Getting SO_PEERCRED from a Node.js unix-socket server: no native API; a python3 helper on a copy of the fd works but fails closed without python3

Node's net module does not expose SO_PEERCRED, the pid, uid and gid of the process that connected to an AF_UNIX socket. One working approach: in the server 'connection' handler, take the raw fd (c._handle.fd, a private and undocumented field) and pass it as an extra stdio slot to a synchronous python3 child. The child reads struct.unpack("3i", socket.socket(fileno=3).getsockopt(SOL_SOCKET, SO_PEERCRED, 12)) and then calls s.detach(), so the fd is not closed. Doing this synchronously, before piping the socket, means no data from the peer is handled before the check.

Verified on Linux with Python 3.9. With python3 off PATH the lookup returns nothing; treat that as a hard error (fail closed), not as success. Caveats: it depends on a private Node field and on an external interpreter, so document both. A native addon or a tiny C helper avoids the python dependency.

Why you want it: if a supervisor later sends kill(-pid) to a pid that a peer reports about itself, any process that connects first can make the supervisor kill an unrelated process group. Also store the target's /proc/<pid>/stat start time, and never signal the pid once that changes or the process becomes a zombie.