chore(CI/CD): Prevent agents from running npm

.github/AGENTS.md

@@ -0,0 +1,24 @@
+# Agent Instructions
+
+## Package Management
+
+This project uses **pnpm** exclusively for package management in the frontend (`invokeai/frontend/web/`).
+
+- ✅ Use `pnpm` commands (e.g., `pnpm install`, `pnpm run`)
+- ❌ Never use `npm` or `yarn` commands
+- ❌ Never suggest creating or using `package-lock.json` or `yarn.lock`
+- ✅ The lock file is `pnpm-lock.yaml`
+
+Use the following pnpm commands for typical operations:
+
+- pnpm -C invokeai/frontend/web install
+- pnpm -C invokeai/frontend/web build
+- pnpm -C invokeai/frontend/web lint:tsc
+- pnpm -C invokeai/frontend/web lint:dpdm
+- pnpm -C invokeai/frontend/web lint:eslint
+- pnpm -C invokeai/frontend/web lint:prettier
+
+## Project Structure
+
+- Backend: Python in `invokeai/`
+- Frontend: TypeScript/React in `invokeai/frontend/web/` (uses pnpm)

.github/workflows/frontend-checks.yml

@@ -41,6 +41,17 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - name: Fail if package-lock.json is added/modified (pnpm only)
+        shell: bash
+        working-directory: .
+        run: |
+          set -euo pipefail
+          git fetch --no-tags --prune --depth=1 origin "${{ github.base_ref }}"
+          if git diff --name-only "origin/${{ github.base_ref }}...HEAD" | grep -E '(^|/)package-lock\.json$'; then
+            echo "::error::package-lock.json was added or modified. This repo uses pnpm only."
+           exit 1
+          fi
+
       - name: check for changed frontend files
         if: ${{ inputs.always_run != true }}
         id: changed-files

invokeai/frontend/web/scripts/package.json

@@ -1,3 +1,4 @@
 {
-  "type": "module"
+  "type": "module",
+  "packageManager": "pnpm@10.12.4"
 }