fix(cli): warn and suggest --run-scripts for global packages

crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/cli_helper_message/snapshots/cli_helper_message.md

@@ -130,6 +130,7 @@ Options:
   -g, --global                 Install globally (requires package names)
   --node <NODE>                Node.js version to use for global installation (only with -g)
   --concurrency <CONCURRENCY>  Number of global package installs to run in parallel (only with -g)
+  --run-scripts                Run all lifecycle scripts (only with -g)
   -h, --help                   Print help
 
 Documentation: https://viteplus.dev/guide/install
@@ -176,6 +177,7 @@ Options:
   -g, --global                        Install globally
   --node <NODE>                       Node.js version to use for global installation (only with -g)
   --concurrency <CONCURRENCY>         Number of global package installs to run in parallel (only with -g)
+  --run-scripts                       Run all lifecycle scripts (only with -g)
   -h, --help                          Print help
 
 Documentation: https://viteplus.dev/guide/install
@@ -228,6 +230,7 @@ Arguments:
 Options:
   -L, --latest                 Update to latest version (ignore semver range)
   -g, --global                 Update global packages
+  --run-scripts                Run all lifecycle scripts (only with -g)
   --concurrency <CONCURRENCY>  Number of global package updates to run in parallel (only with -g)
   --reinstall-node-mismatch    Reinstall up-to-date global packages installed with a different Node.js version
   --ignore-node-mismatch       Skip up-to-date global packages installed with a different Node.js version

crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/command_add_bun/snapshots/command_add_bun.md

@@ -41,6 +41,7 @@ Options:
   -g, --global                        Install globally
   --node <NODE>                       Node.js version to use for global installation (only with -g)
   --concurrency <CONCURRENCY>         Number of global package installs to run in parallel (only with -g)
+  --run-scripts                       Run all lifecycle scripts (only with -g)
   -h, --help                          Print help
 
 Documentation: https://viteplus.dev/guide/install

crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/command_add_npm10/snapshots/command_add_npm10.md

@@ -41,6 +41,7 @@ Options:
   -g, --global                        Install globally
   --node <NODE>                       Node.js version to use for global installation (only with -g)
   --concurrency <CONCURRENCY>         Number of global package installs to run in parallel (only with -g)
+  --run-scripts                       Run all lifecycle scripts (only with -g)
   -h, --help                          Print help
 
 Documentation: https://viteplus.dev/guide/install

crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/command_add_npm11/snapshots/command_add_npm11.md

@@ -41,6 +41,7 @@ Options:
   -g, --global                        Install globally
   --node <NODE>                       Node.js version to use for global installation (only with -g)
   --concurrency <CONCURRENCY>         Number of global package installs to run in parallel (only with -g)
+  --run-scripts                       Run all lifecycle scripts (only with -g)
   -h, --help                          Print help
 
 Documentation: https://viteplus.dev/guide/install

crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/command_add_pnpm10/snapshots/command_add_pnpm10.global.md

@@ -41,6 +41,7 @@ Options:
   -g, --global                        Install globally
   --node <NODE>                       Node.js version to use for global installation (only with -g)
   --concurrency <CONCURRENCY>         Number of global package installs to run in parallel (only with -g)
+  --run-scripts                       Run all lifecycle scripts (only with -g)
   -h, --help                          Print help
 
 Documentation: https://viteplus.dev/guide/install

crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/command_add_pnpm10/snapshots/command_add_pnpm10.local.md

