[BUG] install-strategy=linked rejects root/workspace remote tarball deps with EALLOWREMOTE under allow-remote=root #9509

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

Under the linked install strategy with allow-remote=root, a npm install fails with EALLOWREMOTE on a genuinely remote (non-registry) tarball that is a direct dependency of the project root or a workspace:

npm error code EALLOWREMOTE
npm error Fetching non-root packages of type "remote" have been disabled
npm error Refusing to fetch "@react-native-community/slider@https://raw.githubusercontent.com/wordpress-mobile/react-native-slider/v3.0.2-wp-5/react-native-community-slider-3.0.2-wp-5.tgz"

The same dependency installs fine under the hoisted (default) strategy with allow-remote=root. This is distinct from #9494/#9495, which was about registry tarball URLs; here the URL is a real remote host (raw.githubusercontent.com), so the #isRegistryResolvedTarball exemption does not (and should not) apply — yet the dependency is a legitimate root/workspace direct dep and should pass allow-remote=root.

Expected Behavior

A remote tarball that is a direct dependency of the project root or a workspace should be permitted under allow-remote=root in the linked strategy, identically to the hoisted strategy.

Steps To Reproduce

REPRO=/tmp/linked-allowremote-repro
rm -rf "$REPRO" && mkdir -p "$REPRO"

cat > "$REPRO/package.json" << 'EOF'
{
  "name": "linked-allowremote-repro",
  "version": "1.0.0",
  "dependencies": {
    "@react-native-community/slider": "https://raw.githubusercontent.com/wordpress-mobile/react-native-slider/v3.0.2-wp-5/react-native-community-slider-3.0.2-wp-5.tgz"
  }
}
EOF

cd "$REPRO"

# Hoisted (default) + allow-remote=root  → succeeds
rm -rf node_modules package-lock.json
npm install --allow-remote=root --no-audit --no-fund

# Linked + allow-remote=root  → EALLOWREMOTE
rm -rf node_modules package-lock.json
npm install --install-strategy=linked --allow-remote=root --no-audit --no-fund

Environment

• npm: 12.0.0-pre.0 (latest branch)
• Observed in: Gutenberg