mcollina/skills

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

},   startRedirectPath: '/auth/google',   callbackUri: 'http://localhost:3000/auth/google/callback',

startRedirectPath: '/auth/google',   callbackUri: 'http://localhost:3000/auth/google/callback',   discovery: {

callbackUri: 'http://localhost:3000/auth/google/callback',

discovery: {     issuer: 'https://accounts.google.com',   },

issuer: 'https://accounts.google.com',

// Fetch user info from Google   const userInfo = await fetch('https://www.googleapis.com/oauth2/v2/userinfo', {

const userInfo = await fetch('https://www.googleapis.com/oauth2/v2/userinfo', {

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

// Configured CORS app.register(cors, {   origin: ['https://example.com', 'https://app.example.com'],

app.register(cors, {   origin: ['https://example.com', 'https://app.example.com'],   methods: ['GET', 'POST', 'PUT', 'DELETE'],

origin: ['https://example.com', 'https://app.example.com'],

// Check against allowed origins     const allowedOrigins = [       'https://example.com',

const allowedOrigins = [       'https://example.com',       'https://app.example.com',

'https://example.com',

'https://app.example.com',

styleSrc: ["'self'", "'unsafe-inline'"],       imgSrc: ["'self'", 'data:', 'https:'],       connectSrc: ["'self'", 'https://api.example.com'],

imgSrc: ["'self'", 'data:', 'https:'],       connectSrc: ["'self'", 'https://api.example.com'],     },

connectSrc: ["'self'", 'https://api.example.com'],

useDefaults: true,     directives: {       'script-src': ["'self'", 'https://trusted-cdn.com'],

directives: {       'script-src': ["'self'", 'https://trusted-cdn.com'],     },

'script-src': ["'self'", 'https://trusted-cdn.com'],

[Credential-related source omitted]

request.headers['x-forwarded-proto'] !== 'https'   ) {     const httpsUrl = `https://${request.hostname}${request.url}`;

) {     const httpsUrl = `https://${request.hostname}${request.url}`;     reply.redirect(301, httpsUrl);

const httpsUrl = `https://${request.hostname}${request.url}`;

# Health check HEALTHCHECK --interval=30s --timeout=5s --start-period=5s --retries=3 \   CMD wget --no-verbose --tries=1 --spider http://localhost:3000/health || exit 1

HEALTHCHECK --interval=30s --timeout=5s --start-period=5s --retries=3    CMD wget --no-verbose --tries=1 --spider http://localhost:3000/health || exit 1

CMD wget --no-verbose --tries=1 --spider http://localhost:3000/health || exit 1

[Credential-related source omitted]

app.get('/weather', async (request) => {   try {     return await weatherApi.fetch(request.query.city);

try {     return await weatherApi.fetch(request.query.city);   } catch (error) {

return await weatherApi.fetch(request.query.city);

// Proxy all requests to /api/* to another service app.register(httpProxy, {   upstream: 'http://backend-service:3001',

app.register(httpProxy, {   upstream: 'http://backend-service:3001',   prefix: '/api',

upstream: 'http://backend-service:3001',

// With authentication app.register(httpProxy, {   upstream: 'http://internal-api:3002',

app.register(httpProxy, {   upstream: 'http://internal-api:3002',   prefix: '/internal',

upstream: 'http://internal-api:3002',

app.register(replyFrom, {   base: 'http://backend-service:3001',

base: 'http://backend-service:3001',

// Route to different backends based on request   if (request.headers['x-beta']) {     return 'http://beta-backend:3001';

if (request.headers['x-beta']) {     return 'http://beta-backend:3001';   }

return 'http://beta-backend:3001';

}   return 'http://stable-backend:3001'; }

return 'http://stable-backend:3001';

// Configure multiple upstreams const services = {   users: 'http://users-service:3001',

const services = {   users: 'http://users-service:3001',   orders: 'http://orders-service:3002',

users: 'http://users-service:3001',

orders: 'http://orders-service:3002',

products: 'http://products-service:3003',

app.register(replyFrom, {   base: 'http://backend:3001',

base: 'http://backend:3001',

app.register(httpProxy, {   upstream: 'http://ws-backend:3001',

upstream: 'http://ws-backend:3001',

app.register(replyFrom, {   base: 'http://backend:3001',

base: 'http://backend:3001',

cache.define('proxyGet', async (url: string) => {   const response = await fetch(`http://backend:3001${url}`);

const response = await fetch(`http://backend:3001${url}`);

