fix(install): desktop still gated on Node 26 by a stale lockfile engines mirror

[OutThisLife]

hermes desktop still fails with EBADENGINE demanding Node >=26 after #76562 — my miss. I fixed apps/desktop/package.json but not its mirror in package-lock.json, and npm ci reads engines from the lockfile:

package.json  apps/desktop -> {'node': '^20.19.0 || >=22.12.0'}
package-lock  apps/desktop -> {'node': '>=26.0.0'}      <- what actually gated

Second problem, found while chasing that

The floor #76562 declared was too generous. Running the real npm ci over the whole workspace on Node 22.21.1:

npm error notsup Not compatible with your version of node/npm: react-router@8.3.0
npm error notsup Required: {"node":">=22.22.0"}

react-router 8.3.0 — a direct dependency of both apps/desktop and web — declares >=22.22.0. That is tighter than Vite's ^20.19 || >=22.12 and excludes all of Node 20. So >=20.0.0 promised support the tree cannot deliver: an install on Node 20 or early 22 cleared the installer's gate and then died inside npm ci on somebody else's package.

The fix

All four engine declarations now state the floor the dependency tree actually has, >=22.22.0 — root package.json, apps/desktop/package.json, and both package-lock.json mirrors. The installer gates move with them (node_satisfies_build, Test-NodeVersionOk) so a too-old system Node is replaced with the managed one before npm runs, and any failure a user does hit names hermes-agent instead of a transitive package. NODE_VERSION stays 22 — latest-v22.x is 22.23.2, comfortably above the floor.

Verification

Real npm ci --dry-run over the full workspace, not a trimmed fixture:

Node	Result
22.23.2 (what install.sh provisions)	✓ 1258 packages
26.5.1	✓ 1189 packages
22.21.1 (below the floor)	✓ EBADENGINE naming hermes-agent — our manifest, not react-router

The invariant test gains the case that would have caught the mirror drift on its own: the desktop assertion now pins the tightest floor any dependency actually declares, and the managed-runtime check compares majors, since install.sh fetches latest-v{major}.x rather than {major}.0.0.

Worth naming the lesson — I verified #76562 against a hand-built fixture (root manifest + lockfile only) rather than the real workspace tree. That fixture had no apps/desktop entry and no react-router, so it could not have caught either bug. The checks here run against git archive of the actual tree.

[github-actions]

૮ >ﻌ< ა ci review

_{ran on 63ff4b8}

ℹ️ Info

Desktop E2E visual evidence · View test artifacts · View job

3 visual diffs.

_{inline evidence is publishing...}