…ipt (#2259)

## Motivation

Built-in commands cannot be overridden, so `vp dev` runs the Vite+ dev server
even in a project whose `dev` script does something else entirely (a framework
wrapper, extra flags, a custom runner). Users regularly reach for the built-in
when they meant the script — see #2243.

Stacked on #2265 (notes go to stderr) and #2262 (the raw subcommand reaches
this CLI).

## What this does

When the user writes `vp <name>` and `<name>` is both a built-in and a
`package.json` script:

```
note: You are running `vp dev` as a Vite+ built-in command. If you meant to run the dev npm script, use `vpr dev` instead.
```

The trigger is the name as written. It comes from `VP_RAW_SUBCOMMAND` when the
global CLI provides it, since that is the only accurate source once a command
has been resolved to its canonical name — `vp format` names the `format`
script, not `fmt`. Otherwise it comes from the command line, where a rewrite is
rejected: `vp help fmt` runs as `fmt --help`, and writing `help` is not writing
the built-in.

The only suppression is `VP_RUN`, set by the task runner
(voidzero-dev/vite-task#570), since the user is then already on the `vpr` path.
There is no TTY check: the note goes to stderr, so an agent capturing piped
output still sees it while parsed stdout — `oxlint -f json`, `vitest
--reporter=json`, `oxfmt --stdin-filepath` — stays intact.

Script lookup walks up to the nearest `package.json`, the package `vp run`
itself resolves a task from, so the note also applies from a subdirectory and
deliberately stops there rather than climbing to a package `vpr` could not
reach.

Only the built-ins are covered. `run`/`cache` are the script path itself,
`install` and friends legitimately trigger a project's `install` lifecycle
scripts through the package manager, and `exec` names a binary rather than a
task.

`vp_build_cache` and `vp_build_cache_monorepo` are re-recorded: both define
`"build": "vp build"` and run `vp build` directly, so they now show the note.

Refs #2243

…ipt (#2259)

## Motivation

Built-in commands cannot be overridden, so `vp dev` runs the Vite+ dev
server
even in a project whose `dev` script does something else entirely (a
framework
wrapper, extra flags, a custom runner). Users regularly reach for the
built-in
when they meant the script — see #2243.

Stacked on #2265 (notes go to stderr) and #2262 (the raw subcommand
reaches
this CLI).

## What this does

When the user writes `vp <name>` and `<name>` is both a built-in and a
`package.json` script:

```
note: You are running `vp dev` as a Vite+ built-in command. If you meant to run the dev npm script, use `vpr dev` instead.
```

The trigger is the name as written. It comes from `VP_RAW_SUBCOMMAND`
when the
global CLI provides it, since that is the only accurate source once a
command
has been resolved to its canonical name — `vp format` names the `format`
script, not `fmt`. Otherwise it comes from the command line, where a
rewrite is
rejected: `vp help fmt` runs as `fmt --help`, and writing `help` is not
writing
the built-in.

The only suppression is `VP_RUN`, set by the task runner
(voidzero-dev/vite-task#570), since the user is then already on the
`vpr` path.
There is no TTY check: the note goes to stderr, so an agent capturing
piped
output still sees it while parsed stdout — `oxlint -f json`, `vitest
--reporter=json`, `oxfmt --stdin-filepath` — stays intact.

Script lookup walks up to the nearest `package.json`, the package `vp
run`
itself resolves a task from, so the note also applies from a
subdirectory and
deliberately stops there rather than climbing to a package `vpr` could
not
reach.

Only the built-ins are covered. `run`/`cache` are the script path
itself,
`install` and friends legitimately trigger a project's `install`
lifecycle
scripts through the package manager, and `exec` names a binary rather
than a
task.

`vp_build_cache` and `vp_build_cache_monorepo` are re-recorded: both
define
`"build": "vp build"` and run `vp build` directly, so they now show the
note.

Refs #2243

Release vite-plus v0.2.7: Clearer commands and smoother setup.

This release makes built-in and package-script collisions easier to
navigate, adds concurrency control to `vp pack`, and smooths migrations
and package-manager setup.

### Highlights

- Guide users to `vpr <name>` when a built-in shares a name with a
`package.json` script, preserve the exact command alias they typed, and
avoid duplicate notes from task-spawned tools
([#2262](#2262),
[#2259](#2259),
[vite-task#570](voidzero-dev/vite-task#570)), by
@wan9chi
- Add `--concurrency` to `vp pack` to limit parallel Rolldown builds,
and update tsdown `0.22.13` -> `0.22.14` and Vite DevTools `0.4.2` ->
`0.4.5` ([#2233](#2233)),
by @voidzero-guard[bot]
- Add read-only Svelte rune globals to migrated Oxlint overrides,
preventing false `no-undef` errors
([#2192](#2192)), by
@naokihaba
- Install package managers from npm tarballs with nonstandard top-level
directories, fixing Yarn 1.22.19 installation
([#2264](#2264)), by
@TheAlexLichter

### Fixes & Enhancements

- Preserve machine-readable command output by sending informational CLI
notes to stderr
([#2265](#2265)), by
@wan9chi
- Prevent the Oxc language server from crashing when contributors open
the Vite+ workspace in VS Code
([#2245](#2245)), by
@jong-kyung

### Docs

- Document the full procedure for removing Vite+ commit hooks
([#2218](#2218)), by
@TheAlexLichter
- Document per-process and per-machine ways to disable Vite+ commit
hooks without uninstalling them
([#2230](#2230)), by
@TheAlexLichter
- Clarify when to use built-in `vp` commands versus package scripts
through `vp run` or `vpr`, including migration and agent guidance
([#2255](#2255)), by
@wan9chi
- Document GitLab CI/CD setup with the reusable `setup-vp` template
([#2258](#2258)), by
@naokihaba

### Chore

- Run Semgrep security scans on pull requests and pushes to `main`
([#2223](#2223)), by
@Boshen
- Re-enable Vitest browser-mode CLI snapshot coverage on every supported
platform ([#2275](#2275)),
by @wan9chi
- Stabilize Windows CLI snapshot tests for interrupted installs and
browser port fallback
([#2282](#2282)), by
@wan9chi
- Replace deprecated shared JavaScript and TypeScript VS Code settings
with their current `js/ts.*` names
([#2246](#2246)), by
@jong-kyung

### Bundled Versions

| Tool | Version | Source |
| --------------- | ---------- |
-----------------------------------------------------------------------
|
| vite | `8.1.5` |
[`5e7fe12`](vitejs/vite@5e7fe12)
|
| rolldown | `1.2.0` |
[`03e1e34`](rolldown/rolldown@03e1e34)
|
| tsdown | `0.22.14` | [npm](https://npmx.dev/package/tsdown/v/0.22.14)
|
| vitest | `4.1.10` | [npm](https://npmx.dev/package/vitest/v/4.1.10) |
| oxlint | `1.75.0` | [npm](https://npmx.dev/package/oxlint/v/1.75.0) |
| oxlint-tsgolint | `7.0.2001` |
[npm](https://npmx.dev/package/oxlint-tsgolint/v/7.0.2001) |
| oxfmt | `0.60.0` | [npm](https://npmx.dev/package/oxfmt/v/0.60.0) |

### Upgrade

```bash
vp upgrade
```

**Full Changelog**:
v0.2.6...v0.2.7

---

Merging this PR will trigger the release workflow.

---------

Co-authored-by: voidzero-guard[bot] <278573678+voidzero-guard[bot]@users.noreply.github.com>
Co-authored-by: wan9chi <dk4rest@gmail.com>