fix(env): report package manager pin targets and scope by SaKaNa-Y · Pull Request #3103 · voidzero-dev/vite-plus

SaKaNa-Y · 2026-10-18T07:46:58Z

Summary

From a workspace member such as /repo/packages/app, vp env pin yarn@4.12.0 --no-install --force updates the workspace root package.json. The help describes changes in the current directory, and the result omits the target file. Users can mistake a shared package-manager change for a change limited to that member.

Correct the help and guide to explain that Node.js pins use the current directory and package-manager pins use the workspace root. Show the actual manifest and field before existing overwrite prompts and after package-manager results. File paths are relative to the current working directory:

 ✓ Pinned package manager to yarn@4.12.0
+  File: ../../package.json
+  Field: packageManager

When no matching pin exists, report the searched fields and any explicit manager selector. Distinguish missing files from other read failures. --target continues to select the pin source within the existing project scope.

Evidence

Before: In the workspace-member reproduction, pin and unpin changed the root manifest and left the member manifest unchanged. Their results did not identify the file or field.
After: The same operations identify the root manifest and actual field. Mixed Node/package-manager snapshots show separate member and root targets. Cancellation shows the target once before the question and preserves the manifest.

Validation of cd43b861 on macOS arm64:

just check, just test (2338 passed, 7 ignored), and just lint passed.
All 27 focused global snapshot comparisons passed: 13 package-manager cases, 11 .nvmrc cases, and 3 mismatch/confirmation cases. Generated snapshots were reviewed.
Seven isolated CLI calls passed, covering stdout target details, root writes, unchanged member files, and byte-for-byte preservation after cancellation and no-op results.
The read-error classification unit test, changed-file rustfmt --check, and git diff --check passed.

The snapshot wrapper stopped at missing Playwright dependencies. The same Rust runner passed directly against the freshly built global binary with local-flavor cases excluded. Linux and Windows were not tested locally. Read-error classification used synthetic I/O errors, without a filesystem-permission integration test.

Merge Danger

Door: two-way

Reverting this change restores the previous messages and documentation without a project-file migration.

Blast Radius: CLI

Human-readable pin/unpin output changes, so scripts that match exact messages need adjustment. Workspace resolution, declaration selection, Node.js behavior, confirmation points, --force, and exit statuses remain unchanged.

Clarify current-directory Node pins and workspace-root package-manager pins. Report the actual manifest and declaration around existing confirmations and results, and distinguish missing manifests from unmatched pins without changing selection or exit status.

SaKaNa-Y · 2026-10-19T07:23:57Z

The documentation did not clearly explain which files package-manager pin and unpin commands modify.

This change clarifies that scope in the documentation and command help. The command output also shows the actual file path and field, so users can see where changes occur.

fengmk2 · 2026-10-19T08:57:24Z

@codex review

chatgpt-codex-connector · 2026-10-19T08:57:39Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-20T03:15:58.238920Z	`27ef5d2`	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

chatgpt-codex-connector · 2026-10-19T09:04:11Z

Codex Review: Didn't find any major issues. 🚀

Reviewed commit: 6a93ae909c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

fengmk2 · 2026-10-19T13:00:47Z

File: /repo/package.json

Can it be changed to a relative path based on the cwd? Instead of displaying the absolute path by default.

fengmk2 · 2026-10-20T03:08:50Z

@codex review

chatgpt-codex-connector · 2026-10-20T03:15:56Z

Codex Review: Didn't find any major issues. Delightful!

Reviewed commit: 27ef5d2f9e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@Brooooooklyn

