From ebc10253052b53a93796b5b3e2b6fda17ef6074a Mon Sep 17 00:00:00 2001 From: Corey Butler <770982+coreybutler@users.noreply.github.com> Date: Wed, 28 Oct 2026 22:00:52 -0500 Subject: [PATCH] docs: note npm script inheritance for permission/V8 flags Help text now says npm/npx/pnpm lifecycle scripts inherit these flags via npm_config_node_options only when the setting is on. Signed-off-by: Corey Butler <770982+coreybutler@users.noreply.github.com> --- settings/options.go | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/settings/options.go b/settings/options.go index d369fe8..ff02251 100644 --- a/settings/options.go +++ b/settings/options.go @@ -47,12 +47,12 @@ type Settings struct { TrustedFirewallThumbprint []string `cfg:"trusted_firewall_thumbprint" reg:"TrustedFirewallThumbprint" help:"Optional SHA-1 leaf thumbprint pins for HTTPS firewall policy URLs (certified)." hidden:"true"` AuthenticodeRevocation string `cfg:"authenticode_revocation" reg:"AuthenticodeRevocation" default:"online" enum:"online,cached,disabled" help:"Certificate revocation mode for Authenticode. Seed paths (install/use/sign) honor this; shim runtime never uses online (clamped to cached) so warm launches stay fast. AirGapped forces cached when online would apply." hidden:"true"` LogExecutions bool `cfg:"log_executions" reg:"LogExecutions" default:"false" help:"Whether to log every Node.js invocation (ex: node file.js). (shim-only)" hidden:"false"` - EnforcePermissionModel bool `cfg:"enforce_permission_model" reg:"EnforcePermissionModel" default:"false" help:"When true, the shim prepends Node's permission-model flag (--permission or --experimental-permission by version) so each node.exe starts in default-deny lockdown. Users must pass --allow-* at runtime. (shim-only)" hidden:"false"` + EnforcePermissionModel bool `cfg:"enforce_permission_model" reg:"EnforcePermissionModel" default:"false" help:"When true, the node shim prepends Node's permission-model flag (--permission or --experimental-permission by version) so node starts default-deny. npm/npx/pnpm lifecycle scripts get the same flag via npm_config_node_options. Off does not write that env var. Yarn/bun/corepack/vlt are not covered. Users must pass --allow-* at runtime. (shim-only)" hidden:"false"` PermissionGrantAudit bool `cfg:"permission_grant_audit" reg:"PermissionGrantAudit" default:"false" help:"When true, or when enforce_permission_model is true, the node shim writes one nodejs.permission_grants event. permission_allow records supplied, applied, and removed allow flags. It does not block. (shim-only)" hidden:"false"` - DefaultPermissionGrants []string `cfg:"default_permission_grants" reg:"DefaultPermissionGrants" default:"" help:"argv tokens appended immediately after the permission flag when the shim itself injects it. One flag per entry, for example --allow-fs-read=*. Empty injects nothing. Skips a token the caller already passed. (shim-only)"` + DefaultPermissionGrants []string `cfg:"default_permission_grants" reg:"DefaultPermissionGrants" default:"" help:"argv tokens appended immediately after the permission flag when the shim itself injects it, including npm_config_node_options for npm/npx/pnpm lifecycle scripts. One flag per entry, for example --allow-fs-read=*. Empty injects nothing. Skips a token the caller already passed. (shim-only)"` AllowedPermissionGrants []string `cfg:"allowed_permission_grants" reg:"AllowedPermissionGrants" default:"" help:"When non-empty, caller --allow-* tokens not in this list are removed, only when the shim itself injects the permission flag. Empty leaves caller flags unchanged. Default grants are not filtered by this list. (shim-only)"` - FreezeV8GlobalObjects bool `cfg:"freeze_v8_global_objects" reg:"FreezeV8GlobalObjects" default:"false" help:"When true, the shim prepends --frozen-intrinsics so built-in JavaScript prototypes cannot be modified. Adds measurable latency. (shim-only; Node.js 12+)" hidden:"false"` - DisableEvalAndStringExecution bool `cfg:"disable_eval_and_string_execution" reg:"DisableEvalAndStringExecution" default:"false" help:"When true, the shim prepends --disallow-code-generation-from-strings to block eval() and new Function(). (shim-only)" hidden:"false"` + FreezeV8GlobalObjects bool `cfg:"freeze_v8_global_objects" reg:"FreezeV8GlobalObjects" default:"false" help:"When true, the node shim prepends --frozen-intrinsics so built-in JavaScript prototypes cannot be modified. npm/npx/pnpm lifecycle scripts inherit it via npm_config_node_options. Off does not write that env var. Adds measurable latency. (shim-only; Node.js 12+)" hidden:"false"` + DisableEvalAndStringExecution bool `cfg:"disable_eval_and_string_execution" reg:"DisableEvalAndStringExecution" default:"false" help:"When true, the node shim prepends --disallow-code-generation-from-strings to block eval() and new Function(). npm/npx/pnpm lifecycle scripts inherit it via npm_config_node_options. Off does not write that env var. (shim-only)" hidden:"false"` Enabled bool `cfg:"enabled" reg:"Enabled" default:"true" help:"Whether Node.js version management is enabled. This is automatically set when running 'nvm on' or 'nvm off'." hidden:"true"` RuntimeACLDegraded bool `cfg:"runtime_acl_degraded" reg:"RuntimeACLDegraded" default:"false" help:"Install finished with Node.js storage that may still fail NVM4305 checks." hidden:"true"` AllowToolInstall bool `cfg:"allow_tool_install" reg:"AllowToolInstall" default:"true" help:"Whether to allow installation of native tools (nvm install native-tools)." hidden:"true"`