feat(cli): add vp self-update command (#548)

feat(cli): add `vp self-update` command

Implement `vp self-update` (alias: `vp upgrade`) that downloads and
installs a new vp CLI version from the npm registry with SHA-512
integrity verification.

Features:
- Version resolution from npm registry (latest, specific version, or dist-tag)
- Parallel download of platform binary + main JS package tarballs
- SHA-512 SRI integrity verification for both tarballs
- Atomic symlink swap on Unix, junction swap on Windows
- Production dependency installation via new binary
- Shim refresh after update
- Automatic cleanup of old versions (keeps 5 most recent)
- `--check` flag to check for updates without installing
- `--rollback` to revert to previous version
- `--force`, `--silent`, `--tag`, `--registry` flags
- Path traversal protection in tarball extraction
- Post-extraction validation of critical files

test(cli): add snap tests for `vp self-update` command

- Add self-update help to cli-helper-message snap test
- Add command-self-update-check test (--check flag and upgrade alias)
- Add command-self-update-rollback test (error when no previous version)
- Rename help section to "Maintenance Commands" for consistency
- Fix description alignment to match other sections

Author: fengmk2

.github/workflows/ci.yml

@@ -135,7 +135,7 @@ jobs:
       - name: Build CLI
         run: |
           pnpm bootstrap-cli:ci
-          echo "$HOME/.vite-plus-dev/bin" >> $GITHUB_PATH
+          echo "$HOME/.vite-plus/bin" >> $GITHUB_PATH
 
       - name: Print help for built-in commands
         run: |
@@ -198,9 +198,9 @@ jobs:
         run: |
           pnpm bootstrap-cli:ci
           if [[ "$RUNNER_OS" == "Windows" ]]; then
-            echo "$USERPROFILE\.vite-plus-dev\bin" >> $GITHUB_PATH
+            echo "$USERPROFILE\.vite-plus\bin" >> $GITHUB_PATH
           else
-            echo "$HOME/.vite-plus-dev/bin" >> $GITHUB_PATH
+            echo "$HOME/.vite-plus/bin" >> $GITHUB_PATH
           fi
 
       - name: Verify CLI installation
@@ -239,16 +239,16 @@ jobs:
           where.exe tsc
 
           # Test 2: Verify the package was installed correctly
-          Get-ChildItem "$env:USERPROFILE\.vite-plus-dev\packages\typescript\"
-          Get-ChildItem "$env:USERPROFILE\.vite-plus-dev\bin\"
+          Get-ChildItem "$env:USERPROFILE\.vite-plus\packages\typescript\"
+          Get-ChildItem "$env:USERPROFILE\.vite-plus\bin\"
 
           # Test 3: Uninstall
           vp uninstall -g typescript
 
           # Test 4: Verify uninstall removed shim
           Write-Host "Checking bin dir after uninstall:"
-          Get-ChildItem "$env:USERPROFILE\.vite-plus-dev\bin\"
-          $shimPath = "$env:USERPROFILE\.vite-plus-dev\bin\tsc.cmd"
+          Get-ChildItem "$env:USERPROFILE\.vite-plus\bin\"
+          $shimPath = "$env:USERPROFILE\.vite-plus\bin\tsc.cmd"
           if (Test-Path $shimPath) {
             Write-Error "tsc shim file still exists at $shimPath"
             exit 1
@@ -285,23 +285,23 @@ jobs:
           where.exe tsc
 
           REM Test 2: Verify the package was installed correctly
-          dir "%USERPROFILE%\.vite-plus-dev\packages\typescript\"
-          dir "%USERPROFILE%\.vite-plus-dev\bin\"
+          dir "%USERPROFILE%\.vite-plus\packages\typescript\"
+          dir "%USERPROFILE%\.vite-plus\bin\"
 
           REM Test 3: Uninstall
           vp uninstall -g typescript
 
           REM Test 4: Verify uninstall removed shim (.cmd wrapper)
           echo Checking bin dir after uninstall:
-          dir "%USERPROFILE%\.vite-plus-dev\bin\"
-          if exist "%USERPROFILE%\.vite-plus-dev\bin\tsc.cmd" (
+          dir "%USERPROFILE%\.vite-plus\bin\"
+          if exist "%USERPROFILE%\.vite-plus\bin\tsc.cmd" (
             echo Error: tsc.cmd shim file still exists
             exit /b 1
           )
           echo tsc.cmd shim removed successfully
 
