After rebasing on main's normalize-vite-plus block (#1697), the
isVitestAdjacent / browser-mode detection was flipping needVitePlus on
projects that already had vite-plus pinned, causing the "pure normalize
pass" to add vitest to the user's devDependencies — breaking the
regression test introduced in #1697. Gate both vitest-adjacent and
browser-mode signals on `!existingVitePlus` so they trigger only when
vite-plus would actually be installed, leaving normalize-only passes to
mutate just the vite-plus spec.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

After rebasing on main's normalize-vite-plus block (#1697), the
isVitestAdjacent / browser-mode detection was flipping needVitePlus on
projects that already had vite-plus pinned, causing the "pure normalize
pass" to add vitest to the user's devDependencies — breaking the
regression test introduced in #1697. Gate both vitest-adjacent and
browser-mode signals on `!existingVitePlus` so they trigger only when
vite-plus would actually be installed, leaving normalize-only passes to
mutate just the vite-plus spec.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Release vite-plus v0.1.23.

Enterprise-ready HTTP (proxy + custom CA), task command shorthands in
`vite.config.ts`, a smoother `vp create`/`vp migrate`, and the
oxc/vite/rolldown bundled stack moves forward.

### Highlights

- **Proxy and custom-CA aware HTTP**: a new process-wide
`vite_shared::shared_http_client()` honors `HTTPS_PROXY` / `HTTP_PROXY`
/ `NO_PROXY`, picks up macOS System Settings / Windows registry proxies,
loads custom CAs from `SSL_CERT_FILE` and `NODE_EXTRA_CA_CERTS`, and
exposes a `VP_INSECURE_TLS` diagnostic switch; makes `vp` work through
Socket Firewall Free and other TLS-intercepting proxies
([#1686](#1686)), by
@fengmk2
- **Task command shorthands**: `run.tasks` entries in `vite.config.ts`
now accept a bare string (`"build": "cmd"`) or array (`"build": ["cmd1",
"cmd2"]`) instead of always requiring `{ command: ... }`; arrays reuse
the existing `&&` planning path so cache, `dependsOn`, and task options
stay consistent
([vite-task#391](voidzero-dev/vite-task#391)),
by @jong-kyung
- **Managed `vp outdated -g`**: routes through Vite+'s managed global
package metadata instead of delegating to the underlying `npm outdated
-g` store, so all installed global packages are reported consistently
([#1659](#1659)), by
@liangmiQwQ

### Features

- `vp pm approve-builds`: new unified subcommand that mirrors `pnpm
approve-builds` one-to-one, adapts to `bun pm trust`, and
warns-and-noops on npm/yarn
([#1662](#1662)), by
@fengmk2
- `vp create`: opt-in GitHub Copilot setup; selecting `--agent copilot`
now generates a `.github/workflows/copilot-setup-steps.yml` so the
Copilot Coding Agent can set up Vite+ and run `vp` in the new project
out of the box
([#1683](#1683)), by
@jong-kyung
- `vp migrate`: prompt to remove `baseUrl` from `tsconfig.json` before
applying type-aware lint defaults (runs `@andrewbranch/ts5to6
--fixBaseUrl .` under the hood; auto-applied in non-interactive mode)
([#1692](#1692)), by
@TheAlexLichter
- Respect `packageManager` in package-manager shims (`npm`/`npx`,
`pnpm`/`pnpx`, `yarn`/`yarnpkg`, `bun`/`bunx`); add non-mutating
`packageManager` resolution metadata for `vp env current` and `vp env
which` ([#1654](#1654)),
by @fengmk2
- vite-task: `--filter` no-match now exits `0` by default; add
`--fail-if-no-match` to opt back in
([vite-task#393](voidzero-dev/vite-task#393)),
by @kazupon

