chore(deps): standardize Node 24 and npm 12

.github/actions/ci-cli-coverage-merge/action.yaml

@@ -34,9 +34,12 @@ runs:
     - name: Setup Node.js
       uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
-        node-version: "22"
+        node-version: "24.18.1"
         cache: npm
 
+    - name: Install reviewed npm
+      uses: NVIDIA/NemoClaw/.github/actions/setup-reviewed-npm@7363df49a5f25b0dd1c20c80905917c31760a27e
+
     - name: Install dependencies
       shell: bash
       env:

.github/actions/ci-cli-coverage-shard/action.yaml

@@ -44,12 +44,15 @@ runs:
     - name: Setup Node.js
       uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
-        node-version: "22"
+        node-version: "24.18.1"
         cache: npm
         cache-dependency-path: |
           package-lock.json
           nemoclaw/package-lock.json
 
+    - name: Install reviewed npm
+      uses: NVIDIA/NemoClaw/.github/actions/setup-reviewed-npm@7363df49a5f25b0dd1c20c80905917c31760a27e
+
     - name: Install pinned Pi search tools
       shell: bash
       env:

.github/actions/ci-compile-artifacts/action.yaml

@@ -10,12 +10,15 @@ runs:
     - name: Setup Node.js
       uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
-        node-version: "22.23.2"
+        node-version: "24.18.1"
         cache: npm
         cache-dependency-path: |
           package-lock.json
           nemoclaw/package-lock.json
 
+    - name: Install reviewed npm
+      uses: NVIDIA/NemoClaw/.github/actions/setup-reviewed-npm@7363df49a5f25b0dd1c20c80905917c31760a27e
+
     - name: Identify compiled output
       id: identity
       shell: bash

.github/actions/ci-install-dependencies.sh

@@ -75,8 +75,8 @@ if [ "$package_mode" = "registry" ] && [ -n "${NODE_AUTH_TOKEN:-}" ]; then
   export NPM_CONFIG_USERCONFIG="$trusted_npmrc"
 fi
 
-npm ci --ignore-scripts --prefer-offline --no-audit --no-fund --cache "$npm_cache"
+npm ci --allow-remote=root --ignore-scripts --prefer-offline --no-audit --no-fund --cache "$npm_cache"
 if [ "$plugin_install_mode" != "none" ]; then
   npm "${plugin_install_args[@]}" \
-    --ignore-scripts --prefer-offline --no-audit --no-fund --cache "$npm_cache"
+    --allow-remote=root --ignore-scripts --prefer-offline --no-audit --no-fund --cache "$npm_cache"
 fi

.github/actions/ci-installer-integration/action.yaml

@@ -10,12 +10,15 @@ runs:
     - name: Setup Node.js
       uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
-        node-version: "22"
+        node-version: "24.18.1"
         cache: npm
         cache-dependency-path: |
           package-lock.json
           nemoclaw/package-lock.json
 
+    - name: Install reviewed npm
+      uses: NVIDIA/NemoClaw/.github/actions/setup-reviewed-npm@7363df49a5f25b0dd1c20c80905917c31760a27e
+
     - name: Install dependencies
       shell: bash
       env:

.github/actions/ci-plugin-coverage/action.yaml

@@ -10,12 +10,15 @@ runs:
     - name: Setup Node.js
       uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
-        node-version: "22"
+        node-version: "24.18.1"
         cache: npm
         cache-dependency-path: |
           package-lock.json
           nemoclaw/package-lock.json
 
+    - name: Install reviewed npm
+      uses: NVIDIA/NemoClaw/.github/actions/setup-reviewed-npm@7363df49a5f25b0dd1c20c80905917c31760a27e
+
     - name: Install dependencies
       shell: bash
       env:

.github/actions/ci-reviewed-npm-audit/action.yaml

@@ -25,7 +25,7 @@ runs:
     - name: Setup production-compatible Node.js
       uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
-        node-version: "22.23.2"
+        node-version: "24.18.1"
 
     - name: Resolve npm audit cache buckets
       id: cache-buckets
@@ -92,7 +92,7 @@ runs:
       shell: bash
       run: >-
         env -u NODE_AUTH_TOKEN -u NPM_TOKEN -u NPM_CONFIG__AUTH_TOKEN
-        "$GITHUB_ACTION_PATH/verify-and-install-npm.sh"
+        "$GITHUB_ACTION_PATH/../setup-reviewed-npm/verify-and-install-npm.sh"
         "$GITHUB_ACTION_PATH/../../../ci/reviewed-npm-audit.json"
 
     - name: Materialize and audit production dependency graphs

.github/actions/ci-static-checks/action.yaml

@@ -10,12 +10,15 @@ runs:
     - name: Setup Node.js
       uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
-        node-version: ">=22.19.0 <23"
+        node-version: "24.18.1"
         cache: npm
         cache-dependency-path: |
           package-lock.json
           nemoclaw/package-lock.json
 
