From 6de6e1476694a0f696f8ea7284afa782ef3d989c Mon Sep 17 00:00:00 2001
From: Alex Matthews <2862661+qoole@users.noreply.github.com>
Date: Tue, 25 Aug 2026 21:17:04 +0100
Subject: [PATCH] fix: key allowScripts for R by its resolved name, not the
 alias
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The entry was `tree-sitter-r@1.3.0` — the alias used in `dependencies` — but
npm derives the trusted identity from the resolved package in the lockfile,
which is `@davisvaughan/tree-sitter-r@1.3.0`. The old key therefore matched
nothing, the grammar's install script counted as unreviewed, and
`npm ci --strict-allow-scripts` failed with ESTRICTALLOWSCRIPTS. With the key
corrected it installs clean.

This has been latent rather than breaking because the package ships prebuilds
for every supported platform, so a blocked `node-gyp-build` still resolved a
binary.

The `overrides` key must stay the alias `tree-sitter-r`; overrides are keyed by
the dependency name in the tree, allowScripts by the resolved package. The two
fields deliberately differ here.
---
 CHANGELOG.md | 13 +++++++++++++
 package.json |  2 +-
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index a54410bcd..cbb91efe6 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,18 @@
 # Changelog
 
+## Unreleased
+
+### Fixed
+
+- **`allowScripts` now names R by the identity npm actually matches on.** The
+  entry was `tree-sitter-r@1.3.0`, the alias in `dependencies`, but npm derives
+  the identity from the resolved package in the lockfile —
+  `@davisvaughan/tree-sitter-r@1.3.0`. The old key matched nothing, so the
+  grammar's install script counted as unreviewed and was blocked;
+  `npm ci --strict-allow-scripts` failed on it. Harmless in practice only
+  because the package ships prebuilds for every supported platform. Note the
+  `overrides` key must stay the alias — the two fields key differently.
+
 ## 0.13.0
 
 ### Added
diff --git a/package.json b/package.json
index 3cc4709d9..d77f09a13 100644
--- a/package.json
+++ b/package.json
@@ -93,6 +93,6 @@
     "fsevents@2.3.3": true,
     "tree-sitter-kotlin@0.3.8": true,
     "tree-sitter-php@0.23.12": true,
-    "tree-sitter-r@1.3.0": true
+    "@davisvaughan/tree-sitter-r@1.3.0": true
   }
 }