Commit 62ca1bae5a2 for nodejs

commit 62ca1bae5a2ba9fd63041464e90a6073e7dd0392
Author: Rafael Gonzaga <rafael.nunu@hotmail.com>
Date:   Fri Oct 16 21:53:49 2026 -0300

    vfs: allow mounting in permission audit mode

    Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
    PR-URL: https://github.com/nodejs/node/pull/66745
    Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
    Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>

diff --git a/doc/api/cli.md b/doc/api/cli.md
index 7bfe03b77b6..b326cfeb2b9 100644
--- a/doc/api/cli.md
+++ b/doc/api/cli.md
@@ -324,6 +324,8 @@ added: v26.9.0
 When using the [Permission Model][], a [virtual file system][] cannot be
 mounted by default: [`vfs.mount()`][] throws `ERR_INVALID_STATE` unless the
 user explicitly passes the `--allow-fs-vfs` flag when starting Node.js.
+In audit mode ([`--permission-audit`](#--permission-audit)), mounting is not
+refused and no message is published to the diagnostics channel.

 A mounted VFS serves paths that the file system permissions do not describe,
 so mounting one is gated on its own flag rather than on `--allow-fs-read` or
diff --git a/doc/node.1 b/doc/node.1
index c79f46cd2ce..6294c2af42c 100644
--- a/doc/node.1
+++ b/doc/node.1
@@ -206,6 +206,8 @@ process.permission.has('fs.read', 'custom-require-2.js'); // true
 When using the Permission Model, a virtual file system cannot be
 mounted by default: \fBvfs.mount()\fR throws \fBERR_INVALID_STATE\fR unless the
 user explicitly passes the \fB--allow-fs-vfs\fR flag when starting Node.js.
+In audit mode (\fB--permission-audit\fR), mounting is not
+refused and no message is published to the diagnostics channel.
 A mounted VFS serves paths that the file system permissions do not describe,
 so mounting one is gated on its own flag rather than on \fB--allow-fs-read\fR or
 \fB--allow-fs-write\fR.
diff --git a/lib/internal/vfs/setup.js b/lib/internal/vfs/setup.js
index a5f1b42659b..d6af8e566f8 100644
--- a/lib/internal/vfs/setup.js
+++ b/lib/internal/vfs/setup.js
@@ -100,7 +100,9 @@ let normalizedVfsRoot = null;
 let normalizedVfsRootPrefix = null;

 function registerVFS(vfs) {
-  if (permission.isEnabled() && !getOptionValue('--allow-fs-vfs')) {
+  // TODO(rafaelgss): publish a diagnostics channel message in audit mode.
+  if (permission.isEnabled() && !permission.isAuditMode() &&
+      !getOptionValue('--allow-fs-vfs')) {
     throw new ERR_INVALID_STATE(
       'VFS cannot be used when the permission model is enabled. ' +
       'Use --allow-fs-vfs to allow it.',
diff --git a/test/parallel/test-permission-allow-fs-vfs-flags.js b/test/parallel/test-permission-allow-fs-vfs-flags.js
index 68fcac76bd7..19d26532d88 100644
--- a/test/parallel/test-permission-allow-fs-vfs-flags.js
+++ b/test/parallel/test-permission-allow-fs-vfs-flags.js
@@ -20,6 +20,31 @@ spawnSyncAndExit(
   },
 );

+// Mounting a VFS is refused under --permission without --allow-fs-vfs, but
+// audit mode only observes and lets the mount through.
+const mount = `
+  require('node:vfs').create().mount();
+  console.log('mounted');
+`;
+
+spawnSyncAndExit(
+  process.execPath,
+  ['--experimental-vfs', '--permission', '-e', mount],
+  {
+    status: 1,
+    signal: null,
+    stderr: /ERR_INVALID_STATE/,
+  },
+);
+
+spawnSyncAndAssert(
+  process.execPath,
+  ['--experimental-vfs', '--permission-audit', '-e', mount],
+  {
+    stdout: /^mounted$/m,
+  },
+);
+
 if (process.config.variables.node_without_node_options) {
   common.skip('missing NODE_OPTIONS support');
 }