From 2abec167ce4ca620f644f8329aff8d89233867a4 Mon Sep 17 00:00:00 2001
From: NG YUN SHING <yunshingng25@gmail.com>
Date: Sat, 12 Sep 2026 17:37:40 +0000
Subject: [PATCH] permission: clamp Worker grants for explicit execArgv
 (SEMVER-MAJOR)

When the parent has the Permission Model enabled, an explicit Worker
execArgv (including []) cannot obtain a wider permission-related grant
set than the parent. Default Worker (no execArgv) is unchanged.

Keep the main-branch options gate so custom env / NODE_OPTIONS and
execArgv: [] still fresh-parse; apply the permission ceiling afterward
for any explicit execArgv. Explicit permission tokens without fs grants
intersect (stay restrictive) instead of inheriting the parent allowlist.
Skip the implicit empty-argv cwd grant after clamp so eval Workers do
not re-widen FS reads. When --permission is set, it takes precedence
over --permission-audit (enforce mode), matching permissions.md.

Signed-off-by: NG YUN SHING <yunshingng25@gmail.com>
---
 doc/api/permissions.md                        |  12 +-
 doc/api/worker_threads.md                     |  11 +-
 src/env.cc                                    |   4 +-
 src/node_worker.cc                            | 307 +++++++++++++
 .../test-permission-worker-empty-execargv.js  | 409 ++++++++++++++++++
 5 files changed, 740 insertions(+), 3 deletions(-)
 create mode 100644 test/parallel/test-permission-worker-empty-execargv.js

diff --git a/doc/api/permissions.md b/doc/api/permissions.md
index b677013d7978..b0ce04a0678c 100644
--- a/doc/api/permissions.md
+++ b/doc/api/permissions.md
@@ -31,6 +31,12 @@ If you find a potential security vulnerability, please refer to our
 <!-- YAML
 added: v20.0.0
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/65359
+    description: >-
+      When the Permission Model is enabled in the parent, an explicit
+      `worker_threads.Worker` `execArgv` (including `[]`) cannot obtain a
+      wider permission-related grant set than the parent.
   - version:
     - v23.5.0
     - v22.13.0
@@ -338,7 +344,11 @@ easy to configure permissions as needed when using `npx`.
 
 There are constraints you need to know before using this system:
 
-* The model does not inherit to a worker thread.
+* By default the model does not inherit to a worker thread. When the parent
+  process has the Permission Model enabled, an explicit `worker_threads.Worker`
+  `execArgv` (including an empty array) is clamped so the worker cannot obtain
+  a wider permission-related grant set than the parent. Omitting `execArgv` is
+  unchanged. Non-permission `execArgv` flags are unaffected.
 * When using the Permission Model the following features will be restricted:
   * Native modules
   * Network
diff --git a/doc/api/worker_threads.md b/doc/api/worker_threads.md
index e7b6b19b355c..fa72eca31af2 100644
--- a/doc/api/worker_threads.md
+++ b/doc/api/worker_threads.md
@@ -1564,6 +1564,12 @@ if (isMainThread) {
 <!-- YAML
 added: v10.5.0
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/65359
+    description: >-
+      When the parent has the Permission Model enabled, an explicit
+      `execArgv` (including `[]`) cannot obtain a wider permission-related
+      grant set than the parent.
   - version:
     - v19.8.0
     - v18.16.0
@@ -1630,7 +1636,10 @@ changes:
     V8 options (such as `--max-old-space-size`) and options that affect the
     process (such as `--title`) are not supported. If set, this is provided
     as [`process.execArgv`][] inside the worker. By default, options are
-    inherited from the parent thread.
+    inherited from the parent thread. When the parent runs with the
+    [Permission Model](permissions.md#permission-model) enabled,
+    permission-related grants for an explicit `execArgv` (including `[]`)
+    cannot exceed the parent's.
   * `stdin` {boolean} If this is set to `true`, then `worker.stdin`
     provides a writable stream whose contents appear as `process.stdin`
     inside the Worker. By default, no data is provided.
diff --git a/src/env.cc b/src/env.cc
index 57e2849b25aa..005e54560316 100644
--- a/src/env.cc
+++ b/src/env.cc
@@ -982,7 +982,9 @@ Environment::Environment(IsolateData* isolate_data,
   if (options_->permission || options_->permission_audit) {
     permission()->EnablePermissions();
     static const std::array args = {std::string("*")};
-    if (options_->permission_audit) {
+    // Docs: when both --permission and --permission-audit are set,
+    // --permission takes precedence (enforce mode, not warning-only).
