fix(cli): pin the shared Effect runtime for npm installs

[rynfar]

The server manifest now declares the shared Effect Node runtime directly, keeping standalone npm dependency resolution on the same pinned rc.112 version as the platform packages. Pylon’s bundled desktop server continues to inline this dependency under the existing package-boundary rules.

Cycle #497, frozen range 6c583620ff7ad3235b135af7107c0543467eecfa..4a4c6dd2adc350a68ba18bb28b24b5a7e4660dab. Adopted 5eecc24a10013be14e496b485f8d1d9491c75f6a; retained Pylon’s Effect patch and lockfile graph. Added the documented dependency-usage exception for the deliberate runtime pin.

Validation: frozen-lockfile install; server-scoped dependency knip; focused CLI packaging-boundary tests; formatting/diff checks. No version upgrade, publication, or deployment performed.

Implemented with GPT-6 in Codex.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
pylon-marketing	Ready	Preview	Sep 12, 2026 6:26am UTC

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	14.1 KiB	14.1 KiB	−1 B (−0.0%)	15.1 KiB	✅
Codex	Thread snapshot wire	7.2 KiB	7.2 KiB	−6 B (−0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.9 KiB	6.9 KiB	+5 B (+0.1%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	58.8 KiB	58.8 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	10	10	0 (0.0%)	21	✅
Claude	Total thread wire	14.1 KiB	14.1 KiB	+4 B (+0.0%)	15.1 KiB	✅
Claude	Thread snapshot wire	7.2 KiB	7.2 KiB	0 B (0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.9 KiB	6.9 KiB	+4 B (+0.1%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	59.7 KiB	59.7 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	10	10	0 (0.0%)	21	✅

Baseline: f3402be · PR result: 259b25a · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 115.6 KiB
• Claude decoded thread snapshot: 116.3 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[rynfar]

Independent review of head 259b25a found no blocking issue: the direct shared-runtime dependency matches the existing Effect rc.112 catalog and lock resolution; the unused-dependency exception is limited to the standalone CLI runtime pin. Packaging tests and final-head CI are green. Landing under the standing upstream-cycle approval.