[ClaudiaFang]

Closes #29 · Part of firstsun-dev/.github#38

Changes

• packageManager: pnpm@12.14.0 (previously unpinned; CI used pnpm 9 / Node 20, Dockerfile pnpm 10.33.0 / Node 22).
• pnpm-workspace.yaml: onlyBuiltDependencies -> allowBuilds (better-sqlite3: true; @ax-llm/ax, @openrouter/sdk, @scarf/scarf, core-js, protobufjs explicitly false — their postinstalls are telemetry/banners and pnpm 12 fails installs on unreviewed build scripts). Catalog preserved.
• CI and Dockerfile: Node 24, pnpm 12.14.0 from packageManager, pnpm install --frozen-lockfile.
• engines.node >=24 on private packages (root, server, dashboard); the published cli keeps >=20.19.0.
• ci.yml previously triggered only on master, so it never ran on main; main added so this PR is checked.

Lockfile refresh (separate commit 7a34555, revertable alone)

Lockfile-only, package.json ranges and pnpm-workspace.yaml untouched (plain pnpm update rewrites ranges in pnpm 12, so the lockfile was re-resolved without it). 198 packages changed. Notable: vite 8.1.5->8.3.4, rolldown 1.1.5->1.2.14, vitest 4.1.10->4.1.12, tailwindcss 4.3.0->4.3.3, react 19.2.7->19.3.1, hono 4.12.21->4.13.13, better-sqlite3 12.10.0->12.11.1, @ax-llm/ax 22.0.2->22.0.9. Majors within existing ranges: @asteasolutions/zod-to-openapi 8.5.0->9.1.0, web-vitals 5.2.0->6.2.3 (revert this commit if either is unwanted).

Validation (Node 24.18, pnpm 12.14.0)

• rm -rf node_modules && pnpm install --frozen-lockfile: OK, before and after the refresh
• pnpm build (cli, server, dashboard): OK
• Tests: cli 927, server 677, dashboard 15 passed (no lint script, no e2e suite)
• better-sqlite3 and sqlite-vec load on host and inside the image
• pnpm pack --dry-run (cli): OK
• docker build (no push): OK; image has Node 24.22 + pnpm 12.14.0, dist/index.js --version = 4.11.0
• CI build-and-test: pass on the migration commit and on the refresh commit

Risks

• The multi-arch (arm64/QEMU) image push job only runs on main/master and was not exercised.

Post-merge status (checked 2026-10-20 02:26 UTC)

• Merged into main at 2026-10-20T02:15:15Z as 3edfec9.
• Push CI on the merge commit: CI: completed/success; Build and Push Docker Image: completed/success.
• Includes the Docker image build/push workflow (success).
• Tracking: chore(toolchain): standardize Node.js 24 and pnpm 12 across active repositories .github#38.

🤖 Generated with Claude Code