fix(upgrade): bypass package manager release age gates during vp upgrade (#1272)

## Summary

resolves #1260

`vp upgrade` fails when a package manager's global config enforces a
minimum release age (e.g. pnpm's `minimumReleaseAge`), because newly
published vite-plus versions are blocked during dependency installation.

## Changes

- Write local config overrides to the version directory before `vp
install`, bypassing release age gates for all package managers:
- `.npmrc` — pnpm (`minimum-release-age=0`) and npm
(`min-release-age=0`)
  - `.yarnrc.yml` — yarn (`npmMinimalAgeGate: "0m"`)
  - `bunfig.toml` — bun (`minimumReleaseAge = 0`)
- Write `upgrade.log` on install failure with stdout+stderr for
debugging

---------

Co-authored-by: MK (fengmk2) <fengmk2@gmail.com>

Author: kazupon

crates/vite_global_cli/src/commands/upgrade/install.rs

@@ -87,10 +87,15 @@ pub async fn extract_platform_package(
     Ok(())
 }
 
+/// The pnpm version pinned in the wrapper package.json for global installs.
+/// This ensures consistent install behavior regardless of the user's global pnpm version.
+const PINNED_PNPM_VERSION: &str = "pnpm@10.33.0";
+
 /// Generate a wrapper `package.json` that declares `vite-plus` as a dependency.
 ///
-/// This replaces the old approach of extracting the main package tarball.
-/// npm will install `vite-plus` and all its transitive deps via `vp install`.
+/// The `packageManager` field pins pnpm to a known-good version, ensuring
+/// consistent behavior regardless of the user's global pnpm version.
+/// pnpm will install `vite-plus` and all its transitive deps via `vp install`.
 pub async fn generate_wrapper_package_json(
     version_dir: &AbsolutePath,
     version: &str,
@@ -99,6 +104,7 @@ pub async fn generate_wrapper_package_json(
         "name": "vp-global",
         "version": version,
         "private": true,
+        "packageManager": PINNED_PNPM_VERSION,
         "dependencies": {
             "vite-plus": version
         }
@@ -108,9 +114,44 @@ pub async fn generate_wrapper_package_json(
     Ok(())
 }
 
+/// Create a local `.npmrc` in the version directory to bypass pnpm's
+/// `minimumReleaseAge` setting that may block installing recently-published packages.
+pub async fn write_release_age_overrides(version_dir: &AbsolutePath) -> Result<(), Error> {
+    let npmrc_path = version_dir.join(".npmrc");
+    tokio::fs::write(&npmrc_path, "minimum-release-age=0\n").await?;
+    Ok(())
+}
+
+/// Write stdout and stderr from a failed install to `upgrade.log`.
+///
+/// The log is written to the **parent** of `version_dir` (i.e. `~/.vite-plus/upgrade.log`)
+/// so it survives the cleanup that removes `version_dir` on failure.
+///
+/// Returns the log file path on success, or `None` if writing failed.
+pub async fn write_upgrade_log(
+    version_dir: &AbsolutePath,
+    stdout: &[u8],
+    stderr: &[u8],
+) -> Option<AbsolutePathBuf> {
+    // Write to parent dir so the log survives version_dir cleanup on failure
+    let parent = version_dir.as_path().parent()?;
+    let log_path = AbsolutePathBuf::new(parent.join("upgrade.log"))?;
+    let stdout_str = String::from_utf8_lossy(stdout);
+    let stderr_str = String::from_utf8_lossy(stderr);
+    let content = format!("=== stdout ===\n{stdout_str}\n=== stderr ===\n{stderr_str}");
+    match tokio::fs::write(&log_path, &content).await {
+        Ok(()) => Some(log_path),
+        Err(e) => {
+            tracing::warn!("Failed to write upgrade log: {}", e);
+            None
+        }
+    }
+}
+
 /// Install production dependencies using the new version's binary.
 ///
 /// Spawns: `{version_dir}/bin/vp install --silent [--registry <url>]` with `CI=true`.
+/// On failure, writes stdout+stderr to `{version_dir}/upgrade.log` for debugging.
 pub async fn install_production_deps(
     version_dir: &AbsolutePath,
     registry: Option<&str>,
@@ -140,12 +181,16 @@ pub async fn install_production_deps(
         .await?;
 
