refactor: restructure VERSION_DIR to install vite-plus as npm dependency

Instead of extracting vite-plus internals (dist/, binding/, templates/,
rules/, package.json) directly into ~/.vite-plus/VERSION/, generate a
wrapper package.json that declares vite-plus as a dependency and let npm
install it into node_modules/. This decouples the vp binary from
vite-plus's internal file layout.

New structure: VERSION_DIR/{bin/vp, package.json, node_modules/vite-plus/}

- Update js_executor.rs to resolve scripts from node_modules/vite-plus/dist
- Remove extract_main_package, strip_dev_dependencies, MAIN_PACKAGE_ENTRIES
- Add generate_wrapper_package_json to upgrade/install.rs
- Remove main tarball download from upgrade flow (npm handles it)
- Remove .node file extraction (npm installs via optionalDeps)
- Simplify install.sh and install.ps1 to only extract binary + generate wrapper
- Rewrite setupLocalDevDeps to symlink packages/cli as node_modules/vite-plus
- Rewrite installCiDeps to generate wrapper with file: protocol refs
- Update CI get_cli_version to read from node_modules/vite-plus/package.json

Author: fengmk2

.github/workflows/ci.yml

@@ -361,7 +361,7 @@ jobs:
         run: |
           # Helper to read the installed CLI version from package.json
           get_cli_version() {
-            node -p "require(require('path').resolve(process.env.USERPROFILE || process.env.HOME, '.vite-plus', 'current', 'package.json')).version"
+            node -p "require(require('path').resolve(process.env.USERPROFILE || process.env.HOME, '.vite-plus', 'current', 'node_modules', 'vite-plus', 'package.json')).version"
           }
 
           # Save initial (dev build) version
@@ -407,7 +407,7 @@ jobs:
 
           # Helper to read the installed CLI version from package.json
           function Get-CliVersion {
-            node -p "require(require('path').resolve(process.env.USERPROFILE, '.vite-plus', 'current', 'package.json')).version"
+            node -p "require(require('path').resolve(process.env.USERPROFILE, '.vite-plus', 'current', 'node_modules', 'vite-plus', 'package.json')).version"
           }
 
           # Save initial (dev build) version
@@ -450,7 +450,7 @@ jobs:
         shell: cmd
         run: |
           REM Save initial (dev build) version
-          for /f "usebackq delims=" %%v in (`node -p "require(require('path').resolve(process.env.USERPROFILE, '.vite-plus', 'current', 'package.json')).version"`) do set INITIAL_VERSION=%%v
+          for /f "usebackq delims=" %%v in (`node -p "require(require('path').resolve(process.env.USERPROFILE, '.vite-plus', 'current', 'node_modules', 'vite-plus', 'package.json')).version"`) do set INITIAL_VERSION=%%v
           echo Initial version: %INITIAL_VERSION%
 
           REM --check queries npm registry and prints update status
@@ -464,7 +464,7 @@ jobs:
           dir "%USERPROFILE%\.vite-plus\"
 
           REM Verify version changed after update
-          for /f "usebackq delims=" %%v in (`node -p "require(require('path').resolve(process.env.USERPROFILE, '.vite-plus', 'current', 'package.json')).version"`) do set UPDATED_VERSION=%%v
+          for /f "usebackq delims=" %%v in (`node -p "require(require('path').resolve(process.env.USERPROFILE, '.vite-plus', 'current', 'node_modules', 'vite-plus', 'package.json')).version"`) do set UPDATED_VERSION=%%v
           echo Updated version: %UPDATED_VERSION%
           if "%UPDATED_VERSION%"=="%INITIAL_VERSION%" (
             echo Error: version should have changed after upgrade, still %INITIAL_VERSION%
@@ -477,7 +477,7 @@ jobs:
           vp env doctor
 
