Runtime SQL-injection capture agent for Node.js applications. Attach it with
NODE_OPTIONS="--require /path/to/reysys-agent.js" — no application code changes.
It hooks the SQL drivers (pg, mysql2, mysql) via require-in-the-middle,
associates each statement with the in-scope HTTP request inputs (query, JSON body,
path, headers) via AsyncLocalStorage, runs the shared literal/placeholder scan
(privacy boundary — request inputs only travel for literal-bearing statements), and
ships records to the Reysys backend over an authenticated connection. Posting is
fully asynchronous (background flush, drop-oldest queue, 30s backoff), so a backend
outage cannot block the host application.
REYSYS_AGENT_SERVICE, REYSYS_AGENT_ENDPOINT, REYSYS_AGENT_TOKEN_URL,
REYSYS_AGENT_CLIENT_ID, REYSYS_AGENT_CLIENT_SECRET
Fail-closed: with any of endpoint/token/client unset, the agent installs nothing.
npm ci && npm run bundle # -> dist/reysys-agent.js (single file for injection)
pg (PostgreSQL) verified end-to-end. mysql2/mysql hooked (same pattern). The
scanner passes the shared conformance/hasliteral.tsv corpus (14/14), identical to
the PHP and Rust agents.