     if !output.status.success() {
-        let stderr = String::from_utf8_lossy(&output.stderr);
+        let log_path = write_upgrade_log(version_dir, &output.stdout, &output.stderr).await;
+        let log_msg = log_path.map_or_else(
+            || String::new(),
+            |p| format!(". See log for details: {}", p.as_path().display()),
+        );
         return Err(Error::Upgrade(
             format!(
-                "Failed to install production dependencies (exit code: {})\n{}",
+                "Failed to install production dependencies (exit code: {}){}",
                 output.status.code().unwrap_or(-1),
-                stderr.trim()
+                log_msg
             )
             .into(),
         ));
@@ -431,4 +476,73 @@ mod tests {
         let result = cleanup_old_versions(&non_existent, 5, &[]).await;
         assert!(result.is_err(), "cleanup_old_versions should error on non-existent dir");
     }
+
+    #[tokio::test]
+    async fn test_write_upgrade_log_creates_log_in_parent_dir() {
+        let temp = tempfile::tempdir().unwrap();
+        // Simulate ~/.vite-plus/0.1.15/ structure
+        let version_dir = AbsolutePathBuf::new(temp.path().join("0.1.15").to_path_buf()).unwrap();
+        tokio::fs::create_dir(&version_dir).await.unwrap();
+
+        let stdout = b"some stdout output";
+        let stderr = b"error: something went wrong";
+
+        let result = write_upgrade_log(&version_dir, stdout, stderr).await;
+        assert!(result.is_some(), "write_upgrade_log should return log path");
+
+        let log_path = result.unwrap();
+        // Log should be in parent dir, not version_dir
+        assert_eq!(
+            log_path.as_path().parent().unwrap(),
+            temp.path(),
+            "upgrade.log should be in parent dir"
+        );
+        assert!(log_path.as_path().exists(), "upgrade.log should exist");
+
+        let content = tokio::fs::read_to_string(&log_path).await.unwrap();
+        assert!(content.contains("=== stdout ==="), "log should have stdout section");
+        assert!(content.contains("some stdout output"), "log should contain stdout");
+        assert!(content.contains("=== stderr ==="), "log should have stderr section");
+        assert!(content.contains("error: something went wrong"), "log should contain stderr");
+
+        // Log should survive version_dir removal
+        tokio::fs::remove_dir_all(&version_dir).await.unwrap();
+        assert!(log_path.as_path().exists(), "upgrade.log should survive version_dir cleanup");
+    }
+
+    #[tokio::test]
+    async fn test_write_upgrade_log_handles_empty_output() {
+        let temp = tempfile::tempdir().unwrap();
+        let version_dir = AbsolutePathBuf::new(temp.path().join("0.1.15").to_path_buf()).unwrap();
+        tokio::fs::create_dir(&version_dir).await.unwrap();
+
+        let result = write_upgrade_log(&version_dir, b"", b"").await;
+        assert!(result.is_some());
+
+        let content = tokio::fs::read_to_string(result.unwrap()).await.unwrap();
+        assert!(content.contains("=== stdout ==="));
+        assert!(content.contains("=== stderr ==="));
+    }
+
+    #[tokio::test]
+    async fn test_write_release_age_overrides_creates_npmrc() {
+        let temp = tempfile::tempdir().unwrap();
+        let version_dir = AbsolutePathBuf::new(temp.path().to_path_buf()).unwrap();
+
+        write_release_age_overrides(&version_dir).await.unwrap();
+
+        // .npmrc (pnpm only — packageManager pins pnpm)
+        let npmrc = tokio::fs::read_to_string(version_dir.join(".npmrc")).await.unwrap();
+        assert!(npmrc.contains("minimum-release-age=0"), ".npmrc should contain pnpm override");
+
+        // No .yarnrc.yml or bunfig.toml (pnpm only)
+        assert!(
+            !version_dir.join(".yarnrc.yml").as_path().exists(),
+            ".yarnrc.yml should not be created"
+        );
+        assert!(
+            !version_dir.join("bunfig.toml").as_path().exists(),
+            "bunfig.toml should not be created"
+        );
+    }
 }

