Description

When using pnpm v11's enableGlobalVirtualStore: true setting, package files are stored in the global content-addressable store (e.g. <drive>/.pnpm-store/v11/links/) rather than inside the project's node_modules/.pnpm/. Vite's server.fs.strict blocks requests to these paths with 403 Forbidden because they're outside the workspace root.

This affects any assets served via @fs/ during development — e.g. font files from packages.

Suggested solution

A similar resolution as #15957 did for yarn - detect if pnpm (e.g. via process.env.npm_config_user_agent), call pnpm commands to check if using GVS (pnpm config get enableGlobalVirtualStore), get the path (pnpm store path), and add it to the default allow.

Alternative

Document that individual projects should configure as follows. But considering vite already supports yarn's version of this, I see no reason to not add the same for pnpm.

    fs: {
      allow: [
        execSync('pnpm store path', { encoding: 'utf8' }).trim(),
        '..',
      ],
    },

Additional context

No response

Validations

• Follow our Code of Conduct
• Read the Contributing Guidelines.
• Read the docs.
• Check that there isn't already an issue that request the same feature to avoid creating a duplicate.