chore(deps): align Node and advisor SDK requirements

[cv]

Summary

Raises NemoClaw's supported Node.js minimum from 22.16 to 22.19 so the host and contributor contract matches the current OpenClaw runtime and advisor SDK requirements.
Upgrades both advisor workflows to Pi SDK 0.80.6, removes the SDK advisories present in 0.74.x, and pins TypeBox explicitly where the PR advisor imports it directly.

Changes

• Align package engines, installer and developer checks, the exact-minimum CI lane, fixtures, tests, and user-facing prerequisites on Node.js 22.19.
• Upgrade the PR and E2E advisor SDK pins to @earendil-works/pi-coding-agent@0.80.6 with a reviewed July 11 dependency cutoff.
• Declare typebox@1.1.38 directly and install it explicitly in the PR advisor workflow because Pi 0.80.6 shrinkwraps its own nested dependency copy.
• Extend the PR advisor workflow boundary and install-step test to protect the direct TypeBox runtime dependency.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification:
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Pending maintainer review; no waiver requested.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: None.

Verification

• PR description includes the DCO sign-off declaration and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — Node.js 22.19: CLI typecheck passed; 3 CLI files/11 tests, 17 integration files/318 tests, and 2 installer-integration files/96 tests passed; isolated PR and E2E advisor runtime imports passed.
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result: Not run; the focused version, installer, workflow, and advisor lanes cover this dependency change.
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only) — Build passed with 0 errors; Fern reported an unauthenticated redirects warning and the existing light-theme contrast warning.
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Carlos Villela cvillela@nvidia.com

Summary by CodeRabbit

• Compatibility

  • Raised the minimum supported Node.js version to 22.19 across installer/runtime checks, fixtures, and tooling.

• Maintenance

  • Updated pinned runtime Node.js versions in workflows to 22.19.
  • Upgraded the Pi SDK to 0.80.6 and pinned TypeBox where required.
  • Hardened the advisor workflow by cleaning up analysis workspace symlinks to prevent unsafe reads.

• Documentation

  • Updated prerequisites and “Node.js too old” troubleshooting guidance to require 22.19.

• Tests

  • Updated installer/workflow validations and assertions to expect 22.19 behavior, including advisor workflow boundary checks.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 53a66eac-1990-4eaa-979a-34f8ea31c655

📥 Commits

Reviewing files that changed from the base of the PR and between fd28b0c and a866513.

📒 Files selected for processing (4)

• .github/workflows/pr-review-advisor.yaml
• ci/source-shape-test-budget.json
• test/pr-review-advisor-workflow-boundary.test.ts
• tools/pr-review-advisor/workflow-boundary.mts

---

📝 Walkthrough

Walkthrough

The pull request raises the repository’s minimum Node.js version from 22.16 to 22.19, updates installer validation and tests, refreshes documentation and package engines, and pins Pi SDK and TypeBox versions in advisor workflows.

Changes

Runtime baseline and validation

Layer / File(s)	Summary
Node.js minimum enforcement scripts/install.sh, scripts/dev-setup.sh, src/lib/domain/installer/version.ts, package.json, nemoclaw/package.json, agents/openclaw/mcporter-runtime/package.json, test/e2e/fixtures/plugins/weather/package.json, .github/workflows/installer-hash-check.yaml, test/pr-workflow-contract.test.ts, scripts/check-node-version.js	The minimum supported Node.js version and related runtime checks are updated to 22.19.0.
Node.js requirement documentation AGENTS.md, CONTRIBUTING.md, docs/..., scripts/bench/README.md	Development, setup, troubleshooting, starter prompt, and benchmark guidance now require Node.js 22.19 or later.
Installer and runtime test updates src/lib/.../*.test.ts, test/...	Fixtures and expectations use Node.js 22.19.0, with unsupported-runtime cases updated to Node.js 22.18.0 where applicable.

Advisor runtime and workspace protection

Layer / File(s)	Summary
Advisor dependency pinning .github/workflows/e2e-advisor.yaml, .github/workflows/pr-review-advisor.yaml, package.json, tools/pr-review-advisor/workflow-boundary.mts, test/pr-review-advisor-workflow-boundary.test.ts, docs/security/...	Pi SDK is pinned to 0.80.6, TypeBox 1.1.38 is installed explicitly, and the corresponding workflow boundary checks and dependency review record are updated.
Analysis workspace symlink protection .github/workflows/pr-review-advisor.yaml, tools/pr-review-advisor/workflow-boundary.mts, test/pr-review-advisor-workflow-boundary.test.ts, ci/source-shape-test-budget.json	The workflow removes analysis-workspace symlinks before review execution, while validation and tests enforce the cleanup command and step ordering.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested labels: chore

Suggested reviewers: ericksoa, jyaunches

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 36.36% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main changes: raising Node requirements and updating advisor SDK dependencies.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/node-22-19-pi-0-80-6

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage remains at 96%, unchanged from the main branch.

TypeScript / code-coverage/cli

The overall coverage in the codex/node-22-19-pi-... branch remains at 79%, unchanged from the main branch.

Show a code coverage summary of the most impacted files.

File	main 13bece6	codex/node-22-19-pi-... a866513	+/-
src/lib/actions...l-validation.ts	95%	89%	-6%
src/lib/actions...-add-restart.ts	19%	14%	-5%
src/lib/securit...ntial-filter.ts	99%	97%	-2%
src/lib/policy/index.ts	60%	61%	+1%
src/lib/actions...e-validation.ts	88%	90%	+2%
src/lib/state/config-io.ts	90%	93%	+3%
src/lib/security/redact.ts	95%	100%	+5%
src/lib/messagi...ridge-health.ts	91%	96%	+5%
src/lib/messagi...onfig-prompt.ts	91%	97%	+6%
src/lib/messagi.../token-paste.ts	82%	92%	+10%

---

_{Updated July 13, 2026 00:23 UTC
Code Coverage is in Public Preview. Learn more and provide us with your feedback.}

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-6729.docs.buildwithfern.com/nemoclaw

[github-actions]

E2E Advisor Recommendation

Required E2E: cloud-onboard
Optional E2E: None

Dispatch hint: cloud-onboard

Workflow run

Full advisor summary

E2E Recommendation Advisor

Base: origin/main
Head: HEAD
Confidence: high

Required E2E

• cloud-onboard (high): Required by the deterministic platform-install risk plan. It validates that the public installer works on a clean supported host with the pinned runtime dependencies and reaches a usable hosted sandboxed agent after the Node.js runtime-floor change.

Optional E2E

• None.

New E2E recommendations

• None.

Dispatch hint

• Workflow: E2E
• jobs input: cloud-onboard

[github-actions]

PR Review Advisor — No blocking findings

Merge posture: No blocking advisor findings
Primary next action: No advisor follow-up required beyond maintainer review.
Findings: 0 required · 0 warnings · 0 optional suggestions
Since last review: 1 prior item resolved · 0 still apply · 0 new items found

Workflow run details

This is an automated review. Required findings need action before merge. Warnings and optional suggestions do not require a response or follow-up. A human maintainer makes the final merge decision.