vp install -g silently skips package lifecycle scripts, breaking script-dependent CLIs

[legibet]

Describe the bug

vp install -g does not run package lifecycle scripts. Packages whose bin is produced by postinstall install silently broken: exit 0, the bin shim resolves, the tool errors on first run. There is no warning and no opt-in for global installs.

Reproduced with @opencode/cli 2.0.9 (opencode's v2 docs list a "vite+" install tab claiming no additional flag is needed: anomalyco/opencode#50310):

$ vp --version
vp v0.3.3                 # latest published release
$ vp install -g @opencode/cli
                          # success, no warnings
$ opencode
Error: @opencode/cli's postinstall script was not run.

The installed package keeps a 229-byte placeholder at bin/opencode.exe; the real binary is already present under node_modules/@opencode/cli-darwin-arm64/bin/ — only the postinstall link is missing. Running node postinstall.mjs in the package directory repairs it, until the next vp upgrade re-runs the script-free install. Reproduced twice (fresh install and upgrade).

PR #2336 documents the current state ("vp's own global installs have no scripts", "vp install -g has no --allow-scripts plumbing"), so this reads as a known gap rather than a regression — but I couldn't find an issue tracking the user-visible fallout.

Possible directions: run scripts for global installs (npm parity), or keep skipping them but warn when scripts were skipped and provide an opt-in (--allow-scripts for -g, or a global equivalent of vp pm approve-builds). pnpm's onlyBuiltDependencies plus an install-time warning is a workable precedent for the latter.

Reproduction

No repository — this is global CLI install behavior, reproducible in any directory with the commands below.

Steps to reproduce

1. Install Vite+ 0.3.3 (latest): curl -fsSL https://vite.plus | bash
2. vp install -g @opencode/cli — exits 0, no warnings
3. opencode → Error: @opencode/cli's postinstall script was not run.

System Info

$ vp --version
vp v0.3.3

$ vp env current
Node.js:
  Version    24.21.0
  Source     default
  Bin Path   /Users/legibet/.vite-plus/js_runtime/node/24.21.0/bin/node
  Installed  true
  Mode       managed

Used Package Manager

npm

Logs

No response

Validations

• Read the Contributing Guidelines.
• Check that there isn't already an issue for the same bug.
• Confirm this is a Vite+ issue and not an upstream issue (Vite, Vitest, tsdown, Rolldown, or Oxc).
• The provided reproduction is a minimal reproducible example.

[fengmk2]

Could you provide the vp env doctor information?

[legibet]

Could you provide the vp env doctor information?

$ vp env doctor
VITE+ - The Unified Toolchain for the Web

Installation
  ✓ Bin dir           ~/.vite-plus/bin
  ✓ Data dir          ~/.vite-plus
  ✓ Cache dir         ~/.vite-plus/cache
  ✓ Config dir        ~/.vite-plus
  ✓ State dir         ~/.vite-plus
  ✓ Shims             node, npm, npx, pnpm, pnpx, yarn, yarnpkg, bun, bunx, vpx, vpr

Configuration
  ✓ Node.js           managed mode
  ✓ Package manager   managed mode
  ✓ IDE integration   env sourced in ~/.zshenv

PATH
  ✓ vp                ~/.vite-plus/bin/vp
  ✓ Shim dir          ~/.vite-plus/bin
  ✓ node              ~/.vite-plus/bin/node (vp shim)
  ✓ npm               ~/.vite-plus/bin/npm (vp shim)
  ✓ npx               ~/.vite-plus/bin/npx (vp shim)
  ✓ pnpm              ~/.vite-plus/bin/pnpm (vp shim)
  ✓ pnpx              ~/.vite-plus/bin/pnpx (vp shim)
  ✓ yarn              ~/.vite-plus/bin/yarn (vp shim)
  ✓ yarnpkg           ~/.vite-plus/bin/yarnpkg (vp shim)
  ✓ bun               ~/.vite-plus/bin/bun (vp shim)
  ✓ bunx              ~/.vite-plus/bin/bunx (vp shim)
  ✓ vpx               ~/.vite-plus/bin/vpx (vp shim)
  ✓ vpr               ~/.vite-plus/bin/vpr (vp shim)

Node.js Resolution
    Directory         /Users/legibet/opcode/opencode
    Source            default
    Version           24.21.0
  ✓ Node binary       installed

Package Manager Resolution
    Source            packageManager
    Version           bun@1.4.2
  ✓ PM binaries       installed

✓ All checks passed

The trigger may be the managed npm version. With npm 12.0.2, vp install -g never runs the postinstall: bin/opencode.exe stays the 229-byte stub from the tarball, while the real binary is already in node_modules/@opencode/cli-darwin-arm64/bin/. npm 12 skips install scripts that allowScripts doesn't cover, and #2336 handles that only for project installs, so on -g it fails silently. A plain npm install -g under npm 12 skips the postinstall too, but it prints a warning with the remedy (--allow-scripts=<pkg>). With managed npm 11 the same install works.

[liangmiQwQ]

Hello!

Skipping unapproved lifecycle scripts by default is intentional and follows pnpm 10+ and npm 12, including global installs. I think we should not change this behavior for now.

However, in my opinion, to make the behavior more transparent, a missing warning and an explicit option for global installations could be added.

(Since this is not caused by OpenCode, but Vite+, I suggest closing anomalyco/opencode#50310 to save OpenCode's maintainers some triage time.)

[liangmiQwQ]

as there are some edge cases, I'll handle this soon.