Enhance Vite+ package manager management

[liangmiQwQ]

There is room to improve the current package-manager management system.

1. Vite+ currently provisions package managers for both the global and local CLI.

   • This is expected for the global CLI.
   • The local CLI can also run without a global Vite+ installation. Package-manager commands may therefore create Vite+-managed state even when Vite+ is installed only in a project.
   • Several Vite+ features need a package manager to be available. The old implementation mixed project detection, downloads, PATH changes, and manifest updates, which made behavior inconsistent and caused problems such as Do not update package.json when running vpr #2374 and bug: vp i pins npm@11 into devEngines on low Node, breaking manual npm with "Cannot find module node:path" #1916.

2. Corepack was introduced in feat(env): add corepack to the default shims tool list #1808 to expose package-manager binaries.

   • Corepack handles npm, pnpm, and Yarn, while Vite+ also supports package managers such as Bun.
   • Vite+ already has its own package-manager version resolution and download logic, so Corepack creates overlapping concepts and can download a second copy of the same manager.
   • Corepack is unmaintained and does not support newer managers such as pnpm 12.

Proposed package-manager refactor plan

The refactor is split into three dependent but independently mergeable parts:

1. Replace Corepack with Vite+-owned shims

   PR feat(env)!: replace Corepack with package manager shims #2391 removes the Corepack integration. vp env setup directly provides shims for npm, pnpm, Yarn, and Bun.

2. Manage package managers through vp env

   PR feat(env)!: manage package manager environments #2398 extends vp env from Node.js-only management to a complete JavaScript environment: Node.js plus package-manager components. Commands such as pin, use, install, clean, and current can manage either component.

3. Resolve and run managed package managers without implicit project writes

   PR fix(pm): avoid implicit project writes #2399 keeps ordinary package-manager commands on Vite+ managed binaries. A command detects the manager and version from project metadata, resolves or downloads that version, and executes the managed binary directly. The package manager does not need to be preinstalled on PATH.

   Detection is non-mutating. Lockfiles, configuration files, defaults, and devEngines.packageManager ranges can select a manager for the current command without adding or rewriting package-manager metadata in package.json. Projects can create or remove an explicit declaration with vp env pin and vp env unpin.

   Project-local dependency commands such as vp install and vp add require an existing package.json. Managed global operations continue to use the Vite+ global package store.

The goal is to separate responsibilities that were previously mixed together:

• detecting which package manager and version a project uses;
• provisioning and selecting managed versions through vp env and shims;
• executing ordinary package-manager commands without implicit project mutation.

This addresses the unexpected package.json mutation reported in #2374, avoids the incompatible implicit npm pin reported in #1916, and removes the overlap between Corepack and Vite+ package-manager management. Unlike the earlier PATH-based proposal, it also preserves version-correct commands when no system package manager is installed; local-only Vite+ usage may still provision Vite+-managed state when a package manager is needed.

The change is technically breaking, but common workflows should remain mostly unchanged. The main affected cases are Corepack-specific usage, scripts consuming vp env --json, and workflows that relied on package-manager commands to create or update package.json implicitly.

[liangmiQwQ]

I'm thinking about if merge pm management into vp env, semantically pm is also a part of environment.

The reason why I thought in this way is the current upgrade flow only runs new installation's vp env setup --fresh. So technically, this would be troublesome. And vp pm has already been here for now, too.