@@ -64,6 +64,8 @@ Options:
           Node.js version to use for global installation (only with -g)
       --concurrency <CONCURRENCY>
           Number of global package installs to run in parallel (only with -g)
+      --run-scripts
+          Run all lifecycle scripts (only with -g)
   -h, --help
           Print help
 ```

crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/command_add_pnpm11/snapshots/command_add_pnpm11.md

@@ -41,6 +41,7 @@ Options:
   -g, --global                        Install globally
   --node <NODE>                       Node.js version to use for global installation (only with -g)
   --concurrency <CONCURRENCY>         Number of global package installs to run in parallel (only with -g)
+  --run-scripts                       Run all lifecycle scripts (only with -g)
   -h, --help                          Print help
 
 Documentation: https://viteplus.dev/guide/install

crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/command_add_pnpm12/snapshots/command_add_pnpm12.md

@@ -41,6 +41,7 @@ Options:
   -g, --global                        Install globally
   --node <NODE>                       Node.js version to use for global installation (only with -g)
   --concurrency <CONCURRENCY>         Number of global package installs to run in parallel (only with -g)
+  --run-scripts                       Run all lifecycle scripts (only with -g)
   -h, --help                          Print help
 
 Documentation: https://viteplus.dev/guide/install

crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/command_add_pnpm9/snapshots/command_add_pnpm9.md

@@ -41,6 +41,7 @@ Options:
   -g, --global                        Install globally
   --node <NODE>                       Node.js version to use for global installation (only with -g)
   --concurrency <CONCURRENCY>         Number of global package installs to run in parallel (only with -g)
+  --run-scripts                       Run all lifecycle scripts (only with -g)
   -h, --help                          Print help
 
 Documentation: https://viteplus.dev/guide/install

crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/command_add_yarn4/snapshots/command_add_yarn4.md

@@ -41,6 +41,7 @@ Options:
   -g, --global                        Install globally
   --node <NODE>                       Node.js version to use for global installation (only with -g)
   --concurrency <CONCURRENCY>         Number of global package installs to run in parallel (only with -g)
+  --run-scripts                       Run all lifecycle scripts (only with -g)
   -h, --help                          Print help
 
 Documentation: https://viteplus.dev/guide/install

crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/command_update_bun/snapshots/command_update_bun.md

@@ -18,6 +18,7 @@ Arguments:
 Options:
   -L, --latest                 Update to latest version (ignore semver range)
   -g, --global                 Update global packages
+  --run-scripts                Run all lifecycle scripts (only with -g)
   --concurrency <CONCURRENCY>  Number of global package updates to run in parallel (only with -g)
   --reinstall-node-mismatch    Reinstall up-to-date global packages installed with a different Node.js version
   --ignore-node-mismatch       Skip up-to-date global packages installed with a different Node.js version

crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/command_update_pnpm10/snapshots/command_update_pnpm10.global.md

@@ -18,6 +18,7 @@ Arguments:
 Options:
   -L, --latest                 Update to latest version (ignore semver range)
   -g, --global                 Update global packages
+  --run-scripts                Run all lifecycle scripts (only with -g)
   --concurrency <CONCURRENCY>  Number of global package updates to run in parallel (only with -g)
   --reinstall-node-mismatch    Reinstall up-to-date global packages installed with a different Node.js version
   --ignore-node-mismatch       Skip up-to-date global packages installed with a different Node.js version

crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/command_update_pnpm10/snapshots/command_update_pnpm10.local.md

@@ -16,6 +16,7 @@ Arguments:
 Options:
   -L, --latest                     Update to latest version (ignore semver range)
   -g, --global                     Update global packages
+      --run-scripts                Run all lifecycle scripts (only with -g)
       --concurrency <CONCURRENCY>  Number of global package updates to run in parallel (only with -g)
       --reinstall-node-mismatch    Reinstall up-to-date global packages installed with a different Node.js version
       --ignore-node-mismatch       Skip up-to-date global packages installed with a different Node.js version

crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/command_update_pnpm11/snapshots/command_update_pnpm11.md

@@ -18,6 +18,7 @@ Arguments:
 Options:
   -L, --latest                 Update to latest version (ignore semver range)
   -g, --global                 Update global packages
+  --run-scripts                Run all lifecycle scripts (only with -g)
   --concurrency <CONCURRENCY>  Number of global package updates to run in parallel (only with -g)
   --reinstall-node-mismatch    Reinstall up-to-date global packages installed with a different Node.js version
   --ignore-node-mismatch       Skip up-to-date global packages installed with a different Node.js version

crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/env_install_interrupt/snapshots.toml

@@ -2,7 +2,7 @@
 name = "env_install_interrupt"
 vp = "global"
 steps = [
-  { argv = ["vp", "install", "-g", "./long-time-install-package"], continue-on-failure = true },
+  { argv = ["vp", "install", "-g", "./long-time-install-package", "--run-scripts"], continue-on-failure = true },
   { argv = ["long-time-install-package"], continue-on-failure = true },
   # snapshot = false: the killed install's partial screen is timing-dependent
   # (which spinner frame was live when the process tree was terminated). ConPTY
@@ -11,7 +11,7 @@ steps = [
   { argv = ["node", "test-reinstall-interrupt.js"], comment = "Reinstall but interrupt", snapshot = false, continue-on-failure = true },
   { argv = ["long-time-install-package"], comment = "Original package should be still runnable", continue-on-failure = true },
   { argv = ["node", "check-stale-packages.js", "--expect-stale"], comment = "Interrupted reinstall should leave stale package", continue-on-failure = true },
-  { argv = ["vp", "install", "-g", "./long-time-install-package"], comment = "Successful reinstall should clean stale packages", continue-on-failure = true },
+  { argv = ["vp", "install", "-g", "./long-time-install-package", "--run-scripts"], comment = "Successful reinstall should clean stale packages", continue-on-failure = true },
   { argv = ["node", "check-stale-packages.js"], continue-on-failure = true },
 ]
 after = [

crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/env_install_interrupt/snapshots/env_install_interrupt.md

@@ -1,6 +1,6 @@
 # env_install_interrupt
 
-## `vp install -g ./long-time-install-package`
+## `vp install -g ./long-time-install-package --run-scripts`
 
