fix(setup): bypass pnpm minimum release age without prompting

Author: liangmiQwQ

crates/vp_global_cli/src/commands/upgrade/mod.rs

@@ -199,7 +199,7 @@ async fn install_platform_and_main(
     install::generate_wrapper_package_json(version_dir, new_version).await?;
 
     // Install production dependencies (pnpm installs vite-plus + all transitive deps)
-    install::install_production_deps(version_dir, registry, silent, new_version).await?;
+    install::install_production_deps(version_dir, registry).await?;
 
     // Save previous version for rollback
     let previous_version = install::save_previous_version(install_dir).await?;

crates/vp_global_cli/src/self_setup.rs

@@ -141,8 +141,7 @@ async fn run(source: &Path) -> Result<(), Error> {
         output::info(&format!("installing vite-plus@{version}..."));
         install::generate_wrapper_package_json(&version_dir, version).await?;
         if !skip_deps {
-            install::install_production_deps(&version_dir, registry, !interactive(), version)
-                .await?;
+            install::install_production_deps(&version_dir, registry).await?;
         }
     }
     #[cfg(windows)]

crates/vp_installer/src/legacy.rs

@@ -137,8 +137,7 @@ async fn install_new_version(
     if !opts.quiet {
         print_info("installing dependencies (this may take a moment)...");
     }
-    install::install_production_deps(version_dir, opts.registry.as_deref(), opts.yes, version)
-        .await?;
+    install::install_production_deps(version_dir, opts.registry.as_deref()).await?;
 
     let previous_version =
         if has_previous { install::save_previous_version(install_dir).await? } else { None };

crates/vp_setup/src/install.rs

@@ -5,7 +5,7 @@
 
 use std::{
     env,
-    io::{Cursor, Read as _, Write as _},
+    io::{Cursor, Read as _},
     path::Path,
     process::{self, Output},
     time::{SystemTime, UNIX_EPOCH},
@@ -136,92 +136,11 @@ pub async fn write_release_age_overrides(version_dir: &AbsolutePath) -> Result<(
     Ok(())
 }
 
-fn is_affirmative_response(input: &str) -> bool {
-    matches!(input.trim().to_ascii_lowercase().as_str(), "y" | "yes")
-}
-
-fn should_prompt_release_age_override(silent: bool) -> bool {
-    !silent && vp_shared::is_stdin_terminal() && vp_shared::is_stderr_terminal()
-}
-
-fn prompt_release_age_override(version: &str) -> bool {
-    eprintln!();
-    eprintln!("warn: Your minimumReleaseAge setting prevented installing vite-plus@{version}.");
-    eprintln!("This setting helps protect against newly published compromised packages.");
-    eprintln!("Proceeding will disable this protection for this Vite+ install only.");
-    eprint!("Do you want to proceed? (y/N): ");
-    if std::io::stderr().flush().is_err() {
-        return false;
-    }
-
-    let mut input = String::new();
-    if std::io::stdin().read_line(&mut input).is_err() {
-        return false;
-    }
-
-    is_affirmative_response(&input)
-}
-
-fn is_release_age_error(stdout: &[u8], stderr: &[u8]) -> bool {
-    let output =
-        format!("{}\n{}", String::from_utf8_lossy(stdout), String::from_utf8_lossy(stderr));
-    let lower = output.to_ascii_lowercase();
-
-    // This wrapper install path is pinned to pnpm via packageManager, so this
-    // detection follows pnpm's resolver/reporter output rather than npm/yarn.
-    //
-    // pnpm's PnpmError prefixes internal codes with ERR_PNPM_, so
-    // `NO_MATURE_MATCHING_VERSION` becomes `ERR_PNPM_NO_MATURE_MATCHING_VERSION`
-    // in CLI output. We still match the unprefixed code as a fallback in case
-    // future reporter/log output includes the raw internal code.
-    // https://github.com/pnpm/pnpm/blob/16cfde66ec71125d692ea828eba2a5f9b3cc54fc/core/error/src/index.ts#L18-L20
-    //
-    // npm-resolver chooses NO_MATURE_MATCHING_VERSION when
-    // publishedBy/minimumReleaseAge rejects a matching version, and uses the
-    // "does not meet the minimumReleaseAge constraint" message.
-    // https://github.com/pnpm/pnpm/blob/16cfde66ec71125d692ea828eba2a5f9b3cc54fc/resolving/npm-resolver/src/index.ts#L76-L84
-    //
-    // default-reporter handles both ERR_PNPM_NO_MATURE_MATCHING_VERSION and
-    // ERR_PNPM_NO_MATCHING_VERSION, and may append guidance mentioning
-    // minimumReleaseAgeExclude when the error has an immatureVersion.
-    // https://github.com/pnpm/pnpm/blob/16cfde66ec71125d692ea828eba2a5f9b3cc54fc/cli/default-reporter/src/reportError.ts#L163-L164
-    //
-    // pnpm itself notes that NO_MATCHING_VERSION can also happen under
-    // minimumReleaseAge when all candidate versions are newer than the threshold.
-    // Because it is also used for real missing versions, we only treat it as
-    // release-age related when accompanied by the age-gate text below.
-    // https://github.com/pnpm/pnpm/blob/16cfde66ec71125d692ea828eba2a5f9b3cc54fc/deps/inspection/outdated/src/createManifestGetter.ts#L66-L76
-    //
-    // minimum-release-age is the pnpm .npmrc key; npm's min-release-age is
-    // intentionally not treated as a pnpm signal here.
-    // https://github.com/pnpm/pnpm/blob/16cfde66ec71125d692ea828eba2a5f9b3cc54fc/config/reader/src/types.ts#L73-L74
-    let has_release_age_text = output.contains("does not meet the minimumReleaseAge constraint")
-        || output.contains("minimumReleaseAge")
-        || output.contains("minimumReleaseAgeExclude")
-        || lower.contains("minimum release age")
-        || lower.contains("minimum-release-age");
-
-    output.contains("ERR_PNPM_NO_MATURE_MATCHING_VERSION")
-        || output.contains("NO_MATURE_MATCHING_VERSION")
-        || (output.contains("ERR_PNPM_NO_MATCHING_VERSION") && has_release_age_text)
-        || has_release_age_text
-}
-
-fn format_install_failure_message(
-    exit_code: i32,
-    log_path: Option<&AbsolutePathBuf>,
-    release_age_blocked: bool,
-) -> String {
+fn format_install_failure_message(exit_code: i32, log_path: Option<&AbsolutePathBuf>) -> String {
     let log_msg = log_path
         .map_or_else(String::new, |p| format!(". See log for details: {}", p.as_path().display()));
 