+    if (options_->permission_audit && !options_->permission) {
       permission()->EnableWarningOnly();
     }
     // The process shouldn't be able to neither
diff --git a/src/node_worker.cc b/src/node_worker.cc
index 10386498e7df..8daa8f015b94 100644
--- a/src/node_worker.cc
+++ b/src/node_worker.cc
@@ -10,6 +10,7 @@
 #include "node_perf.h"
 #include "node_profiling.h"
 #include "node_snapshot_builder.h"
+#include "path.h"
 #include "permission/permission.h"
 #include "util-inl.h"
 #include "v8-cppgc.h"
@@ -503,6 +504,263 @@ Worker::~Worker() {
   Debug(this, "Worker %llu destroyed", thread_id_.id);
 }
 
+// SEMVER-MAJOR: Permission ceiling for Worker when execArgv is explicit
+// (including []). Default Worker (no execArgv) is unchanged.
+//
+// After options parse, NODE_OPTIONS and repeated --allow-* are already in
+// EnvironmentOptions. Runtime FSPermission remains authoritative for FS
+// checks; path filtering here is create-time only (prefix / exact / *).
+//
+// Boolean --allow-* dimensions are listed once in PERMISSION_BOOL_FLAGS so
+// ceiling / intersect / CLI token / rebuild cannot drift.
+
+namespace {
+
+// Single source of truth for boolean permission dimensions (not fs path
+// lists, which are handled separately since they're not simple booleans).
+#define PERMISSION_BOOL_FLAGS(V)                                               \
+  V(allow_fs_vfs, "--allow-fs-vfs")                                            \
+  V(allow_addons, "--allow-addons")                                            \
+  V(allow_inspector, "--allow-inspector")                                      \
+  V(allow_child_process, "--allow-child-process")                              \
+  V(allow_net, "--allow-net")                                                  \
+  V(allow_wasi, "--allow-wasi")                                                \
+  V(allow_ffi, "--allow-ffi")                                                  \
+  V(allow_openssl_store, "--allow-openssl-store")                              \
+  V(allow_worker_threads, "--allow-worker")
+
+bool WorkerConfiguredPermission(const EnvironmentOptions* w) {
+  if (w == nullptr) return false;
+  if (w->permission || w->permission_audit) return true;
+  if (!w->allow_fs_read.empty() || !w->allow_fs_write.empty()) return true;
+#define V(field, flag) || w->field
+  return false PERMISSION_BOOL_FLAGS(V);
+#undef V
+}
+
+void ApplyParentPermissionCeiling(EnvironmentOptions* w,
+                                  const EnvironmentOptions* parent) {
+  w->permission = true;
+  w->permission_audit = parent->permission_audit;
+#define V(field, flag) w->field = parent->field;
+  PERMISSION_BOOL_FLAGS(V)
+#undef V
+  w->allow_fs_read = parent->allow_fs_read;
+  w->allow_fs_write = parent->allow_fs_write;
+}
+
+void NormalizePathForCompare(std::string* s) {
+  while (s->size() > 1 &&
+         (s->back() == '/' || s->back() == static_cast<char>(92))) {
+    s->pop_back();
+  }
+#ifdef _WIN32
+  for (char& c : *s) {
+    if (c >= 'A' && c <= 'Z') {
+      c = static_cast<char>(c - 'A' + 'a');
+    }
+    if (c == '/') c = static_cast<char>(92);
+  }
+#endif
+}
+
+std::string ResolveForCompare(Environment* env, const std::string& in) {
+  if (in.empty() || in == "*") return in;
+  std::string resolved =
+      PathResolve(env, std::vector<std::string_view>{std::string_view(in)});
+  if (resolved.empty()) resolved = in;
+  NormalizePathForCompare(&resolved);
+  return resolved;
+}
+
+bool ParentEntryCoversResolvedPath(Environment* env,
+                                   const std::string& parent_raw,
+                                   const std::string& resolved_requested) {
+  if (parent_raw == "*") return true;
+  const std::string parent = ResolveForCompare(env, parent_raw);
+  if (parent.empty()) return false;
+  if (resolved_requested == parent) return true;
+  if (resolved_requested.size() <= parent.size()) return false;
+  if (resolved_requested.compare(0, parent.size(), parent) != 0) return false;
+  const char next = resolved_requested[parent.size()];
+  return next == '/' || next == static_cast<char>(92);
+}
+
+bool ParentListHasWildcard(const std::vector<std::string>& parent) {
+  for (const std::string& entry : parent) {
+    if (entry == "*") return true;
+  }
+  return false;
+}
+
+void FilterPathListToParentSubset(Environment* env,
+                                  std::vector<std::string>* worker,
+                                  const std::vector<std::string>& parent) {
+  if (worker == nullptr) return;
+  // Worker listed no fs paths → keep empty (restrict).
