feat(pm): add vp pm approve-builds subcommand (#1662)

## Summary

Adds `vp pm approve-builds` — a unified subcommand for approving
dependency lifecycle scripts (`install`/`postinstall`). Mirrors `pnpm
approve-builds` one-to-one, adapts to `bun pm trust`, and falls back to
informative warn-and-noop on npm/yarn.

**Surface** (intentionally tight, matches pnpm's documented flags):

```bash
vp pm approve-builds                       # interactive (pnpm)
vp pm approve-builds esbuild fsevents      # approve named packages
vp pm approve-builds esbuild !core-js      # pnpm >= 11.0.0 (deny syntax)
vp pm approve-builds --all                 # pnpm >= 10.32.0 / bun
vp pm approve-builds -- <raw args>         # forward to underlying PM
```

## Cross-PM behavior

| PM | Behavior |
|---|---|
| **pnpm** | Pass-through. `--all` gated on `>= 10.32.0`, `!pkg` deny
syntax gated on `>= 11.0.0` (per pnpm PR #11030). Prereleases
(`10.32.0-rc.0`, `11.0.0-beta.1`) satisfy via
`Version::parse("<floor>-0")` comparison. |
| **bun** | `bun pm trust [--all] [pkgs...]`. `!pkg` tokens emit a warn
and are filtered (bun has no denylist model). When only deny tokens are
given, the warn alone is enough — no redundant note. |
| **npm** | Warn + exit 0, pointing at `ignore-scripts=true` in
`.npmrc`. |
| **yarn** | Warn + exit 0. **Yarn 1** (Classic) gets an npm-style hint
(lifecycle scripts run by default); **Yarn Berry** gets
`dependenciesMeta.<pkg>.built: true` advice. Per yarn docs,
`enableScripts` defaults to `false` in Berry. |

## Safety

- **`--all` and positional packages are mutually exclusive** at the clap
layer (`conflicts_with = "packages"`). This prevents a silent override
where `--all !core-js` on bun would warn "Skipping: core-js" then `bun
pm trust --all` everything anyway.
- Version-gate failures render via `Error::UserMessage` (no harsh
`error:` prefix).
- `ApproveBuilds` is **not** in the `needs_project` allowlist, so the
npm/yarn/bun educational messages can fire outside a project directory.

## Files

- **Code**: `crates/vite_install/src/commands/approve_builds.rs` (new),
`crates/vite_install/src/commands/mod.rs` (export),
`crates/vite_pm_cli/src/cli.rs` (variant + parse tests),
`crates/vite_pm_cli/src/handlers.rs` (dispatch + error mapping)
- **RFC**: `rfcs/approve-builds-command.md`
- **Snap tests**:
  - Local: `command-pm-approve-builds-{pnpm10,npm,yarn}/`
  - Global: `command-pm-approve-builds-{bun,pnpm10-old}/` (new)
- Updated: `snap-tests-global/cli-helper-message/snap.txt` (for the new
subcommand entry)

## Test plan

- [x] `cargo test -p vite_install --lib approve_builds` → 23/23
- [x] `cargo test -p vite_pm_cli --lib approve_builds` → 8/8
- [x] `vp check --fix` → 0 warnings/errors
- [x] `pnpm -F vite-plus snap-test-local approve-builds` → 3/3 pass
- [x] `pnpm -F vite-plus snap-test-global approve-builds` → 2/2 pass
- [ ] CI matrix verification

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Low Risk**
> New PM subcommand with pass-through to native tools; npm/yarn are
no-ops and pnpm gates limit misuse. Touches CLI error rendering only for
this path.
> 
> **Overview**
> Introduces **`vp pm approve-builds`** so one CLI can approve
dependency install/postinstall scripts: **pnpm** gets `pnpm
approve-builds` (including `!pkg` on ≥11 and `--all` on ≥10.32.0),
**bun** gets `bun pm trust` with `!pkg` filtered and warned, and
**npm/yarn** print guidance and exit 0 without shelling out.
> 
> The resolver uses **`node-semver`** for pnpm capability checks,
rejects **`--all` plus positional packages** (including via `--`), and
maps version-gate failures to **`UserMessage`** so local and global CLIs
show friendly errors. **`ApproveBuilds`** is wired through
**`vite_pm_cli`** (clap variant, handler, project-scoped PM build) and
the local CLI binding handles **`UserMessage`** like the global CLI.
> 
> Adds an RFC, per-PM **snap tests**, updates **`vp pm -h`**, normalizes
bun banner hashes in snapshots, and drops the `error:` prefix on missing
**`package.json`** messages in one snap fixture.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
7d975a4. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