+    - name: Install reviewed npm
+      uses: NVIDIA/NemoClaw/.github/actions/setup-reviewed-npm@7363df49a5f25b0dd1c20c80905917c31760a27e
+
     - name: Install base-trusted createRequire verifier dependencies
       shell: bash
       run: npm ci --ignore-scripts --no-audit --no-fund --prefix "$GITHUB_ACTION_PATH"

.github/actions/prepare-e2e/action.yaml

@@ -16,9 +16,12 @@ runs:
     - name: Set up Node
       uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
-        node-version: 22
+        node-version: 24.18.1
         cache: npm
 
+    - name: Install reviewed npm
+      uses: NVIDIA/NemoClaw/.github/actions/setup-reviewed-npm@470a5417558c65260d59cdb5eabb01d35834535e
+
     - name: Install root dependencies
       shell: bash
       run: npm ci --ignore-scripts

.github/actions/setup-reviewed-npm/action.yaml

@@ -0,0 +1,15 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+name: setup-reviewed-npm
+description: Install the exact npm release approved by the reviewed npm audit identity.
+
+runs:
+  using: composite
+  steps:
+    - name: Download, verify, and install reviewed npm
+      shell: bash
+      run: >-
+        env -u NODE_AUTH_TOKEN -u NPM_TOKEN -u NPM_CONFIG__AUTH_TOKEN
+        "$GITHUB_ACTION_PATH/verify-and-install-npm.sh"
+        "$GITHUB_ACTION_PATH/../../../ci/reviewed-npm-audit.json"

.github/actions/ci-reviewed-npm-audit/verify-and-install-npm.sh → .github/actions/setup-reviewed-npm/verify-and-install-npm.sh

@@ -38,15 +38,18 @@ npm pack "npm@$version" \
   --ignore-scripts --no-audit --no-fund >/dev/null
 
 archive="$download_dir/npm-$version.tgz"
-IFS=$'\t' read -r actual_sha512 actual_sha256 < <(node -e '
+actual_hashes="$download_dir/actual-hashes"
+node -e '
   const fs = require("node:fs");
   const crypto = require("node:crypto");
   const archive = fs.readFileSync(process.argv[1]);
   process.stdout.write(
-    crypto.createHash("sha512").update(archive).digest("base64") + "\t" +
+    crypto.createHash("sha512").update(archive).digest("base64") + "\n" +
     crypto.createHash("sha256").update(archive).digest("hex") + "\n",
   );
-' "$archive")
+' "$archive" >"$actual_hashes"
+IFS= read -r actual_sha512 <"$actual_hashes"
+IFS= read -r actual_sha256 < <(sed -n '2p' "$actual_hashes")
 actual_integrity="sha512-$actual_sha512"
 if [ "$actual_integrity" != "$expected_integrity" ] || [ "$actual_sha256" != "$expected_sha256" ]; then
   echo "ERROR: npm@$version archive integrity mismatch." >&2
@@ -71,3 +74,9 @@ fi
 npm install --global "$archive" \
   --userconfig /dev/null \
   --ignore-scripts --no-audit --no-fund --offline
+
+installed_version="$(npm --version)"
+if [ "$installed_version" != "$version" ]; then
+  echo "ERROR: installed npm@$installed_version does not match reviewed npm@$version." >&2
+  exit 1
+fi

.github/workflows/base-image.yaml

@@ -27,6 +27,7 @@ on:
       - "test/e2e/live/managed-image-activation-e2e.test.ts"
       - "test/e2e/live/managed-image-activation-e2e-helpers.ts"
       - ".github/actions/ci-reviewed-npm-audit/**"
+      - ".github/actions/setup-reviewed-npm/**"
       - ".github/actions/publish-managed-image-digest/**"
       - ".github/actions/build-base-image-platform/**"
       - ".github/actions/publish-base-image-manifest/**"

.github/workflows/candidate-compatibility.yaml

@@ -57,7 +57,10 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: ">=22.19.0 <23"
+          node-version: "24.18.1"
+
+      - name: Install reviewed npm
+        uses: ./controller/.github/actions/setup-reviewed-npm
 
       - id: identity
         name: Resolve official candidate provenance
@@ -142,10 +145,13 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: ">=22.19.0 <23"
+          node-version: "24.18.1"
           cache: npm
           cache-dependency-path: candidate-source/package-lock.json
 
+      - name: Install reviewed npm
+        uses: ./controller/.github/actions/setup-reviewed-npm
+
       - name: Install repository dependencies
         working-directory: candidate-source
         run: npm ci --ignore-scripts
@@ -270,10 +276,13 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: ">=22.19.0 <23"
+          node-version: "24.18.1"
           cache: npm
           cache-dependency-path: candidate-source/package-lock.json
 
