[BUG] (CLI-related) npm install ignores explicit prefix

[jameschensmith]

What / Why

I install a package with npm using an explicit prefix, npm ignores the prefix and is using save-prefix instead.

The reason appears to be the npa call on line 893 (v2.2.8 snippet). Currently, it's only passing spec as the argument. This results in an invalid req object as a result of the parse. This req object is no longer the expected type range, but rather tag. When it reaches lines 908-909, range is evaluated to prefixRange.

I think the fix would be to address the npa call on line 893 mentioned above. Below is a possible solution:

    if (this[_resolvedAdd]) {
      const root = this.idealTree
      const pkg = root.package
      for (const { name } of this[_resolvedAdd]) {
-        const req = npa(root.edgesOut.get(name).spec, root.realpath)
+        const req = npa.resolve(name, root.edgesOut.get(name).spec, root.realpath)

When

I install a package with npm using an explicit prefix.

Example

npm i -D typescript@~3.5.0

Current Behavior

After the installation, package.json has "typescript": "^3.5.3".

Expected Behavior

npm should honor the explicit prefix. package.json should have "typescript": "~3.5.3".

References

• [BUG] Unable to install/downgrade with tilde versioning cli#636.
• [BUG] (CLI-related) Specifier without package name is parsed incorrectly npm-package-arg#55.

[jameschensmith]

Ran into an issue with the following change:

    if (this[_resolvedAdd]) {
      const root = this.idealTree
      const pkg = root.package
      for (const { name } of this[_resolvedAdd]) {
-        const req = npa(root.edgesOut.get(name).spec, root.realpath)
+        const req = npa.resolve(name, root.edgesOut.get(name).spec, root.realpath)

If spec is not supplied, * will be passed in. This is not treated as a tag, but rather a valid semver range. This fails at least 14 tests, which don't pass a spec and validate prefixRange is the result. Instead * is the result in package.json. This also follows the code comment on lines 902-906:

• * is a range.
• * is not a subset of prefixRange (at least up to node-semver v7.3.4, only * can be a subset of *)

Therefore the current logic correctly chooses * to place in package.json. Looking for a way to resolve this.