+  if (worker->empty()) return;
+  // Parent "*" → FS already unrestricted; worker paths cannot exceed parent.
+  if (ParentListHasWildcard(parent)) return;
+
+  std::vector<std::string> out;
+  out.reserve(worker->size());
+  bool saw_star = false;
+  for (const std::string& wpath : *worker) {
+    if (wpath == "*") {
+      saw_star = true;
+      continue;
+    }
+    const std::string resolved_wpath = ResolveForCompare(env, wpath);
+    for (const std::string& entry : parent) {
+      if (ParentEntryCoversResolvedPath(env, entry, resolved_wpath)) {
+        // Keep the worker's original grant string so the list stays
+        // consistent with parent raw entries (e.g. when copying parent
+        // for "*") and with CLI rebuild.
+        out.push_back(wpath);
+        break;
+      }
+    }
+  }
+  // "*" alone or combined with concrete paths still means "everything the
+  // parent allows" here, not "just the concrete paths that also matched" —
+  // treating it as a subset would silently grant *less* than requesting "*"
+  // by itself, which is backwards. See PR discussion for why this needs to
+  // be unconditional on saw_star, not just "saw_star && out.empty()".
+  if (saw_star) {
+    *worker = parent;
+    return;
+  }
+  *worker = std::move(out);
+}
+
+void IntersectPermissionGrants(Environment* env,
+                               EnvironmentOptions* w,
+                               const EnvironmentOptions* parent) {
+  w->permission = true;
+  w->permission_audit = w->permission_audit || parent->permission_audit;
+#define V(field, flag) w->field = w->field && parent->field;
+  PERMISSION_BOOL_FLAGS(V)
+#undef V
+  FilterPathListToParentSubset(env, &w->allow_fs_read, parent->allow_fs_read);
+  FilterPathListToParentSubset(env, &w->allow_fs_write, parent->allow_fs_write);
+}
+
+bool IsPermissionCliToken(const std::string& a) {
+  if (a == "--permission" || a == "--permission-audit") return true;
+  if (a == "--allow-fs-read" || a == "--allow-fs-write") return true;
+  if (a.rfind("--allow-fs-read=", 0) == 0) return true;
+  if (a.rfind("--allow-fs-write=", 0) == 0) return true;
+#define V(field, flag)                                                         \
+  if (a == flag) return true;                                                  \
+  {                                                                            \
+    const size_t n = sizeof(flag) - 1;                                         \
+    if (a.size() > n && a.compare(0, n, flag) == 0 && a[n] == '=')             \
+      return true;                                                             \
+  }
+  PERMISSION_BOOL_FLAGS(V)
+#undef V
+  return false;
+}
+
+bool ExecArgvHasPermissionToken(const std::vector<std::string>& argv) {
+  for (const std::string& tok : argv) {
+    if (IsPermissionCliToken(tok)) return true;
+  }
+  return false;
+}
+
+void ClampWorkerPermissionToParent(
+    Environment* env,
+    PerIsolateOptions* worker_opts,
+    const std::vector<std::string>& exec_argv_out) {
+  if (worker_opts == nullptr || env == nullptr ||
+      !env->permission()->enabled()) {
+    return;
+  }
+  EnvironmentOptions* parent =
+      env->isolate_data()->options()->get_per_env_options();
+  EnvironmentOptions* w = worker_opts->get_per_env_options();
+  if (parent == nullptr || w == nullptr) return;
+
+  // Ceiling (inherit parent grants) only when the worker did not ask for any
+  // permission-related configuration. If execArgv contains permission tokens
+  // (or options already reflect them), intersect so an explicit
+  // `--permission` without fs grants stays restrictive instead of being
+  // widened back to the parent allowlist.