crates/vite_global_cli/src/commands/upgrade/mod.rs

@@ -165,6 +165,11 @@ async fn install_platform_and_main(
     // Generate wrapper package.json that declares vite-plus as a dependency
     install::generate_wrapper_package_json(version_dir, new_version).await?;
 
+    // Isolate from user's global package manager config that may block
+    // installing recently-published packages (e.g. pnpm's minimumReleaseAge,
+    // yarn's npmMinimalAgeGate, bun's minimumReleaseAge)
+    install::write_release_age_overrides(version_dir).await?;
+
     // Install production dependencies (npm installs vite-plus + all transitive deps)
     install::install_production_deps(version_dir, registry).await?;
 

packages/cli/install.ps1

@@ -351,21 +351,22 @@ function Main {
     }
 
     # Generate wrapper package.json that declares vite-plus as a dependency.
-    # npm will install vite-plus and all transitive deps via `vp install`.
+    # pnpm will install vite-plus and all transitive deps via `vp install`.
+    # The packageManager field pins pnpm to a known-good version.
     $wrapperJson = @{
         name = "vp-global"
         version = $ViteVersion
         private = $true
+        packageManager = "pnpm@10.33.0"
         dependencies = @{
             "vite-plus" = $ViteVersion
         }
     } | ConvertTo-Json -Depth 10
     Set-Content -Path (Join-Path $VersionDir "package.json") -Value $wrapperJson
 
-    # Isolate from user's global package manager config that may block
-    # installing recently-published packages (e.g. pnpm's minimumReleaseAge,
-    # npm's min-release-age) by creating a local .npmrc in the version directory.
-    Set-Content -Path (Join-Path $VersionDir ".npmrc") -Value "minimum-release-age=0`nmin-release-age=0"
+    # Isolate from pnpm's global config that may block installing
+    # recently-published packages (e.g. minimumReleaseAge).
+    Set-Content -Path (Join-Path $VersionDir ".npmrc") -Value "minimum-release-age=0"
 
     # Install production dependencies (skip if VP_SKIP_DEPS_INSTALL is set,
     # e.g. during local dev where install-global-cli.ts handles deps separately)

packages/cli/install.sh

@@ -625,24 +625,25 @@ main() {
   fi
 
   # Generate wrapper package.json that declares vite-plus as a dependency.
-  # npm will install vite-plus and all transitive deps via `vp install`.
+  # pnpm will install vite-plus and all transitive deps via `vp install`.
+  # The packageManager field pins pnpm to a known-good version, ensuring
+  # consistent behavior regardless of the user's global pnpm version.
   cat > "$VERSION_DIR/package.json" <<WRAPPER_EOF
 {
   "name": "vp-global",
   "version": "$VP_VERSION",
   "private": true,
+  "packageManager": "pnpm@10.33.0",
   "dependencies": {
     "vite-plus": "$VP_VERSION"
   }
 }
 WRAPPER_EOF
 
-  # Isolate from user's global package manager config that may block
-  # installing recently-published packages (e.g. pnpm's minimumReleaseAge,
-  # npm's min-release-age) by creating a local .npmrc in the version directory.
+  # Isolate from pnpm's global config that may block installing
+  # recently-published packages (e.g. minimumReleaseAge).
   cat > "$VERSION_DIR/.npmrc" <<NPMRC_EOF
 minimum-release-age=0
-min-release-age=0
 NPMRC_EOF
 
   # Install production dependencies (skip if VP_SKIP_DEPS_INSTALL is set,