fix: add policy preset for brew

.agents/skills/cut-release-tag/SKILL.md

@@ -0,0 +1,90 @@
+---
+name: cut-release-tag
+description: Cut a new semver release tag on main, move the `latest` tag, and push. Use when cutting a release, tagging a version, shipping a build, or preparing a deployment. Trigger keywords - cut tag, release tag, new tag, cut release, tag version, ship it.
+user_invocable: true
+---
+
+# Cut Release Tag
+
+Create an annotated semver tag on `origin/main` HEAD, move the `latest` floating tag, and push both.
+
+## Prerequisites
+
+- You must be in the NemoClaw git repository.
+- You must have push access to `origin` (NVIDIA/NemoClaw).
+- The nightly E2E suite should have passed before tagging. Check with the user if unsure.
+
+## Step 1: Determine the Current Version
+
+Fetch all tags and find the latest semver tag:
+
+```bash
+git fetch origin --tags
+git tag --sort=-v:refname | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' | head -1
+```
+
+Parse the major, minor, and patch components from this tag.
+
+## Step 2: Ask the User Which Bump
+
+Present the options with the **patch bump as default**:
+
+- **Patch** (default): `vX.Y.(Z+1)` — bug fixes, small changes
+- **Minor**: `vX.(Y+1).0` — new features, larger changes
+- **Major**: `v(X+1).0.0` — breaking changes
+
+Show the concrete version strings. Example prompt:
+
+> Current tag: `v0.0.2`
+>
+> Which version bump?
+>
+> 1. **Patch** → `v0.0.3` (default)
+> 2. **Minor** → `v0.1.0`
+> 3. **Major** → `v1.0.0`
+
+Wait for the user to confirm before proceeding. If they just say "yes", "go", "do it", or similar, use the patch default.
+
+## Step 3: Show What's Being Tagged
+
+Show the user the commit that will be tagged and the changelog since the last tag:
+
+```bash
+git log --oneline origin/main -1
+git log --oneline <previous-tag>..origin/main
+```
+
+Ask for confirmation: "Tag `<new-version>` at commit `<sha>`?"
+
+## Step 4: Create and Push Tags
+
+Create the annotated tag, move `latest`, and push:
+
+```bash
+# Create annotated tag on main HEAD
+git tag -a <new-version> origin/main -m "<new-version>"
+
+# Move the latest tag (delete old, create new)
+git tag -d latest 2>/dev/null || true
+git tag -a latest origin/main -m "latest"
+
+# Push both tags (force-push latest since it moves)
+git push origin <new-version>
+git push origin latest --force
+```
+
+## Step 5: Verify
+
+```bash
+git ls-remote --tags origin | grep -E '(<new-version>|latest)'
+```
+
+Confirm both tags point to the same commit on the remote.
+
+## Important Notes
+
+- NEVER tag without explicit user confirmation of the version.
+- NEVER tag a branch other than `origin/main`.
+- Always use annotated tags (`-a`), not lightweight tags.
+- The `latest` tag is a floating tag that always points to the most recent release — it requires `--force` to push.
+- Do NOT update `package.json` version — that is handled separately.

.agents/skills/nemoclaw-get-started/SKILL.md

@@ -35,7 +35,7 @@ The sandbox image is approximately 2.4 GB compressed. During image push, the Doc
 | Dependency | Version                          |
 |------------|----------------------------------|
 | Linux      | Ubuntu 22.04 LTS or later |
-| Node.js    | 20 or later |
+| Node.js    | 22.16 or later |
 | npm        | 10 or later |
 | Container runtime | Supported runtime installed and running |
 | [OpenShell](https://github.com/NVIDIA/OpenShell) | Installed |

.agents/skills/nemoclaw-reference/references/troubleshooting.md

@@ -21,19 +21,19 @@ If you see an unsupported platform error, verify that you are running on a suppo
 
 ### Node.js version is too old
 
-NemoClaw requires Node.js 20 or later.
+NemoClaw requires Node.js 22.16 or later.
 If the installer exits with a Node.js version error, check your current version:
 
 ```console
 $ node --version
 ```
 
-If the version is below 20, install a supported release.
+If the version is below 22.16, install a supported release.
 If you use nvm, run:
 
 ```console
-$ nvm install 20
-$ nvm use 20
+$ nvm install 22
+$ nvm use 22
 ```
 
 Then re-run the installer.
@@ -69,7 +69,7 @@ If another process is already bound to this port, onboarding fails.
 Identify the conflicting process, verify it is safe to stop, and terminate it:
 
 ```console
-$ lsof -i :18789
+$ sudo lsof -i :18789
 $ kill <PID>
 ```
 

.dockerignore

@@ -4,3 +4,9 @@ node_modules
 *.pyc
 __pycache__
 .pytest_cache
+.venv
+.ruff_cache
+.mypy_cache
+.env
+*.egg-info
+.DS_Store

.github/PULL_REQUEST_TEMPLATE.md

@@ -40,3 +40,7 @@
 - [ ] Follows the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md). Try running the `update-docs` agent skill to draft changes while complying with the style guide. For example, prompt your agent with "`/update-docs` catch up the docs for the new changes I made in this PR."
 - [ ] New pages include SPDX license header and frontmatter, if creating a new page.
 - [ ] Cross-references and links verified.
+
+---
+<!-- DCO sign-off (required by CI). Replace with your real name and email. -->
+Signed-off-by: Your Name <your-email@example.com>

