chore: add monorepo type-check and CI validation lanes

[zapabob]

Motivation

• Provide a single, repeatable monorepo type-check runner that walks key TS packages in a deterministic order and surfaces version skew early.
• Make Python script/checks (py -3 usage) and MCP/protocol schema/version validation first-class CI checks so failures are easy to triage.
• Broaden Rust linting coverage to include upstream-refactor target crates and fail CI on new clippy warnings to prevent regressions.

Description

• Add a root type-check pipeline and type-check:versions script in package.json and a driver scripts/run-type-check.mjs to run TypeScript checks across gui, sdk, sdk/typescript, packages/protocol-client, shell-tool-mcp, extensions and Python (pyright).
• Introduce shared strict TS base config tsconfig.strict.json and update subpackage tsconfig.json files to extend it; add type-check scripts and bump several package versions to 3.0.0 (e.g. sdk, sdk/typescript, packages/protocol-client, shell-tool-mcp, extensions) and convert extensions/vscode-codex dependency to file:../../packages/protocol-client for monorepo resolution.
• Add Python pyrightconfig.json for chosen scripts, plus scripts/check-workspace-versions.mjs and scripts/check_protocol_versions.py to validate package versions and canonical MCP/protocol schema/version alignment.
• Split CI into dedicated jobs in .github/workflows/ci.yml: type-check, schema-diff, and protocol-version, and expand subagent-ci clippy steps to run codex-app-server-protocol, codex-protocol, and codex-cli; suppress a newly exposed clippy::too_many_arguments warning in codex-rs/protocol/src/models.rs to resolve immediate failure.

Testing

• Ran npm run type-check:versions which succeeded and confirmed workspace versions are aligned.
• Ran python3 scripts/check_protocol_versions.py which passed and printed the canonical protocol version.
• Ran pyright --project pyrightconfig.json against the selected scripts which completed with no errors for the scoped set.
• Ran npm --prefix packages/protocol-client run type-check and npm --prefix shell-tool-mcp run type-check which completed successfully.
• Ran the monorepo npm run type-check which correctly executes but stops on gui because gui contains many pre-existing strict TypeScript errors (not introduced by this PR) and therefore fails as expected; other targeted packages pass.
• Executed cargo clippy on codex-protocol/codex-app-server-protocol/codex-cli path and fixed the surfaced too_many_arguments warning in codex-rs/protocol/src/models.rs so the expanded clippy lane is currently satisfied.

---

Codex Task

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
codex	Canceled		Mar 20, 2026 2:19pm

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 39f55039d4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Stop using npm ci in packages without lockfiles

npm ci is only valid when the target package already has a package-lock.json/npm-shrinkwrap.json. In this tree, sdk/typescript, shell-tool-mcp, and extensions/windsurf-extension do not have lockfiles, and npm ci --prefix sdk/typescript currently fails with EUSAGE (“can only install with an existing package-lock.json…”). That means the new type-check job exits during dependency installation and never reaches any of the validation steps.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Exclude the already-red GUI package from the new monorepo lane

Putting gui first in the new runner makes npm run type-check fail on every invocation in the current repo state: npm --prefix gui run type-check exits non-zero with hundreds of TypeScript errors, and run() aborts on the first failing package. As a result, the lane never reaches sdk, packages/protocol-client, or the pyright pass, so this check is permanently red until the entire GUI backlog is fixed.

Useful? React with 👍 / 👎.

[github-actions]

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}