fix: write registry allowScripts keys under install-strategy=linked

[manzoorwanijk]

Under install-strategy=linked, npm install-scripts approve <pkg> wrote verbose, duplicated file: entries pointing into node_modules/.store (one per incoming symlink depth) instead of name@version pins, and those store-path entries never matched at install time.

There are two root causes.
In findNodesForArgs (allow-scripts-cmd.js), positional args matched every Link pointing at the store package; each Link's relative file:.store/... resolved spec became its own policy key and could even strip the correct pin as stale.
In script-allowed.js, a store package has no edgesIn (they land on its incoming Links), so isRegistryNode refused registry keys, and ls, the post-install advisory, and prune treated a correct name@version entry as matching nothing.

The fix skips Link nodes when matching positional args, mirroring collectUnreviewedScripts and prune, so approvals key off the real package's trusted registry identity.
isRegistryNode and nameFromEdges now delegate edge-based checks to a link target's incoming Links, which also covers omit-lockfile-registry-resolved (approve by name, like the hoisted #9558 path).
resolvedSourceSpecs no longer fabricates file: specs from links into the store, so store packages are never keyed by store paths and prune cleans up the buggy entries while keeping the valid pin.

References

Fixes #9939

[manzoorwanijk]

@reggi this probably needs a label for v11 backport.

[nikolawork]

Thanks for the quick fix! However it doesn't add the version number in allowScripts:

// expected:
"allowScripts": {
	"esbuild@0.28.1": true
}

// actual
"allowScripts": {
	"esbuild": true
}

I installed the fix locally using a local copy of the repo with this branch:

➜ npm -v
11.19.0

➜ node npm/bin/npm-cli.js -v
12.0.2

Then, both of these commands gave me the output above:

➜ node npm/bin/npm-cli.js install-script approve esbuild@0.28.1

➜ node npm/bin/npm-cli.js install-script approve esbuild

[manzoorwanijk]

it doesn't add the version number in allowScripts:

It works perfectly fine

Screen.Recording.2026-09-01.at.3.15.02.PM.mov

npm-dev is an alias that I have created for local clone.

[nikolawork]

However it doesn't add the version number in allowScripts

Let's chalk it up to me not setting up the npm version from this PR properly

[nikolawork]

I see that #9940 has a fix solely for the deduping (same fix as you have in ‎lib/utils/allow-scripts-cmd.js) as well as some tests for that specific use case. Do we test for deduping in the current PR as well?

[manzoorwanijk]

I see that #9940 has a fix solely for the deduping (same fix as you have in ‎lib/utils/allow-scripts-cmd.js) as well as some tests for that specific use case. Do we test for deduping in the current PR as well?

Yes, it covers many other cases as well.