npm + restore, npm resolves the vp trampoline (no leftover npm.ps1/npm.cmd/extensionless wrapper)

Old/new version compatibility

Existing vp install -g corepack (the old workaround) survives the upgrade: still wins over bundled, vp env setup --refresh keeps its BinConfig
Pre-PR npm install -g corepack user: after upgrade + vp env setup, the stale Npm BinConfig is dropped and a later npm uninstall -g corepack does NOT delete the default shim
vp remove -g corepack: package removed, default shim kept, resolution falls back to bundled; --dry-run marks the shim as (kept: default shim)
Auto-installed corepack then vp update -g (when a newer corepack exists): still links only the corepack bin, no pnpm/yarn shims appear, no BinaryConflict with a vp-managed pnpm
Explicit vp install -g corepack after an auto-install: resets the restriction and exposes the package's launcher bins (conflict semantics with --force unchanged)
Old metadata files without the binsRestricted field load fine (vp list -g works after upgrade)
Windows downgrade via old install.ps1: stale corepack.exe/vpr.exe trampolines are removed
vp upgrade --rollback to a pre-corepack version: corepack shim remains in bin but old vp reports "Binary 'corepack' not found" (known behavior, confirm acceptable)

Modes and overrides

vp env off (system-first) with a system corepack installed: shim prefers the system corepack; vp env on restores managed behavior
VP_BYPASS=1 corepack --version bypasses the shim
vp env use 20 vs vp env use 25 in the same shell: corepack switches between bundled and managed/auto-install resolution
vp env exec corepack --version works (shim mode without --node)

CI

snap tests green: shim-corepack-bundled, shim-corepack-enable-install-directory, command-env-which, command-env-setup-external-vp, cli-helper-message

fengmk2 · 2026-06-11T12:18:41Z

@cursor review

fengmk2 · 2026-06-11T12:18:46Z

@codex review

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit f3abd36. Configure here.}

cursor · 2026-06-11T12:22:04Z

+        1,
+        false,
+        Some(&["corepack"]),
+    )


Auto-install pollutes corepack stdout

Medium Severity

On Node.js 25+, the shim’s first-use auto-install calls the regular vp install -g path, which prints info: and ✓ Installed lines to stdout. That contradicts the nearby intent that wrapped corepack stdout stay parseable, so commands like corepack --version can emit extra stdout before corepack’s own output.

^{Reviewed by Cursor Bugbot for commit f3abd36. Configure here.}

chatgpt-codex-connector · 2026-06-11T12:24:27Z

Codex Review: Didn't find any major issues. Keep them coming!

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

vp env setup now creates a corepack shim alongside node/npm/npx. The shim resolves corepack in this order: a vp-managed global install (vp install -g corepack), the copy bundled with the project-resolved Node.js (Node.js <= 24), and finally an automatic managed install on Node.js 25+ where corepack is no longer bundled. The auto-install links only the corepack bin so it never conflicts with vp-managed package managers like an existing vp install -g pnpm. corepack enable/disable without an explicit --install-directory get --install-directory ~/.vite-plus/bin injected so the pnpm/yarn launchers land on PATH. Vite+-owned shims (npm/npx and vp install -g binaries) are restored with a warning if corepack removes or replaces them, and vp remove -g corepack keeps the default shim in place. Closes #1309 Closes #858

- Persist the auto-install bin restriction in package metadata (bins_restricted) so vp update -g cannot re-expose corepack's pnpm/pnpx/yarn/yarnpkg launchers or fail with a binary conflict - Fall back to the Node-bundled corepack when the vp-managed install is unusable (stale metadata) instead of failing every invocation - Snapshot Vite+-owned shims before corepack enable/disable and restore only entries corepack actually removed or replaced, including links created by the npm install -g interception - Guard npm uninstall -g link cleanup and dry-run output with a shared is_protected_shim helper so stale Npm BinConfigs cannot delete default shims; vp env setup now drops such stale BinConfigs - Remove corepack's .ps1 launchers on Windows (PowerShell resolves .ps1 ahead of the trampoline .exe) and detect them in shim checks - Print the auto-install notice to stderr to keep corepack's stdout parseable; check the cheap enable/disable arg match before resolving the bin dir and warn instead of silently skipping the injection - Share the package-binary invocation logic with dispatch_package_binary and reuse locate_tool in vp env which; add corepack.exe and vpr.exe to the install.ps1 stale trampoline cleanup; isolate corepack snap tests from a leftover managed corepack

The corepack shim now makes corepack enable work out of the box, and the created pnpm launcher resolves varlet's pinned packageManager version (pnpm@9.15.9) instead of installing the latest pnpm globally. This also exercises the new corepack enable interception in a real e2e run. The sfw TLS test in ci.yml keeps vp i -g pnpm@9.15.0 on purpose: it exists to force vp's own registry-fetch path through the TLS proxy.

'corepack is not bundled with Node.js 20.18.0' is inaccurate when the bundled copy was removed (e.g. npm uninstall -g corepack) rather than never shipped. Say 'not available for' to cover both Node.js 25+ and damaged Node.js <= 24 installs.

fengmk2 self-assigned this Jun 10, 2026

fengmk2 force-pushed the feat/corepack-default-shim branch from 35b7365 to cf0e351 Compare June 11, 2026 01:03

cursor Bot reviewed Jun 11, 2026

View reviewed changes

fengmk2 added 5 commits June 11, 2026 23:42

test(env): regenerate corepack snap outputs for isolation guard steps

8aea5a3

fengmk2 force-pushed the feat/corepack-default-shim branch from f3abd36 to 4b4fd16 Compare June 11, 2026 15:49

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(env): add corepack to the default shims tool list#1808

feat(env): add corepack to the default shims tool list#1808
fengmk2 wants to merge 5 commits into
mainfrom
feat/corepack-default-shim

fengmk2 commented Jun 10, 2026 •

edited by cursor Bot

Loading

Uh oh!

github-actions Bot commented Jun 10, 2026 •

edited

Loading

Uh oh!

netlify Bot commented Jun 10, 2026 •

edited

Loading

Uh oh!

fengmk2 commented Jun 11, 2026 •

edited

Loading

Uh oh!

fengmk2 commented Jun 11, 2026

Uh oh!

fengmk2 commented Jun 11, 2026

Uh oh!

cursor Bot left a comment

Uh oh!

cursor Bot Jun 11, 2026

Uh oh!

chatgpt-codex-connector Bot commented Jun 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

fengmk2 commented Jun 10, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

How it works

Testing

Uh oh!

github-actions Bot commented Jun 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

netlify Bot commented Jun 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for viteplus-preview canceled.

Uh oh!

fengmk2 commented Jun 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Manual verification checklist

Shim creation and upgrade paths

Resolution order

corepack enable / disable

Old/new version compatibility

Modes and overrides

CI

Uh oh!

fengmk2 commented Jun 11, 2026

Uh oh!

fengmk2 commented Jun 11, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor Bot Jun 11, 2026

Choose a reason for hiding this comment

Auto-install pollutes corepack stdout

Uh oh!

chatgpt-codex-connector Bot commented Jun 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

fengmk2 commented Jun 10, 2026 •

edited by cursor Bot

Loading

github-actions Bot commented Jun 10, 2026 •

edited

Loading

netlify Bot commented Jun 10, 2026 •

edited

Loading

fengmk2 commented Jun 11, 2026 •

edited

Loading