Vite+ 1.4 runs TypeScript and JavaScript files with `vpx`, and `vp migrate` can move tsx scripts to it. It also adds `vp check --deny-warnings` and `vp pm team`, and installs the global CLI's dependencies from a lockfile published with each release. ### Features - `vpx <file>` runs a TypeScript or JavaScript file on the project's Node.js with the [oxc-node](https://github.com/oxc-project/oxc-node) loader that ships with Vite+, and `vpx --watch <file>` reruns it when a file it uses changes. In `package.json` scripts, the `vpx` bin of the `vite-plus` package runs scripts without the global CLI and runs package binaries only from `node_modules/.bin`, pointing to `vp dlx` for anything not installed ([docs](https://viteplus.dev/guide/vpx#running-scripts)) ([#2936](#2936), [#3164](#3164)), by @Brooooooklyn and @fengmk2. - `vp migrate` offers to move tsx scripts to `vpx`: `tsx a.ts`, `npx tsx a.ts`, `node --import tsx a.ts`, and `tsx watch a.ts` in `package.json` scripts, lint-staged tasks, and `#!/usr/bin/env tsx` shebangs become `vpx a.ts` or `vpx --watch a.ts`. A project already on Vite+ gets the offer with `vp migrate --full` ([docs](https://viteplus.dev/guide/migrate-rules#tsx-to-vpx)) ([#3179](#3179)), by @fengmk2. - `vp check --deny-warnings` fails the check on lint warnings, so CI no longer needs a separate `vp lint --deny-warnings` run ([docs](https://viteplus.dev/guide/check#usage)) ([#3075](#3075)), by @acalvino4. - `vp pm team` creates and destroys registry organization teams and adds, removes, and lists their members, through npm or pnpm 11.13.0 and later, falling back to npm for older pnpm and Bun ([#3040](#3040)), by @jong-kyung. - Security: `vp` no longer accepts HTTPS certificates issued through the distrusted emSign intermediates when downloading Node.js, package managers, and upgrades ([RUSTSEC-2026-0382](https://rustsec.org/advisories/RUSTSEC-2026-0382.html), [RUSTSEC-2026-0383](https://rustsec.org/advisories/RUSTSEC-2026-0383.html)), and it ships tokio 1.54.1, which fixes a race in `tokio::time::Interval` ([RUSTSEC-2026-0384](https://rustsec.org/advisories/RUSTSEC-2026-0384)) ([#3159](#3159), [#3202](#3202)), by @wan9chi and @fengmk2. - `vp pm` registry commands (`login`, `logout`, `whoami`, `owner`, `token`, `dist-tag`, `deprecate`, `search`, `ping`, and `publish`) run pnpm's own commands on pnpm 11 and later (`token` from 12.13.0), and `vp pm owner` and `vp pm publish` run Yarn's own commands, so they follow that package manager's registry configuration and authentication. Older versions still go through npm ([#3044](#3044)), by @jong-kyung. - The installer and `vp upgrade` install the global CLI's JavaScript dependencies from a lockfile published with each release, so every installation of a version gets the same dependency versions. Set `VP_SETUP_SKIP_INSTALL_LOCKFILE=1` to resolve them again if that installation fails ([docs](https://viteplus.dev/guide/global-cli#vp-setup-skip-install-lockfile)) ([#3117](#3117)), by @fengmk2. - Upgrade the bundled tools ([#3133](#3133), [#3158](#3158), [#3175](#3175)), by @voidzero-guard[bot] and @fengmk2: - `vite@8.3.4` to `vite@8.3.5`, with fixes for bundled dev mode, chunk import maps, CSS `url()` values containing `%`, and subpath imports with several `#` characters. - `rolldown@1.2.14` to `rolldown@1.2.15`, with fixes for `this.resolve` recursion between plugins using `skipSelf: true`, strict execution order, and chunk import maps. - `oxlint@1.88.0` to `oxlint@1.89.0`, with rule fixes that report cases missed before, for example in `prefer-const`, `no-param-reassign`, and `sort-imports`. - `oxfmt@0.73.0` to `oxfmt@0.74.0`, with formatting fixes for comments, parentheses, JSDoc, JSON, YAML, and Markdown. - The new oxlint and oxfmt versions can flag code that passed before. If your CI runs `vp check`, run `vp fmt` after upgrading. - `vpx` scripts run on `oxc-node@1.0.0`. - `@vitejs/devtools` 0.8 is accepted as a peer dependency, alongside 0.7. ### Fixes & Enhancements - The standalone `vp` executable is 30%+ smaller ([#3086](#3086)), by @fengmk2. - `VP_SETUP_NODE_VERSION` selects the Node.js version the installer uses for the CLI's dependencies, so `setup-vp` can use the project's version and avoid downloading a second Node.js in CI ([docs](https://viteplus.dev/guide/global-cli#vp-setup-node-version)) ([#3087](#3087)), by @fengmk2. - When tasks miss the cache, `vp run` finishes sooner because it no longer waits for the disk after saving each result. If the computer loses power or the operating system crashes during a run, the entries it saved can be lost and those tasks run again ([vite-task#871](voidzero-dev/vite-task#871)), by @magurotuna. - Cached tasks no longer miss the cache when only pnpm's `node_modules/.modules.yaml` differs, for example after installing with another pnpm version, with `--ignore-scripts`, or on glibc and musl machines ([vite-task#850](voidzero-dev/vite-task#850)), by @wan9chi. - `vp run` in a package that sits inside a workspace folder but is not listed in its `pnpm-workspace.yaml` `packages` or `package.json` `workspaces` runs that package's own tasks with its own `packageManager`, instead of treating the enclosing workspace as its root ([vite-task#859](voidzero-dev/vite-task#859)), by @liangmiQwQ. - A mistyped or misplaced task setting fails with an error that names it, such as `unknown field outputs`, instead of `data did not match any variant of untagged enum UserTaskDefinition` ([vite-task#815](voidzero-dev/vite-task#815)), by @tlq5l. - `vp run` no longer panics on scripts that contain non-ASCII characters, such as `echo こんにちは`, and no longer cuts those commands off in its output ([vite-task#861](voidzero-dev/vite-task#861)), by @magurotuna. - In cached tasks on Linux and macOS, programs that pass `-1` as a directory descriptor, such as `ps -p <pid>` from procps-ng 4.0.6 and later, no longer abort ([vite-task#862](voidzero-dev/vite-task#862)), by @magurotuna. - On Linux, cached tasks such as `pnpm dlx` no longer occasionally abort with a stack overflow when the program makes concurrent system calls at startup ([vite-task#854](voidzero-dev/vite-task#854)), by @fengmk2. - On Windows, `vp run` and the global `vpx` wait for the child process to finish its Ctrl+C cleanup and exit with its code, instead of exiting immediately ([#3167](#3167)), by @fengmk2. - `vp migrate` and the `prefer-vite-plus-imports` lint autofix leave `vite/rolldown` and `vite/rolldown/*` imports unchanged, instead of rewriting them to `vite-plus/rolldown` subpaths that `vite-plus` does not export ([#3070](#3070), [#3191](#3191)), by @Crimson341 and @Dunqing. - `vp migrate` keeps existing `.nvmrc` files instead of converting them to `.node-version`, so nvm, fnm, and other tools that read `.nvmrc` keep working and the selected Node.js version does not change ([#3126](#3126)), by @liangmiQwQ. - `vp migrate` converts Oxlint configs that `extends` shared JSON files into TypeScript modules imported through `lint.extends`, so the inherited rules keep applying after migration ([#3097](#3097)), by @fengmk2. - `vp migrate` skips the git hooks prompt when the project's Vite+ hooks are already set up, and completes a partial setup without prompting ([#3118](#3118)), by @0froq. - `vp migrate` keeps the workspace members declared in `package.json` `workspaces` when it selects pnpm for a project without a lockfile, so recursive commands still include them ([#2863](#2863)), by @SaKaNa-Y. - `vp migrate` no longer reports `unawaited-assertion` for a local assertion promise that the function later awaits or returns ([#3180](#3180)), by @fengmk2. - `pnpm create vite-plus` and `yarn create vite-plus` no longer fail during dependency installation when `vp` is not on `PATH`, and no longer run a different global `vp` version for installation, formatting, and hooks ([#3181](#3181)), by @fengmk2. - `vp create` and `vp migrate` resolve the npm registry and credentials as npm does: a `.npmrc` above the project is no longer read, `userconfig` and `globalconfig` are honored, and registry hosts in credential keys match regardless of case ([#3124](#3124)), by @liangmiQwQ. - `vp pack` and `vp create` find the monorepo root the same way as `vp run` and `vp install`, and `vp pack` at a monorepo root without a `vite.config` no longer picks up a config from the directory above ([#3101](#3101)), by @liangmiQwQ. - `defineConfig` keeps plugins that are promises unchanged, so plugins that find themselves through properties on their promise, such as `vike()`, work under Vite+ ([#3154](#3154)), by @liangmiQwQ. - `vp dev` with `experimental.bundledDev` no longer fails with `ERR_MODULE_NOT_FOUND` when no separate `rolldown` package is installed, and no longer picks up the runtime of an unrelated installed `rolldown` ([#3111](#3111)), by @fengmk2. - With `nodeShimMode: system_first`, `vp node` and `vp env exec` run the system tool that the shell would find, instead of downloading and running the managed Node.js ([#3100](#3100)), by @liangmiQwQ. - `VP_NODE_VERSION=22` and other partial versions resolve to an exact release in `vp env install`, `vp env exec`, and `vp env clean`, instead of failing with a 404 download error ([#3038](#3038)), by @Dev-next-gen. - `vp env pin` and `vp env unpin` show the file and field they changed. Package-manager pins from a workspace member update the workspace root `package.json`, and the help and guide now say so ([#3103](#3103)), by @SaKaNa-Y. - In PowerShell, a bare `--` reaches `vp` again, so `vp create vite -- --template react-ts` forwards `--template` to create-vite ([#3083](#3083)), by @fengmk2. - Nushell 0.112.1 and later starts when the user defines a custom