# Extension points — npm/cli

> Canonical page: https://codevetter.com/unpack/cli/extension-points

# Extension points — npm/cli

Scanned commit b317f16c80df02ea3628cfa77170d5ae9b59720c (2026-10-01). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

Extension mechanisms range from internal command registration to project-controlled dependency policy. Command metadata integrates help, parsing, workspace behavior, and nested routing. Arborist mixes independently defined behaviors and supports both declarative and executable manifest repair. These extension points carry different trust and persistence contracts.
- A top-level command plugs into the alphabetically sorted commands table and corresponding lib/commands filename; aliases and abbreviations pass through deref before Npm.cmd loads the class. — [lib/utils/cmd-list.js#L3-6](https://github.com/npm/cli/blob/b317f16c80df02ea3628cfa77170d5ae9b59720c/lib/utils/cmd-list.js#L3-L6) [lib/utils/cmd-list.js#L76-113](https://github.com/npm/cli/blob/b317f16c80df02ea3628cfa77170d5ae9b59720c/lib/utils/cmd-list.js#L76-L113) [lib/utils/cmd-list.js#L144-172](https://github.com/npm/cli/blob/b317f16c80df02ea3628cfa77170d5ae9b59720c/lib/utils/cmd-list.js#L144-L172) [lib/npm.js#L20-29](https://github.com/npm/cli/blob/b317f16c80df02ea3628cfa77170d5ae9b59720c/lib/npm.js#L20-L29)
- BaseCommand metadata provides name, description, params, definitions, subcommands, and positional limits; flags builds types/defaults/aliases from definitions and validates before returning parsed flags and positional arguments. — [lib/base-cmd.js#L5-18](https://github.com/npm/cli/blob/b317f16c80df02ea3628cfa77170d5ae9b59720c/lib/base-cmd.js#L5-L18) [lib/base-cmd.js#L281-330](https://github.com/npm/cli/blob/b317f16c80df02ea3628cfa77170d5ae9b59720c/lib/base-cmd.js#L281-L330) [lib/base-cmd.js#L332-364](https://github.com/npm/cli/blob/b317f16c80df02ea3628cfa77170d5ae9b59720c/lib/base-cmd.js#L332-L364)
- Nested command families register classes through static subcommands objects, as stage and trust demonstrate; execCommandClass recursively removes consumed command names and adjusts flag-parser depth. — [lib/commands/stage/index.js#L7-14](https://github.com/npm/cli/blob/b317f16c80df02ea3628cfa77170d5ae9b59720c/lib/commands/stage/index.js#L7-L14) [lib/commands/trust/index.js#L8-14](https://github.com/npm/cli/blob/b317f16c80df02ea3628cfa77170d5ae9b59720c/lib/commands/trust/index.js#L8-L14) [lib/npm.js#L248-267](https://github.com/npm/cli/blob/b317f16c80df02ea3628cfa77170d5ae9b59720c/lib/npm.js#L248-L267) [lib/npm.js#L297-305](https://github.com/npm/cli/blob/b317f16c80df02ea3628cfa77170d5ae9b59720c/lib/npm.js#L297-L305)
- Global configuration extensions belong in definitions.js as Definition instances; definitions/index.js derives shorthand/default tables and invokes per-definition flatten handlers while preserving registry-scoped settings. — [workspaces/config/lib/definitions/definitions.js#L270-295](https://github.com/npm/cli/blob/b317f16c80df02ea3628cfa77170d5ae9b59720c/workspaces/config/lib/definitions/definitions.js#L270-L295) [workspaces/config/lib/definitions/index.js#L12-32](https://github.com/npm/cli/blob/b317f16c80df02ea3628cfa77170d5ae9b59720c/workspaces/config/lib/definitions/index.js#L12-L32)
- Arborist behavior is composed through a mixins array reduced over EventEmitter, providing a direct internal integration point for tree loading, resolution, rebuilding, and installation strategies. — [workspaces/arborist/lib/arborist/index.js#L24-27](https://github.com/npm/cli/blob/b317f16c80df02ea3628cfa77170d5ae9b59720c/workspaces/arborist/lib/arborist/index.js#L24-L27) [workspaces/arborist/lib/arborist/index.js#L39-50](https://github.com/npm/cli/blob/b317f16c80df02ea3628cfa77170d5ae9b59720c/workspaces/arborist/lib/arborist/index.js#L39-L50)
- Root packageExtensions rules match package names and semver ranges and may change only dependency/peer fields; normal dependencies are add-only, while peer ranges and peer metadata can be repaired. — [workspaces/arborist/lib/package-extensions.js#L9-15](https://github.com/npm/cli/blob/b317f16c80df02ea3628cfa77170d5ae9b59720c/workspaces/arborist/lib/package-extensions.js#L9-L15) [workspaces/arborist/lib/package-extensions.js#L23-61](https://github.com/npm/cli/blob/b317f16c80df02ea3628cfa77170d5ae9b59720c/workspaces/arborist/lib/package-extensions.js#L23-L61) [workspaces/arborist/lib/package-extensions.js#L115-150](https://github.com/npm/cli/blob/b317f16c80df02ea3628cfa77170d5ae9b59720c/workspaces/arborist/lib/package-extensions.js#L115-L150)
- Root .npm-extension.mjs/.cjs exports transformManifest(pkg,context); NpmExtension hashes the selected file, requires synchronous object results, memoizes by package identity, and returns cloned manifests with provenance. — [workspaces/arborist/lib/npm-extension.js#L15-19](https://github.com/npm/cli/blob/b317f16c80df02ea3628cfa77170d5ae9b59720c/workspaces/arborist/lib/npm-extension.js#L15-L19) [workspaces/arborist/lib/npm-extension.js#L64-90](https://github.com/npm/cli/blob/b317f16c80df02ea3628cfa77170d5ae9b59720c/workspaces/arborist/lib/npm-extension.js#L64-L90) [workspaces/arborist/lib/npm-extension.js#L115-138](https://github.com/npm/cli/blob/b317f16c80df02ea3628cfa77170d5ae9b59720c/workspaces/arborist/lib/npm-extension.js#L115-L138) [workspaces/arborist/lib/npm-extension.js#L142-186](https://github.com/npm/cli/blob/b317f16c80df02ea3628cfa77170d5ae9b59720c/workspaces/arborist/lib/npm-extension.js#L142-L186)
- Dependency patches integrate through patchedDependencies resolution during buildIdealTree and application immediately after extraction; patch commands provide edit/commit/update workflows and reject non-registry target specs. — [lib/commands/patch.js#L62-88](https://github.com/npm/cli/blob/b317f16c80df02ea3628cfa77170d5ae9b59720c/lib/commands/patch.js#L62-L88) [lib/commands/patch.js#L108-133](https://github.com/npm/cli/blob/b317f16c80df02ea3628cfa77170d5ae9b59720c/lib/commands/patch.js#L108-L133) [workspaces/arborist/lib/arborist/build-ideal-tree.js#L192-196](https://github.com/npm/cli/blob/b317f16c80df02ea3628cfa77170d5ae9b59720c/workspaces/arborist/lib/arborist/build-ideal-tree.js#L192-L196) [workspaces/arborist/lib/arborist/reify.js#L740-759](https://github.com/npm/cli/blob/b317f16c80df02ea3628cfa77170d5ae9b59720c/workspaces/arborist/lib/arborist/reify.js#L740-L759)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)