 ```
 VITE+ - The Unified Toolchain for the Web
@@ -37,7 +37,7 @@ Interrupted reinstall should leave stale package
 interrupted stale package exists
 ```
 
-## `vp install -g ./long-time-install-package`
+## `vp install -g ./long-time-install-package --run-scripts`
 
 Successful reinstall should clean stale packages
 

crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/env_install_interrupt/test-reinstall-interrupt.js

@@ -25,7 +25,7 @@ const vpBinary = path.join(
   'bin',
   process.platform === 'win32' ? 'vp.exe' : 'vp',
 );
-const child = spawn(vpBinary, ['install', '-g', './long-time-install-package'], {
+const child = spawn(vpBinary, ['install', '-g', './long-time-install-package', '--run-scripts'], {
   env: { ...process.env, VP_TEST_INTERRUPT_INSTALL: '1' },
   stdio: 'inherit',
 });

crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/global_install_scripts/.node-version

@@ -0,0 +1 @@
+22.23.2

crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/global_install_scripts/local-cli/cli.cjs

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+console.log('local-cli works');

crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/global_install_scripts/local-cli/package.json

@@ -0,0 +1,10 @@
+{
+  "name": "local-cli",
+  "version": "1.0.0",
+  "bin": {
+    "local-cli": "cli.cjs"
+  },
+  "scripts": {
+    "postinstall": "node -e \"require('node:fs').writeFileSync('postinstall-ran', '')\""
+  }
+}

crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/global_install_scripts/mock-manifest.json

@@ -0,0 +1,60 @@
+{
+  "my-cli": {
+    "name": "my-cli",
+    "dist-tags": {
+      "latest": "2.0.0"
+    },
+    "versions": {
+      "1.0.0": {
+        "name": "my-cli",
+        "version": "1.0.0",
+        "bin": {
+          "my-cli": "check.cjs"
+        },
+        "scripts": {
+          "postinstall": "node -e \"require('node:fs').writeFileSync('postinstall-ran', process.version)\""
+        },
+        "dependencies": {
+          "native-addon": "1.0.0"
+        },
+        "dist": {
+          "tarball": "{REGISTRY}/my-cli/-/my-cli-1.0.0.tgz"
+        }
+      },
+      "2.0.0": {
+        "name": "my-cli",
+        "version": "2.0.0",
+        "bin": {
+          "my-cli": "check.cjs"
+        },
+        "scripts": {
+          "postinstall": "node -e \"require('node:fs').writeFileSync('postinstall-ran', process.version)\""
+        },
+        "dependencies": {
+          "native-addon": "1.0.0"
+        },
+        "dist": {
+          "tarball": "{REGISTRY}/my-cli/-/my-cli-2.0.0.tgz"
+        }
+      }
+    }
+  },
+  "native-addon": {
+    "name": "native-addon",
+    "dist-tags": {
+      "latest": "1.0.0"
+    },
+    "versions": {
+      "1.0.0": {
+        "name": "native-addon",
+        "version": "1.0.0",
+        "scripts": {
+          "postinstall": "node -e \"require('node:fs').writeFileSync('postinstall-ran', process.version)\""
+        },
+        "dist": {
+          "tarball": "{REGISTRY}/native-addon/-/native-addon-1.0.0.tgz"
+        }
+      }
+    }
+  }
+}

crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/global_install_scripts/my-cli/check.cjs

@@ -0,0 +1,13 @@
+#!/usr/bin/env node
+const assert = require('node:assert/strict');
+const { existsSync, readFileSync } = require('node:fs');
+const { dirname, join } = require('node:path');
+
+// Exercise the installed CLI, including a transitive package's build output.
+const parent = existsSync(join(__dirname, 'postinstall-ran')) ? 'ran' : 'skipped';