Author: fengmk2

Cargo.lock

@@ -14,6 +14,7 @@ flate2 = { workspace = true }
 futures-util = { workspace = true }
 hex = { workspace = true }
 indoc = { workspace = true }
+node-semver = { workspace = true }
 pathdiff = { workspace = true }
 semver = { workspace = true }
 serde = { workspace = true, features = ["derive"] }

crates/vite_install/Cargo.toml

@@ -1,4 +1,5 @@
 pub mod add;
+pub mod approve_builds;
 pub mod audit;
 pub mod cache;
 pub mod config;

crates/vite_install/src/commands/approve_builds.rs

@@ -554,6 +554,23 @@ impl PackageManagerCommand {
 /// Package manager subcommands (`vp pm <subcommand>`).
 #[derive(Subcommand, Debug, Clone)]
 pub enum PmCommands {
+    /// Approve dependency lifecycle scripts (install/postinstall) to run
+    #[command(name = "approve-builds")]
+    ApproveBuilds {
+        /// Packages to approve. Prefix with `!` to deny (pnpm >= 11.0.0 only).
+        /// Omit to launch interactive mode (pnpm only).
+        packages: Vec<String>,
+
+        /// Approve every package currently pending approval (pnpm >= 10.32.0).
+        /// Mutually exclusive with positional packages.
+        #[arg(long, conflicts_with = "packages")]
+        all: bool,
+
+        /// Additional arguments to pass through to the package manager
+        #[arg(last = true, allow_hyphen_values = true)]
+        pass_through_args: Option<Vec<String>>,
+    },
+
     /// Remove unnecessary packages
     Prune {
         /// Remove devDependencies
@@ -1182,4 +1199,56 @@ mod tests {
 
         assert_eq!(error.kind(), clap::error::ErrorKind::ValueValidation);
     }
+
+    #[test]
+    fn approve_builds_all_conflicts_with_packages() {
+        let error = parse_pm_command(&["vp", "pm", "approve-builds", "--all", "esbuild"])
+            .expect_err("expected --all + positional to fail");
+
+        assert_eq!(error.kind(), clap::error::ErrorKind::ArgumentConflict);
+    }
+
+    #[test]
+    fn approve_builds_all_conflicts_with_deny_packages() {
+        let error = parse_pm_command(&["vp", "pm", "approve-builds", "--all", "!core-js"])
+            .expect_err("expected --all + !pkg to fail");
+
+        assert_eq!(error.kind(), clap::error::ErrorKind::ArgumentConflict);
+    }
+
+    #[test]
+    fn approve_builds_all_alone_parses() {
+        let command = parse_pm_command(&["vp", "pm", "approve-builds", "--all"])
+            .expect("--all alone should parse");
+
+        assert!(matches!(
+            command,
+            PackageManagerCommand::Pm(PmCommands::ApproveBuilds { all: true, .. })
+        ));
+    }
+
+    #[test]
+    fn approve_builds_packages_alone_parses() {
+        let command = parse_pm_command(&["vp", "pm", "approve-builds", "esbuild", "fsevents"])
+            .expect("positional packages should parse");
+
+        assert!(matches!(
+            command,
+            PackageManagerCommand::Pm(PmCommands::ApproveBuilds { all: false, .. })
+        ));
+    }
+
+    #[test]
+    fn approve_builds_pass_through_args_capture() {
+        let command =
+            parse_pm_command(&["vp", "pm", "approve-builds", "esbuild", "--", "--workspace-root"])
+                .expect("pass-through args should parse");
+
+        let PackageManagerCommand::Pm(PmCommands::ApproveBuilds { pass_through_args, .. }) =
+            command
+        else {
+            panic!("expected ApproveBuilds variant");
+        };
+        assert_eq!(pass_through_args, Some(vec!["--workspace-root".to_string()]));
+    }
 }

crates/vite_install/src/commands/mod.rs

@@ -8,6 +8,7 @@ use vite_install::{
     PackageManager,
     commands::{
         add::AddCommandOptions,
+        approve_builds::ApproveBuildsCommandOptions,
         audit::AuditCommandOptions,
         cache::CacheCommandOptions,
         config::ConfigCommandOptions,
@@ -178,7 +179,8 @@ pub async fn run_pm_subcommand(
 ) -> Result<ExitStatus, Error> {
     let needs_project = matches!(
         command,
-        PmCommands::Prune { .. }
+        PmCommands::ApproveBuilds { .. }
+            | PmCommands::Prune { .. }
             | PmCommands::Pack { .. }
             | PmCommands::List { .. }
             | PmCommands::Publish { .. }
@@ -194,6 +196,21 @@ pub async fn run_pm_subcommand(
     };
 
     match command {
+        PmCommands::ApproveBuilds { packages, all, pass_through_args } => {
+            let options = ApproveBuildsCommandOptions {
+                packages: &packages,
+                all,
+                pass_through_args: pass_through_args.as_deref(),
+            };
+            // Map `Error::InvalidArgument` from the resolver to `UserMessage`
+            // so the version-gate failure renders without the harsh `error:` prefix.
+            match pm.run_approve_builds_command(&options, cwd).await {
+                Ok(status) => Ok(status),
+                Err(vite_error::Error::InvalidArgument(msg)) => Err(Error::UserMessage(msg)),
+                Err(other) => Err(Error::Install(other)),
+            }
+        }
+
         PmCommands::Prune { prod, no_optional, pass_through_args } => {
             let options = PruneCommandOptions {
                 prod,

