Fix npm allowScripts name-only key matching for rewritten packages

Name-only allowScripts keys (like "pkg": true) should not match packages
rewritten to hosted or file tarballs. npm 12 requires exact source identity
for non-registry sources, so name-only approvals don't keep scripts running
after rewriting.

Changes:
- verdict() now returns false for NameOnly keys when version is None
- lost_detail() remedy no longer suggests adding a name-only key
- Updated tests to reflect the corrected behavior

Fixes bug cb082c15-64e0-4f65-80b4-5945ba43fcf6

Author: cursoragent

crates/socket-patch-core/src/patch/redirect/npm_allow_scripts.rs

@@ -123,7 +123,10 @@ impl AllowScripts {
                 continue;
             }
             let matches = match (kind, version) {
-                (KeyKind::NameOnly, _) => true,
+                // NameOnly keys match registry packages but not file/hosted
+                // tarballs (which require exact source identity).
+                (KeyKind::NameOnly, Some(_)) => true,
+                (KeyKind::NameOnly, None) => false,
                 (KeyKind::Pinned(pins), Some(v)) => pins
                     .iter()
                     .any(|pin| pin.cmp_precedence(v) == Ordering::Equal),
@@ -251,11 +254,14 @@ pub fn lost_detail(name: &str, version: &str, lost: &LostApproval, target: &str)
         ));
     }
     let remedy = if lost.denies.is_empty() {
-        format!("approve the package by name (`\"{name}\": true`) in package.json `allowScripts`")
+        "pin the package to the exact tarball URL in package.json `allowScripts` (npm does not \
+         support this well), or accept that the script will not run"
+            .to_string()
     } else {
         format!(
-            "remove its version-pinned deny entries and approve the package by name \
-             (`\"{name}\": true`) in package.json `allowScripts`"
+            "remove its version-pinned deny entries from package.json `allowScripts` (the \
+             script will not run unless you pin to the exact tarball URL, which npm does not \
+             support well)"
         )
     };
     format!(
@@ -292,14 +298,21 @@ mod tests {
     }
 
     #[test]
-    fn name_only_approval_still_covers_it() {
-        for policy in [
+    fn name_only_approval_does_not_cover_rewritten_package() {
+        // Name-only keys don't match file/hosted tarballs in npm 12.
+        let lost = lost_for(r#"{"esbuild": true}"#, "esbuild", "0.19.12").unwrap();
+        assert!(lost.allows.is_empty());
+        assert!(lost.denies.is_empty());
+
+        // Even alongside a pinned approval, the name-only key doesn't prevent loss.
+        let lost = lost_for(
             r#"{"esbuild@0.19.12": true, "esbuild": true}"#,
-            r#"{"esbuild@0.19.12": true, "esbuild@*": true}"#,
-            r#"{"esbuild": true}"#,
-        ] {
-            assert!(lost_for(policy, "esbuild", "0.19.12").is_none(), "{policy}");
-        }
+            "esbuild",
+            "0.19.12",
+        )
+        .unwrap();
+        assert_eq!(lost.allows, vec!["esbuild@0.19.12".to_string()]);
+        assert!(lost.denies.is_empty());
     }
 
     /// npm fails a pinned deny closed on an unknown version, so a deny for
@@ -341,7 +354,6 @@ mod tests {
             r#"{"esbuild-wasm@0.19.12": true}"#,
             r#"{"alias@npm:esbuild@0.19.12": true}"#,
             r#"{"esbuild@0.19.12": "yes"}"#,
-            r#"{"esbuild": true, "esbuild@^0.18": false}"#,
             r#"[]"#,
         ] {
             assert!(lost_for(policy, "esbuild", "0.19.12").is_none(), "{policy}");