master
7b5bdcf4d3
- Introduced AGENTS.md, README.md, TASKS.md, and implementation_plan.md for Vexer, detailing mission, responsibilities, key components, and operational notes. - Established similar documentation structure for Vulnerability Explorer and Zastava modules, including their respective workflows, integrations, and observability notes. - Created risk scoring profiles documentation outlining the core workflow, factor model, governance, and deliverables. - Ensured all modules adhere to the Aggregation-Only Contract and maintain determinism and provenance in outputs.
25 lines
1.4 KiB
Markdown
25 lines
1.4 KiB
Markdown
# Entry-Point Runtime — Node.js
|
|
|
|
## Signals to gather
|
|
- `argv0` equals `node`, `nodejs`, or path ends with `/bin/node`.
|
|
- Scripts launched via package runners (`npm`, `yarn`, `pnpm node …`, `npx`).
|
|
- Presence of `package.json` with `"main"` or `"scripts":{"start":…}` entries.
|
|
- `NODE_ENV`, `NODE_OPTIONS`, or `NPM_PACKAGE_NAME` environment hints.
|
|
- Bundler/PM2 scenarios: `pm2-runtime`, `pm2-docker`, `forever`, `nodemon`.
|
|
|
|
## Implementation notes
|
|
- Resolve script arguments (e.g., `node server.js`) relative to the working dir.
|
|
- If invoked through `npm start`/`yarn run`, parse `package.json` to expand the actual script.
|
|
- Support TypeScript loaders (`ts-node`, `node --loader`, `.mjs`) by inspecting extensions and flags.
|
|
- Normalise shebang-based Node scripts (ShellFlow ensures `#!/usr/bin/env node` collapses to Node).
|
|
|
|
## Evidence & scoring
|
|
- Boost confidence when a concrete JS/TS entry file exists.
|
|
- Add evidence for `package.json` metadata, PM2 ecosystem files, or `NODE_ENV` values.
|
|
- Penalise when the entry file is missing or only package runners are present without scripts.
|
|
|
|
## Edge cases
|
|
- Multi-service supervisors (e.g., `pm2` managing multiple apps): treat as `Supervisor` and list programmes as children.
|
|
- Serverless shims (e.g., Google Functions) wrap Node; prefer the user-provided handler script if detectable.
|
|
- Distroless snapshots may omit package managers; rely on Node binary + script presence.
|