### Fixes & Enhancements

- `vp create`: keep generated `.vscode/settings.json` trackable when the
VS Code editor option is selected (avoid templates' `.vscode/*`
`.gitignore` masking it)
([#1700](#1700)), by
@jong-kyung
- `vp create vite:monorepo`: normalize sub-package `vite-plus` to
`catalog:` even when only `vite-plus` (not `vite`/`vitest`/...) is
present, and drop the `vite`/`vitest` aliases generated by the upstream
library template
([#1697](#1697)), by
@fengmk2
- `vp add/install -g <path>`: resolve the real package name from
`package.json` instead of using the path string, so local-path installs
don't create broken directories
([#1685](#1685)), by
@liangmiQwQ
- `vp test --coverage` and other direct built-in commands now expose the
workspace's `package.json#packageManager` to child processes so tools
like Vitest coverage can spawn the configured PM
([#1696](#1696)), by
@jong-kyung
- `vp migrate`: clean up the whole ESLint ecosystem (plugins, configs,
parser/resolver, type-utils) rather than just `eslint`; skip the
migration entirely when `@nuxt/eslint` is detected
([#1682](#1682)), by
@fengmk2
- `vp create`: write `fmt.configPath` (not `configPath`) for Zed oxfmt
settings to match the official Zed OXC extension layout
([#1687](#1687)), by
@chungweileong94
- `vp migrate`: parse `tsconfig.json` as JSONC so files with comments
don't break `baseUrl` detection/removal
([#1688](#1688)), by
@TheAlexLichter
- `vp env setup`: Unix env shims now point at the active `vp` executable
instead of always assuming `VP_HOME/current/bin/vp`, so Homebrew-style
installs work
([#1631](#1631)), by
@leohara
- `vp outdated -g` / `vp why -g`: don't require a local `package.json`;
global commands run regardless of cwd
([#1622](#1622)), by
@liangmiQwQ
- `vp create`: default the "Initialize a git repository?" prompt to yes
([#1650](#1650)), by
@fengmk2
- `vp` hooks: include the managed Node bin in `PATH` so
`./node_modules/.bin/vp` can find `node` from a VS Code commit on macOS
([#1647](#1647)), by
@TheAlexLichter
- `vpx` on Windows now invokes the package's `.cmd` shim instead of the
Unix binary
([#1652](#1652)), by
@tobynguyen27
- vite-task: bump cache database schema to version 13 (forces a one-time
rebuild of the local task cache)
([vite-task#402](voidzero-dev/vite-task#402)),
by @branchseer
- Bump vite-task to `d02b257` and `5833b374`; also bumps the repo's Rust
nightly toolchain to `nightly-2026-05-24` and ships the regenerated
`run` config types and docs for the new task command shorthand
([#1689](#1689),
[#1695](#1695)), by
@branchseer

### Refactor

- Replace `VP_SHELL_NU`/`VP_SHELL_PWSH` with a single `VP_SHELL`
override; add explicit shell parsing for `bash`, `zsh`, `fish`, `nu`,
`pwsh`, and `cmd`, and harden auto-detection against nested shells
([#1658](#1658)), by
@nekomoyi
- vite-task: replace `allocator-api2` with `bumpalo` collections
([vite-task#400](voidzero-dev/vite-task#400)),
by @branchseer
- vite-task: drop the unused `and_item_index` field from
`ExecutionItemDisplay`
([vite-task#394](voidzero-dev/vite-task#394)),
by @branchseer

### Docs

- Add the root `AGENTS.md` as the primary AI-agent guide for the
vite-plus repository; convert `CLAUDE.md` into a compatibility pointer
([#1670](#1670)), by
@jong-kyung
- Align the agent validation table to match `AGENTS.md`
([#1673](#1673)), by
@jong-kyung
- Update the task output caching guide so the documented behavior
matches what vite-task actually does
([#1639](#1639)), by
@ericclemmons
- Correct the bundled-source location in `packages/core/BUNDLING.md`
([#1660](#1660)), by
@shulaoda

### Chore

- Clarify `--help` text for `vp env default`/`pin`/`use`/`exec` with
`Examples:` blocks
([#1664](#1664)), by
@Boshen
- Refresh trusted stack stats on the docs homepage
([#1680](#1680)), by
@voidzero-guard[bot]
- Drop the standalone `pnpm --filter @rolldown/pluginutils build` step
now that `@rolldown/pluginutils` is published from its own package
([#1655](#1655)), by
@shulaoda
- Preserve single-quote style when `sync-remote` rewrites
`pnpm-workspace.yaml`
([#1672](#1672)), by
@lyzno1
- Enable `vite_pm_cli` lib tests by removing a stale `test = false` flag
([#1661](#1661)), by
@shulaoda
- CI: switch macOS runners back to `namespace-profile-mac-default`
([#1701](#1701)), by
@fengmk2
- CI: fix release-day flakes in the upgrade test and snap test when the
dev `package.json` version equals npm latest
([#1645](#1645)), by
@fengmk2
- CI: replace `zizmor` and `cargo-deny` workflows with
`oxc-project/security-action`
([#1635](#1635)), by
@Boshen
- CI: warm-up monorepo cache test under npm
([#1649](#1649)), by
@fengmk2
- CI: attach per-target `vp` binary archives (`.tar.gz`/`.zip`) to
GitHub Releases alongside the existing `vp-setup-*.exe` installers
([#1665](#1665)), by
@Boshen
- CI: declare Playwright via `repo.json` in ecosystem tests and bump
consumers to `>=1.60` to dodge the Node 24.16.0 hang
([#1668](#1668)), by
@fengmk2
- Update GitHub Actions
([#1640](#1640),
[#1675](#1675),
[#1678](#1678),
[#1679](#1679),
[#1691](#1691)), by
@renovate[bot]
- Upgrade upstream dependencies: vite `8.0.11 → 8.0.14`, rolldown `1.0.0
→ 1.0.3`, vitest `4.1.6 → 4.1.7`, oxlint `1.63.0 → 1.67.0`, oxfmt
`0.48.0 → 0.52.0`, oxlint-tsgolint `0.22.1 → 0.23.0`, `@oxc-project/*`
and oxc Rust crates `0.129.0 → 0.133.0`
([#1646](#1646),
[#1653](#1653),
[#1693](#1693),
[#1699](#1699)), by
@voidzero-guard[bot]

