Repository navigation
Permission allow-fs-* to resolve env variables #65422
Description
What is the problem this feature will solve?
While it is possible to pass values of env variables when calling node directly
node --permission --allow-fs-read=$HOME
there are other ways to set permissions (in config file or via NODE_OPTIONS) that don't go through the shell first.
I'd like to make it possible for all methods of passing in permissions to support using environment variables.
{
"nodeOptions": {
"--permission": true,
"--allow-fs-read": [
"$HOME"
]
}
}
What is the feature you are proposing to solve the problem?
Pseudocode:
const replaceEnvVar = (value) => {
const envVarMatch = value.match(/^\$([A-Z_][A-Z0-9_]*)$/i)
if (envVarMatch) {
const envVarName = envVarMatch[1]
if (process.env[envVarName] !== undefined) {
return process.env[envVarName]
} else {
console.error(
`[LavaMoat] Environment variable "${envVarName}" referenced in config but not found in environment`
)
}
}
return value
}
for (const key of ['--allow-fs-read', '--allow-fs-write']) {
if (Array.isArray(configOptions[key])) {
configOptions[key] = configOptions[key].map(replaceEnvVar)
} else if (typeof configOptions[key] === 'string') {
configOptions[key] = replaceEnvVar(configOptions[key])
}
}What alternatives have you considered?
I've considered more advanced support where this would also work:
{
"nodeOptions": {
"--permission": true,
"--allow-fs-read": [
"/home/${MY_USER}/some/place/else"
]
}
}
but it seems unnecessarily complex and error prone to be worth it IMHO.
Activity
naugtur commentedon Aug 20, 2026
Planning to implement this. May need some pointers or opinions.