command with the same name as a built-in that the Vite+ `env.nu` calls, such as `update`. Run `vp env setup` again to regenerate `env.nu` ([#3123](#3123)), by @naokihaba. - Package-manager commands reject options that the selected version would silently ignore, such as `--dry-run` or `--provenance` with an npm whose version is unknown, instead of running without them ([#3122](#3122)), by @jong-kyung. - Fresh Bun installs verify the integrity hash in a `packageManager` pin and reject a mismatched download, as pnpm 12 and later already did ([#3134](#3134)), by @jong-kyung. - A failed `vp install -g` restores the executables and npm links that existed before, instead of deleting files it never created ([#3119](#3119)), by @jong-kyung. - `vp install -g` skips package binaries with unsafe names or targets instead of linking them, as pnpm does ([#3156](#3156)), by @jong-kyung. - `npm uninstall -g <package> --dry-run` no longer removes the package's commands from Vite+ ([#3112](#3112)), by @jong-kyung. ### Refactor - Replace `glob` with `tinyglobby` in the CLI and share `.nvmrc` line parsing between reading and pinning. Workspace discovery in `vp create` and `vp migrate` now honors negated patterns such as `!packages/foo` and follows symlinked directories in `**` patterns, as pnpm does ([#3099](#3099), [#3125](#3125)), by @liangmiQwQ. - Share clap error diagnostics, manager preference parsing, external tool lookup, and native shell parsing for migration rewrites, and remove a redundant git hooks wrapper ([#3172](#3172), [#3143](#3143), [#3138](#3138), [#3173](#3173)), by @jong-kyung, @myuron, and @fengmk2. ### Docs - Note that `run.cache` can only be set in the workspace root's `vite.config.ts` ([#3139](#3139)), by @yusuke99. ### Chore - Bump vite-task to `a3c087a`; its user-facing changes are listed above ([#3153](#3153), [#3168](#3168), [#3184](#3184)), by @wan9chi. - Run Node.js, runtime download, and package-manager tests against local mirrors and offline fixtures, serve snapshot registry traffic from local fixtures and a shared cache, replace sleeps with deterministic waits, keep snapshot setup off the npm registry, and fix or remove tests that checked nothing ([#3067](#3067), [#3169](#3169), [#3170](#3170), [#3171](#3171), [#3144](#3144), [#3146](#3146), [#3145](#3145), [#3147](#3147), [#3148](#3148), [#3194](#3194), [#3203](#3203)), by @fengmk2 and @liangmiQwQ. - Cover package-manager detection for nested projects and owner listing with pnpm 11.28.7, and allow time for the Playwright type check on slow runners ([#3051](#3051), [#3174](#3174), [#3082](#3082)), by @liangmiQwQ, @jong-kyung, and @fengmk2. - Update the Node.js versions used for development, CI, and release publishing to the [October 2026 security releases](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases): 22.23.4, 24.22.1, and 26.12.1 ([#3186](#3186)), by @fengmk2. - Reduce GitHub Actions cache storage and enable the e18e lint rules for the repository ([#3149](#3149), [#3088](#3088)), by @fengmk2. - Upgrade JavaScript dependencies and Rust crates, including `@ast-grep/napi@0.51.0` and `serial_test@4` ([#3108](#3108), [#3109](#3109)), by @renovate[bot]. - Refine the release-manager and vite-task bump guidance ([#3084](#3084), [#3160](#3160)), by @fengmk2 and @wan9chi. ### Bundled Versions | Tool | Version | Source | Changelog | | --------------- | ---------- | --------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------- | | vite | `8.3.5` | [`981f07f`](vitejs/vite@981f07f) | [8.3.5](https://github.com/vitejs/vite/releases/tag/v8.3.5) | | rolldown | `1.2.15` | [`89d821c`](rolldown/rolldown@89d821c) | [1.2.15](https://github.com/rolldown/rolldown/releases/tag/v1.2.15) | | oxc-node | `1.0.0` | [`4759ced`](oxc-project/oxc-node@4759ced) | [1.0.0](https://github.com/oxc-project/oxc-node/releases/tag/v1.0.0) | | tsdown | `0.23.1` | [npm](https://npmx.dev/package/tsdown/v/0.23.1) | unchanged | | vitest | `5.0.5` | [npm](https://npmx.dev/package/vitest/v/5.0.5) | unchanged | | oxlint | `1.89.0` | [npm](https://npmx.dev/package/oxlint/v/1.89.0) | [1.89.0](https://github.com/oxc-project/oxc/releases/tag/oxlint_v1.89.0) | | oxlint-tsgolint | `7.0.2004` | [npm](https://npmx.dev/package/oxlint-tsgolint/v/7.0.2004) | unchanged | | oxfmt | `0.74.0` | [npm](https://npmx.dev/package/oxfmt/v/0.74.0) | [0.74.0](https://github.com/oxc-project/oxc/releases/tag/oxfmt_v0.74.0) | ### Upgrade ```bash vp upgrade ``` ### New Contributors @acalvino4, @Dev-next-gen, @0froq, @Crimson341, @Dunqing, @magurotuna, @tlq5l **Full Changelog**: v1.3.0...v1.4.0 --- Merging this PR will trigger the release workflow. --------- Co-authored-by: voidzero-guard[bot] <278573678+voidzero-guard[bot]@users.noreply.github.com> Co-authored-by: MK (fengmk2) <fengmk2@gmail.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

