feat(installer): prepare DGX Station host prerequisites

docs/get-started/prerequisites.mdx

@@ -41,6 +41,18 @@ If the group change is not active in the current shell, the installer exits with
 If you choose the native Linux Ollama install path, the onboard wizard also requires `zstd` for Ollama archive extraction.
 The installer also requires `strings` from `binutils` to verify the OpenShell binary before it continues with OpenShell install work.
 
+On an Ubuntu 24.04 ARM64 DGX Station GB300, accepting express install prepares the host with NVIDIA open driver `610.43.02`, Docker CE `29.6.1` with Buildx, and NVIDIA Container Toolkit `1.19.1`.
+The preparation probes package and runtime state first, reuses exact matches, and installs only missing pinned packages.
+It requires Secure Boot to be disabled, matching headers for the running kernel, at least 20 GiB free on the root filesystem, and no active agent, inference, or Docker workloads.
+It does not install a host CUDA toolkit or Docker Compose.
+If an existing prerequisite has a different version, preparation stops instead of automatically upgrading or downgrading it.
+After installing missing pinned packages, the installer exits with status `10`; reboot, sign in, and rerun the same installer command to resume express setup.
+
+<Warning title="DGX Station Support Status">
+DGX Station remains Deferred.
+Full NemoClaw onboarding with this recipe has not completed end-to-end validation on physical DGX Station hardware.
+</Warning>
+
 <Warning title="Docker Group Access">
 NemoClaw needs Docker access.
 On personal Linux development machines, adding your user to the `docker` group is the standard way to run Docker without sudo.

docs/get-started/quickstart.mdx

@@ -121,6 +121,9 @@ Use these details when your first-run path needs more control.
 
     DGX Spark, DGX Station, and Windows WSL offer an interactive express-install path that chooses a managed local inference option for the platform.
     On DGX Station, accepting the express prompt selects the pinned `nemotron-3-ultra-550b-a55b` managed-vLLM recipe and completes onboarding without more provider, model, policy, or sandbox-name choices.
+    The Station path probes the validated driver, Docker, Buildx, and NVIDIA Container Toolkit versions, reuses exact matches, and installs missing pinned packages without additional choices.
+    After it installs missing pinned packages, the installer exits with status `10` at the validated reboot boundary; reboot, sign in, and rerun the same installer command to resume the accepted recipe without another prompt.
+    This automation does not change Station's Deferred support status; physical end-to-end validation remains open.
     Pass `--station-deepseek` to use DeepSeek V4 Flash for a Station demo instead.
     Refer to [Platform Support](../reference/platform-support) and [Choose an Inference Provider](../inference/learn-and-choose/choose-inference-provider) for the current platform behavior.
 
@@ -190,6 +193,10 @@ Use these details when your first-run path needs more control.
     Express install switches onboarding to non-interactive mode, allows `sudo` password prompts for required host changes, and selects the managed local inference path for that platform.
     DGX Spark uses managed vLLM with `qwen3.6-35b-a3b-nvfp4` by default.
     DGX Station express install explicitly selects `nemotron-3-ultra-550b-a55b` instead of the Station managed-vLLM profile default, `deepseek-v4-flash`, and discloses the approximately `352 GB` model download before confirmation.
+    Before onboarding, the Station path checks for NVIDIA open driver `610.43.02`, Docker CE `29.6.1` with Buildx, and NVIDIA Container Toolkit `1.19.1`.
+    It reuses exact versions, installs missing pinned packages, and refuses to automatically upgrade or downgrade an existing mismatched version.
+    Installing missing pinned packages exits with status `10` for a reboot; after you sign in and rerun the same installer command, the accepted express recipe resumes without another prompt.
+    This automation does not change Station's Deferred support status; physical end-to-end validation remains open.
     To select DeepSeek V4 Flash while retaining the one-confirmation Station express flow, run `curl -fsSL https://www.nvidia.com/nemoclaw.sh | bash -s -- --station-deepseek`.
     Unless `NEMOCLAW_POLICY_TIER` is set, express install applies policy in `suggested` mode with the `balanced` tier, including the base sandbox policy and supported package, model, web-search, and local-inference presets.
     Express install uses `my-assistant` as the sandbox name across all platforms unless `NEMOCLAW_SANDBOX_NAME` is set.

scripts/checks/vitest-project-overlap.ts

@@ -46,6 +46,7 @@ const INSTALLER_INTEGRATION_TESTS = new Set([
   "test/install-openshell-version-check.test.ts",
   "test/install-preflight-docker-bootstrap.test.ts",
   "test/install-preflight.test.ts",
+  "test/install-station-host-preparation.test.ts",
 ]);
 
 function normalizeRepoPath(file: string): string {

scripts/install.sh

@@ -2868,6 +2868,7 @@ STATION_ULTRA_VLLM_MODEL="nemotron-3-ultra-550b-a55b"
 STATION_ULTRA_SERVED_MODEL="nvidia/nemotron-3-ultra-550b-a55b"
 STATION_DEEPSEEK_VLLM_MODEL="deepseek-v4-flash"
 STATION_DEEPSEEK_SERVED_MODEL="deepseek-ai/DeepSeek-V4-Flash"
+_SELECTED_EXPRESS_PLATFORM=""
 
 normalize_station_vllm_model() {
   printf "%s" "${1:-}" | tr '[:upper:]' '[:lower:]' | sed 's/^[[:space:]]*//; s/[[:space:]]*$//'
@@ -2939,6 +2940,124 @@ configure_station_express_model() {
   fi
 }
 
