diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6a556daf3..644db9e66 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,14 @@
 
 ### Fixed
 
+- **`allowScripts` now names R by the identity npm actually matches on.** The
+  entry was `tree-sitter-r@1.3.0`, the alias in `dependencies`, but npm derives
+  the identity from the resolved package in the lockfile —
+  `@davisvaughan/tree-sitter-r@1.3.0`. The old key matched nothing, so the
+  grammar's install script counted as unreviewed and was blocked;
+  `npm ci --strict-allow-scripts` failed on it. Harmless in practice only
+  because the package ships prebuilds for every supported platform. Note the
+  `overrides` key must stay the alias — the two fields key differently.
 - **`graft check` no longer reports every container-tier node as `removed`.**
   `checkGraph` branched on the depth and breadth tiers but never on the container
   tier the build uses for `.vue`, so `genericLangOf` returned null, a `generic!`
diff --git a/node_modules b/node_modules
new file mode 120000
index 000000000..9cf9293fe
--- /dev/null
+++ b/node_modules
@@ -0,0 +1 @@
+/Users/shrishdwivedi/Documents/Context graphs/context-graph-engine/node_modules
\ No newline at end of file
diff --git a/package.json b/package.json
index 0431bbdd2..28d340f72 100644
--- a/package.json
+++ b/package.json
@@ -93,6 +93,6 @@
     "fsevents@2.3.3": true,
     "tree-sitter-kotlin@0.3.8": true,
     "tree-sitter-php@0.23.12": true,
-    "tree-sitter-r@1.3.0": true
+    "@davisvaughan/tree-sitter-r@1.3.0": true
   }
 }