I don't think this addresses what sapphi mentioned here. But we also don't want to run this exec for everyone on every startup.

I noticed pnpm saves some metadata in node_modules/.modules.yaml where:

non-gvs:

{
  "storeDir": "/Users/bjorn/Library/pnpm/store/v11",
  "virtualStoreDir": ".pnpm",
  "virtualStoreDirMaxLength": 120
}

gvs:

{
  "storeDir": "/Users/bjorn/Library/pnpm/store/v11",
  "virtualStoreDir": "../../../../Library/pnpm/store/v11/links",
  "virtualStoreDirMaxLength": 120,

we could use the path here to pass to the allowlist.

This looks good; we don't even need to distinguish whether GVS is running or not. We can directly read the relevant file and retrieve the value of the storeDir field. However, it seems we need to add an operation to read and parse the YAML file.

Normally, the content of a node_modules/.modules.yaml file is in a standard JSON format, so using JSON.parse to parse it is generally sufficient.