SaKaNa-Y added 2 commits October 18, 2026 15:43

test(env): update unified pin output snapshot and guide format

6a93ae9

SaKaNa-Y marked this pull request as ready for review October 19, 2026 07:08

fix(env): show package-manager targets relative to cwd

27ef5d2

Merge branch 'main' into fix/env-pin-scope-output

3c2b030

fengmk2 self-assigned this Oct 20, 2026

fengmk2 approved these changes Oct 20, 2026

View reviewed changes

fengmk2 merged commit 0d8b4a5 into voidzero-dev:main Oct 20, 2026
104 of 106 checks passed

SaKaNa-Y deleted the fix/env-pin-scope-output branch October 21, 2026 02:46

fengmk2 mentioned this pull request Oct 22, 2026

release: v1.4.0 #3201

Merged

BrewTestBot mentioned this pull request Oct 23, 2026

vite-plus 1.4.0 Homebrew/homebrew-core#320609

Open

Navigation Menu

Repository navigation

fix(env): report package manager pin targets and scope - #3103

fix(env): report package manager pin targets and scope#3103
fengmk2 merged 4 commits into
voidzero-dev:mainfrom
SaKaNa-Y:fix/env-pin-scope-output

SaKaNa-Y commented Oct 18, 2026 •

edited

Loading

Uh oh!

SaKaNa-Y commented Oct 19, 2026

Uh oh!

fengmk2 commented Oct 19, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 19, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot commented Oct 19, 2026

Uh oh!

fengmk2 commented Oct 19, 2026

Uh oh!

fengmk2 commented Oct 20, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 20, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

SaKaNa-Y commented Oct 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Evidence

Merge Danger

Uh oh!

SaKaNa-Y commented Oct 19, 2026

Uh oh!

fengmk2 commented Oct 19, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

chatgpt-codex-connector Bot commented Oct 19, 2026

Uh oh!

fengmk2 commented Oct 19, 2026

Uh oh!

fengmk2 commented Oct 20, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 20, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

SaKaNa-Y commented Oct 18, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Oct 19, 2026 •

edited

Loading