Fix unsupported Node onboarding failures

[Waishnav]

Summary

• fail npm installs early on unsupported Node versions with an actionable error
• route the published devspace binary through a dependency-free runtime bootstrap
• keep the supported Node range synchronized across package metadata and CLI diagnostics
• verify Node 18 rejection in CI before any transitive dependency can load

Why

On Node 18, devspace init currently parses @earendil-works/pi-tui before the existing runtime guard executes, producing SyntaxError: Invalid regular expression flags. The launcher now validates Node before importing the compiled CLI, while preinstall rejects normal unsupported installations.

Validation

• npm ci
• npm run typecheck
• npm test
• npm run build
• npm pack --dry-run
• actual Node 18.19.1 smoke tests for both preinstall and the published launcher

Summary by CodeRabbit

• New Features

  • Added Node.js version validation for DevSpace commands and installation.
  • DevSpace now clearly reports the supported Node.js range: 22.19 through 26.x.
  • Updated command startup behavior to provide helpful errors before launching.

• Bug Fixes

  • Prevented confusing runtime errors when DevSpace runs on unsupported Node.js versions.

• Tests

  • Added coverage for supported and unsupported Node.js versions and related error messaging.

[coderabbitai]

📝 Walkthrough

Walkthrough

Changes

Node.js compatibility is centralized in shared CommonJS helpers, enforced during installation and CLI startup, wired through package scripts, tested against package metadata and version cases, and verified in CI under supported and unsupported runtimes.

Node compatibility enforcement

Layer / File(s)	Summary
Node version contract scripts/node-version.cjs, src/cli.test.ts	Defines the supported range, parsing and diagnostics, exports validation helpers, and tests version behavior and package metadata.
Guarded CLI entrypoints and package wiring scripts/check-node-version.cjs, scripts/devspace.cjs, package.json, src/cli.ts	Validates Node.js before installation or CLI startup, routes package commands through the script entrypoint, and shares the configured range with the CLI.
Unsupported-runtime verification .github/workflows/ci.yml	Builds with Node.js 22.19, then verifies expected failures under Node.js 18.19.1. её

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant User
  participant scripts/devspace.cjs
  participant node-version.cjs
  participant dist/cli.js
  User->>scripts/devspace.cjs: invoke devspace command
  scripts/devspace.cjs->>node-version.cjs: validate Node.js version
  node-version.cjs-->>scripts/devspace.cjs: return support status
  alt supported version
    scripts/devspace.cjs->>dist/cli.js: dynamically import CLI
    dist/cli.js-->>User: execute command
  else unsupported version
    scripts/devspace.cjs-->>User: print error and exit
  end

Loading

Poem

A bunny checks the Node at the door,
“Twenty-two point nineteen, or more!”
Scripts guide the way,
CI tests night and day,
And errors hop clearly ashore.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: adding early failures for unsupported Node.js onboarding.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/node-version-bootstrap

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/ci.yml:
- Around line 56-57: Update the Checkout step using actions/checkout@v4 to set
persist-credentials to false before dependency installation runs.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: f92132f1-a56c-4233-b1d7-5b936ffb9802

📥 Commits

Reviewing files that changed from the base of the PR and between 80423b5 and 0d50596.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (7)

• .github/workflows/ci.yml
• package.json
• scripts/check-node-version.cjs
• scripts/devspace.cjs
• scripts/node-version.cjs
• src/cli.test.ts
• src/cli.ts

[coderabbitai]

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Disable persisted checkout credentials before running dependency scripts.

npm ci can execute lifecycle scripts; with checkout’s default credential persistence, a compromised dependency can read the GitHub token from local Git configuration. Set persist-credentials: false.

Proposed fix

       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	- name: Checkout
	uses: actions/checkout@v4
	- name: Checkout
	uses: actions/checkout@v4
	with:
	persist-credentials: false

🧰 Tools

🪛 zizmor (1.26.1)

[warning] 56-57: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml around lines 56 - 57, Update the Checkout step
using actions/checkout@v4 to set persist-credentials to false before dependency
installation runs.

Source: Linters/SAST tools