From 8b6e688e2738754b49b0adcfe4b981922a2b00df Mon Sep 17 00:00:00 2001 From: yunshingng Date: Sat, 19 Sep 2026 00:56:26 -0400 Subject: [PATCH 1/4] doc: clarify Worker execArgv vs Permission Model grants Omit execArgv: the worker keeps the parent's CLI flags, including --permission and --allow-*. Explicit execArgv (including []) replaces inheritance and can drop those grants. That is intended. Documented after nodejs/node#65359. No runtime change. Refs: https://github.com/nodejs/node/pull/65359 Signed-off-by: yunshingng --- doc/api/permissions.md | 2 +- doc/api/worker_threads.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/doc/api/permissions.md b/doc/api/permissions.md index 0b46f42d982a..feb6dba616db 100644 --- a/doc/api/permissions.md +++ b/doc/api/permissions.md @@ -330,7 +330,7 @@ easy to configure permissions as needed when using `npx`. There are constraints you need to know before using this system: -* The model does not inherit to a worker thread. +* The model does not inherit to a worker thread. A default `worker_threads.Worker` (no `execArgv` option) still receives the parent process CLI flags, including `--permission` and `--allow-*` if those were passed to the parent. Setting `execArgv` explicitly, including `execArgv: []`, replaces the inherited flags. The worker then does not keep the parent's Permission Model grants unless those flags are listed again in `execArgv`. That difference is intended, not a bypass. * When using the Permission Model the following features will be restricted: * Native modules * Network diff --git a/doc/api/worker_threads.md b/doc/api/worker_threads.md index e7b6b19b355c..4cdb0b1b65c1 100644 --- a/doc/api/worker_threads.md +++ b/doc/api/worker_threads.md @@ -1630,7 +1630,7 @@ changes: V8 options (such as `--max-old-space-size`) and options that affect the process (such as `--title`) are not supported. If set, this is provided as [`process.execArgv`][] inside the worker. By default, options are - inherited from the parent thread. + inherited from the parent thread. Passing an explicit `execArgv` (including an empty array) replaces that inheritance: the worker receives only the listed flags. Under the [Permission Model](permissions.md#permission-model), that means an explicit `execArgv` can drop the parent's `--permission` / `--allow-*` grants. Omit `execArgv` to keep the parent's CLI flags. This is intended. See [Permission Model limitations](permissions.md#limitation-and-known-issues). * `stdin` {boolean} If this is set to `true`, then `worker.stdin` provides a writable stream whose contents appear as `process.stdin` inside the Worker. By default, no data is provided. From db55810f8869f6b4d6463c64a6b92afae902a619 Mon Sep 17 00:00:00 2001 From: yunshingng Date: Sat, 19 Sep 2026 02:16:57 -0400 Subject: [PATCH 2/4] doc: fix Limitations heading anchor Signed-off-by: yunshingng --- doc/api/worker_threads.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/doc/api/worker_threads.md b/doc/api/worker_threads.md index 4cdb0b1b65c1..2f7fdbc70fc3 100644 --- a/doc/api/worker_threads.md +++ b/doc/api/worker_threads.md @@ -1630,7 +1630,7 @@ changes: V8 options (such as `--max-old-space-size`) and options that affect the process (such as `--title`) are not supported. If set, this is provided as [`process.execArgv`][] inside the worker. By default, options are - inherited from the parent thread. Passing an explicit `execArgv` (including an empty array) replaces that inheritance: the worker receives only the listed flags. Under the [Permission Model](permissions.md#permission-model), that means an explicit `execArgv` can drop the parent's `--permission` / `--allow-*` grants. Omit `execArgv` to keep the parent's CLI flags. This is intended. See [Permission Model limitations](permissions.md#limitation-and-known-issues). + inherited from the parent thread. Passing an explicit `execArgv` (including an empty array) replaces that inheritance: the worker receives only the listed flags. Under the [Permission Model](permissions.md#permission-model), that means an explicit `execArgv` can