+  const bool permission_requested = WorkerConfiguredPermission(w) ||
+                                    ExecArgvHasPermissionToken(exec_argv_out);
+  if (!permission_requested) {
+    ApplyParentPermissionCeiling(w, parent);
+  } else {
+    if (!w->permission && !w->permission_audit) {
+      w->permission = true;
+    }
+    IntersectPermissionGrants(env, w, parent);
+  }
+}
+
+bool PermissionFlagTakesNextArg(const std::string& a) {
+  return a == "--allow-fs-read" || a == "--allow-fs-write";
+}
+
+bool PathSafeForAllowFlag(const std::string& path) {
+  if (path.empty()) return false;
+  for (unsigned char c : path) {
+    if (c == 0 || c == 10 || c == 13) return false;
+  }
+  return true;
+}
+
+void RebuildExecArgvOutFromPermissionOptions(
+    PerIsolateOptions* worker_opts, std::vector<std::string>* exec_argv_out) {
+  if (worker_opts == nullptr || exec_argv_out == nullptr) return;
+  EnvironmentOptions* w = worker_opts->get_per_env_options();
+  if (w == nullptr || !w->permission) return;
+
+  std::vector<std::string> kept;
+  kept.reserve(exec_argv_out->size());
+  for (size_t i = 0; i < exec_argv_out->size(); ++i) {
+    const std::string& tok = (*exec_argv_out)[i];
+    if (tok.empty()) continue;
+    if (IsPermissionCliToken(tok)) {
+      // Space-form --allow-fs-read/--allow-fs-write always consume the next
+      // token as their argument, regardless of its first character — paths
+      // are legal starting with '-' on Unix, so gating on that would leave
+      // a stray token behind instead of consuming it as the flag's value.
+      if (PermissionFlagTakesNextArg(tok) && i + 1 < exec_argv_out->size()) {
+        ++i;
+      }
+      continue;
+    }
+    kept.push_back(tok);
+  }
+
+  std::vector<std::string> out;
+  out.reserve(kept.size() + 16 + w->allow_fs_read.size() +
+              w->allow_fs_write.size());
+  for (const std::string& tok : kept) out.push_back(tok);
+
+  out.push_back("--permission");
+  if (w->permission_audit) out.push_back("--permission-audit");
+#define V(field, flag)                                                         \
+  if (w->field) out.push_back(flag);
+  PERMISSION_BOOL_FLAGS(V)
+#undef V
+  for (const std::string& p : w->allow_fs_read) {
+    if (!PathSafeForAllowFlag(p)) continue;
+    out.push_back("--allow-fs-read=" + p);
+  }
+  for (const std::string& p : w->allow_fs_write) {
+    if (!PathSafeForAllowFlag(p)) continue;
+    out.push_back("--allow-fs-write=" + p);
+  }
+  *exec_argv_out = std::move(out);
+}
+
+#undef PERMISSION_BOOL_FLAGS
+
+}  // namespace
+
 void Worker::New(const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
   THROW_IF_INSUFFICIENT_PERMISSIONS(
@@ -559,6 +817,11 @@ void Worker::New(const FunctionCallbackInfo<Value>& args) {
     THROW_ERR_OPERATION_FAILED(env, "Failed to copy environment variables");
   }
 
+  // Keep the main-branch gate so custom env / NODE_OPTIONS and execArgv
+  // (including []) still go through fresh option parsing. Empty execArgv
+  // must not skip that path — only the permission ceiling below differs.
+  const bool explicit_exec_argv = args[2]->IsArray();
+
   if (args[1]->IsObject() || args[2]->IsArray()) {
     per_isolate_opts.reset(new PerIsolateOptions());
 
@@ -682,6 +945,50 @@ void Worker::New(const FunctionCallbackInfo<Value>& args) {
     per_isolate_opts = env->isolate_data()->options()->Clone();
   }
 
+  // Any explicit execArgv (including []): clamp permission grants to the
+  // parent. [] stays on the fresh-parse path above so NODE_OPTIONS still
+  // applies; the ceiling then re-attaches parent permission grants.
+  if (env->permission()->enabled() && per_isolate_opts && explicit_exec_argv) {
+    // Prefer the original JS execArgv strings for "did the caller ask for
+    // permission flags?" — Parse may consume known tokens out of
+    // exec_argv_out, which would otherwise make a restrictive
+    // `--permission` (no fs grants) look unconfigured and hit the ceiling.
+    std::vector<std::string> permission_argv_probe = exec_argv_out;
+    if (args[2]->IsArray()) {
+      Local<Array> array = args[2].As<Array>();
+      uint32_t length = array->Length();
+      for (uint32_t i = 0; i < length; i++) {
+        Local<Value> arg;
+        if (!array->Get(env->context(), i).ToLocal(&arg)) {
+          return;
+        }
+        Local<String> arg_v8;
+        if (!arg->ToString(env->context()).ToLocal(&arg_v8)) {
+          return;
+        }
+        Utf8Value arg_utf8_value(args.GetIsolate(), arg_v8);
+        permission_argv_probe.emplace_back(arg_utf8_value.out(),
+                                           arg_utf8_value.length());
+      }
+    }
+    ClampWorkerPermissionToParent(
+        env, per_isolate_opts.get(), permission_argv_probe);
+    // Match permissions.md: --permission wins over --permission-audit.