crates/vite_pm_cli/src/cli.rs

@@ -208,9 +208,17 @@ async fn execute_pm_command(
             "Global package operations (`-g`/`--global`) are only supported by the globally-installed `vp` CLI. See https://viteplus.dev/guide/ to install it, then run the same command via the global `vp` binary.",
         )));
     }
-    let status = vite_pm_cli::dispatch(cwd, command)
-        .await
-        .map_err(|e| Error::Anyhow(anyhow::Error::new(e)))?;
+    let status = match vite_pm_cli::dispatch(cwd, command).await {
+        Ok(status) => status,
+        // Render `UserMessage` cleanly (no `error:` prefix) and exit non-zero —
+        // matches the global CLI's `is_user_message()` branch in main.rs so the
+        // friendly version-gate / usage errors look the same on both surfaces.
+        Err(vite_pm_cli::Error::UserMessage(msg)) => {
+            vite_shared::output::raw_stderr(&msg);
+            return Ok(ExitStatus(1));
+        }
+        Err(e) => return Err(Error::Anyhow(anyhow::Error::new(e))),
+    };
     Ok(ExitStatus(status.code().unwrap_or(1) as u8))
 }
 

crates/vite_pm_cli/src/handlers.rs

@@ -313,25 +313,26 @@ Usage: vp pm <COMMAND>
 Forward a command to the package manager
 
 Commands:
-  prune      Remove unnecessary packages
-  pack       Create a tarball of the package
-  list       List installed packages [aliases: ls]
-  view       View package information from the registry [aliases: info, show]
-  publish    Publish package to registry
-  owner      Manage package owners [aliases: author]
-  cache      Manage package cache
-  config     Manage package manager configuration [aliases: c]
-  login      Log in to a registry [aliases: adduser]
-  logout     Log out from a registry
-  whoami     Show the current logged-in user
-  token      Manage authentication tokens
-  audit      Run a security audit
-  dist-tag   Manage distribution tags
-  deprecate  Deprecate a package version
-  search     Search for packages in the registry
-  rebuild    Rebuild native modules [aliases: rb]
-  fund       Show funding information for installed packages
-  ping       Ping the registry
+  approve-builds  Approve dependency lifecycle scripts (install/postinstall) to run
+  prune           Remove unnecessary packages
+  pack            Create a tarball of the package
+  list            List installed packages [aliases: ls]
+  view            View package information from the registry [aliases: info, show]
+  publish         Publish package to registry
+  owner           Manage package owners [aliases: author]
+  cache           Manage package cache
+  config          Manage package manager configuration [aliases: c]
+  login           Log in to a registry [aliases: adduser]
+  logout          Log out from a registry
+  whoami          Show the current logged-in user
+  token           Manage authentication tokens
+  audit           Run a security audit
+  dist-tag        Manage distribution tags
+  deprecate       Deprecate a package version
+  search          Search for packages in the registry
+  rebuild         Rebuild native modules [aliases: rb]
+  fund            Show funding information for installed packages
+  ping            Ping the registry
 
 Options:
   -h, --help  Print help

packages/cli/binding/src/cli/mod.rs

@@ -36,7 +36,7 @@ Usage: vp add <PACKAGES>... [-- <PASS_THROUGH_ARGS>...]
 For more information, try '--help'.
 
 > vp add testnpm2 -D && cat package.json # should add package as dev dependencies
-bun add v<semver> (af24e281)
+bun add v<semver> (<hash>)
 
 installed testnpm2@<semver>
 
@@ -51,7 +51,7 @@ installed testnpm2@<semver>
 }
 
 > vp add testnpm2 test-vite-plus-install && cat package.json # should add packages to dependencies
-bun add v<semver> (af24e281)
+bun add v<semver> (<hash>)
 
 installed testnpm2@<semver>
 installed test-vite-plus-install@<semver>
@@ -70,7 +70,7 @@ installed test-vite-plus-install@<semver>
 }
 
 > vp install test-vite-plus-package@1.0.0 --save-peer && cat package.json # should install package alias for add
-bun add v<semver> (af24e281)
+bun add v<semver> (<hash>)
 
 installed test-vite-plus-package@<semver>
 
@@ -91,7 +91,7 @@ installed test-vite-plus-package@<semver>
 }
 
 > vp add test-vite-plus-package-optional -O && cat package.json # should add package as optional dependencies
-bun add v<semver> (af24e281)
+bun add v<semver> (<hash>)
 
 installed test-vite-plus-package-optional@<semver>
 

packages/cli/snap-tests-global/cli-helper-message/snap.txt

@@ -1,5 +1,5 @@
 > vp install # should install packages first
-bun install v<semver> (af24e281)
+bun install v<semver> (<hash>)
 
 + test-vite-plus-package@<semver>
 + test-vite-plus-package-optional@<semver>