diff --git a/.changeset/update-codex-app-server-protocol.md b/.changeset/update-codex-app-server-protocol.md
new file mode 100644
index 0000000..76187dd
--- /dev/null
+++ b/.changeset/update-codex-app-server-protocol.md
@@ -0,0 +1,5 @@
+---
+"@pwrdrvr/agent-client": patch
+---
+
+Update @pwrdrvr/codex-app-server-protocol to 0.135.0.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 021c11d..91f8926 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -22,7 +22,7 @@ jobs:
           cache: pnpm
 
       - name: Install
-        run: pnpm install --frozen-lockfile --ignore-pnpmfile
+        run: pnpm install --frozen-lockfile
 
       - name: License policy
         run: pnpm lint:licenses
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f4e9f11..76709ee 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -45,7 +45,7 @@ jobs:
         run: npm install -g npm@11
 
       - name: Install
-        run: pnpm install --frozen-lockfile --ignore-pnpmfile
+        run: pnpm install --frozen-lockfile
 
       - name: Build
         run: pnpm build
diff --git a/.npmrc b/.npmrc
new file mode 100644
index 0000000..e3c3270
--- /dev/null
+++ b/.npmrc
@@ -0,0 +1,5 @@
+# Force pnpm to ignore any user-level global-pnpmfile when running
+# inside this repo. The repo-level .pnpmfile.cjs is the only hook that
+# should affect pnpmfileChecksum, so frozen installs behave the same
+# on contributor machines and in CI.
+global-pnpmfile=
diff --git a/.pnpmfile.cjs b/.pnpmfile.cjs
new file mode 100644
index 0000000..a248742
--- /dev/null
+++ b/.pnpmfile.cjs
@@ -0,0 +1,61 @@
+'use strict'
+
+const dependencyFields = [
+  'dependencies',
+  'optionalDependencies',
+  'peerDependencies',
+]
+
+const firstPartyPackageNames = new Set([
+  '@pwrdrvr/agent-kit-root',
+  'minimal-consumer',
+])
+const firstPartyPackagePrefix = '@pwrdrvr/'
+
+function isFirstParty(pkg) {
+  if (!pkg || typeof pkg.name !== 'string') return false
+  if (firstPartyPackageNames.has(pkg.name)) return true
+  return pkg.name.startsWith(firstPartyPackagePrefix)
+}
+
+const gitSpecPattern = /^(?:git(?:\+|:)|git@|ssh:\/\/git@|github:|gitlab:|bitbucket:|https?:\/\/(?:www\.)?(?:github|gitlab|bitbucket)\.com\/|[^/@\s]+\/[^/\s]+(?:#.*)?$)/
+
+function isGitSpec(spec) {
+  return typeof spec === 'string' && gitSpecPattern.test(spec)
+}
+
+function scanField(pkg, field) {
+  const dependencies = pkg[field]
+  if (!dependencies) return
+  for (const [name, spec] of Object.entries(dependencies)) {
+    if (isGitSpec(spec)) {
+      throw new Error(`Blocked git dependency ${name}@${spec} (in ${pkg.name ?? '<unknown>'}.${field})`)
+    }
+  }
+}
+
+function readPackage(pkg) {
+  for (const field of dependencyFields) {
+    scanField(pkg, field)
+  }
+  if (isFirstParty(pkg)) {
+    scanField(pkg, 'devDependencies')
+  }
+  return pkg
+}
+
+function blockGitFetcher() {
+  return async () => {
+    throw new Error('Blocked pnpm git dependency fetch')
+  }
+}
+
+module.exports = {
+  hooks: {
+    readPackage,
+    fetchers: {
+      git: blockGitFetcher,
+      gitHostedTarball: blockGitFetcher,
+    },
+  },
+}
diff --git a/packages/agent-client/package.json b/packages/agent-client/package.json
index 99e9425..520e3e9 100644
--- a/packages/agent-client/package.json
+++ b/packages/agent-client/package.json
@@ -25,8 +25,8 @@
   "dependencies": {
     "@pwrdrvr/agent-core": "workspace:^",
     "@pwrdrvr/agent-transport": "workspace:^",
+    "@pwrdrvr/codex-app-server-protocol": "^0.135.0",
     "@pwrdrvr/codex-discovery": "workspace:^",
-    "@pwrdrvr/codex-app-server-protocol": "^0.133.0",
     "zod": "^4.0.0"
   },
   "devDependencies": {
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index d538c17..b21982f 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -7,6 +7,8 @@ settings:
 overrides:
   zod: ^4.0.0
 
+pnpmfileChecksum: sha256-nSeLKzq5FAIkAHHxqmAwTobjeMQDJ2T2n/c5eU3xkpo=
+
 importers:
 
   .:
@@ -105,8 +107,8 @@ importers:
         specifier: workspace:^
         version: link:../agent-transport
       '@pwrdrvr/codex-app-server-protocol':
-        specifier: ^0.133.0
-        version: 0.133.0
+        specifier: ^0.135.0
+        version: 0.135.0
       '@pwrdrvr/codex-discovery':
         specifier: workspace:^
         version: link:../codex-discovery
@@ -592,8 +594,8 @@ packages:
     resolution: {integrity: sha512-oGB+UxlgWcgQkgwo8GcEGwemoTFt3FIO9ababBmaGwXIoBKZ+GTy0pP185beGg7Llih/NSHSV2XAs1lnznocSg==}
     engines: {node: '>= 8'}
 
-  '@pwrdrvr/codex-app-server-protocol@0.133.0':
-    resolution: {integrity: sha512-mt+geA0RZEz5A3kEK8poDE3wYDrteWGb2syfXS4/kzzgWEe26DUbQlbdQyFYoa7Zs/Z6L64gNGIfFHgemfzj8g==}
+  '@pwrdrvr/codex-app-server-protocol@0.135.0':
+    resolution: {integrity: sha512-lmebPpbmaE7yfe0EDqcT2MPRtKurUc1o9NinHAVdA3lBdF3c8ZK3okiHIw6r6GEQLqOTd+7dpEuPsk4a1dEpkw==}
     engines: {node: '>=20'}
 
   '@rollup/rollup-android-arm-eabi@4.60.4':
@@ -2241,7 +2243,7 @@ snapshots:
       '@nodelib/fs.scandir': 2.1.5
       fastq: 1.20.1
 
-  '@pwrdrvr/codex-app-server-protocol@0.133.0': {}
+  '@pwrdrvr/codex-app-server-protocol@0.135.0': {}
 
   '@rollup/rollup-android-arm-eabi@4.60.4':
     optional: true