doc: clarify Worker execArgv vs Permission Model grants

[yunshingng]

Description

Follow-up to #65359.

Rafael asked to keep the current runtime behavior and only clarify the docs.

This PR does not change src/. It states:

• Omit execArgv: the worker keeps the parent CLI flags (--permission, --allow-* if the parent has them).
• Explicit execArgv, including []: inheritance is replaced; Permission Model grants from the parent are not kept unless listed again.
• That difference is intended, not a worker bypass.

Test plan

• Docs only.

[nodejs-github-bot]

Review requested:

• @nodejs/security-wg

[github-actions]

Welcome to Node.js, and thank you for your first contribution!

Before review, please take a moment to read:

• the guide for first-time contributors
• the contribution and automation policies
• the pull request guide
• the AI use policy
• the Code of Conduct

Please make sure every commit is signed off. For a first pull request, GitHub Actions require collaborator approval and Jenkins CI must be started by a collaborator or triager, so an initial wait is normal.

[nodejs-github-bot]

Commit Queue failed

This pull request has multiple commits, but no landing policy was selected.

Add commit-queue-squash PRs the Commit Queue should land as one squashed commit. to land it as one commit, or commit-queue-rebase PRs the Commit Queue should land as multiple self-contained commits. to land the commits separately.

The pull request was removed from the Commit Queue and labeled commit-queue-failed PRs whose Commit Queue landing failed and need manual intervention before retrying. . After resolving the failure, remove that label and add commit-queue PRs queued for automated landing through the Commit Queue. to retry.

Full Commit Queue output

�[36m⠋�[39m Loading data for nodejs/node/pull/66124
�[36m⠋�[39m Loading data for nodejs/node/pull/66124
�[36m⠋�[39m Getting collaborator contacts from README of nodejs/node
�[36m⠋�[39m Getting PR from nodejs/node/pull/66124
�[36m⠋�[39m Getting reviews from nodejs/node/pull/66124
�[36m⠋�[39m Getting comments from nodejs/node/pull/66124
�[36m⠋�[39m Getting commits from nodejs/node/pull/66124
✔  Done loading data for nodejs/node/pull/66124
----------------------------------- PR info ------------------------------------
Title      doc: clarify Worker execArgv vs Permission Model grants (#66124)
   ⚠  Could not retrieve the email or name of the PR author's from user's GitHub profile!
Branch     yunshingng:doc-worker-execargv-permission -> nodejs:main
Labels     doc, author ready, commit-queue
Commits    4
 - doc: clarify Worker execArgv vs Permission Model grants
 - doc: fix Limitations heading anchor
 - doc: wrap Permission Model execArgv lines to 120 cols
 - doc: indent wrapped Permission Model execArgv notes
Committers 1
 - yunshingng <yunshingng25@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/66124
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
------------------------------ Generated metadata ------------------------------
PR-URL: https://github.com/nodejs/node/pull/66124
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
--------------------------------------------------------------------------------
   ℹ  This PR was created on Sat, 19 Sep 2026 04:59:11 GMT
   ✔  Approvals: 2
   ✔  - James M Snell (@jasnell) (TSC): https://github.com/nodejs/node/pull/66124#pullrequestreview-5256141869
   ✔  - Rafael Gonzaga (@RafaelGSS) (TSC): https://github.com/nodejs/node/pull/66124#pullrequestreview-5257111041
   ✔  Last GitHub CI successful
   ℹ  Green GitHub CI is sufficient
--------------------------------------------------------------------------------
   ✔  No git cherry-pick in progress
   ✔  No git am in progress
   ✔  No git rebase in progress
--------------------------------------------------------------------------------
�[36m⠙�[39m Bringing origin/main up to date...
�[36m⠙�[39m Bringing origin/main up to date...
From https://github.com/nodejs/node
 * branch                  main       -> FETCH_HEAD
✔  origin/main is now up-to-date
�[36m⠹�[39m Downloading patch for 66124
�[36m⠹�[39m Downloading patch for 66124
From https://github.com/nodejs/node
 * branch                  refs/pull/66124/merge -> FETCH_HEAD
✔  Fetched commits as 8cb3355e925f..0df0f6c57864
--------------------------------------------------------------------------------
Auto-merging doc/api/permissions.md
Auto-merging doc/api/worker_threads.md
[main b28ed14f7a] doc: clarify Worker execArgv vs Permission Model grants
 Author: yunshingng <yunshingng25@gmail.com>
 Date: Sat Sep 19 00:56:26 2026 -0400
 2 files changed, 2 insertions(+), 2 deletions(-)
Auto-merging doc/api/worker_threads.md
[main e5102a7ff9] doc: fix Limitations heading anchor
 Author: yunshingng <yunshingng25@gmail.com>
 Date: Sat Sep 19 02:16:57 2026 -0400
 1 file changed, 1 insertion(+), 1 deletion(-)
Auto-merging doc/api/permissions.md
Auto-merging doc/api/worker_threads.md
[main ef55b44db0] doc: wrap Permission Model execArgv lines to 120 cols
 Author: yunshingng <yunshingng25@gmail.com>
 Date: Sat Sep 19 06:26:07 2026 -0400
 2 files changed, 12 insertions(+), 3 deletions(-)
Auto-merging doc/api/permissions.md
Auto-merging doc/api/worker_threads.md
[main 062ca818a5] doc: indent wrapped Permission Model execArgv notes
 Author: yunshingng <yunshingng25@gmail.com>
 Date: Sat Sep 19 06:28:12 2026 -0400
 2 files changed, 15 insertions(+), 12 deletions(-)
   ✔  Patches applied
There are 4 commits in the PR. Attempting autorebase.
(node:464) [DEP0190] DeprecationWarning: Passing args to a child process with shell option true can lead to security vulnerabilities, as the arguments are not escaped, only concatenated.
(Use `node --trace-deprecation ...` to show where the warning was created)
Rebasing (2/8)
Executing: git node land --amend --yes
--------------------------------- New Message ----------------------------------
doc: clarify Worker execArgv vs Permission Model grants

Omit execArgv: the worker keeps the parent's CLI flags, including
--permission and --allow-*.