// Include in outgoing requests const response = await fetch('http://other-service/api', {

const response = await fetch('http://other-service/api', {

# Basic benchmark autocannon http://localhost:3000/api/users

autocannon http://localhost:3000/api/users

# With options autocannon -c 100 -d 30 -p 10 http://localhost:3000/api/users

autocannon -c 100 -d 30 -p 10 http://localhost:3000/api/users

const result = await autocannon({   url: 'http://localhost:3000/api/users',

url: 'http://localhost:3000/api/users',

Executable file

it('should return healthy status when not shutting down', async () => {     const port = getPort();     const response = await fetch(`http://localhost:${port}/health`);

const response = await fetch(`http://localhost:${port}/health`);

const response = await fetch(`http://localhost:${port}/health`);

const response = await fetch(`http://localhost:${port}/`);

const response = await fetch(`http://localhost:${port}/`);

Executable file

server.listen(3000, '0.0.0.0', () => {     console.log('Server listening on http://0.0.0.0:3000');

console.log('Server listening on http://0.0.0.0:3000');

Limit concurrent operations to prevent resource exhaustion and extreme memory usage. Use [p-limit](https://github.com/sindresorhus/p-limit) or [p-map](https://github.com/sindresorhus/p-map):

async function fetchMultiple(urls: string[]): Promise<Map<string, string | Error>> {   const results = await Promise.allSettled(     urls.map((url) => fetch(url).then((r) => r.text()))

const results = await Promise.allSettled(     urls.map((url) => fetch(url).then((r) => r.text()))   );

urls.map((url) => fetch(url).then((r) => r.text()))

try {     return await fetch(url, { signal: controller.signal });

return await fetch(url, { signal: controller.signal });

Use [mnemoist](https://github.com/Yomguithereal/mnemonist) for synchronous memoization:

Use [async-cache-dedupe](https://github.com/mcollina/async-cache-dedupe) for async operations with request deduplication:

Use [lru-cache](https://github.com/isaacs/node-lru-cache) for bounded in-memory caching:

[Credential-related source omitted]

[Credential-related source omitted]

Use [env-schema](https://github.com/fastify/env-schema) with [TypeBox](https://github.com/sinclairzx81/typebox) for type-safe environment validation:

[Credential-related source omitted]

[Credential-related source omitted]

Alternatively, use [Zod](https://github.com/colinhacks/zod) for validation:

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

**Cloud Provider Services:** - [AWS Secrets Manager](https://aws.amazon.com/secrets-manager/)

- [AWS Secrets Manager](https://aws.amazon.com/secrets-manager/)

- [Google Cloud Secret Manager](https://cloud.google.com/secret-manager)

- [Azure Key Vault](https://azure.microsoft.com/en-us/products/key-vault)

**Infrastructure Tools:** - [HashiCorp Vault](https://www.vaultproject.io/)

- [HashiCorp Vault](https://www.vaultproject.io/)

- [Doppler](https://www.doppler.com/)

- [Infisical](https://infisical.com/)

Use [@fastify/create-error](https://github.com/fastify/fastify-error) for creating custom errors with codes:

Do not handle `unhandledRejection` and `uncaughtException` manually. Use [close-with-grace](https://github.com/fastify/close-with-grace) which handles these automatically and triggers graceful shutdown.

Always use [close-with-grace](https://github.com/fastify/close-with-grace) for handling graceful shutdowns:

Use [pino](https://github.com/pinojs/pino) for fast, structured JSON logging:

Use [pino-pretty](https://github.com/pinojs/pino-pretty) for human-readable output during development:

- [pino-pretty](https://github.com/pinojs/pino-pretty) - Human-readable formatting

- [pino-elasticsearch](https://github.com/pinojs/pino-elasticsearch) - Send to Elasticsearch

- [pino-loki](https://github.com/Julien-R44/pino-loki) - Send to Grafana Loki

- [pino-datadog](https://github.com/ovhemert/pino-datadog) - Send to Datadog

The [debug](https://github.com/debug-js/debug) module is useful for library and module authors to emit tracing information. It is not meant for application logging:

Use [piscina](https://github.com/piscinajs/piscina) for CPU-intensive tasks:

Use [@platformatic/flame](https://github.com/platformatic/flame) for CPU profiling with flame graph visualization:

Use [autocannon](https://github.com/mcollina/autocannon) for HTTP benchmarking:

# Basic benchmark npx autocannon http://localhost:3000

npx autocannon http://localhost:3000

# With options npx autocannon -c 100 -d 30 -p 10 http://localhost:3000

npx autocannon -c 100 -d 30 -p 10 http://localhost:3000

# POST request with body npx autocannon -m POST -H "Content-Type: application/json" -b '{"name":"test"}' http://localhost:3000/users

npx autocannon -m POST -H "Content-Type: application/json" -b '{"name":"test"}' http://localhost:3000/users

const result = await autocannon({   url: 'http://localhost:3000',

url: 'http://localhost:3000',

[wrk](https://github.com/wg/wrk) is a high-performance HTTP benchmarking tool:

# Basic benchmark wrk -t12 -c400 -d30s http://localhost:3000

wrk -t12 -c400 -d30s http://localhost:3000

# With Lua script for custom requests wrk -t12 -c400 -d30s -s post.lua http://localhost:3000

wrk -t12 -c400 -d30s -s post.lua http://localhost:3000

[k6](https://k6.io/) is ideal for complex load testing scenarios:

export default function () {   const res = http.get('http://localhost:3000');

const res = http.get('http://localhost:3000');

cache.define('lookupPlan', async (planId: string) => {   return await fetch(`https://billing.internal/plans/${planId}`).then(async (res) => await res.json());

return await fetch(`https://billing.internal/plans/${planId}`).then(async (res) => await res.json());

"clean": "rm -rf dist",

sudo apt-get install -y \

"module_name": "addon",     "module_path": "./lib/binding/{platform}-{arch}",     "host": "https://github.com/user/repo/releases/download/",

"module_path": "./lib/binding/{platform}-{arch}",     "host": "https://github.com/user/repo/releases/download/",     "remote_path": "v{version}",

"host": "https://github.com/user/repo/releases/download/",

- Node.js Building: https://github.com/nodejs/node/blob/main/BUILDING.md

- GYP documentation: https://gyp.gsrc.io/docs/UserDocumentation.md

- node-gyp: https://github.com/nodejs/node-gyp

- prebuildify: https://github.com/prebuild/prebuildify

├── exec()

## exec() and execFile()

### exec() Implementation

function exec(command, options, callback) {

exec('ls -la', (err, stdout) => { });

Fixes: https://github.com/nodejs/node/issues/12345

Signed-off-by: A. Contributor <contributor@example.com> PR-URL: https://github.com/nodejs/node/pull/12345

PR-URL: https://github.com/nodejs/node/pull/12345

Fixes: https://github.com/nodejs/node/issues/12344

Fixes: https://github.com/nodejs/node/issues/52112

Reverts https://github.com/nodejs/node/pull/53063. There are still some

Fixes https://github.com/nodejs/node/issues/54991

Refs: https://github.com/nodejs/node/issues/12345

Fixes: https://github.com/nodejs/node/issues/12345

- [Current contribution policy](https://github.com/nodejs/node/blob/cf882a79042cba4146acfdb7993b6a97c21e7239/CONTRIBUTING.md) - [Commit message guidelines](https://github.com/nodejs/node/blob/cf882a79042cba4146acfdb7993b6a97c21e7239/doc/con

- [Commit message guidelines](https://github.com/nodejs/node/blob/cf882a79042cba4146acfdb7993b6a97c21e7239/doc/contributing/pull-requests.md#commit-message-guidelines)

- [Pull request template](https://github.com/nodejs/node/blob/cf882a79042cba4146acfdb7993b6a97c21e7239/.github/PULL_REQUEST_TEMPLATE.md) - [Pull request guide](https://github.com/nodejs/node/blob/cf882a79042cba4146acfdb7993b6a97c21e7239/doc

- [Pull request guide](https://github.com/nodejs/node/blob/cf882a79042cba4146acfdb7993b6a97c21e7239/doc/contributing/pull-requests.md)

- [Large pull request guide](https://github.com/nodejs/node/blob/cf882a79042cba4146acfdb7993b6a97c21e7239/doc/contributing/large-pull-requests.md)

- [Supported subsystems](https://github.com/nodejs/core-validate-commit/blob/main/lib/rules/subsystem.js)

# Fork and clone git clone https://github.com/YOUR_USERNAME/node.git

git clone https://github.com/YOUR_USERNAME/node.git

# Add upstream remote git remote add upstream https://github.com/nodejs/node.git

git remote add upstream https://github.com/nodejs/node.git

# Browse issues labeled "good first issue" # https://github.com/nodejs/node/labels/good%20first%20issue

# https://github.com/nodejs/node/labels/good%20first%20issue

Fixes: https://github.com/nodejs/node/issues/12345

Signed-off-by: Human Contributor <human@example.com> PR-URL: https://github.com/nodejs/node/pull/12345

PR-URL: https://github.com/nodejs/node/pull/12345

Fixes: https://github.com/nodejs/node/issues/12344

See the pinned [collaborator guide](https://github.com/nodejs/node/blob/cf882a79042cba4146acfdb7993b6a97c21e7239/doc/contributing/collaborator-guide.md#landing-pull-requests)