+      - name: Install reviewed npm
+        uses: ./controller/.github/actions/setup-reviewed-npm
+
       - name: Install repository dependencies
         working-directory: candidate-source
         run: npm ci --ignore-scripts
@@ -304,7 +313,7 @@ jobs:
         continue-on-error: true
         working-directory: candidate-source
         env:
-          DOCKER_GRPC_PROBE_IMAGE: node:22-trixie-slim@sha256:db8a96a63e5264607ada2d206758876ebbed6a12be2ada7517793cbfb0c2a29c
+          DOCKER_GRPC_PROBE_IMAGE: node:24.18.1-trixie-slim@sha256:ac39e4b5fcb2b1b34b20364fd58b2e898f3bb80731ee6f62a7536f9df3d6aadc
           E2E_ARTIFACT_DIR: ${{ github.workspace }}/candidate-source/e2e-artifacts/live/openshell-gateway-auth-contract
           E2E_JOB: "1"
           E2E_TARGET_ID: openshell-gateway-auth-contract

.github/workflows/code-scanning.yaml

@@ -69,7 +69,10 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: 22.19.0
+          node-version: 24.18.1
+
+      - name: Install reviewed npm
+        uses: NVIDIA/NemoClaw/.github/actions/setup-reviewed-npm@7363df49a5f25b0dd1c20c80905917c31760a27e
 
       - name: Install ShellCheck
         run: |

.github/workflows/codebase-growth-guardrails.yaml

@@ -26,6 +26,14 @@ jobs:
           ref: ${{ github.event.pull_request.base.sha }}
           persist-credentials: false
 
+      - name: Set up Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 24.18.1
+
+      - name: Install reviewed npm
+        uses: ./.github/actions/setup-reviewed-npm
+
       - name: Install trusted dependencies
         run: npm ci --ignore-scripts --no-audit --no-fund
 

.github/workflows/commit-lint.yaml

@@ -27,9 +27,12 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: "22"
+          node-version: "24.18.1"
           cache: npm
 
+      - name: Install reviewed npm
+        uses: ./.github/actions/setup-reviewed-npm
+
       - name: Install dependencies
         run: npm install --ignore-scripts
 

.github/workflows/docker-pin-check.yaml

@@ -2,7 +2,7 @@
 # SPDX-License-Identifier: Apache-2.0
 #
 # Weekly check that the pinned Dockerfile base-image digest is still current.
-# Fails with an actionable message when a newer node:22-trixie-slim is available.
+# Fails with an actionable message if the node:24.18.1-trixie-slim digest changes.
 
 name: Images / Check Docker Base Image Pins
 

.github/workflows/docs-cli-parity-pr.yaml

@@ -44,7 +44,10 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: "22"
+          node-version: "24.18.1"
+
+      - name: Install reviewed npm
+        uses: ./.github/actions/setup-reviewed-npm
 
       - name: Install dependencies
         run: npm install --ignore-scripts

.github/workflows/docs-preview-pr.yaml

@@ -54,7 +54,10 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: "24"
+          node-version: "24.18.1"
+
+      - name: Install reviewed npm
+        uses: NVIDIA/NemoClaw/.github/actions/setup-reviewed-npm@7363df49a5f25b0dd1c20c80905917c31760a27e
 
       - name: Install docs dependencies
         run: npm ci --ignore-scripts

.github/workflows/docs-publish-public.yaml

@@ -42,9 +42,12 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: "24"
+          node-version: "24.18.1"
           package-manager-cache: false
 
+      - name: Install reviewed npm
+        uses: ./.github/actions/setup-reviewed-npm
+
       - name: Install docs dependencies
         run: npm ci --ignore-scripts
 

.github/workflows/docs-publish-staging.yaml

@@ -40,7 +40,10 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: "24"
+          node-version: "24.18.1"
+
+      - name: Install reviewed npm
+        uses: ./.github/actions/setup-reviewed-npm
 
       - name: Install docs dependencies
         run: npm ci --ignore-scripts
@@ -109,7 +112,11 @@ jobs:
         if: ${{ steps.previews.outputs.has_previews == 'true' }}
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: "24"
+          node-version: "24.18.1"
+
+      - name: Install reviewed npm
+        if: ${{ steps.previews.outputs.has_previews == 'true' }}
+        uses: ./.github/actions/setup-reviewed-npm
 
       - name: Delete Fern previews
         if: ${{ steps.previews.outputs.has_previews == 'true' }}

.github/workflows/e2e-main-retry.yaml

@@ -47,7 +47,10 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: ">=22.19.0 <23"
+          node-version: "24.18.1"
+
+      - name: Install reviewed npm
+        uses: ./.github/actions/setup-reviewed-npm
 
       - name: Evaluate main E2E retry
         env:
@@ -96,7 +99,10 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: ">=22.19.0 <23"
+          node-version: "24.18.1"
+
+      - name: Install reviewed npm
+        uses: ./.github/actions/setup-reviewed-npm
 
       - name: Build advisory same-commit reliability report
         env: