[CompleteDotTech]

Advance #4 without changing the existing Node2Shell CLI, collector or schema. Add a separate builtins-only capability collector for HTTP/2, TLS, DNS, Permission API, snapshot API, SEA and Brotli; available APIs never become application-use or exposure evidence. Add an offline stdlib npm metadata reader that preserves engines.node declarations by package path without inferring a deployed runtime. Container metadata remains in optional OCI tooling.

No app imports, environment/argument/host dumps, credentials, network, shell, decoding, DNS/TLS/server creation or snapshot/SEA asset access. Both formats keep unknown provenance, unknown runtime context and not_tested exploitability. Document exact formats, bounds, source APIs, migration and limitations. CI explicitly installs pinned setup-node action/Node 24 for collector tests.

Validation: 65 local stdlib tests pass, including unchanged classification/legacy collector regressions, guarded Node VM checks and synthetic lock v1/v2/v3/bounds/privacy. Actual collector, help and synthetic build-context example pass; git diff --check passes. Copilot review and exact-head CI required before merge. Named advisory matrix is a separate documentation change; no threshold/date edits.

[Copilot]

🟡 Changes recommended

The npm v1 reader accepts malformed dot-segment package paths and reports them as complete metadata.

1 open issue

• Reject dot-segment dependency names in v1 lockfile paths · New

1 file not reviewed

• docs/examples/node-package-lock.json: Generated file

What changed in this PR

Adds optional runtime-capability and npm build-context metadata tools to support the advisory-specific checker roadmap without changing the existing Node2Shell CLI, collector, or inventory schema.

Changes:

• Adds a builtins-only Node capability collector and an offline Python npm metadata reader.
• Adds synthetic validation and privacy checks, with Node 24 configured in CI.
• Documents separate report formats, uncertainty limits, and usage.

File	Description
tools/​inspect-node-build-context.py	Reads bounded npm engine declarations without inferring runtime versions.
tools/​collect-node-capabilities.cjs	Reports builtin capabilities without treating them as application exposure.
test_capabilities.py	Checks collector behavior, privacy guards, and legacy compatibility.
test_build_context.py	Covers npm formats, malformed inputs, bounds, and privacy.
README.md	Links to the optional metadata tools.
docs/​NODE_METADATA.md	Documents formats, usage, limitations, and integration.
docs/​examples/​node-package-lock.json	Provides a synthetic build-context example.
.github/​workflows/​tests.yml	Installs Node 24 for collector checks.

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No blocking findings remain, and hosted tests for the current PR head now pass across Linux, Windows, and macOS.

No open issues 🎉

1 resolved since last review

• Reject dot-segment dependency names in v1 lockfile paths

1 file not reviewed

• docs/examples/node-package-lock.json: Generated file

_{Review effort: Balanced}

[CompleteDotTech]

Final validation for head 28960c9: 65 local unittest cases pass; CLI/help and diff checks pass. GitHub Copilot recommends approval on this exact head, with no unresolved threads. Hosted CI reports SUCCESS across Linux, Windows and macOS. This adds bounded offline metadata only; application use/reachability and exploitability remain unknown/not_tested.