fix(@angular/cli): refine min-release-age version selection

Follow-up to the previous commit, addressing review feedback.

- Skip the metadata fetch for explicit version specifiers when a
  cooldown is configured. The package manager itself enforces the
  cooldown at install time, and an extra registry round-trip just
  slows down the common case (`ng add foo@1.2.3`).
- Pass `includePrerelease: true` to `maxSatisfying` on the tag
  fallback path so `next` does not silently downgrade to a stable
  release when its current pointer is too new.
- Detect a `.git` repo root by existence rather than `isDirectory()`
  so the `.npmrc` walk also stops at submodule and worktree roots,
  where `.git` is a regular file containing a `gitdir:` pointer.

New unit tests cover the prerelease fallback and the gitfile case.

Author: crimsondhaks

packages/angular/cli/src/package-managers/min-release-age.ts

@@ -67,10 +67,12 @@ async function readNpmrcChain(
     directoriesToVisit.push(currentDir);
 
     // Stop walking when we reach a git repository root, mirroring `discovery.ts`.
+    // `.git` may be a directory (regular repo), a file (submodules and
+    // worktrees use a `gitdir:` pointer file), or absent. We just need to
+    // know whether it exists; `host.stat` rejects when it doesn't.
     try {
-      if ((await host.stat(join(currentDir, '.git'))).isDirectory()) {
-        break;
-      }
+      await host.stat(join(currentDir, '.git'));
+      break;
     } catch {
       // No `.git` here; continue searching upwards.
     }

packages/angular/cli/src/package-managers/min-release-age_spec.ts

@@ -77,6 +77,18 @@ describe('getMinReleaseAgeMs', () => {
     ).toBe(2 * MS_PER_DAY);
   });
 
+  it('treats a `.git` file as a repo root (git submodules and worktrees)', async () => {
+    const host = new MockHost();
+    // In a submodule or worktree `.git` is a regular file containing a
+    // `gitdir:` pointer, not a directory. The walk must still stop here.
+    host.setFile('/repo/.git', 'gitdir: /elsewhere/.git/modules/repo\n');
+    host.setFile('/repo/.npmrc', 'min-release-age=4\n');
+
+    expect(await getMinReleaseAgeMs(host, '/repo', SUPPORTED_PACKAGE_MANAGERS.npm)).toBe(
+      4 * MS_PER_DAY,
+    );
+  });
+
   it('returns 0 for non-positive or non-numeric values', async () => {
     const host = new MockHost();
     host.setDirectory('/project/.git');

packages/angular/cli/src/package-managers/package-manager.ts

@@ -534,14 +534,14 @@ export class PackageManager {
 
         // We only need to resolve the version locally when:
         // 1. The package manager requires it (e.g. yarn-classic), OR
-        // 2. A `minReleaseAge` cooldown is configured. In that case, even for
-        //    `range`/`tag` specifiers we must filter out versions newer than
-        //    the cutoff; otherwise the package manager would refuse to install
-        //    the version we picked.
+        // 2. A `minReleaseAge` cooldown is configured AND the spec is a `tag`
+        //    or `range`. For an explicit version we skip the extra metadata
+        //    lookup; if the version is too new the package manager itself
+        //    will reject the install with a clearer error than we could give.
         const needsLocalResolution =
           (this.descriptor.requiresManifestVersionLookup &&
             (type === 'tag' || type === 'range' || !fetchSpec)) ||
-          minReleaseAgeMs > 0;
+          (minReleaseAgeMs > 0 && (type === 'tag' || type === 'range'));
 
         if (needsLocalResolution) {
           const metadata = await this.getRegistryMetadata(name, options);
@@ -613,15 +613,19 @@ export class PackageManager {
    * release age cooldown.
    *
    * Behavior summary:
-   * - `version`: returns the requested version, or `null` when it is too new.
-   *   The caller asked for an exact version, so we don't second-guess them.
    * - `tag`: resolves the tag, then returns it directly when it is old enough.
    *   When it is too new, falls back to the newest version that satisfies the
    *   cooldown, so commands like `ng update` and `ng add` can still proceed.
    * - `range`: returns the newest version in the range that is old enough.
    *
+   * Note: this is not called for explicit `version` specifiers when a
+   * cooldown is configured (the manifest endpoint is used directly and the
+   * package manager enforces the cooldown at install time).
+   *
    * @param metadata The package metadata returned by the registry.
-   * @param type The specifier type (`tag`, `range`, or `version`).
+   * @param type The specifier type (`tag` or `range`). `version` is only
+   *   passed when `requiresManifestVersionLookup` is set, in which case the
+   *   cooldown is `0` and we just echo the version back.
    * @param spec The tag, range, or version requested by the caller.
    * @param minReleaseAgeMs The cooldown in milliseconds. `0` disables filtering.
    * @returns A concrete version string, or `null` when no version qualifies.
@@ -664,10 +668,15 @@ export class PackageManager {
       return Number.isNaN(publishedMs) ? true : publishedMs <= cutoff;
     };
 