           REM Verify version restored after rollback
-          for /f "usebackq delims=" %%v in (`node -p "require(require('path').resolve(process.env.USERPROFILE, '.vite-plus', 'current', 'package.json')).version"`) do set ROLLBACK_VERSION=%%v
+          for /f "usebackq delims=" %%v in (`node -p "require(require('path').resolve(process.env.USERPROFILE, '.vite-plus', 'current', 'node_modules', 'vite-plus', 'package.json')).version"`) do set ROLLBACK_VERSION=%%v
           echo Rollback version: %ROLLBACK_VERSION%
           if not "%ROLLBACK_VERSION%"=="%INITIAL_VERSION%" (
             echo Error: version should have been restored after rollback, expected %INITIAL_VERSION%, got %ROLLBACK_VERSION%

crates/vite_global_cli/src/commands/upgrade/install.rs

@@ -26,27 +26,22 @@ fn is_safe_tar_path(path: &Path) -> bool {
         && !path.components().any(|c| matches!(c, std::path::Component::ParentDir))
 }
 
-/// Files/directories to extract from the main package tarball.
-const MAIN_PACKAGE_ENTRIES: &[&str] =
-    &["binding/", "dist/", "templates/", "rules/", "AGENTS.md", "package.json"];
-
-/// Extract the platform-specific package (binary + .node files).
+/// Extract the platform-specific package (binary only).
 ///
 /// From the platform tarball, extracts:
 /// - The `vp` binary → `{version_dir}/bin/vp`
-/// - Any `.node` files → `{version_dir}/binding/`
+///
+/// `.node` files are no longer extracted here — npm installs them
+/// via the platform package's optionalDependencies.
 pub async fn extract_platform_package(
     tgz_data: &[u8],
     version_dir: &AbsolutePath,
 ) -> Result<(), Error> {
     let bin_dir = version_dir.join("bin");
-    let binding_dir = version_dir.join("binding");
     tokio::fs::create_dir_all(&bin_dir).await?;
-    tokio::fs::create_dir_all(&binding_dir).await?;
 
     let data = tgz_data.to_vec();
     let bin_dir_clone = bin_dir.clone();
-    let binding_dir_clone = binding_dir.clone();
 
     tokio::task::spawn_blocking(move || {
         let cursor = Cursor::new(data);
@@ -80,12 +75,6 @@ pub async fn extract_platform_package(
                     use std::os::unix::fs::PermissionsExt;
                     std::fs::set_permissions(&target, std::fs::Permissions::from_mode(0o755))?;
                 }
-            } else if file_name.ends_with(".node") {
-                // .node NAPI files go to binding/ (alongside index.cjs loader)
-                let target = binding_dir_clone.join(file_name);
-                let mut buf = Vec::new();
-                entry.read_to_end(&mut buf)?;
-                std::fs::write(&target, &buf)?;
             }
         }
 
