The full playbook · v0/plugins/11ai-operator-nodejs-api-v24/skills/11ai-operator-nodejs-api-v24-server/SKILL.md

11ai Node.js API server

Version baseline: Node.js 24.x Krypton LTS, using the latest security patch in that release line (24.18.0 at this review). Do not silently move an existing application between Node release lines; inspect engines, runtime files, CI, and deployment support first.

Operate on a local development or test server with a clear target and an evidence trail. Discover the project's start command, entrypoint, port, and health route before acting. Never kill an unrelated process, start a production service, expose a port publicly, or pass secrets on a command line without explicit user direction.

Inspect first

Run the smallest useful read-only checks:

npm run
npm pkg get scripts
lsof -nP -iTCP:PORT -sTCP:LISTEN
curl -sS -D - -o /dev/null http://localhost:PORT/health

Replace PORT and /health only with values discovered from the project or the user's request. If the server may be bound to another interface, inspect the actual listen configuration before changing it.

Start

Prefer the declared dev, start, or test-server script.
Run it in the foreground when the user needs to see output or when ownership of the process is unclear.
If a background process is explicitly requested, record the command, working directory, PID, port, and log destination. Do not hide startup failures.
Wait for a bounded readiness check rather than a blind long sleep:
```
for i in 1 2 3 4 5; do
  curl -fsS http://localhost:PORT/health && break
  sleep 1
done
```
Use the project's health endpoint or a harmless known GET route. A 404 may mean the route is wrong, not that the process is down.

Verify behavior

Check both transport and application behavior:

curl -i http://localhost:PORT/health
curl -i http://localhost:PORT/api/resource

Report the status code, relevant headers, response body shape, process identity, bound address, and any startup warnings. Redact cookies, authorization headers, API keys, and connection strings.

Port conflicts

Inspect the listener and its command before changing anything:

lsof -nP -iTCP:PORT -sTCP:LISTEN
ps -o pid=,ppid=,etime=,command= -p PID

If another process owns the port, report it and offer a project-supported alternate port or a targeted stop. Do not use a broad pkill, kill a parent process blindly, or assume a listener is abandoned.

Stop and cleanup

Stop only a process started for this task or one the user explicitly identifies. Prefer a graceful signal and verify that the PID exited. If a supervisor respawns it, identify the supervisor and stop at that layer only with approval. Do not remove logs, build output, or dependencies as part of stopping a server.

Reporting

End with: command used, working directory, PID if applicable, port/address, readiness result, relevant logs or error, and whether the process remains running. If startup failed, hand the evidence to 11ai-operator-nodejs-api-v24-troubleshooting.