fix(pm-cli): honor -g and reject -g --dry-run on the local CLI

Two local-CLI safety bugs on the new shared PM dispatcher (flagged by
the codex adversarial review on PR #1495):

1. `vp install -g <pkg>` was downgraded into a project add. The shared
   `Install` arm dropped `global` and the `install <packages>` →
   `add` alias hardcoded `AddCommandOptions.global = false`, so the
   command silently ran `pnpm add <pkg>` (project) instead of
   `pnpm add -g <pkg>` (global). Worse, `run_add` always called
   `ensure_package_json`, so invoking `vp install -g foo` from an
   empty directory created a fresh `package.json` and added the
   package as a project dependency.

   Pass `global` through from `Install` to `AddCommandOptions`, and in
   `run_add` skip `ensure_package_json` when `options.global` is
   true, falling back to npm-default PM detection so we still have a
   binary to dispatch to in an empty directory. Same fix mirrored on
   `run_remove` so `vp remove -g <pkg>` works in an empty dir too.

2. `vp remove -g --dry-run <pkg>` could perform a real uninstall.
   The dispatcher bound `dry_run: _` and never forwarded it; the
   underlying `RemoveCommandOptions` has no preview field.

   Reject the combination in the dispatcher with a clear user message
   pointing the user at the globally-installed `vp` CLI. The global
   CLI's `run_package_manager_command` intercepts `Remove { global:
   true }` before reaching this path, so it keeps using its
   vite-plus-managed `managed_uninstall` flow with `dry_run` honored;
   the new error only fires on the local CLI.

Verified end-to-end on the local CLI in an empty tmp dir:
- `vp install -g testnpm2` installs globally, no package.json created
- `vp remove -g testnpm2` removes globally, exit 0
- `vp remove -g --dry-run testnpm2` exits 1 with the new message and
  does not touch the global store

Snap-test deltas: only the local `command-remove-pnpm10` fixture
regenerates to capture the new error message; the global fixture is
unchanged because the managed-uninstall path still handles `--dry-run`.

Author: fengmk2

crates/vite_pm_cli/src/dispatch.rs

@@ -42,7 +42,7 @@ pub async fn dispatch(
             save_peer,
             save_optional,
             save_catalog,
-            global: _,
+            global,
             node: _,
             packages,
             pass_through_args,
@@ -65,7 +65,7 @@ pub async fn dispatch(
                     filters: filter.as_deref(),
                     workspace_root,
                     workspace_only: false,
-                    global: false,
+                    global,
                     allow_build: None,
                     pass_through_args: pass_through_args.as_deref(),
                 };
@@ -141,10 +141,21 @@ pub async fn dispatch(
             workspace_root,
             recursive,
             global,
-            dry_run: _,
+            dry_run,
             packages,
             pass_through_args,
         } => {
+            // `--dry-run` (which clap requires alongside `-g`) is honored by the
+            // global CLI's vite-plus-managed uninstall flow. The shared
+            // dispatcher reaches this arm only for non-managed paths
+            // (project-scoped removes, or local-CLI global removes), and the
+            // underlying `RemoveCommandOptions` has no preview field. Refuse
+            // rather than silently performing a real uninstall.
+            if dry_run {
+                return Err(Error::UserMessage(
+                    "`--dry-run` is only supported by the globally-installed `vp` CLI for managed packages. Run the command without `--dry-run` to actually remove the package.".into(),
+                ));
+            }
             let options = RemoveCommandOptions {
                 packages: &packages,
                 filters: filter.as_deref(),

crates/vite_pm_cli/src/handlers.rs

@@ -50,8 +50,14 @@ pub async fn run_add(
     cwd: &AbsolutePath,
     options: &AddCommandOptions<'_>,
 ) -> Result<ExitStatus, Error> {
-    ensure_package_json(cwd).await?;
-    let pm = PackageManager::builder(cwd).build_with_default().await?;
+    let pm = if options.global {
+        // Global add doesn't need a project; fall back to npm if no package.json
+        // is present so the underlying PM still has a binary to dispatch to.
+        build_package_manager_or_npm_default(cwd).await?
+    } else {
+        ensure_package_json(cwd).await?;
+        PackageManager::builder(cwd).build_with_default().await?
+    };
     Ok(pm.run_add_command(options, cwd).await?)
 }
 
@@ -68,7 +74,13 @@ pub async fn run_remove(
     cwd: &AbsolutePath,
     options: &RemoveCommandOptions<'_>,
 ) -> Result<ExitStatus, Error> {
-    let pm = build_package_manager(cwd).await?;
+    let pm = if options.global {
+        // Global remove doesn't need a project; fall back to npm if no
+        // package.json is present.
+        build_package_manager_or_npm_default(cwd).await?
+    } else {
+        build_package_manager(cwd).await?
+    };
     Ok(pm.run_remove_command(options, cwd).await?)
 }
 

packages/cli/snap-tests/command-remove-pnpm10/snap.txt

@@ -97,14 +97,8 @@ Done in <variable>ms using pnpm v<semver>
   "packageManager": "pnpm@<semver>"
 }
 
-> vp remove -g --dry-run testnpm2 && cat package.json # support remove global package with dry-run
-
-up to date in <variable>ms
-{
-  "name": "command-remove-pnpm10",
-  "version": "1.0.0",
-  "packageManager": "pnpm@<semver>"
-}
+[1]> vp remove -g --dry-run testnpm2 && cat package.json # support remove global package with dry-run
+error: `--dry-run` is only supported by the globally-installed `vp` CLI for managed packages. Run the command without `--dry-run` to actually remove the package.
 
 [2]> vp rm --stream foo && should show tips to use pass through arguments when options are not supported
 error: Unexpected argument '--stream'