[codex] Support pnpm 11 build approvals

package.json

@@ -213,15 +213,5 @@
       "owner": "wimi321",
       "repo": "GoAgent"
     }
-  },
-  "pnpm": {
-    "onlyBuiltDependencies": [
-      "electron",
-      "electron-winstaller",
-      "esbuild",
-      "onnxruntime-node",
-      "protobufjs",
-      "sharp"
-    ]
   }
 }

pnpm-workspace.yaml

@@ -1,3 +1,10 @@
 packages:
   - "."
   - "website"
+allowBuilds:
+  electron: true
+  electron-winstaller: true
+  esbuild: true
+  onnxruntime-node: true
+  protobufjs: true
+  sharp: true

tests/pnpm-config-contract.test.mjs

@@ -0,0 +1,20 @@
+import assert from 'node:assert/strict'
+import { readFileSync } from 'node:fs'
+import { join } from 'node:path'
+import test from 'node:test'
+
+const root = process.cwd()
+
+test('pnpm build-script approvals are compatible with pnpm 11', () => {
+  const packageJson = JSON.parse(readFileSync(join(root, 'package.json'), 'utf8'))
+  const workspace = readFileSync(join(root, 'pnpm-workspace.yaml'), 'utf8')
+
+  assert.equal(packageJson.pnpm?.onlyBuiltDependencies, undefined)
+  assert.match(workspace, /^allowBuilds:\r?$/m)
+
+  for (const dependency of ['electron', 'electron-winstaller', 'esbuild', 'onnxruntime-node', 'protobufjs', 'sharp']) {
+    assert.match(workspace, new RegExp(`^  ${dependency}: true\\r?$`, 'm'), `missing allowBuilds approval for ${dependency}`)
+  }
+
+  assert.doesNotMatch(workspace, /set this to true or false/)
+})