fix(contributor): keep devDependencies on npm install

[rluo8]

Summary

A new contributor following CONTRIBUTING.md top-to-bottom on a clean machine hits three setup breaks (reported in #6090). The worst is that the root prepare hook unconditionally runs npm install --omit=dev --ignore-scripts, which prunes typescript/prek from a contributor checkout — so the very next documented step, npm run typecheck:cli, fails with tsc: not found. This guards that prune so it only bootstraps production deps when they are actually missing, and fills two documentation gaps.

Related Issue

Fixes #6090

Changes

• package.json (prepare): only run the --omit=dev production-dependency bootstrap when a prod dep is unresolved (node -e "require.resolve('p-retry')" || npm install --omit=dev …). This preserves the npm install -g .while no longer pruning devDependencies on a normal contributor npm install.
• CONTRIBUTING.md: give uv an install command (curl -LsSf https://astral.sh/uv/install.sh | sh, or brew install uv) matching how hadolint already shows one.
• CONTRIBUTING.md: after npm link, add npm's global bin to PATH (export PATH="$(npm prefix -g)/bin:$PATH") so the nemoclaw command resolves.

Type of Change

• Code change (feature, bug fix, or refactor)
• [√ ] Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• [√] Docs updated for user-facing behavior changes
• Docs not applicable — justification:
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification:
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Verification

• [√ ] PR description includes the DCO sign-off declaration and every commit appears as Verified in GitHub
• [√] Git hooks passed during commit and push, or npx prek run --from-ref main --to-ref HEAD passes
• Targeted tests pass for changed behavior
• [√] Full npm test passes (broad runtime changes only)
• Quality Gates section completed with required justifications or waivers
• [√] No secrets, API keys, or credentials committed
• [√] npm run docs builds without warnings (doc changes only)
• [√] Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: rluo8 ruluo@nvidia.com

Summary by CodeRabbit

• Documentation

  • Expanded setup guidance with explicit prerequisite install instructions (curl-based or Homebrew on macOS).
  • Added clearer instructions to persistently configure PATH so the CLI command remains available across shell sessions.

• Bug Fixes

  • Improved setup/prepare behavior by only reinstalling production dependencies when a required package isn’t already available.
  • Made hook/CLI setup more resilient by cleanly skipping when the required tooling isn’t present.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 78f2ca95-88da-43f1-b0b0-790f4190c1bf

📥 Commits

Reviewing files that changed from the base of the PR and between 9c9dda9 and a46039d.

📒 Files selected for processing (1)

• package.json

🚧 Files skipped from review as they are similar to previous changes (1)

• package.json

---

📝 Walkthrough

Walkthrough

Updates CONTRIBUTING.md with uv install and PATH export guidance, and changes package.json so the prepare script conditionally installs p-retry only when missing.

Changes

Contributor setup fixes

Layer / File(s)	Summary
CONTRIBUTING.md prerequisite and PATH guidance updates CONTRIBUTING.md	Expands the uv prerequisite with install commands and adds an npm global bin PATH export snippet for the nemoclaw CLI.
Prepare script p-retry install check package.json	Updates the prepare script to check require.resolve('p-retry') before running npm install --omit=dev --ignore-scripts; the git-hook setup flow remains unchanged.

Estimated code review effort: 2 (Simple) | ~10 minutes

Related Issues: #6090

Suggested labels: documentation, dependencies

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is concise and accurately reflects the main fix to preserve devDependencies during npm install.
Linked Issues check	✅ Passed	The PR addresses all three linked requirements: preserves devDependencies, documents PATH setup after npm link, and adds a uv install command.
Out of Scope Changes check	✅ Passed	The changes stay within contributor setup and documentation scope with no clear unrelated additions.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@package.json`:
- Line 65: The prepare script is swallowing failures from the fallback
dependency repair step, so a missing p-retry can still leave the checkout broken
while reporting success. Update the package.json prepare command to avoid the
unconditional fallback success in the require.resolve('p-retry')/npm install
branch: either let the npm install step fail normally or verify p-retry again
immediately after installation and exit non-zero if it is still missing. Keep
the change focused on the prepare script so the repair logic in package.json is
the only behavior adjusted.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: cbe83c31-c8af-45e7-9ef6-63ff0f2fe8a5

📥 Commits

Reviewing files that changed from the base of the PR and between 6092ad2 and 9c9dda9.

📒 Files selected for processing (2)

• CONTRIBUTING.md
• package.json

[ericksoa]

Reviewed exact head a46039d. No blocking findings. All CI is green, DCO and GitHub verification pass, CodeRabbit is resolved, and fresh Node 22/npm 10 validation confirmed npm install and prepare preserve devDependencies while dependency-repair failures propagate. The advisor test-coverage suggestion is non-blocking for this focused lifecycle guard given the exact-head install validation; its curl|sh concern is consistent with the repository’s existing official-installer guidance.