### Bundled Versions

| Tool | Version | Source |
| --- | --- | --- |
| vite | `8.0.14` |
[`c917f1e`](vitejs/vite@c917f1e)
|
| rolldown | `1.0.3` |
[`a287faa`](rolldown/rolldown@a287faa)
|
| tsdown | `0.22.0` | [npm](https://npmx.dev/package/tsdown/v/0.22.0) |
| vitest | `4.1.7` | [npm](https://npmx.dev/package/vitest/v/4.1.7) |
| oxlint | `1.67.0` | [npm](https://npmx.dev/package/oxlint/v/1.67.0) |
| oxlint-tsgolint | `0.23.0` |
[npm](https://npmx.dev/package/oxlint-tsgolint/v/0.23.0) |
| oxfmt | `0.52.0` | [npm](https://npmx.dev/package/oxfmt/v/0.52.0) |

### New Contributors

Welcome to all new contributors! 🎉

@ericclemmons, @tobynguyen27, @shulaoda, @leohara, @chungweileong94

**Full Changelog**:
v0.1.22...v0.1.23

Merging this PR will trigger the release workflow.

---------

Co-authored-by: voidzero-guard[bot] <278573678+voidzero-guard[bot]@users.noreply.github.com>
Co-authored-by: MK <fengmk2@gmail.com>

After rebasing on main's normalize-vite-plus block (#1697), the
isVitestAdjacent / browser-mode detection was flipping needVitePlus on
projects that already had vite-plus pinned, causing the "pure normalize
pass" to add vitest to the user's devDependencies — breaking the
regression test introduced in #1697. Gate both vitest-adjacent and
browser-mode signals on `!existingVitePlus` so they trigger only when
vite-plus would actually be installed, leaving normalize-only passes to
mutate just the vite-plus spec.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

After rebasing on main's normalize-vite-plus block (#1697), the
isVitestAdjacent / browser-mode detection was flipping needVitePlus on
projects that already had vite-plus pinned, causing the "pure normalize
pass" to add vitest to the user's devDependencies — breaking the
regression test introduced in #1697. Gate both vitest-adjacent and
browser-mode signals on `!existingVitePlus` so they trigger only when
vite-plus would actually be installed, leaving normalize-only passes to
mutate just the vite-plus spec.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

…tays effective (#1728)

## Summary

In a monorepo created via `vp create vite:monorepo` with **pnpm**,
running `vp why vite` reported the override as ineffective: it resolved
`vite` to upstream `vite` (a transitive dependency of
`@voidzero-dev/vite-plus-core`) rather than to
`@voidzero-dev/vite-plus-core` itself.

## Root cause

PR #1697 added `dropAliasedRuntimeDevDeps`, which strips `vite`/`vitest`
from `apps/website/package.json` for every package manager. For pnpm
this removed the only direct `vite` dependency in a fresh workspace, so
the `pnpm-workspace.yaml` `overrides.vite: catalog:` entry had no
consumer to redirect. The only `vite` left in the tree was
vite-plus-core's own internal `vite`, so `vp why vite` showed upstream
vite and the override looked ineffective. The single-package app keeps
`vite: catalog:` and resolves correctly.