           REM Test 5: Verify shell script was also removed (for Git Bash)
-          if exist "%USERPROFILE%\.vite-plus-dev\bin\tsc" (
+          if exist "%USERPROFILE%\.vite-plus\bin\tsc" (
             echo Error: tsc shell script still exists
             exit /b 1
           )
@@ -317,8 +317,8 @@ jobs:
       - name: Test global package install (bash)
         run: |
           echo "PATH: $PATH"
-          ls -la ~/.vite-plus-dev/
-          ls -la ~/.vite-plus-dev/bin/
+          ls -la ~/.vite-plus/
+          ls -la ~/.vite-plus/bin/
           which node
           which npm
           which npx
@@ -331,17 +331,17 @@ jobs:
           which tsc
 
           # Test 2: Verify the package was installed correctly
-          ls -la ~/.vite-plus-dev/packages/typescript/
-          ls -la ~/.vite-plus-dev/bin/
+          ls -la ~/.vite-plus/packages/typescript/
+          ls -la ~/.vite-plus/bin/
 
           # Test 3: Uninstall
           vp uninstall -g typescript
 
           # Test 4: Verify uninstall removed shim
           echo "Checking bin dir after uninstall:"
-          ls -la ~/.vite-plus-dev/bin/
-          if [ -f ~/.vite-plus-dev/bin/tsc ]; then
-            echo "Error: tsc shim file still exists at ~/.vite-plus-dev/bin/tsc"
+          ls -la ~/.vite-plus/bin/
+          if [ -f ~/.vite-plus/bin/tsc ]; then
+            echo "Error: tsc shim file still exists at ~/.vite-plus/bin/tsc"
             exit 1
           fi
           echo "tsc shim removed successfully"
@@ -361,6 +361,197 @@ jobs:
           RUST_BACKTRACE=1 pnpm test
           git diff --exit-code
 