-    if release_age_blocked {
-        format!(
-            "Upgrade blocked by your minimumReleaseAge setting. Wait until the package is old enough or adjust your package manager configuration explicitly{log_msg}"
-        )
-    } else {
-        format!("Failed to install production dependencies (exit code: {exit_code}){log_msg}")
-    }
+    format!("Failed to install production dependencies (exit code: {exit_code}){log_msg}")
 }
 
 /// Write stdout and stderr from a failed install to `upgrade.log`.
@@ -257,15 +176,12 @@ pub async fn write_upgrade_log(
 pub async fn install_production_deps(
     version_dir: &AbsolutePath,
     registry: Option<&str>,
-    silent: bool,
-    new_version: &str,
 ) -> Result<(), Error> {
     tracing::debug!("Running pnpm install in {}", version_dir.as_path().display());
 
-    // Do not pass `--silent` to the inner install: pnpm suppresses the
-    // release-age error body in silent mode, which would leave upgrade.log
-    // empty and make the release-age gate impossible to detect. This outer
-    // process captures the output and only surfaces it through the log.
+    // Keep the bypass local to this Vite+ installation.
+    write_release_age_overrides(version_dir).await?;
+
     let mut args = vec!["install"];
     if let Some(registry_url) = registry {
         args.push("--registry");
@@ -297,48 +213,13 @@ pub async fn install_production_deps(
 
     if !output.status.success() {
         let log_path = write_upgrade_log(version_dir, &output.stdout, &output.stderr).await;
-        let release_age_blocked = is_release_age_error(&output.stdout, &output.stderr);
-
-        if !release_age_blocked {
-            return Err(Error::Setup(
-                format_install_failure_message(
-                    vp_shared::exit_code_from_status(output.status),
-                    log_path.as_ref(),
-                    false,
-                )
-                .into(),
-            ));
-        }
-
-        if !should_prompt_release_age_override(silent) || !prompt_release_age_override(new_version)
-        {
-            return Err(Error::Setup(
-                format_install_failure_message(
-                    vp_shared::exit_code_from_status(output.status),
-                    log_path.as_ref(),
-                    true,
-                )
-                .into(),
-            ));
-        }
-
-        // Only create the local override after explicit consent. This preserves
-        // minimumReleaseAge protection for the default and non-interactive paths.
-        write_release_age_overrides(version_dir).await?;
-        let retry_output =
-            run_pnpm_install(version_dir, &node_runtime, &pnpm_entry, &args, registry).await?;
-        if !retry_output.status.success() {
-            let retry_log_path =
-                write_upgrade_log(version_dir, &retry_output.stdout, &retry_output.stderr).await;
-            return Err(Error::Setup(
-                format_install_failure_message(
-                    vp_shared::exit_code_from_status(retry_output.status),
-                    retry_log_path.as_ref(),
-                    false,
-                )
-                .into(),
-            ));
-        }
+        return Err(Error::Setup(
+            format_install_failure_message(
+                vp_shared::exit_code_from_status(output.status),
+                log_path.as_ref(),
+            )
+            .into(),
+        ));
     }
 
     Ok(())
@@ -1021,41 +902,4 @@ mod tests {
         let registry = tokio::fs::read_to_string(version_dir.join("registry.txt")).await.unwrap();
         assert_eq!(registry, registry_url);
     }
-
-    #[test]
-    fn test_is_release_age_error_detects_pnpm_no_mature_code() {
-        assert!(is_release_age_error(
-            b"",
-            b"ERR_PNPM_NO_MATURE_MATCHING_VERSION Version 0.1.16 of vite-plus does not meet the minimumReleaseAge constraint",
-        ));
-    }
-
-    #[test]
-    fn test_is_release_age_error_detects_minimum_release_age_message() {
-        assert!(is_release_age_error(
-            b"",
-            b"Version 0.1.16 (released just now) of vite-plus does not meet the minimumReleaseAge constraint",
-        ));
-    }
-
-    #[test]
-    fn test_is_release_age_error_detects_no_matching_with_release_age_context() {
-        assert!(is_release_age_error(
-            b"",
-            b"ERR_PNPM_NO_MATCHING_VERSION No matching version found. Add the package name to minimumReleaseAgeExclude if you want to ignore the time it was published.",
-        ));
-    }
-
-    #[test]
-    fn test_is_release_age_error_ignores_plain_no_matching_version() {
-        assert!(!is_release_age_error(
-            b"",
-            b"ERR_PNPM_NO_MATCHING_VERSION No matching version found for vite-plus@999.999.999",
-        ));
-    }
-
-    #[test]
-    fn test_is_release_age_error_ignores_npm_min_release_age() {
-        assert!(!is_release_age_error(b"", b"min-release-age prevented installing vite-plus",));
-    }
 }