+    EnvironmentOptions* clamped =
+        per_isolate_opts->get_per_env_options();
+    if (clamped != nullptr && clamped->permission) {
+      clamped->permission_audit = false;
+    }
+    RebuildExecArgvOutFromPermissionOptions(per_isolate_opts.get(),
+                                            &exec_argv_out);
+    // Workers load via LOAD_SCRIPT after Environment construction, so
+    // argv_ has no script path yet. Without this, Environment's implicit
+    // entrypoint grant pushes empty argv[1], PathResolve turns that into
+    // cwd, and a restrictive `--permission` (no fs grants) still allows
+    // reading anything under cwd — which broke the empty-grant cases.
+    per_isolate_opts->get_per_env_options()->has_eval_string = true;
+  }
+
   // Internal workers should not wait for inspector frontend to connect or
   // break on the first line of internal scripts. Module loader threads are
   // essential to load user codes and must not be blocked by the inspector
diff --git a/test/parallel/test-permission-worker-empty-execargv.js b/test/parallel/test-permission-worker-empty-execargv.js
new file mode 100644
index 000000000000..5f3bf98722bf
--- /dev/null
+++ b/test/parallel/test-permission-worker-empty-execargv.js
@@ -0,0 +1,409 @@
+'use strict';
+const common = require('../common');
+const { isMainThread } = require('worker_threads');
+
+if (!isMainThread) common.skip('This test only works on a main thread');
+if (!common.hasCrypto) common.skip('no crypto');
+
+const assert = require('assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { spawnSync } = require('child_process');
+const tmpdir = require('../common/tmpdir');
+
+tmpdir.refresh();
+
+const allowedDir = tmpdir.path;
+const allowedFile = path.join(allowedDir, 'ok.txt');
+const subDir = path.join(allowedDir, 'sub');
+const subFile = path.join(subDir, 'nested.txt');
+fs.mkdirSync(subDir, { recursive: true });
+
+// Keep the denied tree outside NODE_TEST_DIR / test/.tmp.* so a parent
+// prefix grant cannot accidentally cover the sibling "secret" file.
+const deniedDir = fs.mkdtempSync(path.join(os.tmpdir(), 'perm-deny-'));
+const deniedFile = path.join(deniedDir, 'secret.txt');
+
+fs.writeFileSync(allowedFile, 'allowed\n');
+fs.writeFileSync(subFile, 'nested\n');
+fs.writeFileSync(deniedFile, 'secret\n');
+
+const allowedDirSlash = allowedDir.endsWith(path.sep) ?
+  allowedDir :
+  allowedDir + path.sep;
+
+function runWithParent(parentArgs, workerBody, execArgvFragment) {
+  const code = `
+    const { Worker } = require('worker_threads');
+    const w = new Worker(${JSON.stringify(workerBody)}, {
+      eval: true,
+      ${execArgvFragment}
+    });
+    w.on('message', (msg) => {
+      process.stdout.write(JSON.stringify(msg) + '\\n');
+      process.exit(0);
+    });
+    w.on('error', (err) => { console.error(err); process.exit(1); });
+  `;
+  return spawnSync(
+    process.execPath,
+    parentArgs.concat(['-e', code]),
+    { encoding: 'utf8', timeout: 30000, env: { ...process.env } },
+  );
+}
+
+function baseParent(extra = []) {
+  return [
+    '--permission',
+    `--allow-fs-read=${allowedDir}`,
+    '--allow-worker',
+    ...extra,
+  ];
+}
+
+function parseLastJsonLine(stdout) {
+  const lines = stdout.trim().split('\n').filter(Boolean);
+  assert.ok(lines.length > 0, `expected JSON, got: ${stdout}`);
+  return JSON.parse(lines[lines.length - 1]);
+}
+
+function workerRead(filePath) {
+  return `
+    const { parentPort } = require('worker_threads');
+    const fs = require('fs');
+    try {
+      parentPort.postMessage({
+        ok: true,
+        data: fs.readFileSync(${JSON.stringify(filePath)}, 'utf8'),
+      });
+    } catch (err) {
+      parentPort.postMessage({ ok: false, code: err.code });
+    }
+  `;