.github/actions/basic-checks/action.yaml

@@ -0,0 +1,43 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+name: basic-checks
+description: Run the shared Node.js, hadolint, build, and prek-based checks used by CI.
+
+runs:
+  using: composite
+  steps:
+    - name: Setup Node.js
+      uses: actions/setup-node@v6
+      with:
+        node-version: "22"
+        cache: npm
+
+    - name: Install hadolint
+      shell: bash
+      run: |
+        HADOLINT_VERSION="v2.14.0"
+        HADOLINT_URL="https://github.com/hadolint/hadolint/releases/download/${HADOLINT_VERSION}/hadolint-Linux-x86_64"
+        curl -fsSL -o /usr/local/bin/hadolint "$HADOLINT_URL"
+        EXPECTED=$(curl -fsSL "${HADOLINT_URL}.sha256" | awk '{print $1}')
+        ACTUAL=$(sha256sum /usr/local/bin/hadolint | awk '{print $1}')
+        [ "$EXPECTED" = "$ACTUAL" ] || { echo "::error::hadolint checksum mismatch"; exit 1; }
+        chmod +x /usr/local/bin/hadolint
+
+    - name: Install dependencies
+      shell: bash
+      run: |
+        npm install --ignore-scripts
+        cd nemoclaw && npm install
+
+    - name: Build TypeScript plugin
+      shell: bash
+      run: cd nemoclaw && npm run build
+
+    - name: Build CLI TypeScript modules
+      shell: bash
+      run: npm run build:cli
+
+    - name: Run checks
+      shell: bash
+      run: npx prek run --all-files --stage pre-push

.github/actions/resolve-sandbox-base-image/action.yaml

@@ -0,0 +1,19 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+name: resolve-sandbox-base-image
+description: Resolve the sandbox base image from GHCR, falling back to a local Dockerfile.base build.
+
+runs:
+  using: composite
+  steps:
+    - name: Resolve sandbox base image
+      shell: bash
+      run: |
+        if docker pull ghcr.io/nvidia/nemoclaw/sandbox-base:latest 2>/dev/null; then
+          echo "BASE_IMAGE=ghcr.io/nvidia/nemoclaw/sandbox-base:latest" >> "$GITHUB_ENV"
+        else
+          echo "::warning::GHCR base image not available, building locally"
+          docker build -f Dockerfile.base -t nemoclaw-sandbox-base-local .
+          echo "BASE_IMAGE=nemoclaw-sandbox-base-local" >> "$GITHUB_ENV"
+        fi

.github/dco-bypass.txt

@@ -0,0 +1,28 @@
+adityanjothi
+brandonpelfrey
+cjagwani
+cr7258
+cv
+dnandakumar-nv
+ericksoa
+gagandaroach
+hulynn
+jacobtomlinson
+jayavenkatesh19
+jbfbell
+jieunl24
+jneeee
+jyaunches
+kjw3
+krmurph
+mercl-lau
+miyoungc
+nv-ddave
+nv-kasikritc
+paritoshd-nv
+prekshivyas
+rwipfelnv
+sayalinvidia
+senthilr-nv
+theFong
+wscurran

.github/workflows/base-image.yaml

@@ -45,7 +45,7 @@ jobs:
         uses: docker/setup-qemu-action@v3
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Log in to GHCR
         uses: docker/login-action@v3

.github/workflows/dco-check.yaml

@@ -0,0 +1,53 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+name: dco-check
+
+on:
+  pull_request:
+    types: [opened, edited, synchronize, reopened]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  dco-check:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Check DCO bypass list
+        id: dco-bypass
+        env:
+          USERNAME: ${{ github.event.pull_request.user.login }}
+        run: |
+          if grep -Fxq "$USERNAME" .github/dco-bypass.txt; then
+            echo "bypass=true" >> "$GITHUB_OUTPUT"
+            echo "Author is in dco-bypass.txt; skipping DCO sign-off requirement."
+          else
+            echo "bypass=false" >> "$GITHUB_OUTPUT"
+            echo "Author is not in dco-bypass.txt; DCO sign-off is required."
+          fi
+
+      - name: Check PR body for Signed-off-by
+        if: ${{ steps.dco-bypass.outputs.bypass != 'true' }}
+        env:
+          PR_BODY: ${{ github.event.pull_request.body }}
+        run: |
+          normalized_body="$(printf '%s\n' "$PR_BODY" | tr -d '\r')"
+
+          if ! printf '%s\n' "$normalized_body" | grep -qP '^Signed-off-by:\s+.+\s+<[^<>]+>$'; then
+            echo "::error::PR description must contain a DCO sign-off line."
+            echo "::error::Expected format: Signed-off-by: Your Name <your-email@example.com>"
+            exit 1
+          fi
+
+          echo "PR description contains a DCO sign-off."

.github/workflows/docs-preview-deploy.yaml

@@ -78,7 +78,7 @@ jobs:
 
       - name: Post preview comment
         if: steps.meta.outputs.action != 'closed' && steps.meta.outputs.same-repo == 'true'
-        uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405  # v2
+        uses: marocchino/sticky-pull-request-comment@70d2764d1a7d5d9560b100cbea0077fc8f633987  # v3.0.2
         with:
           header: pr-preview
           number: ${{ steps.meta.outputs.pr-number }}
@@ -99,7 +99,7 @@ jobs:
 
       - name: Remove preview comment
         if: steps.meta.outputs.action == 'closed'
-        uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405  # v2
+        uses: marocchino/sticky-pull-request-comment@70d2764d1a7d5d9560b100cbea0077fc8f633987  # v3.0.2
         with:
           header: pr-preview
           number: ${{ steps.meta.outputs.pr-number }}