[collaborator guide](https://github.com/nodejs/node/blob/cf882a79042cba4146acfdb7993b6a97c21e7239/doc/contributing/collaborator-guide.md#landing-pull-requests)

and [commit queue guide](https://github.com/nodejs/node/blob/cf882a79042cba4146acfdb7993b6a97c21e7239/doc/contributing/commit-queue.md)

# Update commit message git commit --amend # Add: Backport-PR-URL: https://github.com/nodejs/node/pull/12346

# Add: Backport-PR-URL: https://github.com/nodejs/node/pull/12346

- [Contributing guide](https://github.com/nodejs/node/blob/cf882a79042cba4146acfdb7993b6a97c21e7239/CONTRIBUTING.md)

- [Collaborator guide](https://github.com/nodejs/node/blob/cf882a79042cba4146acfdb7993b6a97c21e7239/doc/contributing/collaborator-guide.md)

- [C++ style guide](https://github.com/nodejs/node/blob/cf882a79042cba4146acfdb7993b6a97c21e7239/doc/contributing/cpp-style-guide.md)

- [Building Node.js](https://github.com/nodejs/node/blob/cf882a79042cba4146acfdb7993b6a97c21e7239/BUILDING.md)

- Node.js crypto source: `lib/crypto.js`, `src/crypto/` - OpenSSL documentation: https://www.openssl.org/docs/

- OpenSSL documentation: https://www.openssl.org/docs/

- Web Crypto API: https://developer.mozilla.org/en-US/docs/Web/API/Web_Crypto_API

echo "/tmp/core.%e.%p" | sudo tee /proc/sys/kernel/core_pattern

- LLDB commands: https://lldb.llvm.org/use/map.html

- GDB manual: https://sourceware.org/gdb/current/onlinedocs/gdb/

- V8 debugging: https://v8.dev/docs/debug

- Node.js debugging: https://nodejs.org/en/docs/guides/debugging-getting-started

changes:   - version: REPLACEME     pr-url: https://github.com/nodejs/node/pull/XXXXX

- version: REPLACEME     pr-url: https://github.com/nodejs/node/pull/XXXXX     description: Added the `signal` option.

pr-url: https://github.com/nodejs/node/pull/XXXXX

sudo dtruss -f node app.js

sudo dtrace -n 'syscall::read:return /pid == $target/ { printf("%d bytes", arg1); }' -p $(pgrep node)

console.log('Active requests:', requests.length); requests.forEach(r => console.log(' ', r.constructor.name));

requests.forEach(r => console.log(' ', r.constructor.name));

- libuv documentation: http://docs.libuv.org/

- libuv Design Overview: http://docs.libuv.org/en/v1.x/design.html

- libuv documentation: http://docs.libuv.org/

- Node.js Event Loop guide: https://nodejs.org/en/docs/guides/event-loop-timers-and-nexttick/

- libuv Thread Pool: http://docs.libuv.org/en/v1.x/threadpool.html

- Chrome DevTools Memory Panel: https://developer.chrome.com/docs/devtools/memory-problems/

- V8 Memory Management: https://v8.dev/blog/trash-talk

- Node.js Diagnostics Working Group: https://github.com/nodejs/diagnostics

- N-API documentation: https://nodejs.org/api/n-api.html

- V8 Memory Management: https://v8.dev/blog/high-performance-gc

- Node.js Buffer API: https://nodejs.org/api/buffer.html

- AddressSanitizer: https://clang.llvm.org/docs/AddressSanitizer.html

sudo dtrace -n 'syscall::connect:entry /pid == $target/ {

- node-addon-api documentation: https://github.com/nodejs/node-addon-api

- API reference: https://github.com/nodejs/node-addon-api/blob/main/doc/

- Examples: https://github.com/nodejs/node-addon-examples

sudo dtrace -x ustackframes=100 -n 'profile-97 /pid == $target/ {

# Clone node git clone https://github.com/nodejs/node.git

git clone https://github.com/nodejs/node.git

- V8 blog: https://v8.dev/blog

- V8 profiler: https://v8.dev/docs/profile

- Node.js profiling guide: https://nodejs.org/en/docs/guides/simple-profiling

- 0x: https://github.com/davidmarkclements/0x

- Link to the [contributing guide](https://github.com/nodejs/node/blob/cf882a79042cba4146acfdb7993b6a97c21e7239/CONTRIBUTING.md)