+station_express_resume_file() {
+  local state_dir
+  state_dir="$(nemoclaw_state_dir)" || return 1
+  printf '%s/station-express-resume' "$state_dir"
+}
+
+validate_station_express_resume_model() {
+  local model="${1:-}"
+  [[ ${#model} -le 255 && "$model" =~ ^[A-Za-z0-9][A-Za-z0-9._/-]*$ ]]
+}
+
+load_station_express_resume() {
+  local state_file model line_count
+  state_file="$(station_express_resume_file)" || return 1
+  assert_nemoclaw_state_path_safe "$state_file"
+  [[ -f "$state_file" ]] || return 1
+  line_count="$(wc -l <"$state_file" | tr -d '[:space:]')"
+  IFS= read -r model <"$state_file" || model=""
+  if [[ "$line_count" != "1" ]] || ! validate_station_express_resume_model "$model"; then
+    error "DGX Station express resume state is invalid. Remove ${state_file} and rerun the installer."
+  fi
+  NEMOCLAW_VLLM_MODEL="$model"
+  export NEMOCLAW_VLLM_MODEL
+}
+
+save_station_express_resume() {
+  local state_file state_dir temp_file model="${NEMOCLAW_VLLM_MODEL:-}"
+  validate_station_express_resume_model "$model" || error "Cannot save an invalid DGX Station express model selector."
+  state_file="$(station_express_resume_file)" || error "Could not resolve NemoClaw state for DGX Station express resume."
+  state_dir="$(ensure_nemoclaw_state_dir)" || error "Could not prepare NemoClaw state for DGX Station express resume."
+  assert_nemoclaw_state_path_safe "$state_file"
+  temp_file="$(mktemp "${state_file}.tmp.XXXXXX")" || error "Could not create DGX Station express resume state under ${state_dir}."
+  chmod 600 "$temp_file" || {
+    rm -f "$temp_file"
+    error "Could not secure DGX Station express resume state under ${state_dir}."
+  }
+  if ! printf '%s\n' "$model" >"$temp_file"; then
+    rm -f "$temp_file"
+    error "Could not write DGX Station express resume state under ${state_dir}."
+  fi
+  if ! mv -f "$temp_file" "$state_file"; then
+    rm -f "$temp_file"
+    error "Could not publish DGX Station express resume state under ${state_dir}."
+  fi
+}
+
+clear_station_express_resume() {
+  local state_file
+  state_file="$(station_express_resume_file)" || return 0
+  assert_nemoclaw_state_path_safe "$state_file"
+  rm -f "$state_file"
+}
+
+activate_express_install() {
+  local platform="$1"
+  _SELECTED_EXPRESS_PLATFORM="$platform"
+  NON_INTERACTIVE=1
+  export NEMOCLAW_NON_INTERACTIVE=1
+  export NEMOCLAW_NON_INTERACTIVE_SUDO_MODE=prompt
+  export NEMOCLAW_YES=1
+  export NEMOCLAW_POLICY_MODE=suggested
+  case "$platform" in
+    "DGX Spark")
+      export NEMOCLAW_SANDBOX_NAME="${NEMOCLAW_SANDBOX_NAME:-my-assistant}"
+      export NEMOCLAW_PROVIDER=install-vllm
+      if [ -n "${NEMOCLAW_VLLM_MODEL:-}" ]; then
+        export NEMOCLAW_VLLM_MODEL
+      fi
+      ;;
+    "DGX Station")
+      export NEMOCLAW_SANDBOX_NAME="${NEMOCLAW_SANDBOX_NAME:-my-assistant}"
+      export NEMOCLAW_PROVIDER=install-vllm
+      configure_station_express_model
+      ;;
+    "Windows WSL")
+      export NEMOCLAW_PROVIDER=install-windows-ollama
+      ;;
+  esac
+}
+
+run_station_host_preparation() {
+  local helper="${SCRIPT_DIR}/prepare-dgx-station-host.sh"
+  [[ -f "$helper" ]] || error "DGX Station host preparation helper is missing: ${helper}"
+  bash "$helper" --apply
+}
+
+ensure_station_express_host() {
+  [[ "${_SELECTED_EXPRESS_PLATFORM:-}" == "DGX Station" ]] || return 0
+
+  info "Checking pinned DGX Station host prerequisites. Exact matches are reused."
+  local status=0
+  run_station_host_preparation || status=$?
+  case "$status" in
+    0)
+      ok "DGX Station host prerequisites are ready"
+      ;;
+    10)
+      save_station_express_resume
+      warn "DGX Station host prerequisites were installed and require a reboot."
+      info "Run: sudo reboot"
+      info "After signing in again, rerun the same NemoClaw installer command; express setup resumes without another choice."
+      exit 10
+      ;;
+    *)
+      error "DGX Station host preparation failed. Review the station-bootstrap log above, correct the reported host state, and rerun the installer."
+      ;;
+  esac
+}
+
+prepare_installer_host() {
+  maybe_offer_express_install
+  # Intentional ordering: Station preparation owns the reboot boundary before
