Walkthrough

In makeEnv, the regex used to exclude inherited process.env variables is narrowed from ^npm_ to ^npm_package_, allowing npm_config_* variables to propagate into the lifecycle environment. Additionally, a filter is added to exclude "private" npm_config_* auth and config keys matching the pattern ^npm_config_([/@_]|.*:_ ). The unit test is updated to inject both user-defined npm_config_platform_arch and auth-related npm_config_* variants, assert that the user-defined value is preserved while auth keys are filtered out, and clean up via try/finally.

Changes

makeEnv env-var filter narrowing and auth key filtering

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

🐇 A filter refined, auth secrets now gone,
While user configs carry bravely on!
The package vars still screened with care,
Private npm_config_ keys vanish in air.
One regex tightened, one test to declare —
The rabbit guards env with precision and flair! ✨

❌ Failed checks (1 warning)

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

• X
• Mastodon
• Reddit
• LinkedIn

• Preserve user-defined npm_config_* variables when building lifecycle child environments.
• Narrow env-var stripping to only remove regenerated npm_package_* keys.
• Add regression test ensuring custom npm_config_* survives makeEnv().

The following are alternative approaches to this PR:

Recommendation: Keep the PR’s approach: makeEnv only needs to strip variables it regenerates (npm_package_). This minimizes behavior change, avoids resurrecting the removed opts.config→npm_config_ injection, and fixes the regression where user-defined npm_config_* values were silently dropped.

index.js Only strip npm_package_* from process.env when building child env +1/-1

Only strip npm_package_* from process.env when building child env

• Updates makeEnv() to stop removing all npm_* variables from the inherited environment. The filter now removes only npm_package_* keys, which are the ones makeEnv regenerates from package data, preserving user-provided npm_config_* variables.

index.js

---

index.js Regression test for preserving user-defined npm_config_* vars +17/-11

Regression test for preserving user-defined npm_config_* vars

• Extends the makeEnv test to set process.env.npm_config_platform_arch and assert it remains present in the generated env. Uses a try/finally cleanup to avoid leaking environment state across tests.

test/index.js

---