Skip to content

feat(cli): add vp self-update command#548

Merged
fengmk2 merged 13 commits intomainfrom
self-upgrade
Feb 7, 2026
Merged

feat(cli): add vp self-update command#548
fengmk2 merged 13 commits intomainfrom
self-upgrade

Conversation

@fengmk2
Copy link
Copy Markdown
Member

@fengmk2 fengmk2 commented Feb 6, 2026

feat(cli): add vp self-update command

Implement vp self-update (alias: vp upgrade) that downloads and
installs a new vp CLI version from the npm registry with SHA-512
integrity verification.

Features:

  • Version resolution from npm registry (latest, specific version, or dist-tag)
  • Parallel download of platform binary + main JS package tarballs
  • SHA-512 SRI integrity verification for both tarballs
  • Atomic symlink swap on Unix, junction swap on Windows
  • Production dependency installation via new binary
  • Shim refresh after update
  • Automatic cleanup of old versions (keeps 5 most recent)
  • --check flag to check for updates without installing
  • --rollback to revert to previous version
  • --force, --silent, --tag, --registry flags
  • Path traversal protection in tarball extraction
  • Post-extraction validation of critical files

test(cli): add snap tests for vp self-update command

  • Add self-update help to cli-helper-message snap test
  • Add command-self-update-check test (--check flag and upgrade alias)
  • Add command-self-update-rollback test (error when no previous version)
  • Rename help section to "Maintenance Commands" for consistency
  • Fix description alignment to match other sections

@fengmk2 fengmk2 force-pushed the fix-vp-dev-missing-package-json branch 2 times, most recently from a29953d to c5293ba Compare February 6, 2026 05:14
@fengmk2 fengmk2 force-pushed the self-upgrade branch 2 times, most recently from 220262e to def89c2 Compare February 6, 2026 05:41
@fengmk2 fengmk2 force-pushed the fix-vp-dev-missing-package-json branch from c5293ba to a612cef Compare February 6, 2026 05:41
@fengmk2 fengmk2 force-pushed the fix-vp-dev-missing-package-json branch from a612cef to 85c0097 Compare February 6, 2026 06:40
@fengmk2 fengmk2 force-pushed the fix-vp-dev-missing-package-json branch from 78c1988 to ae90321 Compare February 6, 2026 07:26
Comment thread Cargo.toml Outdated
Comment thread .github/workflows/ci.yml
@fengmk2 fengmk2 force-pushed the self-upgrade branch 2 times, most recently from 48e1dbc to 0c7a539 Compare February 7, 2026 06:25
@fengmk2 fengmk2 force-pushed the fix-vp-dev-missing-package-json branch from ae90321 to 97f4a34 Compare February 7, 2026 07:42
@fengmk2 fengmk2 marked this pull request as ready for review February 7, 2026 07:46
@fengmk2 fengmk2 changed the base branch from fix-vp-dev-missing-package-json to graphite-base/548 February 7, 2026 09:06
@fengmk2 fengmk2 changed the base branch from graphite-base/548 to main February 7, 2026 09:27
Implement `vp self-update` (alias: `vp upgrade`) that downloads and
installs a new vp CLI version from the npm registry with SHA-512
integrity verification.

Features:
- Version resolution from npm registry (latest, specific version, or dist-tag)
- Parallel download of platform binary + main JS package tarballs
- SHA-512 SRI integrity verification for both tarballs
- Atomic symlink swap on Unix, junction swap on Windows
- Production dependency installation via new binary
- Shim refresh after update
- Automatic cleanup of old versions (keeps 5 most recent)
- `--check` flag to check for updates without installing
- `--rollback` to revert to previous version
- `--force`, `--silent`, `--tag`, `--registry` flags
- Path traversal protection in tarball extraction
- Post-extraction validation of critical files
- Add self-update help to cli-helper-message snap test
- Add command-self-update-check test (--check flag and upgrade alias)
- Add command-self-update-rollback test (error when no previous version)
- Rename help section to "Maintenance Commands" for consistency
- Fix description alignment to match other sections
…ap error handling

- Add `-msvc` suffix for Windows platform detection (win32-x64-msvc)
- Sort cleanup by creation time instead of semver, matching install.sh
- Add protected_versions to cleanup to prevent deleting active version on downgrade
- Make post-swap operations (shim refresh, cleanup) non-fatal
- Add tests for all three fixes
- Sync RFC with implementation changes
…dows

`Path::is_absolute()` on Windows only recognizes `C:\...` style paths,
so `/etc/passwd` from a tar archive was not rejected. Add explicit check
for leading `/` since tar archives always use Unix-style paths.
Test the full self-update cycle (check, upgrade alias, update, rollback)
on all platforms: Linux x64, macOS x64/ARM64, Linux ARM64 via QEMU,
and Windows x64.
`/tmp/...` is not a valid absolute path on Windows, causing
`AbsolutePathBuf::new` to return `None`. Use `std::env::temp_dir()`
instead.
Add a dedicated job that builds the CLI from source, runs self-update
with --tag test --force, verifies version changed, then rollbacks and
verifies version restored. Includes version assertions using the
installed package.json to ensure correctness after both update and
rollback. Runs on all 3 platforms (Linux, macOS, Windows).
CI now installs `vp` to `~/.vite-plus` instead of `~/.vite-plus-dev`,
matching the real user environment. Local dev (`vp-dev`) continues to
use `~/.vite-plus-dev`. Snap output normalizes both paths to
`<vite-plus-home>` for stable cross-environment snapshots.
…y verification

Consolidate on `base64-simd` which is already used elsewhere in the codebase,
removing the `base64` crate dependency entirely.
Capture stdout/stderr from `vp env setup --refresh` and `vp install
--silent` sub-processes instead of inheriting stdio. This prevents
~20 lines of setup instructions and package manager warnings from
leaking into the self-update progress output.

On failure, captured stderr is included in error messages for
diagnostics. Also improve Windows junction error message to include
the path and recovery hint.
Replace junction::exists() check with std::fs::remove_dir() fallback
chain when removing the `current` junction during self-update. The
junction crate may not detect junctions created by cmd /c mklink /J
(used by install.ps1), causing OS error 183 on re-creation.

Now unconditionally attempts removal via std::fs::remove_dir (safe for
junctions/symlinks) with fallback to junction::delete().
Validate the junction swap fix from all three shell types on Windows
by adding pwsh and cmd test steps alongside the existing bash test.
@fengmk2 fengmk2 force-pushed the self-upgrade branch 4 times, most recently from a030d82 to 50406ae Compare February 7, 2026 10:21
Both local development and CI now install to ~/.vite-plus using the same
`vp` binary, eliminating the separate vp-dev/vp-raw wrapper scripts and
~/.vite-plus-dev directory that caused confusion between dev and release.
Copy link
Copy Markdown
Member Author

fengmk2 commented Feb 7, 2026

Merge activity

  • Feb 7, 10:42 AM UTC: A user started a stack merge that includes this pull request via Graphite.
  • Feb 7, 10:42 AM UTC: @fengmk2 merged this pull request with Graphite.

@fengmk2 fengmk2 merged commit d44848f into main Feb 7, 2026
39 checks passed
@fengmk2 fengmk2 deleted the self-upgrade branch February 7, 2026 10:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants