NVIDIA · ericksoa · Apr 10, 2026 · Apr 9, 2026 · Apr 9, 2026 · Apr 9, 2026
diff --git a/.agents/skills/nemoclaw-maintainer-day/RISKY-AREAS.md b/.agents/skills/nemoclaw-maintainer-day/RISKY-AREAS.md
@@ -5,7 +5,7 @@ PRs touching these areas need tests before approval.
 | Area | Key paths |
 |------|-----------|
 | Installer / bootstrap shell | `install.sh`, `setup.sh`, `brev-setup.sh`, `scripts/*.sh` |
-| Onboarding / host glue | `bin/lib/onboard.js`, `bin/*.js` |
+| Onboarding / host glue | `src/lib/onboard.ts`, `bin/nemoclaw.js`, `scripts/*.sh` |
 | Sandbox / policy / SSRF | `nemoclaw/src/blueprint/`, `nemoclaw-blueprint/`, policy presets |
 | Workflow / enforcement | `.github/workflows/`, prek hooks, DCO, signing, version/tag flows |
 | Credentials / inference / network | credential helpers, inference provider routing, approval flows |

diff --git a/.github/workflows/legacy-path-guard.yaml b/.github/workflows/legacy-path-guard.yaml
@@ -9,7 +9,7 @@ on:
 
 jobs:
   guard-migrated-paths:
-    name: block edits to migrated legacy paths
+    name: block edits to migrated legacy paths and removed shims
     if: ${{ github.base_ref == 'main' && !startsWith(github.head_ref, 'ts-migration/') }}
     runs-on: ubuntu-latest
 

diff --git a/AGENTS.md b/AGENTS.md
@@ -14,8 +14,8 @@ This repo ships agent skills under `.agents/skills/`, organized into three audie
 
 | Path | Language | Purpose |
 |------|----------|---------|
-| `bin/` | JavaScript (CJS) | CLI entry point (`nemoclaw.js`) and library modules |
-| `bin/lib/` | JavaScript (CJS) | Core CLI logic: onboard, credentials, inference, policies, preflight, runner |
+| `bin/` | JavaScript (CJS) | CLI launcher (`nemoclaw.js`) and small compatibility helpers |
+| `src/lib/` | TypeScript | Core CLI logic: onboard, credentials, inference, policies, preflight, runner |
 | `nemoclaw/` | TypeScript | Plugin project (Commander CLI extension for OpenClaw) |
 | `nemoclaw/src/blueprint/` | TypeScript | Runner, snapshot, SSRF validation, state management |
 | `nemoclaw/src/commands/` | TypeScript | Slash commands, migration state |
@@ -47,12 +47,12 @@ This repo ships agent skills under `.agents/skills/`, organized into three audie
 
 ### Dual-Language Stack
 
-- **CLI and plugin**: JavaScript (CJS in `bin/`, ESM in `test/`) and TypeScript (`nemoclaw/src/`)
+- **CLI and plugin**: TypeScript (`src/`, `nemoclaw/src/`) with a small CommonJS launcher in `bin/`; ESM in `test/`
 - **Blueprint**: YAML configuration (`nemoclaw-blueprint/`)
 - **Docs**: Sphinx/MyST Markdown
 - **Tooling scripts**: Bash and Python
 
-The `bin/` directory uses CommonJS intentionally — it's the CLI entry point that must work without a build step. The `nemoclaw/` plugin uses TypeScript and requires compilation.
+The `bin/` directory uses CommonJS intentionally for the launcher and a few compatibility helpers so the CLI still has a stable executable entry point. The main CLI implementation lives in `src/` and compiles to `dist/`. The `nemoclaw/` plugin uses TypeScript and requires compilation.
 
 ### Testing Strategy
 
@@ -105,7 +105,7 @@ For shell scripts use `#` comments. For Markdown use HTML comments.
 
 ### JavaScript
 
-- `bin/` and `scripts/`: **CommonJS** (`require`/`module.exports`), Node.js 22.16+
+- `bin/` launcher and remaining `scripts/*.js`: **CommonJS** (`require`/`module.exports`), Node.js 22.16+
 - `test/`: **ESM** (`import`/`export`)
 - ESLint config in `eslint.config.mjs`
 - Cyclomatic complexity limit: 20 (ratcheting down to 15)
@@ -149,8 +149,8 @@ All hooks managed by [prek](https://prek.j178.dev/) (installed via `npm install`
 
 **Adding a CLI command:**
 
-- Entry point: `bin/nemoclaw.js` (routes to `bin/lib/` modules)
-- Keep `bin/lib/` modules as CommonJS
+- Entry point: `bin/nemoclaw.js` (launches the compiled CLI in `dist/`)
+- Main CLI implementation lives in `src/lib/` and compiles to `dist/lib/`
 - Add tests in `test/`
 
 **Adding a plugin feature:**

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -113,7 +113,7 @@ The repository is organized as follows.
 
 All new source files must be TypeScript. Do not add new `.js` files to the project. When modifying an existing JavaScript file, prefer migrating it to TypeScript in the same PR.
 
-Existing JavaScript in `bin/` and `scripts/` is being incrementally migrated (see `src/lib/` for completed migrations). Tests in `test/` may remain ESM JavaScript for now but new test files should use TypeScript where practical.
+Only a small CommonJS launcher/compatibility layer remains in `bin/`, while the main CLI implementation now lives in `src/lib/` and compiles to `dist/`. Tests in `test/` may remain ESM JavaScript for now but new test files should use TypeScript where practical.
 
 Shell scripts (`scripts/*.sh`) must pass ShellCheck and use `shfmt` formatting.
 

diff --git a/bin/lib/chat-filter.js b/bin/lib/chat-filter.js
diff --git a/bin/lib/config-io.js b/bin/lib/config-io.js
diff --git a/bin/lib/debug.js b/bin/lib/debug.js
diff --git a/bin/lib/inference-config.js b/bin/lib/inference-config.js
diff --git a/bin/lib/local-inference.js b/bin/lib/local-inference.js
diff --git a/bin/lib/nim.js b/bin/lib/nim.js
diff --git a/bin/lib/onboard-session.js b/bin/lib/onboard-session.js
diff --git a/bin/lib/onboard.js b/bin/lib/onboard.js
diff --git a/bin/lib/platform.js b/bin/lib/platform.js
diff --git a/bin/lib/policies.js b/bin/lib/policies.js
diff --git a/bin/lib/preflight.js b/bin/lib/preflight.js
diff --git a/bin/lib/registry.js b/bin/lib/registry.js
diff --git a/bin/lib/resolve-openshell.js b/bin/lib/resolve-openshell.js
diff --git a/bin/lib/runner.js b/bin/lib/runner.js
diff --git a/bin/lib/runtime-recovery.js b/bin/lib/runtime-recovery.js
diff --git a/bin/lib/sandbox-build-context.js b/bin/lib/sandbox-build-context.js
diff --git a/bin/lib/services.js b/bin/lib/services.js
diff --git a/bin/lib/version.js b/bin/lib/version.js
diff --git a/package.json b/package.json
@@ -34,6 +34,7 @@
   ],
   "files": [
     "bin/",
+    "dist/",
     "nemoclaw/dist/",
     "nemoclaw/openclaw.plugin.json",
     "nemoclaw/package.json",

diff --git a/scripts/benchmark-sandbox-image-build.js b/scripts/benchmark-sandbox-image-build.js
@@ -10,7 +10,7 @@ const {
   collectBuildContextStats,
   stageLegacySandboxBuildContext,
   stageOptimizedSandboxBuildContext,
-} = require("../bin/lib/sandbox-build-context");
+} = require("../dist/lib/sandbox-build-context");
 
 function parseArgs(argv) {
   const args = {