fix(v21): repair Windows npm execution policy

[laiqian0239-glitch]

Scope

Implements the Windows npm execution-policy repair authorized by #380.

Authorization merge base: 5b2581183643bb06384fd37aa7eea913650d18f2
Implementation branch: fix/v21-delegated-npm-windows-exec-policy
Authorized changed paths only:

• tests/wp0/v21-delegated-dependency-policy.test.js
• shared/release/implementationBranchPolicy.js

Failure-first evidence

First implementation commit (test-only):
f57d65ee0d262e18a05d5222bfbde687ac7cbf54

Direct parent: 5b2581183643bb06384fd37aa7eea913650d18f2
Only changed path: tests/wp0/v21-delegated-dependency-policy.test.js

Fresh causal RED:

• workflow: Stage 6.4.5.9 WP0 Architecture Gates
• run: 31819715748
• exact head: f57d65ee0d262e18a05d5222bfbde687ac7cbf54
• conclusion: failure
• failing file: tests/wp0/v21-delegated-dependency-policy.test.js
• result in that file: 23 existing tests pass; 2 newly added contracts fail because resolveTrustedNpmInvocation is undefined
• complete WP0 result: 403 tests / 401 pass / 2 fail, with no other test file failing

Required production commit trailers:
Yance-Failure-First-Red-Head: f57d65ee0d262e18a05d5222bfbde687ac7cbf54
Yance-Failure-First-Red-Run: 31819715748
Yance-Failure-First-Red-Conclusion: failure

Root cause and repair

On Windows, the trusted policy currently attempts to execute npm.cmd directly through child_process.execFileSync, which fails with EINVAL. The root repair preserves the existing trusted/offline environment and the same static npm arguments while routing the Windows .cmd through the explicit trusted Windows command interpreter (COMSPEC, falling back to cmd.exe) with /d /c; Unix remains direct npm. No shell:true, no dependency/workflow changes, no second process-runner framework, and no dynamic untrusted command interpolation.

[coderabbitai]

Warning

Review limit reached

@laiqian0239-glitch, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 83 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: f28cde60-cb66-42b3-a28b-a80c3c8fbde1

📥 Commits

Reviewing files that changed from the base of the PR and between 5b25811 and fe3357b.

📒 Files selected for processing (2)

• shared/release/implementationBranchPolicy.js
• tests/wp0/v21-delegated-dependency-policy.test.js

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[laiqian0239-glitch]

{
  "protocolVersion": 1,
  "reviewerMode": "CHATGPT_GITHUB_CONNECTED_SESSION",
  "reviewedHead": "fe3357bb10cc65ee91bfc0da1215221041cae894",
  "decision": "ALLOW_MERGE",
  "p0Count": 0,
  "p1Count": 0,
  "temporaryBypassDetected": false,
  "missingEvidence": [],
  "blockers": [],
  "residualRisks": [],
  "summaryZh": "独立审查绑定 exact head fe3357bb10cc65ee91bfc0da1215221041cae894。PR 净变更仅为授权的 Windows npm 执行策略 production 根修与对应 test-only RED contract；未使用 shell:true、未新增依赖或 workflow、未扩大路径授权、未发现临时绕过。failure-first RED 证据为 f57d65ee0d262e18a05d5222bfbde687ac7cbf54 / run 31819715748 / failure；Windows 本机 targeted contract 25/25 GREEN；exact-head Stage 6.4.5.9、ACV2、WP-A、Model Brain Windows 与 PVEP same-head attestation 均 GREEN，Product Experience Shell 按路由正常 skipped。未发现 P0/P1 blocker。"
}