@@ -97,92 +86,24 @@ pub async fn extract_platform_package(
     Ok(())
 }
 
-/// Extract the main package (JS bundles, templates, rules, package.json).
+/// Generate a wrapper `package.json` that declares `vite-plus` as a dependency.
 ///
-/// Copies specific directories and files from the tarball to the version directory.
-pub async fn extract_main_package(
-    tgz_data: &[u8],
+/// This replaces the old approach of extracting the main package tarball.
+/// npm will install `vite-plus` and all its transitive deps via `vp install`.
+pub async fn generate_wrapper_package_json(
     version_dir: &AbsolutePath,
+    version: &str,
 ) -> Result<(), Error> {
-    let version_dir_owned = version_dir.as_path().to_path_buf();
-    let data = tgz_data.to_vec();
-
-    tokio::task::spawn_blocking(move || {
-        let cursor = Cursor::new(data);
-        let decoder = GzDecoder::new(cursor);
-        let mut archive = Archive::new(decoder);
-
-        for entry_result in archive.entries()? {
-            let mut entry = entry_result?;
-            let path = entry.path()?.to_path_buf();
-
-            // Strip the leading `package/` prefix
-            let relative = path.strip_prefix("package").unwrap_or(&path).to_path_buf();
-
-            // Reject paths with traversal components (security)
-            if !is_safe_tar_path(&relative) {
-                continue;
-            }
-
-            let relative_str = relative.to_string_lossy();
-
-            // Check if this entry matches our allowed list
-            let should_extract = MAIN_PACKAGE_ENTRIES.iter().any(|allowed| {
-                if allowed.ends_with('/') {
-                    // Directory prefix match
-                    relative_str.starts_with(allowed)
-                } else {
-                    // Exact file match
-                    relative_str == *allowed
-                }
-            });
-
-            if !should_extract {
-                continue;
-            }
-
-            let target = version_dir_owned.join(&*relative_str);
-
-            if entry.header().entry_type().is_dir() {
-                std::fs::create_dir_all(&target)?;
-            } else {
-                // Ensure parent directory exists
-                if let Some(parent) = target.parent() {
-                    std::fs::create_dir_all(parent)?;
-                }
-                let mut buf = Vec::new();
-                entry.read_to_end(&mut buf)?;
-                std::fs::write(&target, &buf)?;
-            }
+    let json = serde_json::json!({
+        "name": "vp-global",
+        "version": version,
+        "private": true,
+        "dependencies": {
+            "vite-plus": version
         }
-
-        Ok::<(), Error>(())
-    })
-    .await
-    .map_err(|e| Error::Upgrade(format!("Task join error: {e}").into()))??;
-
-    Ok(())
-}
-
-/// Strip devDependencies and optionalDependencies from package.json.
-pub async fn strip_dev_dependencies(version_dir: &AbsolutePath) -> Result<(), Error> {
-    let package_json_path = version_dir.join("package.json");
-
-    if !tokio::fs::try_exists(&package_json_path).await.unwrap_or(false) {
-        return Ok(());
-    }
-
-    let content = tokio::fs::read_to_string(&package_json_path).await?;
-    let mut json: serde_json::Value = serde_json::from_str(&content)?;
-
-    if let Some(obj) = json.as_object_mut() {
-        obj.remove("devDependencies");
-        obj.remove("optionalDependencies");
-    }
-
-    let updated = serde_json::to_string_pretty(&json)?;
-    tokio::fs::write(&package_json_path, format!("{updated}\n")).await?;
-
+    });
+    let content = serde_json::to_string_pretty(&json)? + "\n";
+    tokio::fs::write(version_dir.join("package.json"), content).await?;
     Ok(())
 }
 

crates/vite_global_cli/src/commands/upgrade/mod.rs

@@ -92,26 +92,16 @@ pub async fn execute(options: UpgradeOptions) -> Result<ExitStatus, Error> {
         eprintln!("info: downloading vite-plus@{} for {}...", resolved.version, platform_suffix);
     }
 
-    // Step 6: Download both tarballs
+    // Step 6: Download platform tarball (main package is installed via npm)
     let client = HttpClient::new();
 
-    let (platform_data, main_data) = tokio::try_join!(
-        async {
-            client.get_bytes(&resolved.platform_tarball_url).await.map_err(|e| {
-                Error::Upgrade(format!("Failed to download platform package: {e}").into())
-            })
-        },
-        async {
-            client
-                .get_bytes(&resolved.main_tarball_url)
-                .await
-                .map_err(|e| Error::Upgrade(format!("Failed to download main package: {e}").into()))
-        },
-    )?;
+    let platform_data = client
+        .get_bytes(&resolved.platform_tarball_url)
+        .await
+        .map_err(|e| Error::Upgrade(format!("Failed to download platform package: {e}").into()))?;
 
     // Step 7: Verify integrity
     integrity::verify_integrity(&platform_data, &resolved.platform_integrity)?;
-    integrity::verify_integrity(&main_data, &resolved.main_integrity)?;
 
     if !options.silent {
         eprintln!("info: installing...");
@@ -121,10 +111,9 @@ pub async fn execute(options: UpgradeOptions) -> Result<ExitStatus, Error> {
     let version_dir = install_dir.join(&resolved.version);
     tokio::fs::create_dir_all(&version_dir).await?;
 
-    // Step 9: Extract platform package (binary + .node files)
+    // Step 9: Extract platform binary and install via npm
     let result = install_platform_and_main(
         &platform_data,
-        &main_data,
         &version_dir,
         &install_dir,
         &resolved.version,
@@ -146,38 +135,28 @@ pub async fn execute(options: UpgradeOptions) -> Result<ExitStatus, Error> {
 #[allow(clippy::print_stdout, clippy::print_stderr)]
 async fn install_platform_and_main(
     platform_data: &[u8],
-    main_data: &[u8],
     version_dir: &AbsolutePathBuf,
     install_dir: &AbsolutePathBuf,
     new_version: &str,
     current_version: &str,
     silent: bool,
 ) -> Result<ExitStatus, Error> {
-    // Extract platform package
+    // Extract platform package (binary only; .node files installed via npm optionalDeps)
     install::extract_platform_package(platform_data, version_dir).await?;
 
