[martinrrm]

Summary

• Prevent the PowerShell npm and npx shims from interpolating the selected Node executable or CLI path into evaluated source.
• Reparse the user's original PowerShell argument syntax through a script block that references executable paths only through variables, preserving quotes, environment expansion, backtick escaping, pipelines, and redirection.
• Run the script block in the wrapper scope so the native process's exact exit code is preserved for both npm and npx.
• Remove project-level prefix before project configuration is loaded, so a repository .npmrc cannot redirect CLI selection.

Regression coverage

• Paths containing PowerShell subexpressions and single quotes are not evaluated.
• Single-quoted arguments, environment variables, backtick escapes, pipelines, and stderr redirection retain PowerShell semantics.
• npm and npx preserve a native exit status of 7.
• Project prefix is logged as prohibited but cannot affect the effective prefix.

Validation

• Full @npmcli/config tests, lint, and postlint pass locally.
• Focused Windows shim tests and root lint pass locally; PowerShell runtime cases are skipped on Linux.
• Windows PowerShell and PowerShell 7 coverage is running in CI.

Refs github/npm#15799, finding CLI-CROW-CMD-002.

Draft intentionally while the refreshed cross-platform CI matrix completes.

[Copilot]

🟡 Changes recommended

Expanded configuration keys and project-controlled user/global config paths still bypass prefix filtering, allowing repositories to redirect CLI selection.

3 open issues

• Prevent alternate config files from redirecting CLI selection · New
• Expand config keys before filtering project-controlled prefix · New
• Preserve raw prefix entries when saving project config · New

What changed in this PR

This PR hardens npm and npx’s PowerShell launchers by keeping executable paths out of evaluated source while preserving argument syntax and native exit codes. It also filters direct project-level prefix settings during configuration loading.

Changes:

• Replace Invoke-Expression with variable-based script blocks executed in the wrapper scope.
• Ignore direct project prefix entries while retaining the prohibited-setting error.
• Add regression coverage for special-character paths, PowerShell syntax, exit codes, and prefix precedence.

File	Description
workspaces/​config/​test/​index.js	Assert that project prefix settings do not affect configuration precedence.
workspaces/​config/​lib/​index.js	Remove direct project prefix entries before loading configuration.
test/​bin/​windows-shims.js	Expand shim regression cases and update PowerShell process invocation.
bin/​npx.ps1	Invoke npx through a script block that references paths via variables.
bin/​npm.ps1	Invoke npm through a script block that references paths via variables.

_{Review effort: Max}

[Copilot]

🟡 Changes recommended

The globalconfig documentation still lists project-level prefix as a source of globalPrefix, contradicting the updated behavior that ignores it.

1 open issue

• Remove project from documented globalPrefix sources · New

3 resolved since last review

• Expand config keys before filtering project-controlled prefix
• Prevent alternate config files from redirecting CLI selection
• Preserve raw prefix entries when saving project config

_{Review effort: Max}