Permission allow-fs-* to resolve env variables

Empieza trazando cómo Node.js analiza --allow-fs-read y --allow-fs-write a partir de argumentos directos, NODE_OPTIONS y archivos de configuración. Revisa las pruebas existentes de permission-option y añade cobertura para valores exactos de environment-variable en formas de string y array. Se considera terminado cuando las entradas de permisos compatibles resuelven las variables de entorno de forma consistente, incluido el comportamiento cuando una variable no está definida.

What is the problem this feature will solve?

While it is possible to pass values of env variables when calling node directly

node --permission --allow-fs-read=$HOME

there are other ways to set permissions (in config file or via NODE_OPTIONS) that don't go through the shell first.

I'd like to make it possible for all methods of passing in permissions to support using environment variables.

{
  "nodeOptions": {
    "--permission": true,
    "--allow-fs-read": [
      "$HOME"
    ]
  }
}

What is the feature you are proposing to solve the problem?

Pseudocode:

    const replaceEnvVar = (value) => {
      const envVarMatch = value.match(/^\$([A-Z_][A-Z0-9_]*)$/i)
      if (envVarMatch) {
        const envVarName = envVarMatch[1]
        if (process.env[envVarName] !== undefined) {
          return process.env[envVarName]
        } else {
          console.error(
            `[LavaMoat] Environment variable "${envVarName}" referenced in config but not found in environment`
          )
        }
      }
      return value
    }

    for (const key of ['--allow-fs-read', '--allow-fs-write']) {
      if (Array.isArray(configOptions[key])) {
        configOptions[key] = configOptions[key].map(replaceEnvVar)
      } else if (typeof configOptions[key] === 'string') {
        configOptions[key] = replaceEnvVar(configOptions[key])
      }
    }

What alternatives have you considered?

I've considered more advanced support where this would also work:

{
  "nodeOptions": {
    "--permission": true,
    "--allow-fs-read": [
      "/home/${MY_USER}/some/place/else"
    ]
  }
}

but it seems unnecessarily complex and error prone to be worth it IMHO.