Skip to content

Document npm script inheritance for permission/V8 flags #26

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
coreybutler merged 1 commit into from
Oct 29, 2026
Merged

Document npm script inheritance for permission/V8 flags #26

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions settings/options.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,12 +47,12 @@ type Settings struct {
TrustedFirewallThumbprint []string `cfg:"trusted_firewall_thumbprint" reg:"TrustedFirewallThumbprint" help:"Optional SHA-1 leaf thumbprint pins for HTTPS firewall policy URLs (certified)." hidden:"true"`
AuthenticodeRevocation string `cfg:"authenticode_revocation" reg:"AuthenticodeRevocation" default:"online" enum:"online,cached,disabled" help:"Certificate revocation mode for Authenticode. Seed paths (install/use/sign) honor this; shim runtime never uses online (clamped to cached) so warm launches stay fast. AirGapped forces cached when online would apply." hidden:"true"`
LogExecutions bool `cfg:"log_executions" reg:"LogExecutions" default:"false" help:"Whether to log every Node.js invocation (ex: node file.js). (shim-only)" hidden:"false"`
EnforcePermissionModel bool `cfg:"enforce_permission_model" reg:"EnforcePermissionModel" default:"false" help:"When true, the shim prepends Node's permission-model flag (--permission or --experimental-permission by version) so each node.exe starts in default-deny lockdown. Users must pass --allow-* at runtime. (shim-only)" hidden:"false"`
EnforcePermissionModel bool `cfg:"enforce_permission_model" reg:"EnforcePermissionModel" default:"false" help:"When true, the node shim prepends Node's permission-model flag (--permission or --experimental-permission by version) so node starts default-deny. npm/npx/pnpm lifecycle scripts get the same flag via npm_config_node_options. Off does not write that env var. Yarn/bun/corepack/vlt are not covered. Users must pass --allow-* at runtime. (shim-only)" hidden:"false"`
PermissionGrantAudit bool `cfg:"permission_grant_audit" reg:"PermissionGrantAudit" default:"false" help:"When true, or when enforce_permission_model is true, the node shim writes one nodejs.permission_grants event. permission_allow records supplied, applied, and removed allow flags. It does not block. (shim-only)" hidden:"false"`
DefaultPermissionGrants []string `cfg:"default_permission_grants" reg:"DefaultPermissionGrants" default:"" help:"argv tokens appended immediately after the permission flag when the shim itself injects it. One flag per entry, for example --allow-fs-read=*. Empty injects nothing. Skips a token the caller already passed. (shim-only)"`
DefaultPermissionGrants []string `cfg:"default_permission_grants" reg:"DefaultPermissionGrants" default:"" help:"argv tokens appended immediately after the permission flag when the shim itself injects it, including npm_config_node_options for npm/npx/pnpm lifecycle scripts. One flag per entry, for example --allow-fs-read=*. Empty injects nothing. Skips a token the caller already passed. (shim-only)"`
AllowedPermissionGrants []string `cfg:"allowed_permission_grants" reg:"AllowedPermissionGrants" default:"" help:"When non-empty, caller --allow-* tokens not in this list are removed, only when the shim itself injects the permission flag. Empty leaves caller flags unchanged. Default grants are not filtered by this list. (shim-only)"`
FreezeV8GlobalObjects bool `cfg:"freeze_v8_global_objects" reg:"FreezeV8GlobalObjects" default:"false" help:"When true, the shim prepends --frozen-intrinsics so built-in JavaScript prototypes cannot be modified. Adds measurable latency. (shim-only; Node.js 12+)" hidden:"false"`
DisableEvalAndStringExecution bool `cfg:"disable_eval_and_string_execution" reg:"DisableEvalAndStringExecution" default:"false" help:"When true, the shim prepends --disallow-code-generation-from-strings to block eval() and new Function(). (shim-only)" hidden:"false"`
FreezeV8GlobalObjects bool `cfg:"freeze_v8_global_objects" reg:"FreezeV8GlobalObjects" default:"false" help:"When true, the node shim prepends --frozen-intrinsics so built-in JavaScript prototypes cannot be modified. npm/npx/pnpm lifecycle scripts inherit it via npm_config_node_options. Off does not write that env var. Adds measurable latency. (shim-only; Node.js 12+)" hidden:"false"`
DisableEvalAndStringExecution bool `cfg:"disable_eval_and_string_execution" reg:"DisableEvalAndStringExecution" default:"false" help:"When true, the node shim prepends --disallow-code-generation-from-strings to block eval() and new Function(). npm/npx/pnpm lifecycle scripts inherit it via npm_config_node_options. Off does not write that env var. (shim-only)" hidden:"false"`
Enabled bool `cfg:"enabled" reg:"Enabled" default:"true" help:"Whether Node.js version management is enabled. This is automatically set when running 'nvm on' or 'nvm off'." hidden:"true"`
RuntimeACLDegraded bool `cfg:"runtime_acl_degraded" reg:"RuntimeACLDegraded" default:"false" help:"Install finished with Node.js storage that may still fail NVM4305 checks." hidden:"true"`
AllowToolInstall bool `cfg:"allow_tool_install" reg:"AllowToolInstall" default:"true" help:"Whether to allow installation of native tools (nvm install native-tools)." hidden:"true"`
Expand Down
Loading