+    // Pass `includePrerelease` so prereleases are eligible. This matters when
+    // the resolved tag points at a prerelease (e.g. `next`); otherwise the
+    // fallback would silently downgrade to a stable release.
+    const semverOptions = { includePrerelease: true };
+
     if (type === 'range') {
       const eligible = metadata.versions.filter(isOldEnough);
 
-      return maxSatisfying(eligible, spec) ?? null;
+      return maxSatisfying(eligible, spec, semverOptions) ?? null;
     }
 
     if (isOldEnough(spec)) {
@@ -679,10 +688,11 @@ export class PackageManager {
       // that satisfies the cooldown so the command can still complete.
       const eligible = metadata.versions.filter(isOldEnough);
 
-      return maxSatisfying(eligible, '*') ?? null;
+      return maxSatisfying(eligible, '*', semverOptions) ?? null;
     }
 
-    // Exact version requested but it's too new: signal "no installable version".
+    // Should not be reachable: callers no longer pass an explicit `version`
+    // with a cooldown configured. Returning `null` is the safe default.
     return null;
   }
 

packages/angular/cli/src/package-managers/package-manager_spec.ts

@@ -188,20 +188,27 @@ describe('PackageManager', () => {
       expect(manifest?.version).toBe('21.3.0');
     });
 
-    it('returns null when an explicit version is younger than the cooldown', async () => {
+    it('does not fetch metadata for an explicit version even when a cooldown is configured', async () => {
       spyOn(host, 'readFile').and.callFake((path: string) => {
         if (path === '/tmp/.npmrc') {
           return Promise.resolve('min-release-age=7\n');
         }
 
         return Promise.reject(new Error('not found'));
       });
-      mockMetadataResponse();
+      runCommandSpy.and.resolveTo({
+        stdout: JSON.stringify({ name: 'foo', version: '21.4.0' }),
+        stderr: '',
+      });
 
       const pm = new PackageManager(host, '/tmp', descriptor);
       const manifest = await pm.getManifest('foo@21.4.0');
 
-      expect(manifest).toBeNull();
+      // Hit `getRegistryManifest` directly. The package manager enforces the
+      // cooldown at install time; the CLI should not second-guess an explicit
+      // version, since that would block legitimate use cases like pinning.
+      expect(manifest?.version).toBe('21.4.0');
+      expect(runCommandSpy).toHaveBeenCalledTimes(1);
     });
 
     it('does not call `getRegistryMetadata` when no cooldown is configured', async () => {
@@ -218,5 +225,50 @@ describe('PackageManager', () => {
       // A single call: directly to `getRegistryManifest`. No metadata lookup.
       expect(runCommandSpy).toHaveBeenCalledTimes(1);
     });
+
+    it('keeps prereleases eligible when falling back from a prerelease tag', async () => {
+      spyOn(host, 'readFile').and.callFake((path: string) => {
+        if (path === '/tmp/.npmrc') {
+          return Promise.resolve('min-release-age=7\n');
+        }
+
+        return Promise.reject(new Error('not found'));
+      });
+
+      const metadata = {
+        name: 'foo',
+        'dist-tags': { next: '22.0.0-next.5', latest: '21.3.0' },
+        versions: ['21.3.0', '22.0.0-next.4', '22.0.0-next.5'],
+        time: {
+          // Stable older release.
+          '21.3.0': new Date(now - 30 * MS_PER_DAY).toISOString(),
+          // Older prerelease, eligible.
+          '22.0.0-next.4': new Date(now - 15 * MS_PER_DAY).toISOString(),
+          // Newest prerelease, blocked by the cooldown.
+          '22.0.0-next.5': new Date(now - 1 * MS_PER_DAY).toISOString(),
+        },
+      };
+
+      runCommandSpy.and.callFake((_binary: string, args: readonly string[]) => {
+        const versionedSpec = args.find((a) => /^foo@\S+/.test(a));
+        if (!versionedSpec) {
+          return Promise.resolve({ stdout: JSON.stringify(metadata), stderr: '' });
+        }
+
+        const requestedVersion = /^foo@(\S+)/.exec(versionedSpec)?.[1] ?? '';
+
+        return Promise.resolve({
+          stdout: JSON.stringify({ name: 'foo', version: requestedVersion }),
+          stderr: '',
+        });
+      });
+
+      const pm = new PackageManager(host, '/tmp', descriptor);
+      const manifest = await pm.getManifest('foo@next');
+
+      // Should pick the older prerelease, not silently downgrade to a stable
+      // version that the user never asked for.
+      expect(manifest?.version).toBe('22.0.0-next.4');
+    });
   });
 });