build(runtime): move to Node 26 LTS

.github/scripts/test_release_workflow.py

@@ -257,7 +257,7 @@ def test_dmg_creation_failures_are_not_ignored(self):
     def test_packaging_uses_the_same_node_as_ci(self):
         node = [step["with"] for step in steps(self.jobs["build-macos"]) if step.get("uses", "").startswith("actions/setup-node@")]
         self.assertEqual(len(node), 1)
-        self.assertEqual(str(node[0]["node-version"]), "22.23.3")
+        self.assertEqual(str(node[0]["node-version"]), "26.13.0")
         self.assertIs(node[0]["package-manager-cache"], False)
 
     def test_build_job_produces_an_unsigned_app(self):

.github/workflows/macos.yml

@@ -66,7 +66,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: '22.23.3'
+          node-version: '26.13.0'
           cache: npm
           cache-dependency-path: apps/purepoint-mobile/package-lock.json
       - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master
@@ -104,7 +104,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: '22.23.3'
+          node-version: '26.13.0'
           cache: npm
           cache-dependency-path: apps/purepoint-mobile/package-lock.json
       - run: npm ci --ignore-scripts
@@ -241,7 +241,7 @@ jobs:
 
       - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: '22.23.3'
+          node-version: '26.13.0'
       - name: Prepare actual shared bridge dependencies and isolated helper
         run: |
           npm ci --ignore-scripts --prefix apps/purepoint-mobile
@@ -312,7 +312,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: '22.23.3'
+          node-version: '26.13.0'
       - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master
         with:
           toolchain: "1.89"
@@ -364,7 +364,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: '22.23.3'
+          node-version: '26.13.0'
       - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: point-guard-runtime-arm64
@@ -430,7 +430,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: '22.23.3'
+          node-version: '26.13.0'
       - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master
         with:
           toolchain: "1.89"

.github/workflows/release-proof.yml

@@ -28,7 +28,7 @@ jobs:
           targets: aarch64-apple-darwin,x86_64-apple-darwin
       - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: '22.23.3'
+          node-version: '26.13.0'
       - name: Isolate archive Rust output
         run: printf 'CARGO_TARGET_DIR=%s/release-cargo\n' "$RUNNER_TEMP" >> "$GITHUB_ENV"
       # Pinned release, checked against its SHA-256 instead of Homebrew's moving formula.

.github/workflows/release.yml

@@ -106,7 +106,7 @@ jobs:
       - name: Install Node
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: '22.23.3'
+          node-version: '26.13.0'
           package-manager-cache: false
 
       # Ad-hoc signed only; the sign-macos job re-signs every nested binary
@@ -478,7 +478,7 @@ jobs:
       - name: Install Node for npm
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: '22.23.3'
+          node-version: '26.13.0'
           package-manager-cache: false
 
       - name: Download Linux build
@@ -559,7 +559,7 @@ jobs:
       - name: Install Node
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: '22.23.3'
+          node-version: '26.13.0'
           package-manager-cache: false
 
       # Installed outside the repository so its own lockfile and the 1.94.0

CHANGELOG.md

@@ -9,6 +9,7 @@ All notable changes to PurePoint are documented here. Format follows [Keep a Cha
 - Paste an image (Cmd+V) into any agent's terminal, or drop files on a remote agent's terminal, and the macOS app uploads it to the agent's machine and types its path there, so remote agents can see screenshots. Uploads are kept in `~/.pu/attachments` on that machine for 7 days.
 
 ### Changed
+- Point Guard now runs on its bundled Node.js 26 LTS (26.13.0), up from Node 22, on macOS and on Linux phone hosts. Nothing to install: the runtime ships inside PurePoint. Linux phone hosts still need glibc 2.28 or newer.
 - The daemon protocol is now version 14, for the new `reorder_projects` request. Update PurePoint on every machine and restart its daemon.
 - Phones and iPads now pair with full access (agents, terminals, workspace management and Point Guard chat). Point Guard setup shows each device on one line with a single Access menu (Full access, Terminals only, View only, No access) and a Revoke button. Revoked devices are removed instead of lingering as "Revoked", and the redundant "Require re-pair" button is gone. Devices that are already paired keep their current access.
 - The daemon protocol is now version 12, for the new `attach_file` request. Update PurePoint on every machine and restart its daemon.

apps/purepoint-mobile/README.md

@@ -20,9 +20,9 @@ The service runs for the Mac app lifetime. Restart/update restores selected nati
 
 ## Development and package proof
 
-The lockfile pins vanilla `@earendil-works/pi-coding-agent` **1.1.0** and `ws` **8.22.0**. Development requires Node22.19+ and `npm ci --ignore-scripts`; this is separate from end-user installation. Do not globally install the harness or overwrite running pu binaries. The managed launcher uses bundled versioned support/instructions and explicit CLI routing; existing native Pi resources remain compatible. Cross-project operations use `PU_PROJECT_ROOT=/absolute/project pu ...` or an explicit cwd, never an inherited builder identity.
+The lockfile pins vanilla `@earendil-works/pi-coding-agent` **1.1.0** and `ws` **8.22.0**. Development requires Node 26+ and `npm ci --ignore-scripts`; this is separate from end-user installation. Do not globally install the harness or overwrite running pu binaries. The managed launcher uses bundled versioned support/instructions and explicit CLI routing; existing native Pi resources remain compatible. Cross-project operations use `PU_PROJECT_ROOT=/absolute/project pu ...` or an explicit cwd, never an inherited builder identity.
 