+  # generic Docker bootstrap; ensure_station_express_host is a no-op elsewhere.
+  ensure_station_express_host
+  ensure_docker
+  ensure_openshell_build_deps
+}
+
 # Prompt the user to opt into express install on supported platforms. Sets the
 # non-interactive + provider/model env vars when accepted. Skipped when
 # the user already passed --non-interactive, set NEMOCLAW_PROVIDER, or has
@@ -2972,6 +3091,8 @@ describe_express_install() {
         inference_summary="managed local vLLM with NVIDIA Nemotron 3 Ultra 550B"
         inference_disclosure="Managed vLLM pulls the pinned Station image and approximately 352 GB model, then runs a local inference container."
       fi
+      printf "  Station host setup reuses exact prerequisite versions, installs missing pinned driver, Docker, and NVIDIA Container Toolkit packages, and may require one reboot.\n"
+      printf "  DGX Station remains Deferred; this recipe has not completed end-to-end validation on physical hardware.\n"
       sandbox_summary="${NEMOCLAW_SANDBOX_NAME:-my-assistant}"
       ;;
     "Windows WSL")
@@ -3025,14 +3146,19 @@ maybe_offer_express_install() {
     info "Detected ${platform}. Skipping express prompt (NEMOCLAW_NO_EXPRESS=1)."
     return 0
   fi
-  if [ "${NON_INTERACTIVE:-}" = "1" ]; then
-    info "Detected ${platform}. Skipping express prompt (--non-interactive set)."
-    return 0
-  fi
   if [ -n "${NEMOCLAW_PROVIDER:-}" ]; then
     info "Detected ${platform}. Skipping express prompt (NEMOCLAW_PROVIDER=${NEMOCLAW_PROVIDER} already set)."
     return 0
   fi
+  if [ "$platform" = "DGX Station" ] && load_station_express_resume; then
+    info "Detected DGX Station. Resuming the accepted express install after host preparation."
+    activate_express_install "$platform"
+    return 0
+  fi
+  if [ "${NON_INTERACTIVE:-}" = "1" ]; then
+    info "Detected ${platform}. Skipping express prompt (--non-interactive set)."
+    return 0
+  fi
   local reply=""
   if [ -t 0 ]; then
     info "Detected ${platform}."
@@ -3060,28 +3186,7 @@ maybe_offer_express_install() {
   case "$reply" in
     "" | y | yes)
       info "Using express install for ${platform}."
-      NON_INTERACTIVE=1
-      export NEMOCLAW_NON_INTERACTIVE=1
-      export NEMOCLAW_NON_INTERACTIVE_SUDO_MODE=prompt
-      export NEMOCLAW_YES=1
-      export NEMOCLAW_POLICY_MODE=suggested
-      case "$platform" in
-        "DGX Spark")
-          export NEMOCLAW_SANDBOX_NAME="${NEMOCLAW_SANDBOX_NAME:-my-assistant}"
-          export NEMOCLAW_PROVIDER=install-vllm
-          if [ -n "${NEMOCLAW_VLLM_MODEL:-}" ]; then
-            export NEMOCLAW_VLLM_MODEL
-          fi
-          ;;
-        "DGX Station")
-          export NEMOCLAW_SANDBOX_NAME="${NEMOCLAW_SANDBOX_NAME:-my-assistant}"
-          export NEMOCLAW_PROVIDER=install-vllm
-          configure_station_express_model
-          ;;
-        "Windows WSL")
-          export NEMOCLAW_PROVIDER=install-windows-ollama
-          ;;
-      esac
+      activate_express_install "$platform"
       ;;
     *)
       info "Skipping express install. Continuing with interactive flow."
@@ -3160,15 +3265,13 @@ main() {
   # still collect acceptance before Node.js or the CLI are installed.
   preflight_usage_notice_prompt
 
-  ensure_docker
-  ensure_openshell_build_deps
-
   # Offer express install on supported platforms (DGX Spark / Station / WSL).
   # Runs AFTER the third-party notice so the user has explicitly accepted the
   # license before opting into the unattended path. Express only sets the
   # provider/model/policy + non-interactive vars; license acceptance is
-  # already recorded by preflight above.
-  maybe_offer_express_install
+  # already recorded by preflight above. Station selection runs its pinned
+  # host prerequisite preparation before the generic Docker bootstrap.
+  prepare_installer_host
 
   _INSTALL_START=$SECONDS
   bash "${SCRIPT_DIR}/setup-jetson.sh"
@@ -3237,6 +3340,9 @@ main() {
   fi
 
   finalize_install
+  if [[ "${_SELECTED_EXPRESS_PLATFORM:-}" == "DGX Station" ]]; then
+    clear_station_express_resume
+  fi
 }
 
 # Print the completion summary, then propagate a fatal/non-zero result when the