Permission allow-fs-* to resolve env variables

What is the problem this feature will solve?

While it is possible to pass values of env variables when calling node directly

node --permission --allow-fs-read=$HOME

there are other ways to set permissions (in config file or via NODE_OPTIONS) that don't go through the shell first.

I'd like to make it possible for all methods of passing in permissions to support using environment variables.

{
  "nodeOptions": {
    "--permission": true,
    "--allow-fs-read": [
      "$HOME"
    ]
  }
}

What is the feature you are proposing to solve the problem?

Pseudocode:

    const replaceEnvVar = (value) => {
      const envVarMatch = value.match(/^\$([A-Z_][A-Z0-9_]*)$/i)
      if (envVarMatch) {
        const envVarName = envVarMatch[1]
        if (process.env[envVarName] !== undefined) {
          return process.env[envVarName]
        } else {
          console.error(
            `[LavaMoat] Environment variable "${envVarName}" referenced in config but not found in environment`
          )
        }
      }
      return value
    }

    for (const key of ['--allow-fs-read', '--allow-fs-write']) {
      if (Array.isArray(configOptions[key])) {
        configOptions[key] = configOptions[key].map(replaceEnvVar)
      } else if (typeof configOptions[key] === 'string') {
        configOptions[key] = replaceEnvVar(configOptions[key])
      }
    }

What alternatives have you considered?

I've considered more advanced support where this would also work:

{
  "nodeOptions": {
    "--permission": true,
    "--allow-fs-read": [
      "/home/${MY_USER}/some/place/else"
    ]
  }
}

but it seems unnecessarily complex and error prone to be worth it IMHO.

Start by tracing how Node.js parses --allow-fs-read and --allow-fs-write from direct arguments, NODE_OPTIONS, and configuration files. Check the existing permission-option tests and add coverage for exact environment-variable values in string and array forms. Done means supported permission inputs resolve environment variables consistently, including behavior when a variable is unset.