feat(cli): resolve node, java and npm tools from the tool-versions data

docs/custom-registries.md

@@ -203,7 +203,6 @@ https://github.com/containerbase/mono-prebuild/releases/download/6.14.1/mono-6.1
 https://github.com/containerbase/mono-prebuild/releases/download/6.14.1/mono-6.14.1-jammy-x86_x64.tar.xz
 https://github.com/containerbase/mono-prebuild/releases/download/6.14.1/mono-6.14.1-jammy-aarch64.tar.xz.sha512
 https://github.com/containerbase/mono-prebuild/releases/download/6.14.1/mono-6.14.1-jammy-aarch64.tar.xz
-https://github.com/containerbase/mono-prebuild/releases/latest/download/version
 ```
 
 #### `nuget`

package.json

@@ -54,6 +54,7 @@
     "got": "15.1.0",
     "ini": "7.0.0",
     "inversify": "8.2.3",
+    "ms": "2.1.3",
     "node-ipc": "12.0.0",
     "pino": "10.4.0",
     "pino-pretty": "13.2.0",
@@ -71,6 +72,7 @@
     "@types/common-tags": "1.8.4",
     "@types/global-agent": "3.0.0",
     "@types/ini": "4.1.1",
+    "@types/ms": "2.1.0",
     "@types/node": "24.19.2",
     "@types/node-ipc": "9.2.3",
     "@types/semver": "7.8.0",

src/cli/command/install-npm.spec.ts

@@ -35,6 +35,13 @@ describe('cli/command/install-npm', () => {
 
     vi.stubEnv('DEL_CLI_VERSION', '5.0.0');
     expect(await cli.run(['del-cli'])).toBe(0);
+    // install-npm never reads the tool-versions data
+    expect(mocks.resolveVersion).toHaveBeenLastCalledWith(
+      'del-cli',
+      '5.0.0',
+      'npm',
+      false,
+    );
     expect(mocks.installTool).toHaveBeenCalledTimes(2);
     expect(mocks.installTool).toHaveBeenCalledWith(
       'del-cli',

src/cli/command/install-tool.spec.ts

@@ -38,6 +38,13 @@ describe('cli/command/install-tool', () => {
     );
     vi.stubEnv('NODE_VERSION', '16.13.0');
     expect(await cli.run(['node'])).toBe(0);
+    // install-tool may read the tool-versions data
+    expect(mocks.resolveVersion).toHaveBeenLastCalledWith(
+      'node',
+      '16.13.0',
+      undefined,
+      true,
+    );
     expect(mocks.installTool).toHaveBeenCalledTimes(1);
     expect(mocks.installTool).toHaveBeenCalledWith(
       'node',

src/cli/command/install-tool.ts

@@ -75,7 +75,15 @@ export class InstallToolCommand extends Command {
       logger.debug(
         `Try resolving version for ${this.name}@${version ?? 'latest'} ...`,
       );
-      version = await resolveVersion(this.name, version, type);
+      // only `install-tool` reads the tool-versions data, `install-gem`,
+      // `install-npm` and `install-pip` set `this.type` and always ask their
+      // registry
+      version = await resolveVersion(
+        this.name,
+        version,
+        type,
+        this.type === undefined,
+      );
 
       if (!isNonEmptyStringAndNotWhitespace(version)) {
         error = true;

src/cli/install-tool/index.spec.ts

@@ -3,6 +3,7 @@ import { beforeAll, describe, expect, test, vi } from 'vitest';
 import {
   IpcServer,
   PathService,
+  ToolVersionsService,
   VersionService,
   createContainer,
 } from '../services/index.ts';
@@ -241,6 +242,61 @@ describe('cli/install-tool/index', () => {
       vi.spyOn(svc.prototype, 'resolve').mockResolvedValue('1.0.0');
       expect(await resolveVersion('dummy', '1.0.0', type)).toBe('1.0.0');
     });
+
+    test.each(['flux', 'pnpm', 'npm', 'yarn'])(
+      'resolves install-npm %s with the registry, not the tool-versions data',
+      async (tool) => {
+        // the data has a file with the name of the package
+        await fs.mkdir(rootPath('usr/local/containerbase/tool-versions/v1'), {
+          recursive: true,
+        });
+        await fs.writeFile(
+          rootPath(`usr/local/containerbase/tool-versions/v1/${tool}.json`),
+          JSON.stringify({
+            tool,
+            updatedAt: '2026-10-16T00:00:00Z',
+            type: 'npm',
+            latest: '9.9.9',
+            versions: [{ version: '9.9.9' }],
+          }),
+        );
+        const embedded = vi.spyOn(ToolVersionsService.prototype, 'getVersions');
+        const data = vi.spyOn(
+          ToolVersionsService.prototype,
+          'getResolveVersions',
+        );
+        // the yarn resolver of install-tool is used for `yarn` too
+        vi.spyOn(NpmVersionResolver.prototype, 'resolve').mockResolvedValue(
+          '1.2.3',
+        );
+
+        // install-npm turns the data off
+        expect(await resolveVersion(tool, 'latest', 'npm', false)).toBe(
+          '1.2.3',
+        );
+
+        expect(embedded).not.toHaveBeenCalled();
+        expect(data).not.toHaveBeenCalled();
+      },
+    );
+
+    test.each([
+      { tool: 'php', version: '8.3', type: 'npm' as const },
+      { tool: 'php', version: '8.3.10', type: 'npm' as const },
+      { tool: 'mise', version: '2026.10', type: 'pip' as const },
+      { tool: 'mise', version: '2026.10.21', type: 'pip' as const },
+    ])(
+      'keeps install-$type $tool $version without the tool-versions data',
+      async ({ tool, version, type }) => {
+        // the latest-only resolver of install-tool answers, it keeps any
+        // version but `latest`
+        const embedded = vi.spyOn(ToolVersionsService.prototype, 'getVersions');
+
+        expect(await resolveVersion(tool, version, type, false)).toBe(version);
+
+        expect(embedded).not.toHaveBeenCalled();
+      },
+    );
   });
 
   describe('linkTool', () => {

src/cli/install-tool/index.ts

@@ -453,12 +453,17 @@ export async function linkTool(
 
 /**
  * Resolves the version to install, eg. `latest` to a concrete version. For a
- * `gem`, `npm` or `pip` type, a generic resolver is registered first.
+ * `gem`, `npm` or `pip` type, a generic resolver is registered after the tool
+ * resolvers, so a tool's own resolver wins.
+ * @param data - whether the resolvers may read the tool-versions data first:
+ * true for `install-tool`, false for `install-gem`, `install-npm` and
+ * `install-pip`, which always ask their registry
  */
 export async function resolveVersion(
   tool: string,
   version: string | undefined,
   type?: InstallToolType,
+  data = true,
 ): Promise<string | undefined> {
   const container = prepareResolveContainer();
 
@@ -468,7 +473,7 @@ export async function resolveVersion(
       .to(createGenericVersionResolver(type, tool));
   }
   const svc = await container.getAsync(ToolVersionResolverService);
-  return svc.resolve(tool, version);
+  return svc.resolve(tool, version, data);
 }
 
 interface UninstallToolConfig {