[martinrrm]

Summary

• Add npm approve-scripts, npm deny-scripts, and the npm install-scripts approve/deny/list/prune workflow for reviewing dependency lifecycle scripts.
• Match and write policy entries from trusted resolver identities for registry, remote tarball, git, file, and linked-store dependencies instead of package-controlled manifest fields or internal .store paths.
• Preserve deny-wins behavior across equivalent file paths and linked installs while retaining compatibility with existing file policy spellings.
• Dereference and deduplicate linked targets, retain link names as selectors, and support exact source selectors for ambiguous dependencies.
• Keep exact git selectors commit-aware, honor linked-store registry denies, and allow an explicitly selected identity to approve multi-link file targets.
• Document source-specific approval, denial, listing, pruning, and pinning behavior.

Regression coverage

• Registry identity and alias trust boundaries, remote URL exactness, hosted git commits, local path equivalence, and malformed sources.
• Linked install/store identities, deny-wins behavior, exact selectors, ambiguous names, multiple link identities, and pruning.
• Rebuild/reify lifecycle enforcement and command output for approve, deny, list, and JSON modes.

Validation

• Full @npmcli/arborist tests pass locally with 100% statements, branches, functions, and lines; lint and postlint pass.
• Full @npmcli/config and docs workspace tests, lint, and postlint pass locally.
• Focused root approve/install/writer tests and root lint pass locally.
• Refreshed cross-platform CI is running.

Fixes #9738.

Draft intentionally while the refreshed CI matrix completes.

[Copilot]

🟡 Changes recommended

Critical source-identity matching and Git-pinning flaws can authorize scripts for unrelated paths, replacement tarballs, or unapproved commits.

5 open issues

• Apply git pinning and cleanup to explicit selectors · New
• Resolve flattened link specs relative to their original link directory · New
• Do not authorize tarball install paths as source identities · New
• Require explicit non-registry allowance for linked targets · New
• Prioritize file identities over registry-backed transitive matches · New

What changed in this PR

This PR updates npm’s install-script approval workflow to use trusted dependency source identities, addressing remote-tarball approvals reported in #9738.

Changes:

• Updates source matching and policy writing for remote, git, file, and linked dependencies.
• Adds source-aware selectors, ambiguity checks, and clearer pending-script output.
• Expands regression coverage and documents source-specific approval, denial, and pinning.

File	Description
workspaces/​config/​lib/​definitions/​definitions.js	Clarifies source-specific denial behavior.
workspaces/​arborist/​test/​unreviewed-scripts.js	Tests linked-directory review status.
workspaces/​arborist/​test/​script-allowed.js	Expands file identity and path-matching coverage.
workspaces/​arborist/​test/​arborist/​reify.js	Updates the linked lifecycle approval identity.
workspaces/​arborist/​test/​arborist/​rebuild.js	Tests linked-source lifecycle enforcement and compatibility.
workspaces/​arborist/​lib/​script-allowed.js	Adds lockfile file identities and revises source matching.
test/​lib/​utils/​allow-scripts-writer.js	Tests trusted policy keys and deny precedence.
test/​lib/​commands/​install-scripts.js	Covers source selectors, ambiguity, and command output.
test/​lib/​commands/​approve-scripts.js	Updates provenance fixtures and linked-source expectations.
tap-snapshots/​test/​lib/​docs.js.test.cjs	Refreshes the denial configuration documentation snapshot.
lib/​utils/​allow-scripts-writer.js	Writes source-aware approval and denial keys.
lib/​utils/​allow-scripts-cmd.js	Adds source selection, link deduplication, and ambiguity handling.
docs/​lib/​content/​commands/​npm-install-scripts.md	Documents source-aware workflow behavior.
docs/​lib/​content/​commands/​npm-deny-scripts.md	Explains source-specific denial identities.
docs/​lib/​content/​commands/​npm-approve-scripts.md	Explains trusted selectors and pinning behavior.

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

File-source handling blocks approval and denial of linked-install tarball targets and hides the exact selectors needed for targets with multiple trusted file identities.

1 open issue

• Preserve tarball identities for linked-strategy targets · New

1 previously missed issue

In code that hasn't changed since last review

Expose multiple trusted file identities in listings and errors

lib/​utils/​allow-scripts-cmd.js:61

For a target with multiple trusted file identities, versionedKeyFor() returns null, so ls prints [untrusted source] and JSON exposes only the bare name. Approving that name then fails with ENOMATCH, leaving the supported exact selectors undiscoverable through the documented workflow. Show the choices from filePolicyIdentities(node) in listings and in the error when bare-name approval cannot choose one identity.

5 resolved since last review

• Do not authorize tarball install paths as source identities
• Resolve flattened link specs relative to their original link directory
• Apply git pinning and cleanup to explicit selectors
• Prioritize file identities over registry-backed transitive matches
• Require explicit non-registry allowance for linked targets

_{Review effort: Balanced}