Explicit execArgv (including []) replaces inheritance and can drop
those grants. That is intended.

Documented after nodejs/node#65359. No runtime change.

Refs: https://github.com/nodejs/node/pull/65359

Signed-off-by: yunshingng <yunshingng25@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/66124
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
--------------------------------------------------------------------------------
[detached HEAD a5310dd8d7] doc: clarify Worker execArgv vs Permission Model grants
 Author: yunshingng <yunshingng25@gmail.com>
 Date: Sat Sep 19 00:56:26 2026 -0400
 2 files changed, 2 insertions(+), 2 deletions(-)
Rebasing (3/8)
Rebasing (4/8)
Executing: git node land --amend --yes
--------------------------------- New Message ----------------------------------
doc: fix Limitations heading anchor

Signed-off-by: yunshingng <yunshingng25@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/66124
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
--------------------------------------------------------------------------------
[detached HEAD 517e90869f] doc: fix Limitations heading anchor
 Author: yunshingng <yunshingng25@gmail.com>
 Date: Sat Sep 19 02:16:57 2026 -0400
 1 file changed, 1 insertion(+), 1 deletion(-)
Rebasing (5/8)
Rebasing (6/8)
Executing: git node land --amend --yes
--------------------------------- New Message ----------------------------------
doc: wrap Permission Model execArgv lines to 120 cols

Signed-off-by: yunshingng <yunshingng25@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/66124
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
--------------------------------------------------------------------------------
[detached HEAD 93df406aa8] doc: wrap Permission Model execArgv lines to 120 cols
 Author: yunshingng <yunshingng25@gmail.com>
 Date: Sat Sep 19 06:26:07 2026 -0400
 2 files changed, 12 insertions(+), 3 deletions(-)
Rebasing (7/8)
Rebasing (8/8)
Executing: git node land --amend --yes
--------------------------------- New Message ----------------------------------
doc: indent wrapped Permission Model execArgv notes

Signed-off-by: yunshingng <yunshingng25@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/66124
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
--------------------------------------------------------------------------------
[detached HEAD c0f401b637] doc: indent wrapped Permission Model execArgv notes
 Author: yunshingng <yunshingng25@gmail.com>
 Date: Sat Sep 19 06:28:12 2026 -0400
 2 files changed, 15 insertions(+), 12 deletions(-)
Successfully rebased and updated refs/heads/main.
--------------------------------------------------------------------------------
   ℹ  Add `commit-queue-squash` label to land the PR as one commit, or `commit-queue-rebase` to land as separate commits.

View workflow run

[nodejs-github-bot]

Commit Queue failed

   ⚠  Could not retrieve the email or name of the PR author's from user's GitHub profile!
   ✖  GitHub CI is still running

The pull request was removed from the Commit Queue and labeled commit-queue-failed PRs whose Commit Queue landing failed and need manual intervention before retrying. . After resolving the failure, remove that label and add commit-queue PRs queued for automated landing through the Commit Queue. to retry.

Full Commit Queue output

�[36m⠋�[39m Loading data for nodejs/node/pull/66124
�[36m⠋�[39m Loading data for nodejs/node/pull/66124
�[36m⠋�[39m Getting collaborator contacts from README of nodejs/node
�[36m⠋�[39m Getting PR from nodejs/node/pull/66124
�[36m⠋�[39m Getting reviews from nodejs/node/pull/66124
�[36m⠋�[39m Getting comments from nodejs/node/pull/66124
�[36m⠋�[39m Getting commits from nodejs/node/pull/66124
✔  Done loading data for nodejs/node/pull/66124
----------------------------------- PR info ------------------------------------
Title      doc: clarify Worker execArgv vs Permission Model grants (#66124)
   ⚠  Could not retrieve the email or name of the PR author's from user's GitHub profile!
Branch     yunshingng:doc-worker-execargv-permission -> nodejs:main
Labels     doc, author ready, commit-queue
Commits    1
 - doc: clarify Worker execArgv vs Permission Model grants
Committers 1
 - yunshingng <yunshingng25@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/66124
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
------------------------------ Generated metadata ------------------------------
PR-URL: https://github.com/nodejs/node/pull/66124
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
--------------------------------------------------------------------------------
   ℹ  This PR was created on Sat, 19 Sep 2026 04:59:11 GMT
   ✔  Approvals: 2
   ✔  - James M Snell (@jasnell) (TSC): https://github.com/nodejs/node/pull/66124#pullrequestreview-5256141869
   ✔  - Rafael Gonzaga (@RafaelGSS) (TSC): https://github.com/nodejs/node/pull/66124#pullrequestreview-5277194586
   ✖  GitHub CI is still running
   ℹ  Green GitHub CI is sufficient
--------------------------------------------------------------------------------
   ✔  Aborted `git node land` session in /home/runner/work/node/node/.ncu

View workflow run