# Check CI status for a PR ncu-ci https://github.com/nodejs/node/pull/12345

ncu-ci https://github.com/nodejs/node/pull/12345

- [Current contributing policy](https://github.com/nodejs/node/blob/cf882a79042cba4146acfdb7993b6a97c21e7239/CONTRIBUTING.md) - [Pull request and review guide](https://github.com/nodejs/node/blob/cf882a79042cba4146acfdb7993b6a97c21e7239/doc

- [Pull request and review guide](https://github.com/nodejs/node/blob/cf882a79042cba4146acfdb7993b6a97c21e7239/doc/contributing/pull-requests.md)

- [Collaborator guide](https://github.com/nodejs/node/blob/cf882a79042cba4146acfdb7993b6a97c21e7239/doc/contributing/collaborator-guide.md)

- V8 Blog: https://v8.dev/blog

- V8 Blog on Hidden Classes: https://v8.dev/blog/fast-properties

- V8 Blog on Elements Kinds: https://v8.dev/blog/elements-kinds

# Open in turbolizer (from V8 tools) # https://nickmccurdy.github.io/turbolizer/

# https://nickmccurdy.github.io/turbolizer/

- V8 Ignition: https://v8.dev/docs/ignition

- V8 TurboFan: https://v8.dev/docs/turbofan

- Turbolizer: https://nickmccurdy.github.io/turbolizer/

- Internal implementation: `lib/internal/worker.js` - C++ bindings: `src/node_worker.cc`, `src/node_messaging.cc` - SharedArrayBuffer: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/SharedArrayBuffer

- SharedArrayBuffer: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/SharedArrayBuffer

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

- Any prompt containing a pasted `github.com` URL, even without words like "GitHub", "issue", "PR", or "repo" - Any GitHub link to an issue, pull request, commit, compare page, Actions run, release, discussion, or repository - "Fix https://

- Any GitHub link to an issue, pull request, commit, compare page, Actions run, release, discussion, or repository - "Fix https://github.com/owner/repo/issues/123" style tasks - Creating, reviewing, and managing pull requests and GitHub iss

- "Fix https://github.com/owner/repo/issues/123" style tasks - Creating, reviewing, and managing pull requests and GitHub issues - Reading or triaging repository security advisories (GHSA), private vulnerability reports, and advisory commen

- `Fix https://github.com/mercurius-js/mercurius/issues/1227`

- `Review https://github.com/nodejs/node/pull/12345`

- `What changed in https://github.com/org/repo/compare/v1.0.0...v1.1.0?`

- `Check https://github.com/org/repo/actions/runs/123456789`

- `Investigate https://github.com/org/repo/commit/abcdef1234567890`

- `Triage https://github.com/org/repo/security/advisories/GHSA-xxxx-xxxx-xxxx, including the discussion`

- `Open a fix PR in the private fork of https://github.com/org/repo/security/advisories/GHSA-xxxx-xxxx-xxxx`

1. Resolve the repository and GHSA identifier from the repository advisory URL (`https://github.com/OWNER/REPO/security/advisories/GHSA_ID`). For a global GHSA link or bare identifier, fetch the global advisory (`gh api "advisories/$ghsa"`)

The [October 2, 2026 announcement](https://github.blog/changelog/2026-10-02-repository-security-advisory-comments-api-in-public-preview/) describes a public preview for **public repositories** on GitHub Free, Pro, Team, and Enterprise Cloud

- Comment deletion is not supported through this API. Do not create disposable test comments expecting to delete them afterward. - Stop live probes on access denial or blocked execution and report the verification limit. Check repository/GH

- Consult the [REST reference](https://docs.github.com/en/rest/security-advisories/repository-advisories) for current preview behavior. Use the standard JSON Accept header below; do not invent a preview media type.

All paths below are relative to `https://api.github.com`.

Verified on October 17, 2026 against the [REST reference](https://docs.github.com/en/rest/security-advisories/repository-advisories), the public [OpenAPI description](https://github.com/github/rest-api-description), and the GitHub Docs page

- `POST .../forks` on an advisory that already has a fork returns `403 A repository already exists for this security advisory.` Read `private_fork.full_name` from the advisory instead of retrying. - Creating the fork requires write access t

- Creating the fork requires write access to the advisory (repository admin, security manager, or advisory collaborator; confirm against the [REST reference](https://docs.github.com/en/rest/security-advisories/repository-advisories#create-a

async function fetchUser(): Promise<any> {   const res = await fetch("/api/user");

const res = await fetch("/api/user");

async function fetchUser(): Promise<User> {   const res = await fetch("/api/user");

const res = await fetch("/api/user");

function fetchUrl(url: ValidUrl): Promise<Response> {   return fetch(url);

return fetch(url);

fetchUrl("https://api.example.com"); // OK