From e89b7d815912655468e448cb4ef5f768b3d540a9 Mon Sep 17 00:00:00 2001
From: Lifei Zhou <lifei@squareup.com>
Date: Fri, 30 Jan 2026 03:32:19 +1100
Subject: [PATCH] update doc to remind contributors to activate hermit and
 document minimal npm and node version (#6727)

---
 CONTRIBUTING.md              | 16 +++++++++++-----
 ui/desktop/.npmrc            |  2 +-
 ui/desktop/package-lock.json |  3 ++-
 ui/desktop/package.json      |  3 ++-
 4 files changed, 16 insertions(+), 8 deletions(-)

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 2386989533..d301e83874 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -41,9 +41,16 @@ If you use Goose, Copilot, Claude, or other AI tools to help with your PRs:
 
 ## Prerequisites
 
-goose includes Rust binaries alongside an electron app for the GUI. To work
-on the Rust backend, you will need to [install Rust and cargo][rustup]. To work
-on the App, you will also need to [install node and npm][nvm] - we recommend through nvm.
+goose includes Rust binaries alongside an electron app for the GUI.
+
+We use [Hermit][hermit] to manage development dependencies (Rust, Node, npm, just, etc.).
+Activate Hermit when entering the project:
+
+```bash
+source bin/activate-hermit
+```
+
+Or add [shell hook auto-activation](https://cashapp.github.io/hermit/usage/shell/#shell-hooks) so Hermit activates automatically when you `cd` into the project (recommended).
 
 We provide a shortcut to standard commands using [just][just] in our `justfile`.
 
@@ -285,8 +292,7 @@ Then you can view your traces at http://localhost:3000
 This project follows the [Conventional Commits](https://www.conventionalcommits.org/en/v1.0.0/) specification for PR titles. Conventional Commits make it easier to understand the history of a project and facilitate automation around versioning and changelog generation.
 
 [issues]: https://github.com/block/goose/issues
-[rustup]: https://doc.rust-lang.org/cargo/getting-started/installation.html
-[nvm]: https://github.com/nvm-sh/nvm
+[hermit]: https://cashapp.github.io/hermit/
 [just]: https://github.com/casey/just?tab=readme-ov-file#installation
 
 ## Developer Certificate of Origin
diff --git a/ui/desktop/.npmrc b/ui/desktop/.npmrc
index 214c29d139..5660f81af2 100644
--- a/ui/desktop/.npmrc
+++ b/ui/desktop/.npmrc
@@ -1 +1 @@
-registry=https://registry.npmjs.org/
+registry=https://registry.npmjs.org/
\ No newline at end of file
diff --git a/ui/desktop/package-lock.json b/ui/desktop/package-lock.json
index 6702abc958..86b61632c6 100644
--- a/ui/desktop/package-lock.json
+++ b/ui/desktop/package-lock.json
@@ -115,7 +115,8 @@
         "vitest": "^4.0.17"
       },
       "engines": {
-        "node": "^24.0.0"
+        "node": "^24.10.0",
+        "npm": "^11.6.1"
       }
     },
     "node_modules/@acemir/cssom": {
diff --git a/ui/desktop/package.json b/ui/desktop/package.json
index 0b62834fd2..e39c9fb080 100644
--- a/ui/desktop/package.json
+++ b/ui/desktop/package.json
@@ -4,7 +4,8 @@
   "version": "1.21.0",
   "description": "Goose App",
   "engines": {
-    "node": "^24.0.0"
+    "node": "^24.10.0",
+    "npm": "^11.6.1"
   },
   "main": ".vite/build/main.js",
   "scripts": {