fs.glob (async and sync) returns no matches when `--allow-fs-read` is used

Version

22.22.1 (22.x), 24.14.0 (24.x), 25.8.1 (25.x)

Platform

Linux louiellan-IdeaPad-3-15ITL6 6.14.0-37-generic #37~24.04.1-Ubuntu SMP PREEMPT_DYNAMIC Thu Nov 20 10:25:38 UTC 2 x86_64 x86_64 x86_64 GNU/Linux

Subsystem

fs, permission

What steps will reproduce the bug?

Create the file

sample1.js

const fs = require('fs')
console.log(fs.globSync('somedir/*'));

Directory Structure

somedir
|--> file1.js
sample1.js

Run the following commands:

node --permission --allow-fs-read=somedir/ ./sample1.js

How often does it reproduce? Is there a required condition?

The bug consistently reproduces if the --allow-fs-read is given a specific directory such as somedir/, but not with the allow all *

What is the expected behavior? Why is that the expected behavior?

1. fs.globSync should return matches as it has a read access to that given directory
2. asynchronous fs.glob (also from node:fs/promises) returns matches to that given directory

---

Code snippet for checking fs.glob working as intended
sample2.js
(works just fine - for comparison)

const fsPromise = require('fs/promises'); 
(async () => {
for await (const entry of fsPromise.glob('somedir/*')) {
    console.log(entry);
}})();

sample3.js
(works just fine - for comparison)

const fs = require('node:fs');
fs.glob('somedir/*', (err, matches) => {
    if (err) throw err;
    console.log(matches);
});

Running the files

node --permission --allow-fs-read=somedir/ ./sample2.js
node --permission --allow-fs-read=somedir/ ./sample3.js

What do you see instead?

Empty matches

[]

Additional information

came across this when @RafaelGSS suggested to include permission model tests while using glob on --watch-path
Refs: https://github.com/nodejs/node/pull/59478

Start with the sample1.js reproduction and compare its fs.globSync call with the working fs/promises.glob and callback-based fs.glob examples under --permission --allow-fs-read=somedir/. Trace the glob permission handling and add a regression test for a specifically allowed directory; done means sync and async glob return somedir/file1.js rather than an empty array.