+}
+
+function workerWrite(filePath) {
+  return `
+    const { parentPort } = require('worker_threads');
+    const fs = require('fs');
+    try {
+      fs.writeFileSync(${JSON.stringify(filePath)}, 'w');
+      parentPort.postMessage({ ok: true });
+    } catch (err) {
+      parentPort.postMessage({ ok: false, code: err.code });
+    }
+  `;
+}
+
+function assertAccessDenied(msg) {
+  assert.strictEqual(msg.ok, false, JSON.stringify(msg));
+  assert.strictEqual(msg.code, 'ERR_ACCESS_DENIED');
+}
+
+function assertOk(msg) {
+  assert.strictEqual(msg.ok, true, JSON.stringify(msg));
+}
+
+try {
+  // Default Worker: parent allowlist applies
+  {
+    const r = runWithParent(baseParent(), workerRead(deniedFile), '');
+    assert.strictEqual(r.status, 0, r.stderr);
+    assertAccessDenied(parseLastJsonLine(r.stdout));
+  }
+
+  // ExecArgv: [] ceiling
+  {
+    const denied = runWithParent(
+      baseParent(), workerRead(deniedFile), 'execArgv: [],');
+    assert.strictEqual(denied.status, 0, denied.stderr);
+    assertAccessDenied(parseLastJsonLine(denied.stdout));
+
+    const allowed = runWithParent(
+      baseParent(), workerRead(allowedFile), 'execArgv: [],');
+    assert.strictEqual(allowed.status, 0, allowed.stderr);
+    assertOk(parseLastJsonLine(allowed.stdout));
+
+    const nested = runWithParent(
+      baseParent(), workerRead(subFile), 'execArgv: [],');
+    assert.strictEqual(nested.status, 0, nested.stderr);
+    assertOk(parseLastJsonLine(nested.stdout));
+  }
+
+  // Non-permission flag only
+  {
+    const denied = runWithParent(
+      baseParent(), workerRead(deniedFile), 'execArgv: ["--no-warnings"],');
+    assert.strictEqual(denied.status, 0, denied.stderr);
+    assertAccessDenied(parseLastJsonLine(denied.stdout));
+    const allowed = runWithParent(
+      baseParent(), workerRead(allowedFile), 'execArgv: ["--no-warnings"],');
+    assert.strictEqual(allowed.status, 0, allowed.stderr);
+    assertOk(parseLastJsonLine(allowed.stdout));
+  }
+
+  // Permission on, no fs-read → empty grants
+  {
+    const frag = `execArgv: ${JSON.stringify([
+      '--permission', '--allow-worker',
+    ])},`;
+    const a = runWithParent(baseParent(), workerRead(allowedFile), frag);
+    assert.strictEqual(a.status, 0, a.stderr);
+    assertAccessDenied(parseLastJsonLine(a.stdout));
+  }
+
+  // Escalate * clamped
+  {
+    const frag = `execArgv: ${JSON.stringify([
+      '--permission', '--allow-fs-read=*', '--allow-worker',
+    ])},`;
+    const denied = runWithParent(baseParent(), workerRead(deniedFile), frag);
+    assert.strictEqual(denied.status, 0, denied.stderr);
+    assertAccessDenied(parseLastJsonLine(denied.stdout));
+    const allowed = runWithParent(baseParent(), workerRead(allowedFile), frag);
+    assert.strictEqual(allowed.status, 0, allowed.stderr);
+    assertOk(parseLastJsonLine(allowed.stdout));
+  }
+
+  // "*" plus a concrete path still yields the full parent list
+  {
+    const frag = `execArgv: ${JSON.stringify([
+      '--permission', '--allow-fs-read=*', `--allow-fs-read=${allowedFile}`,
+      '--allow-worker',
+    ])},`;
+    const denied = runWithParent(baseParent(), workerRead(deniedFile), frag);
+    assert.strictEqual(denied.status, 0, denied.stderr);
+    assertAccessDenied(parseLastJsonLine(denied.stdout));
+    const allowed = runWithParent(baseParent(), workerRead(allowedFile), frag);
+    assert.strictEqual(allowed.status, 0, allowed.stderr);
+    assertOk(parseLastJsonLine(allowed.stdout));
+  }
+
+  // Repeated flags cannot exceed parent
+  {
+    const frag = `execArgv: ${JSON.stringify([
+      '--permission',
+      `--allow-fs-read=${allowedDir}`,
+      `--allow-fs-read=${deniedFile}`,
+      '--allow-worker',
+    ])},`;