-`runtime/package-runtime.py` stages the supported Node22.23.3, complete production graph and pu helper into an app artifact. `runtime/sign-runtime.py` signs nested code before the outer app, with Node JIT entitlement. Nonpublishing CI (arm64 on pull requests that touch packaging inputs; x64 and universal on `main`, nightly and manual runs) verifies arm64, x64 and universal resources, signatures and relocated empty-HOME/stripped-PATH launch, then state-preserving bundle replacement. Ad-hoc proof does not establish Developer ID/notarization or physical-device acceptance. The normative [setup/trust contract](../../docs/product/point-guard-setup.md) defines private state and listener/admin boundaries.
+`runtime/package-runtime.py` stages the supported Node26.13.0, complete production graph and pu helper into an app artifact. `runtime/sign-runtime.py` signs nested code before the outer app, with Node JIT entitlement. Nonpublishing CI (arm64 on pull requests that touch packaging inputs; x64 and universal on `main`, nightly and manual runs) verifies arm64, x64 and universal resources, signatures and relocated empty-HOME/stripped-PATH launch, then state-preserving bundle replacement. Ad-hoc proof does not establish Developer ID/notarization or physical-device acceptance. The normative [setup/trust contract](../../docs/product/point-guard-setup.md) defines private state and listener/admin boundaries.
 
 ## iPhone / Xcode — owner-run
 

apps/purepoint-mobile/package.json

@@ -3,7 +3,7 @@
   "private": true,
   "type": "module",
   "engines": {
-    "node": ">=22.19.0"
+    "node": ">=26.0.0"
   },
   "scripts": {
     "start": "node bridge/main.js",
@@ -20,7 +20,7 @@
     "ws": "8.22.0"
   },
   "devDependencies": {
-    "@types/node": "22.19.19",
+    "@types/node": "26.6.6",
     "@types/ws": "8.18.2",
     "prettier": "3.9.10",
     "typescript": "7.0.2"

apps/purepoint-mobile/runtime/bundled-pi-verification.md

@@ -1,6 +1,6 @@
 # Bundled Pi verification — 2026-10-10
 
-Point Guard owns its Pi runtime. Users install and update PurePoint; they do not need to install or update Node, npm, or Pi separately. The app manifest pins Pi 1.1.0 and Node 22.23.3. The native owner launches the explicit bundled Node helper; the bridge launches that same executable with its bundled Pi adapter and package. Canonical Pi credentials and sessions remain outside the app so app updates preserve them.
+Point Guard owns its Pi runtime. Users install and update PurePoint; they do not need to install or update Node, npm, or Pi separately. The app manifest pins Pi 1.1.0 and Node 26.13.0. The native owner launches the explicit bundled Node helper; the bridge launches that same executable with its bundled Pi adapter and package. Canonical Pi credentials and sessions remain outside the app so app updates preserve them.
 
 Managed RPC startup/exit recovery now directs users to Point Guard setup and PurePoint retry/update/reinstallation. Development bridge startup retains npm guidance. Missing-model feedback asks for provider/model configuration without requiring a separate terminal Pi installation.
 

apps/purepoint-mobile/runtime/node-release.json

@@ -1,21 +1,21 @@
 {
-  "version": "22.23.3",
+  "version": "26.13.0",
   "archives": {
     "arm64": {
-      "name": "node-v22.23.3-darwin-arm64.tar.gz",
-      "sha256": "23b25245dcfb9af7262f8ff142e9e2e0af025368117329e7a7458a51e5922f53"
+      "name": "node-v26.13.0-darwin-arm64.tar.gz",
+      "sha256": "d38bd5e5a2ddce6bbb5ce45e46e208337da4d51fffe611e567fd32073d6439f6"
     },
     "x64": {
-      "name": "node-v22.23.3-darwin-x64.tar.gz",
-      "sha256": "8a677b0219178efd6eb0e475457c4afb452b521a92f6e67845a73bd85727f2a8"
+      "name": "node-v26.13.0-darwin-x64.tar.gz",
+      "sha256": "525c9b29bb0263d687de60a4cec0e2a6db876a8eb032369e5795eca71e7c358e"
     },
     "linux-arm64": {
-      "name": "node-v22.23.3-linux-arm64.tar.gz",
-      "sha256": "5ced2d48d1d7198739b7f86804de0171aefb6823b684b12341d3321afc3cb0b2"
+      "name": "node-v26.13.0-linux-arm64.tar.gz",
+      "sha256": "439e9c438acdf6a6ffe47418da709153d66c4bed812e30a473faacb107dd2791"
     },
     "linux-x64": {
-      "name": "node-v22.23.3-linux-x64.tar.gz",
-      "sha256": "1084aa36196bba4c3a5e69a1ee388a6e4ff729dad09445fbcd434b28fe3c24af"
+      "name": "node-v26.13.0-linux-x64.tar.gz",
+      "sha256": "5848553868b402d3fabb5b09270649977780a390f832155721025a08b5104455"
     }
   }
 }