+  cli-self-update:
+    name: CLI self-update test
+    needs:
+      - download-previous-rolldown-binaries
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+          - os: namespace-profile-mac-default
+          - os: windows-latest
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: ./.github/actions/clone
+
+      - name: Configure Git for access to vite-task
+        run: git config --global url."https://x-access-token:${{ secrets.VITE_TASK_TOKEN }}@github.com/".insteadOf "ssh://git@github.com/"
+
+      - run: |
+          brew install rustup
+          rustup install stable
+          echo "PATH=/opt/homebrew/opt/rustup/bin:$PATH" >> $GITHUB_ENV
+        if: ${{ matrix.os == 'namespace-profile-mac-default' }}
+
+      - uses: oxc-project/setup-rust@d286d43bc1f606abbd98096666ff8be68c8d5f57 # v1.0.0
+        with:
+          save-cache: ${{ github.ref_name == 'main' }}
+          cache-key: cli-self-update
+
+      - uses: oxc-project/setup-node@fdbf0dfd334c4e6d56ceeb77d91c76339c2a0885 # v1.0.4
+
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: rolldown-binaries
+          path: ./rolldown/packages/rolldown/src
+          merge-multiple: true
+
+      - name: Build with upstream
+        uses: ./.github/actions/build-upstream
+        with:
+          target: ${{ matrix.os == 'ubuntu-latest' && 'x86_64-unknown-linux-gnu' ||  matrix.os == 'windows-latest' && 'x86_64-pc-windows-msvc' || 'aarch64-apple-darwin' }}
+
+      - name: Build CLI
+        run: |
+          pnpm bootstrap-cli:ci
+          if [[ "$RUNNER_OS" == "Windows" ]]; then
+            echo "$USERPROFILE\.vite-plus\bin" >> $GITHUB_PATH
+          else
+            echo "$HOME/.vite-plus/bin" >> $GITHUB_PATH
+          fi
+
+      - name: Verify CLI installation
+        run: |
+          which vp
+          vp --version
+
+      - name: Test self-update (bash)
+        shell: bash
+        run: |
+          # Helper to read the installed CLI version from package.json
+          get_cli_version() {
+            node -p "require(require('path').resolve(process.env.USERPROFILE || process.env.HOME, '.vite-plus', 'current', 'package.json')).version"
+          }
+
+          # Save initial (dev build) version
+          INITIAL_VERSION=$(get_cli_version)
+          echo "Initial version: $INITIAL_VERSION"
+
+          # --check queries npm registry and prints update status
+          vp self-update --check
+          # upgrade alias should also work
+          vp upgrade --check
+
+          # full self-update: download, extract, swap
+          vp self-update --tag test --force
+          vp --version
+          vp env doctor
+
+          ls -la ~/.vite-plus/
+
+          # Verify version changed after update
+          UPDATED_VERSION=$(get_cli_version)
+          echo "Updated version: $UPDATED_VERSION"
+          if [ "$UPDATED_VERSION" == "$INITIAL_VERSION" ]; then
+            echo "Error: version should have changed after self-update (still $INITIAL_VERSION)"
+            exit 1
+          fi
+
+          # rollback to the previous version
+          vp self-update --rollback
+          vp --version
+          vp env doctor
+
+          # Verify version restored after rollback
+          ROLLBACK_VERSION=$(get_cli_version)
+          echo "Rollback version: $ROLLBACK_VERSION"
+          if [ "$ROLLBACK_VERSION" != "$INITIAL_VERSION" ]; then
+            echo "Error: version should have been restored after rollback (expected $INITIAL_VERSION, got $ROLLBACK_VERSION)"
+            exit 1
+          fi
+
+      - name: Test self-update (powershell)
+        if: matrix.os == 'windows-latest'
+        shell: pwsh
+        run: |
+          Get-ChildItem "$env:USERPROFILE\.vite-plus\"
+
+          # Helper to read the installed CLI version from package.json
+          function Get-CliVersion {
+            node -p "require(require('path').resolve(process.env.USERPROFILE, '.vite-plus', 'current', 'package.json')).version"
+          }
+
+          # Save initial (dev build) version
+          $initialVersion = Get-CliVersion
+          Write-Host "Initial version: $initialVersion"
+
+          # --check queries npm registry and prints update status
+          vp self-update --check
+          # upgrade alias should also work
+          vp upgrade --check
+
+          # full self-update: download, extract, swap
+          vp self-update --tag test --force
+          vp --version
+          vp env doctor
+
+          Get-ChildItem "$env:USERPROFILE\.vite-plus\"
+
+          # Verify version changed after update
+          $updatedVersion = Get-CliVersion
+          Write-Host "Updated version: $updatedVersion"
+          if ($updatedVersion -eq $initialVersion) {
+            Write-Error "Error: version should have changed after self-update (still $initialVersion)"
+            exit 1
+          }
+
+          # rollback to the previous version
+          vp self-update --rollback
+          vp --version
+          vp env doctor
+
+          # Verify version restored after rollback
+          $rollbackVersion = Get-CliVersion
+          Write-Host "Rollback version: $rollbackVersion"
+          if ($rollbackVersion -ne $initialVersion) {
+            Write-Error "Error: version should have been restored after rollback (expected $initialVersion, got $rollbackVersion)"
+            exit 1
+          }
+
+      - name: Test self-update (cmd)
+        if: matrix.os == 'windows-latest'
+        shell: cmd
+        run: |
+          REM Save initial (dev build) version
+          for /f "usebackq delims=" %%v in (`node -p "require(require('path').resolve(process.env.USERPROFILE, '.vite-plus', 'current', 'package.json')).version"`) do set INITIAL_VERSION=%%v
+          echo Initial version: %INITIAL_VERSION%
+
+          REM --check queries npm registry and prints update status
+          vp self-update --check
+          REM upgrade alias should also work
+          vp upgrade --check
+
+          REM full self-update: download, extract, swap
+          vp self-update --tag test --force
+          vp --version
+          vp env doctor
+
+          dir "%USERPROFILE%\.vite-plus\"
+
+          REM Verify version changed after update
+          for /f "usebackq delims=" %%v in (`node -p "require(require('path').resolve(process.env.USERPROFILE, '.vite-plus', 'current', 'package.json')).version"`) do set UPDATED_VERSION=%%v
+          echo Updated version: %UPDATED_VERSION%
+          if "%UPDATED_VERSION%"=="%INITIAL_VERSION%" (
+            echo Error: version should have changed after self-update, still %INITIAL_VERSION%
+            exit /b 1
+          )
+
+          REM rollback to the previous version
+          vp self-update --rollback
+          vp --version
+          vp env doctor
+
+          REM Verify version restored after rollback
+          for /f "usebackq delims=" %%v in (`node -p "require(require('path').resolve(process.env.USERPROFILE, '.vite-plus', 'current', 'package.json')).version"`) do set ROLLBACK_VERSION=%%v
+          echo Rollback version: %ROLLBACK_VERSION%
+          if not "%ROLLBACK_VERSION%"=="%INITIAL_VERSION%" (
+            echo Error: version should have been restored after rollback, expected %INITIAL_VERSION%, got %ROLLBACK_VERSION%
+            exit /b 1
+          )
+
   install-e2e-test:
     name: Local CLI `vite install` E2E test
     needs:
@@ -398,7 +589,7 @@ jobs:
       - name: Build CLI
         run: |
           pnpm bootstrap-cli:ci
-          echo "$HOME/.vite-plus-dev/bin" >> $GITHUB_PATH
+          echo "$HOME/.vite-plus/bin" >> $GITHUB_PATH
 