+    const r = runWithParent(baseParent(), workerRead(deniedFile), frag);
+    assert.strictEqual(r.status, 0, r.stderr);
+    assertAccessDenied(parseLastJsonLine(r.stdout));
+  }
+
+  // Subset path under parent
+  {
+    const frag = `execArgv: ${JSON.stringify([
+      '--permission', `--allow-fs-read=${subFile}`, '--allow-worker',
+    ])},`;
+    const r = runWithParent(baseParent(), workerRead(subFile), frag);
+    assert.strictEqual(r.status, 0, r.stderr);
+    assertOk(parseLastJsonLine(r.stdout));
+  }
+
+  // Trailing-slash parent allow
+  {
+    const parent = [
+      '--permission', `--allow-fs-read=${allowedDirSlash}`, '--allow-worker',
+    ];
+    const r = runWithParent(parent, workerRead(allowedFile), 'execArgv: [],');
+    assert.strictEqual(r.status, 0, r.stderr);
+    assertOk(parseLastJsonLine(r.stdout));
+  }
+
+  // Parent * → worker path kept
+  {
+    const parent = [
+      '--permission', '--allow-fs-read=*', '--allow-worker',
+    ];
+    const frag = `execArgv: ${JSON.stringify([
+      '--permission', `--allow-fs-read=${deniedFile}`, '--allow-worker',
+    ])},`;
+    const r = runWithParent(parent, workerRead(deniedFile), frag);
+    assert.strictEqual(r.status, 0, r.stderr);
+    assertOk(parseLastJsonLine(r.stdout));
+  }
+
+  // Permission-audit + empty execArgv
+  {
+    const parent = [
+      '--permission', '--permission-audit',
+      `--allow-fs-read=${allowedDir}`, '--allow-worker',
+    ];
+    const r = runWithParent(parent, workerRead(allowedFile), 'execArgv: [],');
+    assert.strictEqual(r.status, 0, r.stderr);
+    assertOk(parseLastJsonLine(r.stdout));
+  }
+
+  // Fs-write: parent lacks write → denied; parent grants → ok
+  {
+    const writeTarget = path.join(allowedDir, 'w.txt');
+    const frag = `execArgv: ${JSON.stringify([
+      '--permission', `--allow-fs-write=${allowedDir}`, '--allow-worker',
+    ])},`;
+    const blocked = runWithParent(baseParent(), workerWrite(writeTarget), frag);
+    assert.strictEqual(blocked.status, 0, blocked.stderr);
+    assertAccessDenied(parseLastJsonLine(blocked.stdout));
+
+    const parent = [
+      '--permission',
+      `--allow-fs-read=${allowedDir}`,
+      `--allow-fs-write=${allowedDir}`,
+      '--allow-worker',
+    ];
+    const ok = runWithParent(parent, workerWrite(writeTarget), frag);
+    assert.strictEqual(ok.status, 0, ok.stderr);
+    assertOk(parseLastJsonLine(ok.stdout));
+  }
+
+  // Empty execArgv inherits parent write
+  {
+    const writeTarget = path.join(allowedDir, 'w2.txt');
+    const parent = [
+      '--permission',
+      `--allow-fs-read=${allowedDir}`,
+      `--allow-fs-write=${allowedDir}`,
+      '--allow-worker',
+    ];
+    const r = runWithParent(parent, workerWrite(writeTarget), 'execArgv: [],');
+    assert.strictEqual(r.status, 0, r.stderr);
+    assertOk(parseLastJsonLine(r.stdout));
+  }
+
+  // Boolean AND: worker asks allow-net, parent does not (still fs-clamped)
+  {
+    const frag = `execArgv: ${JSON.stringify([
+      '--permission',
+      `--allow-fs-read=${allowedDir}`,
+      '--allow-net',
+      '--allow-worker',
+    ])},`;
+    const r = runWithParent(baseParent(), workerRead(deniedFile), frag);
+    assert.strictEqual(r.status, 0, r.stderr);
+    assertAccessDenied(parseLastJsonLine(r.stdout));
+  }
+
+  // Rebuild: several booleans when parent grants them
+  {
+    const parent = [
+      '--permission',
+      `--allow-fs-read=${allowedDir}`,
+      '--allow-worker',
+      '--allow-addons',
+      '--allow-inspector',
+      '--allow-net',
+    ];
+    const frag = `execArgv: ${JSON.stringify([
+      '--permission',
+      `--allow-fs-read=${allowedDir}`,
+      '--allow-worker',
+      '--allow-addons',
+      '--allow-inspector',
+      '--allow-net',
+    ])},`;
