fix: also declare pnpm build-script policy in package.json

[JohnMcLear]

Summary

PR #7523 moved the build-script allowlist into `pnpm-workspace.yaml`, which is the modern location. But some pnpm versions / setups still read these settings from `package.json` only — and plugin CI is hitting that case: `ERR_PNPM_IGNORED_BUILDS` is back even though `pnpm-workspace.yaml` correctly lists `esbuild` under `onlyBuiltDependencies` and `@scarf/scarf` under `ignoredBuiltDependencies`.

Mirror the same configuration into `package.json`'s `"pnpm"` field. Whichever location pnpm reads, it now finds the policy.

Verified locally that a fresh `pnpm install` (with store pruned) still:

• runs esbuild's `postinstall` (downloads native binary)
• silently skips `@scarf/scarf`'s `postinstall` (telemetry)
• exits 0 (no `ERR_PNPM_IGNORED_BUILDS`)

Generated with Claude Code

[qodo-free-for-open-source-projects]

Review Summary by Qodo

Mirror pnpm build-script policy to package.json for compatibility

🐞 Bug fix

Walkthroughs

Description

• Mirror pnpm build-script policy from workspace.yaml to package.json
• Ensures compatibility with pnpm versions that only read package.json
• Fixes ERR_PNPM_IGNORED_BUILDS errors in plugin CI environments
• Allows esbuild postinstall while silently skipping @scarf/scarf telemetry

Diagram

flowchart LR
  A["pnpm-workspace.yaml<br/>onlyBuiltDependencies<br/>ignoredBuiltDependencies"]
  B["package.json<br/>pnpm field"]
  C["pnpm versions<br/>read config"]
  A -- "mirrored to" --> B
  B -- "compatible with" --> C

Loading

File Changes

1. package.json 🐞 Bug fix +9/-1

Add pnpm build-script policy configuration

• Added pnpm configuration object to package.json root level
• Declared onlyBuiltDependencies array containing esbuild
• Declared ignoredBuiltDependencies array containing @scarf/scarf
• Mirrors existing configuration from pnpm-workspace.yaml for broader compatibility

package.json

---

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (1)   📘 Rule violations (1)   📎 Requirement gaps (0)

🐞\ ⚙ Maintainability (1)

📘\ ☼ Reliability (1)

1. No regression test for pnpm policy 📘 ☼

Description

This PR fixes ERR_PNPM_IGNORED_BUILDS behavior by changing package.json pnpm configuration but
does not add/update any automated regression test to prevent the issue from reoccurring. Without a
test that fails when this change is reverted, the bug can silently return in future config
refactors.

Code

package.json[R54-60]

+  "pnpm": {
+    "onlyBuiltDependencies": [
+      "esbuild"
+    ],
+    "ignoredBuiltDependencies": [
+      "@scarf/scarf"
+    ]

Evidence

PR Compliance ID 1 requires a regression test for bug fixes; the diff shows only a configuration
change in package.json to address the pnpm build-script policy, with no accompanying test changes
in the PR-provided diff.

package.json[54-60]
Best Practice: Repository guidelines

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
A bug fix was made to pnpm build-script policy configuration, but there is no automated regression test that would fail if the fix were reverted.

## Issue Context
The change mirrors `onlyBuiltDependencies` / `ignoredBuiltDependencies` into `package.json` to avoid `ERR_PNPM_IGNORED_BUILDS` in environments where pnpm reads policy only from `package.json`.

## Fix Focus Areas
- package.json[54-60]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

2. Pnpm policy drift risk 🐞 ⚙

Description

The build-script allow/ignore policy is now duplicated in both package.json and pnpm-workspace.yaml,
so a future change that updates only one file can reintroduce install failures (e.g.,
ERR_PNPM_IGNORED_BUILDS) or unintentionally change which dependency postinstalls run.

Code

package.json[R53-61]

+  "license": "Apache-2.0",
+  "pnpm": {
+    "onlyBuiltDependencies": [
+      "esbuild"
+    ],
+    "ignoredBuiltDependencies": [
+      "@scarf/scarf"
+    ]
+  }

Evidence

The same pnpm keys/values are defined in two different config locations; there is no in-repo
mechanism/documentation tying them together, so they can become inconsistent over time.

package.json[51-61]
pnpm-workspace.yaml[7-13]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
The pnpm build policy is duplicated in `package.json` and `pnpm-workspace.yaml`. Without an explicit note or a consistency check, it’s easy for a future edit to update only one file and break installs/CI or alter which dependency build scripts run.

### Issue Context
Both files currently define the same `onlyBuiltDependencies` and `ignoredBuiltDependencies` lists.

### Fix Focus Areas
- pnpm-workspace.yaml[7-13]
- package.json[51-61]

### Suggested fix
- Add an explicit comment in `pnpm-workspace.yaml` stating that these lists must be mirrored in the root `package.json` for compatibility and must be kept in sync.
- (Optional but stronger) Add a small CI/script check that asserts the two lists are identical (parse `package.json` + `pnpm-workspace.yaml` and fail if they differ).

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

ⓘ The new review experience is currently in Beta. Learn more

[qodo-free-for-open-source-projects]

1. No regression test for pnpm policy 📘 Rule violation ☼ Reliability

This PR fixes ERR_PNPM_IGNORED_BUILDS behavior by changing package.json pnpm configuration but
does not add/update any automated regression test to prevent the issue from reoccurring. Without a
test that fails when this change is reverted, the bug can silently return in future config
refactors.

Agent Prompt

## Issue description
A bug fix was made to pnpm build-script policy configuration, but there is no automated regression test that would fail if the fix were reverted.

## Issue Context
The change mirrors `onlyBuiltDependencies` / `ignoredBuiltDependencies` into `package.json` to avoid `ERR_PNPM_IGNORED_BUILDS` in environments where pnpm reads policy only from `package.json`.

## Fix Focus Areas
- package.json[54-60]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools