fix(cli): warn and suggest --run-scripts for global packages

[liangmiQwQ]

Close #2766

Global installs and updates skip lifecycle scripts by default. --run-scripts enables all scripts, including transitive dependencies, using the selected Node.js runtime and its bundled npm.

When scripts are skipped, a warning after the installation summaries lists the affected packages and gives a reinstall command. The command preserves an explicitly selected Node.js version. Project-install defaults stay unchanged.

🤖 Generated with Codex

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​native-addon@​1.0.0

View full report

[liangmiQwQ]

The reason why I introduce a new --run-scripts instead of --allow-scripts is we must ensure compatibility with different versions of npm, which --allow-scripts is not supported.

[jong-kyung]

💯 All looks good to me

[fengmk2]

For this case, what option does pnpm require to run scripts directly? I’m wondering if we can implement this without adding a new option.

[liangmiQwQ]

For this case, what option does pnpm require to run scripts directly? I’m wondering if we can implement this without adding a new option.

@fengmk2 pnpm / npm 12+ uses --allow-scripts=[...list], this receives a list to control each child dependency. I tried to follow these two existing options but failed, because the current runtime-isolated vp install -g architecture requires us to support different versions of npm, where older npms do not provide that.

[fengmk2]

Let’s hold off on merging this fix for now and revisit the best way to address it after the 1.0 release.