drop the parent's `--permission` / `--allow-*` grants. Omit `execArgv` to keep the parent's CLI flags. This is intended. See [Permission Model limitations](permissions.md#limitations-and-known-issues). * `stdin` {boolean} If this is set to `true`, then `worker.stdin` provides a writable stream whose contents appear as `process.stdin` inside the Worker. By default, no data is provided. From bcb04c8fb24a1d2a61c52cac1c6d3bdb61168f72 Mon Sep 17 00:00:00 2001 From: yunshingng Date: Sat, 19 Sep 2026 06:26:07 -0400 Subject: [PATCH 3/4] doc: wrap Permission Model execArgv lines to 120 cols Signed-off-by: yunshingng --- doc/api/permissions.md | 6 +++++- doc/api/worker_threads.md | 9 +++++++-- 2 files changed, 12 insertions(+), 3 deletions(-) diff --git a/doc/api/permissions.md b/doc/api/permissions.md index feb6dba616db..185b8e154e44 100644 --- a/doc/api/permissions.md +++ b/doc/api/permissions.md @@ -330,7 +330,11 @@ easy to configure permissions as needed when using `npx`. There are constraints you need to know before using this system: -* The model does not inherit to a worker thread. A default `worker_threads.Worker` (no `execArgv` option) still receives the parent process CLI flags, including `--permission` and `--allow-*` if those were passed to the parent. Setting `execArgv` explicitly, including `execArgv: []`, replaces the inherited flags. The worker then does not keep the parent's Permission Model grants unless those flags are listed again in `execArgv`. That difference is intended, not a bypass. +* The model does not inherit to a worker thread. A default `worker_threads.Worker` (no `execArgv` option) still receives +the parent process CLI flags, including `--permission` and `--allow-*` if those were passed to the parent. Setting +`execArgv` explicitly, including `execArgv: []`, replaces the inherited flags. The worker then does not keep the +parent's Permission Model grants unless those flags are listed again in `execArgv`. That difference is intended, not a +bypass. * When using the Permission Model the following features will be restricted: * Native modules * Network diff --git a/doc/api/worker_threads.md b/doc/api/worker_threads.md index 2f7fdbc70fc3..eec2596efeee 100644 --- a/doc/api/worker_threads.md +++ b/doc/api/worker_threads.md @@ -1630,7 +1630,11 @@ changes: V8 options (such as `--max-old-space-size`) and options that affect the process (such as `--title`) are not supported. If set, this is provided as [`process.execArgv`][] inside the worker. By default, options are - inherited from the parent thread. Passing an explicit `execArgv` (including an empty array) replaces that inheritance: the worker receives only the listed flags. Under the [Permission Model](permissions.md#permission-model), that means an explicit `execArgv` can drop the parent's `--permission` / `--allow-*` grants. Omit `execArgv` to keep the parent's CLI flags. This is intended. See [Permission Model limitations](permissions.md#limitations-and-known-issues). + inherited from the parent thread. Passing an explicit `execArgv` (including an empty array) replaces that + inheritance: the worker receives only the listed flags. Under the [Permission + Model](permissions.md#permission-model), that means an explicit `execArgv` can drop the parent's `--permission` / + `--allow-*` grants. Omit `execArgv` to keep the parent's CLI flags. This is intended. See [Permission Model + limitations](permissions.md#limitations-and-known-issues). * `stdin` {boolean} If this is set to `true`, then `worker.stdin` provides a writable stream whose contents appear as `process.stdin` inside the Worker. By default, no data is provided. @@ -2224,7 +2228,8 @@ thread spawned will spawn another until the application crashes. [Addons worker support]: addons.md#worker-support [ECMAScript module loader]: esm.md#data-imports -[HTML structured clone algorithm]: https://developer.mozilla.org/en-US/docs/Web/API/Web_Workers_API/Structured_clone_algorithm +[HTML structured clone algorithm]: +https://developer.mozilla.org/en-US/docs/Web/API/Web_Workers_API/Structured_clone_algorithm [LockManager]: #class-lockmanager [Signals events]: process.md#signal-events [Web Workers]: https://developer.mozilla.org/en-US/docs/Web/API/Web_Workers_API From 0df0f6c57864a5deca068b7985c94160101043ae Mon Sep 17 00:00:00 2001 From: yunshingng Date: Sat, 19 Sep 2026 06:28:12 -0400 Subject: [PATCH 4/4] doc: indent wrapped Permission Model execArgv notes Signed-off-by: yunshingng --- doc/api/permissions.md | 12 +++++++----- doc/api/worker_threads.md | 15 ++++++++------- 2 files changed, 15 insertions(+), 12 deletions(-) diff --git a/doc/api/permissions.md b/doc/api/permissions.md index 185b8e154e44..d57b706dafc9 100644 --- a/doc/api/permissions.md +++ b/doc/api/permissions.md @@ -330,11 +330,13 @@ easy to configure permissions as needed when using `npx`. There are constraints you need to know before using this system: -* The model does not inherit to a worker thread. A default `worker_threads.Worker` (no `execArgv` option) still receives -the parent process CLI flags, including `--permission` and `--allow-*` if those were passed to the parent. Setting -`execArgv` explicitly, including `execArgv: []`, replaces the inherited flags. The worker then does not keep the -parent's Permission Model grants unless those flags are listed again in `execArgv`. That difference is intended, not a -bypass. +* The model does not inherit to a worker thread. A default + `worker_threads.Worker` (no `execArgv` option) still receives the parent + process CLI flags, including `--permission` and `--allow-*` if those were + passed to the parent. Setting `execArgv` explicitly, including + `execArgv: []`, replaces the inherited flags. The worker then does not keep + the parent's Permission Model grants unless those flags are listed again in + `execArgv`. That difference is intended, not a bypass. * When using the Permission Model the following features will be restricted: * Native modules * Network diff --git a/doc/api/worker_threads.md b/doc/api/worker_threads.md index eec2596efeee..21b9ac663b32 100644 --- a/doc/api/worker_threads.md +++ b/doc/api/worker_threads.md @@ -1630,11 +1630,13 @@ changes: V8 options (such as `--max-old-space-size`) and options that affect the process (such as `--title`) are not supported. If set, this is provided as [`process.execArgv`][] inside the worker. By default, options are - inherited from the parent thread. Passing an explicit `execArgv` (including an empty array) replaces that - inheritance: the worker receives only the listed flags. Under the [Permission - Model](permissions.md#permission-model), that means an explicit `execArgv` can drop the parent's `--permission` / - `--allow-*` grants. Omit `execArgv` to keep the parent's CLI flags. This is intended. See [Permission Model - limitations](permissions.md#limitations-and-known-issues). + inherited from the parent thread. + Passing an explicit `execArgv` (including an empty array) replaces that + inheritance: the worker receives only the listed flags. Under the + [Permission Model](permissions.md#permission-model), that means an explicit + `execArgv` can drop the parent's `--permission` / `--allow-*` grants. + Omit `execArgv` to keep the parent's CLI flags. This is intended. See + [Permission Model limitations](permissions.md#limitations-and-known-issues). * `stdin` {boolean} If this is set to `true`, then `worker.stdin` provides a writable stream whose contents appear as `process.stdin` inside the Worker. By default, no data is provided. @@ -2228,8 +2230,7 @@ thread spawned will spawn another until the application crashes. [Addons worker support]: addons.md#worker-support [ECMAScript module loader]: esm.md#data-imports -[HTML structured clone algorithm]: -https://developer.mozilla.org/en-US/docs/Web/API/Web_Workers_API/Structured_clone_algorithm +[HTML structured clone algorithm]: https://developer.mozilla.org/en-US/docs/Web/API/Web_Workers_API/Structured_clone_algorithm [LockManager]: #class-lockmanager [Signals events]: process.md#signal-events [Web Workers]: https://developer.mozilla.org/en-US/docs/Web/API/Web_Workers_API