venv on Windows 11 with Python 3.13.7 includes global paths in sys.path despite include-system-site-packages = false, causing packages to be installed globally instead of in the venv

Bug report

Bug description:

Description

When creating and activating a virtual environment with Python 3.13.7 on Windows 11, sys.path includes global Python paths (e.g., C:\Program Files\Python313\python313.zip, C:\Program Files\Python313\DLLs, etc.), even though pyvenv.cfg has include-system-site-packages = false. This causes python -m pip install <package> to install packages to the global site-packages (C:\Program Files\Python313\Lib\site-packages) instead of the virtual environment's site-packages.

This breaks virtual environment isolation, requiring --target for every install, which is not the expected behavior.

Steps to Reproduce

1. Install Python 3.13.7 from the official Windows installer, ensuring "Add python.exe to PATH" is checked.

2. Open PowerShell 7.5.2.

3. Create a test directory and virtual environment:
   mkdir test_venv_bug
   cd test_venv_bug
   python -m venv .venv

4. Activate the virtual environment:
   ..venv\Scripts\Activate.ps1

5. Check sys.path:
   python -c "import sys; print('\n'.join(sys.path))"

Expected: Only venv paths (e.g., C:\path\to\test_venv_bug\.venv, C:\path\to\test_venv_bug\.venv\Lib\site-packages).

6. Check pyvenv.cfg (should have include-system-site-packages = false):
   Get-Content .venv\pyvenv.cfg

7. Install a test package:
   python -m pip install requests

8. Verify installation location:
   python -m pip list
   Get-ChildItem -Path .venv\Lib\site-packages | findstr requests
   Get-ChildItem -Path 'C:\Program Files\Python313\Lib\site-packages' | findstr requests

Expected: requests in .venv\Lib\site-packages; nothing in global.

Expected Behavior

• sys.path should only include virtual environment paths (no global C:\Program Files\Python313* paths).
• python -m pip install should install to .venv\Lib\site-packages.

Actual Behavior

• sys.path includes global paths:
  • C:\Program Files\Python313\python313.zip
  • C:\Program Files\Python313\DLLs
  • C:\Program Files\Python313\Lib
  • C:\Program Files\Python313
  • C:\Users\jdstr\Documents\GitHub\ndx_scalper.git.venv_ndx_scalper
  • C:\Users\jdstr\Documents\GitHub\ndx_scalper.git.venv_ndx_scalper\Lib\site-packages
• python -m pip install requests installs to global site-packages (C:\Program Files\Python313\Lib\site-packages), with warnings like "Target directory C:\Program Files\Python313\Lib\site-packages\certifi already exists."
• python -m pip list in venv shows only pip; packages are missing in venv.

Environment

• Python version: 3.13.7 (installed via official Windows installer)
• OS: Windows 11 24H2 (Build 26100.5074)
• Shell: PowerShell 7.5.2
• pyvenv.cfg contents:

home = C:\Program Files\Python313
include-system-site-packages = false
version = 3.13.7
executable = C:\Program Files\Python313\python.exe
command = C:\Program Files\Python313\python.exe -m venv C:\Users\jdstr\Documents\GitHub\ndx_scalper.git.venv_ndx_scalper

• Activated venv prompt: (.venv) PS ...
• Get-Command python and Get-Command pip point to venv Scripts\python.exe and Scripts\pip.exe.

Additional Notes

• Using --target=.venv\Lib\site-packages works as a workaround, but it's cumbersome.
• Searched GitHub issues and Stack Overflow—no exact match, but similar to older Windows venv path leaks (e.g., pip #11154).
• No antivirus or custom configs interfering (standard setup).

Minimal Reproducible Example

See "Steps to Reproduce" above. The test directory can be zipped and attached if needed.

Thanks for looking into this—it's breaking venv isolation on Windows.

CPython versions tested on:

3.13

Operating systems tested on:

Windows

Beginne damit, den Bericht mit python -m venv, der aktivierten Scripts\python.exe und der angegebenen Python-3.13.7-Windows-Umgebung nachzustellen. Vergleiche sys.path, pyvenv.cfg und die von python -m pip gemeldeten Zielpfade; als erledigt gilt es, wenn Systempfade ausgeschlossen werden, sobald include-system-site-packages = false gesetzt ist, und die Installationen in der venv verbleiben.