+const child = existsSync(join(dirname(require.resolve('native-addon/package.json')), 'postinstall-ran')) ? 'ran' : 'skipped';
+assert.equal(parent, process.argv[2]);
+assert.equal(child, process.argv[3]);
+if (parent === 'ran') assert.equal(readFileSync(join(__dirname, 'postinstall-ran'), 'utf8'), process.version);
+if (child === 'ran') assert.equal(readFileSync(join(dirname(require.resolve('native-addon/package.json')), 'postinstall-ran'), 'utf8'), process.version);
+console.log(`my-cli: ${parent}; native-addon: ${child}`);

crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/global_install_scripts/my-cli/package.json

@@ -0,0 +1,13 @@
+{
+  "name": "my-cli",
+  "version": "1.0.0",
+  "bin": {
+    "my-cli": "check.cjs"
+  },
+  "scripts": {
+    "postinstall": "node -e \"require('node:fs').writeFileSync('postinstall-ran', process.version)\""
+  },
+  "dependencies": {
+    "native-addon": "1.0.0"
+  }
+}

crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/global_install_scripts/native-addon/package.json

@@ -0,0 +1,7 @@
+{
+  "name": "native-addon",
+  "version": "1.0.0",
+  "scripts": {
+    "postinstall": "node -e \"require('node:fs').writeFileSync('postinstall-ran', process.version)\""
+  }
+}

crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/global_install_scripts/package.json

@@ -0,0 +1,5 @@
+{
+  "name": "global-install-scripts",
+  "private": true,
+  "packageManager": "npm@12.0.2"
+}

crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/global_install_scripts/setup-npm.cjs

@@ -0,0 +1,11 @@
+const assert = require('node:assert/strict');
+const { spawnSync } = require('node:child_process');
+const { dirname, join, relative } = require('node:path');
+
+// Replace npm only inside this unseeded case's runtime, using the same Node.js.
+const prefix = process.platform === 'win32' ? dirname(process.execPath) : dirname(dirname(process.execPath));
+assert.ok(!relative(process.env.VP_HOME, prefix).startsWith('..'));
+const npm = join(prefix, process.platform === 'win32' ? 'node_modules/npm' : 'lib/node_modules/npm');
+const result = spawnSync(process.execPath, [join(npm, 'bin/npm-cli.js'), 'install', '-g', 'npm@12.0.2', '--prefix', prefix, '--ignore-scripts'], { stdio: 'inherit' });
+assert.equal(result.status, 0);
+assert.equal(require(join(npm, 'package.json')).version, '12.0.2');

crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/global_install_scripts/snapshots.toml

@@ -0,0 +1,57 @@
+[[case]]
+name = "global_scripts_dangling_dependency"
+vp = "global"
+comment = "A dangling dependency link in a local package must not prevent global installation or skipped-script warnings."
+steps = [
+  { argv = ["vpt", "mkdir", "-p", "local-cli/node_modules"], snapshot = false },
+  { argv = ["node", "-e", "require('node:fs').symlinkSync(require('node:path').resolve('removed-package'), 'local-cli/node_modules/unused-link', process.platform === 'win32' ? 'junction' : 'dir')"], snapshot = false },
+  ["vp", "install", "-g", "./local-cli"],
+  ["local-cli"],
+  ["vpt", "stat-file", "local-cli/postinstall-ran", "--assert", "missing"],
+]
+
+[[case]]
+name = "global_scripts_default_and_enable"
+vp = "global"
+local-registry = true
+comment = "Global installs and updates skip direct and transitive scripts by default and warn last. --run-scripts runs all scripts with the selected Node.js, including Node 20."
+env = { npm_config_ignore_scripts = "false", npm_config_dangerously_allow_all_scripts = "true", npm_config_audit = "false", npm_config_fund = "false" }
+steps = [