-    // Extract main package
-    install::extract_main_package(main_data, version_dir).await?;
-
-    // Verify critical files were extracted
+    // Verify binary was extracted
     let binary_name = if cfg!(windows) { "vp.exe" } else { "vp" };
     let binary_path = version_dir.join("bin").join(binary_name);
     if !tokio::fs::try_exists(&binary_path).await.unwrap_or(false) {
         return Err(Error::Upgrade(
             "Binary not found after extraction. The download may be corrupted.".into(),
         ));
     }
-    let package_json_path = version_dir.join("package.json");
-    if !tokio::fs::try_exists(&package_json_path).await.unwrap_or(false) {
-        return Err(Error::Upgrade(
-            "package.json not found after extraction. The download may be corrupted.".into(),
-        ));
-    }
 
-    // Strip dev dependencies from package.json
-    install::strip_dev_dependencies(version_dir).await?;
+    // Generate wrapper package.json that declares vite-plus as a dependency
+    install::generate_wrapper_package_json(version_dir, new_version).await?;
 
-    // Install production dependencies
+    // Install production dependencies (npm installs vite-plus + all transitive deps)
     install::install_production_deps(version_dir).await?;
 
     // Save previous version for rollback

crates/vite_global_cli/src/commands/upgrade/registry.rs

@@ -26,12 +26,10 @@ pub struct DistInfo {
     pub integrity: String,
 }
 
-/// Resolved version info with URLs and integrity for both packages.
+/// Resolved version info with URLs and integrity for the platform package.
 #[derive(Debug)]
 pub struct ResolvedVersion {
     pub version: String,
-    pub main_tarball_url: String,
-    pub main_integrity: String,
     pub platform_tarball_url: String,
     pub platform_integrity: String,
 }
@@ -42,7 +40,7 @@ const PLATFORM_PACKAGE_SCOPE: &str = "@voidzero-dev";
 /// Resolve a version from the npm registry.
 ///
 /// Makes two HTTP calls:
-/// 1. Main package metadata to get version, tarball URL, integrity, and optional deps
+/// 1. Main package metadata to get version and optional deps (to find platform package)
 /// 2. Platform package metadata to get platform-specific tarball URL and integrity
 pub async fn resolve_version(
     version_or_tag: &str,
@@ -90,8 +88,6 @@ pub async fn resolve_version(
 
     Ok(ResolvedVersion {
         version: main_meta.version,
-        main_tarball_url: main_meta.dist.tarball,
-        main_integrity: main_meta.dist.integrity,
         platform_tarball_url: platform_meta.dist.tarball,
         platform_integrity: platform_meta.dist.integrity,
     })

crates/vite_global_cli/src/js_executor.rs

@@ -55,16 +55,16 @@ impl JsExecutor {
         }
 
         // 3. Auto-detect from binary location
-        // JS scripts are at ../dist relative to the binary directory
-        // e.g., ~/.vite-plus/<version>/bin/vp -> ~/.vite-plus/<version>/dist/
+        // JS scripts are at ../node_modules/vite-plus/dist relative to the binary directory
+        // e.g., ~/.vite-plus/<version>/bin/vp -> ~/.vite-plus/<version>/node_modules/vite-plus/dist/
         let exe_path = std::env::current_exe().map_err(|_| Error::JsScriptsDirNotFound)?;
         // Resolve symlinks to get the real binary path (Unix only)
         // Skip on Windows to avoid path resolution issues
         #[cfg(unix)]
         let exe_path = std::fs::canonicalize(&exe_path).map_err(|_| Error::JsScriptsDirNotFound)?;
         let bin_dir = exe_path.parent().ok_or(Error::JsScriptsDirNotFound)?;
-        let package_dir = bin_dir.parent().ok_or(Error::JsScriptsDirNotFound)?;
-        let scripts_dir = package_dir.join("dist");
+        let version_dir = bin_dir.parent().ok_or(Error::JsScriptsDirNotFound)?;
+        let scripts_dir = version_dir.join("node_modules").join("vite-plus").join("dist");
 
         AbsolutePathBuf::new(scripts_dir).ok_or(Error::JsScriptsDirNotFound)
     }