## npm / yarn / bun: confirmed not affected (no fix needed)

I verified their override is effective in both single-app and monorepo:
`node_modules/vite` resolves to `@voidzero-dev/vite-plus-core`, and
`<pm> why @voidzero-dev/vite-plus-core` shows it redirecting even
vite-plus-test's peer `vite`. Their root `overrides`/`resolutions`
redirect the transitive/peer `vite` regardless of a direct dependency.
Their `vp why vite` display gap is a pre-existing limitation of `npm
explain` / `yarn why` / `bun why` (they query by resolved package name,
not the `vite` alias key), identical with or without the monorepo strip,
so it is out of scope here.

## Fix

`dropAliasedRuntimeDevDeps` now returns early for pnpm, keeping the
aliased `vite`/`vitest` so the workspace override has a direct consumer.
npm/yarn/bun keep stripping the dead-weight keys.

## Before / after (`vp why vite` in a fresh pnpm monorepo)

Before:

```
vite@8.0.14
└─┬ @voidzero-dev/vite-plus-test@0.1.23
  └─┬ vite-plus@0.1.23
    ...
Found 1 version of vite
```

After:

```
@voidzero-dev/vite-plus-core@0.1.23
├─┬ @voidzero-dev/vite-plus-test@0.1.23
│ └─┬ vite-plus@0.1.23
│   └── website@0.0.0 (devDependencies)
...
```

## Verification

- New unit test `packages/cli/src/create/__tests__/monorepo.spec.ts`:
failed for pnpm before the fix (vite stripped), now passes 4/4 (pnpm
keeps, npm/yarn/bun drop).
- Create + migration unit suite: 234/234 pass; lint clean.
- End-to-end against a rebuilt global CLI: real `vp create
vite:monorepo` + `vp why vite` now resolves to
`@voidzero-dev/vite-plus-core`.
- Global snap test `new-vite-monorepo` regenerated (website now keeps
`vite: catalog:`); `new-vite-monorepo-bun` unchanged.
- CI `test-vp-create.yml` assertion made pnpm-aware: pnpm must keep
`vite`; npm/yarn/bun must drop `vite`/`vitest`.

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Low Risk**
> Scoped to monorepo scaffold post-processing and documentation;
behavior change is intentional and covered by unit, snap, and CI checks.
> 
> **Overview**
> **pnpm monorepo create** no longer strips aliased `vite`/`vitest` from
`apps/website/package.json`. The logic moves into exported
**`dropAliasedRuntimeDevDeps`**, which **returns early for pnpm** so
workspace `overrides` still have a direct `vite` consumer (fixing
misleading `vp why vite` after `vp create vite:monorepo`). **npm, yarn,
and bun** still remove those keys after migration.
> 
> Migration guidance is updated in **`docs/guide/migrate.md`**, **`vp
migrate` help**, and snap tests to say: on pnpm, **keep**
migrator-aliased `vite`/`vitest`; on other package managers, remove them
after import rewrites.
> 
> **CI** (`test-vp-create.yml`) now asserts pnpm keeps `vite` on the
website app while other PMs must not. New **`monorepo.spec.ts`** covers
pnpm vs npm/yarn/bun behavior; **`new-vite-monorepo`** snap expects
`vite: catalog:` on the website.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
16f7d45. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

After rebasing on main's normalize-vite-plus block (#1697), the
isVitestAdjacent / browser-mode detection was flipping needVitePlus on
projects that already had vite-plus pinned, causing the "pure normalize
pass" to add vitest to the user's devDependencies — breaking the
regression test introduced in #1697. Gate both vitest-adjacent and
browser-mode signals on `!existingVitePlus` so they trigger only when
vite-plus would actually be installed, leaving normalize-only passes to
mutate just the vite-plus spec.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

After rebasing on main's normalize-vite-plus block (#1697), the
isVitestAdjacent / browser-mode detection was flipping needVitePlus on
projects that already had vite-plus pinned, causing the "pure normalize
pass" to add vitest to the user's devDependencies — breaking the
regression test introduced in #1697. Gate both vitest-adjacent and
browser-mode signals on `!existingVitePlus` so they trigger only when
vite-plus would actually be installed, leaving normalize-only passes to
mutate just the vite-plus spec.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

After rebasing on main's normalize-vite-plus block (#1697), the
isVitestAdjacent / browser-mode detection was flipping needVitePlus on
projects that already had vite-plus pinned, causing the "pure normalize
pass" to add vitest to the user's devDependencies — breaking the
regression test introduced in #1697. Gate both vitest-adjacent and
browser-mode signals on `!existingVitePlus` so they trigger only when
vite-plus would actually be installed, leaving normalize-only passes to
mutate just the vite-plus spec.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>