chore(agent-client): update codex app server protocol

.changeset/update-codex-app-server-protocol.md

@@ -0,0 +1,5 @@
+---
+"@pwrdrvr/agent-client": patch
+---
+
+Update @pwrdrvr/codex-app-server-protocol to 0.135.0.

.github/workflows/ci.yml

@@ -22,7 +22,7 @@ jobs:
           cache: pnpm
 
       - name: Install
-        run: pnpm install --frozen-lockfile --ignore-pnpmfile
+        run: pnpm install --frozen-lockfile
 
       - name: License policy
         run: pnpm lint:licenses

.github/workflows/release.yml

@@ -45,7 +45,7 @@ jobs:
         run: npm install -g npm@11
 
       - name: Install
-        run: pnpm install --frozen-lockfile --ignore-pnpmfile
+        run: pnpm install --frozen-lockfile
 
       - name: Build
         run: pnpm build

.npmrc

@@ -0,0 +1,5 @@
+# Force pnpm to ignore any user-level global-pnpmfile when running
+# inside this repo. The repo-level .pnpmfile.cjs is the only hook that
+# should affect pnpmfileChecksum, so frozen installs behave the same
+# on contributor machines and in CI.
+global-pnpmfile=

.pnpmfile.cjs

@@ -0,0 +1,61 @@
+'use strict'
+
+const dependencyFields = [
+  'dependencies',
+  'optionalDependencies',
+  'peerDependencies',
+]
+
+const firstPartyPackageNames = new Set([
+  '@pwrdrvr/agent-kit-root',
+  'minimal-consumer',
+])
+const firstPartyPackagePrefix = '@pwrdrvr/'
+
+function isFirstParty(pkg) {
+  if (!pkg || typeof pkg.name !== 'string') return false
+  if (firstPartyPackageNames.has(pkg.name)) return true
+  return pkg.name.startsWith(firstPartyPackagePrefix)
+}
+
+const gitSpecPattern = /^(?:git(?:\+|:)|git@|ssh:\/\/git@|github:|gitlab:|bitbucket:|https?:\/\/(?:www\.)?(?:github|gitlab|bitbucket)\.com\/|[^/@\s]+\/[^/\s]+(?:#.*)?$)/
+
+function isGitSpec(spec) {
+  return typeof spec === 'string' && gitSpecPattern.test(spec)
+}
+
+function scanField(pkg, field) {
+  const dependencies = pkg[field]
+  if (!dependencies) return
+  for (const [name, spec] of Object.entries(dependencies)) {
+    if (isGitSpec(spec)) {
+      throw new Error(`Blocked git dependency ${name}@${spec} (in ${pkg.name ?? '<unknown>'}.${field})`)
+    }
+  }
+}
+
+function readPackage(pkg) {
+  for (const field of dependencyFields) {
+    scanField(pkg, field)
+  }
+  if (isFirstParty(pkg)) {
+    scanField(pkg, 'devDependencies')
+  }
+  return pkg
+}
+
+function blockGitFetcher() {
+  return async () => {
+    throw new Error('Blocked pnpm git dependency fetch')
+  }
+}
+
+module.exports = {
+  hooks: {
+    readPackage,
+    fetchers: {
+      git: blockGitFetcher,
+      gitHostedTarball: blockGitFetcher,
+    },
+  },
+}

packages/agent-client/package.json

@@ -25,8 +25,8 @@
   "dependencies": {
     "@pwrdrvr/agent-core": "workspace:^",
     "@pwrdrvr/agent-transport": "workspace:^",
+    "@pwrdrvr/codex-app-server-protocol": "^0.135.0",
     "@pwrdrvr/codex-discovery": "workspace:^",
-    "@pwrdrvr/codex-app-server-protocol": "^0.133.0",
     "zod": "^4.0.0"
   },
   "devDependencies": {