+  { argv = ["vpt", "mkdir", "-p", "tarballs"], snapshot = false },
+  { argv = ["npm", "pack", "./native-addon", "--ignore-scripts", "--pack-destination", "tarballs"], snapshot = false },
+  { argv = ["npm", "pack", "./my-cli", "--ignore-scripts", "--pack-destination", "tarballs"], snapshot = false },
+  { argv = ["vpt", "json-edit", "my-cli/package.json", "version", "2.0.0"], snapshot = false },
+  { argv = ["npm", "pack", "./my-cli", "--ignore-scripts", "--pack-destination", "tarballs"], snapshot = false },
+  ["vp", "install", "-g", "my-cli@1.0.0", "native-addon@1.0.0"],
+  ["my-cli", "skipped", "skipped"],
+  { argv = ["vp", "install", "-g", "my-cli@1.0.0", "--run-scripts"], envs = [["npm_config_ignore_scripts", "true"], ["npm_config_dangerously_allow_all_scripts", "false"]] },
+  ["my-cli", "ran", "ran"],
+  { argv = ["vp", "env", "install", "node@20.19.6"], snapshot = false },
+  ["vp", "add", "-g", "my-cli@1.0.0", "--node", "20.19.6", "--ignore-scripts"],
+  ["my-cli", "skipped", "skipped"],
+  ["vp", "add", "-g", "my-cli@1.0.0", "--node", "20.19.6", "--run-scripts"],
+  ["my-cli", "ran", "ran"],
+  ["vp", "update", "-g", "my-cli@2.0.0"],
+  ["my-cli", "skipped", "skipped"],
+  ["vp", "update", "-g", "my-cli@1.0.0", "--run-scripts"],
+  ["my-cli", "ran", "ran"],
+]
+
+[[case]]
+name = "global_scripts_npm12"
+vp = "global"
+seed-runtime = false
+local-registry = true
+comment = "A case-owned Node runtime with bundled npm 12 still runs all scripts only when explicitly enabled, without changing Node.js."
+env = { npm_config_ignore_scripts = "true", npm_config_dangerously_allow_all_scripts = "false", npm_config_audit = "false", npm_config_fund = "false" }
+steps = [
+  { argv = ["node", "setup-npm.cjs"], snapshot = false, timeout = 120000 },
+  ["node", "-p", "require(require('node:path').join(require('node:path').dirname(process.execPath), process.platform === 'win32' ? 'node_modules/npm/package.json' : '../lib/node_modules/npm/package.json')).version"],
+  { argv = ["vpt", "mkdir", "-p", "tarballs"], snapshot = false },
+  { argv = ["npm", "pack", "./native-addon", "--ignore-scripts", "--pack-destination", "tarballs"], snapshot = false },
+  { argv = ["npm", "pack", "./my-cli", "--ignore-scripts", "--pack-destination", "tarballs"], snapshot = false },
+  ["vp", "install", "-g", "my-cli@1.0.0"],
+  ["my-cli", "skipped", "skipped"],
+  ["vp", "install", "-g", "my-cli@1.0.0", "--run-scripts"],
+  ["my-cli", "ran", "ran"],
+]

crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/global_install_scripts/snapshots/global_scripts_dangling_dependency.md

@@ -0,0 +1,34 @@
+# global_scripts_dangling_dependency
+
+A dangling dependency link in a local package must not prevent global installation or skipped-script warnings.
+
+## `vpt mkdir -p local-cli/node_modules`
+
+
+## `node -e 'require('\''node:fs'\'').symlinkSync(require('\''node:path'\'').resolve('\''removed-package'\''), '\''local-cli/node_modules/unused-link'\'', process.platform === '\''win32'\'' ? '\''junction'\'' : '\''dir'\'')'`
+
+
+## `vp install -g ./local-cli`
+
+```
+VITE+ - The Unified Toolchain for the Web
+
+info: Installing 1 global package with Node.js <version>
+✓ Installed local-cli 1.0.0
+  Bins: local-cli
+warning: Lifecycle scripts were skipped for: local-cli.
+To allow them, reinstall with:
+  vp install -g ./local-cli --run-scripts
+```
+
+## `local-cli`
+
+```
+local-cli works
+```
+
+## `vpt stat-file local-cli/postinstall-ran --assert missing`
+
+```
+local-cli/postinstall-ran: missing
+```