       - name: Run local CLI `vite install`
         run: |
@@ -440,6 +631,7 @@ jobs:
       - lint
       - run
       - cli-e2e-test
+      - cli-self-update
     steps:
       - run: exit 1
         # Thank you, next https://github.com/vercel/next.js/blob/canary/.github/workflows/build_and_test.yml#L379

.github/workflows/e2e-test.yml

@@ -266,8 +266,8 @@ jobs:
       - name: Install vp CLI
         shell: bash
         run: |
-          node $GITHUB_WORKSPACE/packages/tools/src/install-global-cli.ts vp --tgz $GITHUB_WORKSPACE/tmp/tgz/vite-plus-cli-0.0.0.tgz
-          echo "$HOME/.vite-plus-dev/bin" >> $GITHUB_PATH
+          node $GITHUB_WORKSPACE/packages/tools/src/install-global-cli.ts --tgz $GITHUB_WORKSPACE/tmp/tgz/vite-plus-cli-0.0.0.tgz
+          echo "$HOME/.vite-plus/bin" >> $GITHUB_PATH
 
       - name: Migrate in ${{ matrix.project.name }}
         working-directory: ${{ runner.temp }}/vite-plus-ecosystem-ci/${{ matrix.project.name }}${{ matrix.project.directory && format('/{0}', matrix.project.directory) || '' }}

.github/workflows/test-standalone-install.yml

@@ -103,6 +103,16 @@ jobs:
           which npx
           which vp
 
+      - name: Verify self-update
+        run: |
+          # --check queries npm registry and prints update status
+          vp self-update --check
+          vp self-update 0.0.0-b356849c.20260207-0631
+          vp --version
+          # rollback to the previous version (should succeed after a real update)
+          vp self-update --rollback
+          vp --version
+
   test-install-sh-arm64:
     name: Test install.sh (Linux ARM64 glibc via QEMU)
     runs-on: ubuntu-latest
@@ -155,6 +165,13 @@ jobs:
               export VITE_LOG=trace
               vp env run --node 24 -- node -p \"process.versions\"
 
+              # Verify self-update
+              vp self-update --check
+              vp self-update 0.0.0-b356849c.20260207-0631
+              vp --version
+              vp self-update --rollback
+              vp --version
+
               # FIXME: qemu: uncaught target signal 11 (Segmentation fault) - core dumped
               # vp new create-vite --no-interactive --no-agent -- hello --no-interactive -t vanilla
               # cd hello && vp run build
@@ -180,6 +197,17 @@ jobs:
         run: |
           echo "$USERPROFILE\.vite-plus\bin" >> $GITHUB_PATH
 
+      - name: Verify self-update
+        shell: pwsh
+        run: |
+          # --check queries npm registry and prints update status
+          vp self-update --check
+          vp self-update 0.0.0-b356849c.20260207-0631
+          vp --version
+          # rollback to the previous version (should succeed after a real update)
+          vp self-update --rollback
+          vp --version
+
       - name: Verify installation on powershell
         shell: pwsh
         working-directory: ${{ runner.temp }}
@@ -229,6 +257,7 @@ jobs:
         working-directory: ${{ runner.temp }}
         run: |
           echo PATH: %PATH%
+          dir "%USERPROFILE%\.vite-plus"
           dir "%USERPROFILE%\.vite-plus\bin"
 
           REM test new command