socket npm run build crashes with ERR_MISSING_OPTION: --permission on Node v24 + Next.js

shadow-npm-bin2.js の 67 行目付近を調査し、socket npm run build と npm run build を比較して Node v24 で失敗を再現します。起動されたプロセスの --node-options 値からリテラルのシングルクォートを削除し、その後、Next.js の TypeScript チェックフェーズが ERR_MISSING_OPTION なしで完了することを確認します。

Description

socket npm run build crashes during Next.js's TypeScript checking phase on Node v24. Running npm run build directly works fine.

Root cause

In shadow-npm-bin2.js:67, the --node-options value is wrapped in literal single quotes:

`--node-options='${...}${utils.cmdFlagsToString(permArgs)}'`

Since this argument is passed via child_process.spawn() (no shell), the quotes are not interpreted — npm receives them as part of the value and sets:

NODE_OPTIONS='--permission --allow-child-process --allow-fs-read=* --allow-fs-write=...'

Node.js silently ignores the garbled tokens. However, Next.js re-parses NODE_OPTIONS for its build workers using a tokenizer that splits on whitespace and only handles " as string delimiters, not '. This causes:

• '--permission (leading ') → unrecognized, dropped
• --allow-child-process, --allow-fs-read=*, --allow-fs-write=... → valid, kept

The TypeScript worker then receives --allow-* flags without --permission, and Node v24 throws ERR_MISSING_OPTION.

Suggested fix

Remove the single quotes — they are unnecessary and harmful when arguments are passed via spawn():

- `--node-options='${nodeOptionsArg ? nodeOptionsArg.slice(15) : ''}${utils.cmdFlagsToString(permArgs)}'`
+ `--node-options=${nodeOptionsArg ? nodeOptionsArg.slice(15) : ''}${utils.cmdFlagsToString(permArgs)}`

Repro

• Node v24.11.1, Next.js 16.2.1, Socket CLI 1.1.78 (also 1.1.76)
• npm run build → succeeds
• socket npm run build → crashes at "Running TypeScript ..."

TypeError [ERR_MISSING_OPTION]: --permission is required
    at node:internal/process/pre_execution:656:15
    at Array.forEach (<anonymous>)
    at initializePermission (node:internal/process/pre_execution:653:5)

Related

• #1036 — a separate bug on the same line where user-set NODE_OPTIONS are replaced rather than merged