+    const r = runWithParent(parent, workerRead(allowedFile), frag);
+    assert.strictEqual(r.status, 0, r.stderr);
+    assertOk(parseLastJsonLine(r.stdout));
+  }
+
+  // Worker permission-audit only → empty fs list restrict
+  {
+    const frag = `execArgv: ${JSON.stringify([
+      '--permission', '--permission-audit', '--allow-worker',
+    ])},`;
+    const a = runWithParent(baseParent(), workerRead(allowedFile), frag);
+    assert.strictEqual(a.status, 0, a.stderr);
+    assertAccessDenied(parseLastJsonLine(a.stdout));
+  }
+
+  // --no-warnings kept through rebuild with permission flags
+  {
+    const frag = `execArgv: ${JSON.stringify([
+      '--no-warnings',
+      '--permission',
+      `--allow-fs-read=${allowedDir}`,
+      '--allow-worker',
+    ])},`;
+    const r = runWithParent(baseParent(), workerRead(allowedFile), frag);
+    assert.strictEqual(r.status, 0, r.stderr);
+    assertOk(parseLastJsonLine(r.stdout));
+  }
+
+  // Exact file grant + shorter path rejected
+  {
+    const parent = [
+      '--permission', `--allow-fs-read=${allowedFile}`, '--allow-worker',
+    ];
+    const frag = `execArgv: ${JSON.stringify([
+      '--permission', `--allow-fs-read=${allowedFile}`, '--allow-worker',
+    ])},`;
+    const ok = runWithParent(parent, workerRead(allowedFile), frag);
+    assert.strictEqual(ok.status, 0, ok.stderr);
+    assertOk(parseLastJsonLine(ok.stdout));
+    const bad = runWithParent(parent, workerRead(allowedDir), frag);
+    assert.strictEqual(bad.status, 0, bad.stderr);
+    assertAccessDenied(parseLastJsonLine(bad.stdout));
+  }
+
+  // Sibling path not under parent
+  {
+    const sibling = path.join(path.dirname(allowedDir), 'other-sibling-x');
+    const frag = `execArgv: ${JSON.stringify([
+      '--permission', `--allow-fs-read=${sibling}`, '--allow-worker',
+    ])},`;
+    const r = runWithParent(baseParent(), workerRead(deniedFile), frag);
+    assert.strictEqual(r.status, 0, r.stderr);
+    assertAccessDenied(parseLastJsonLine(r.stdout));
+  }
+
+  // Space-form --allow-fs-read <path>
+  {
+    const frag = `execArgv: ${JSON.stringify([
+      '--permission', '--allow-fs-read', allowedDir, '--allow-worker',
+    ])},`;
+    const ok = runWithParent(baseParent(), workerRead(allowedFile), frag);
+    assert.strictEqual(ok.status, 0, ok.stderr);
+    assertOk(parseLastJsonLine(ok.stdout));
+    const denied = runWithParent(baseParent(), workerRead(deniedFile), frag);
+    assert.strictEqual(denied.status, 0, denied.stderr);
+    assertAccessDenied(parseLastJsonLine(denied.stdout));
+  }
+
+  // Space-form --allow-fs-write <path>
+  {
+    const writeTarget = path.join(allowedDir, 'w3.txt');
+    const parent = [
+      '--permission',
+      `--allow-fs-read=${allowedDir}`,
+      `--allow-fs-write=${allowedDir}`,
+      '--allow-worker',
+    ];
+    const frag = `execArgv: ${JSON.stringify([
+      '--permission', '--allow-fs-write', allowedDir, '--allow-worker',
+    ])},`;
+    const r = runWithParent(parent, workerWrite(writeTarget), frag);
+    assert.strictEqual(r.status, 0, r.stderr);
+    assertOk(parseLastJsonLine(r.stdout));
+  }
+
+  // Write * → fall back to parent write list
+  {
+    const writeTarget = path.join(allowedDir, 'w4.txt');
+    const parent = [
+      '--permission',
+      `--allow-fs-read=${allowedDir}`,
+      `--allow-fs-write=${allowedDir}`,
+      '--allow-worker',
+    ];
+    const frag = `execArgv: ${JSON.stringify([
+      '--permission', '--allow-fs-write=*', '--allow-worker',
+    ])},`;
+    const r = runWithParent(parent, workerWrite(writeTarget), frag);
+    assert.strictEqual(r.status, 0, r.stderr);
+    assertOk(parseLastJsonLine(r.stdout));
+  }
+} finally {
+  fs.rmSync(deniedDir, { recursive: true, force: true });
+}