Commit b8aec5b3c4e for nodejs

commit b8aec5b3c4e15689b4a76bceff3f8c7b67e3f6e9
Author: Rafael Gonzaga <rafael.nunu@hotmail.com>
Date:   Tue Nov 3 17:26:19 2026 -0300

    doc: describe how the permission model grants the entrypoint

    Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
    PR-URL: https://github.com/nodejs/node/pull/67038
    Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
    Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>

diff --git a/doc/api/cli.md b/doc/api/cli.md
index bddd4a5c0a5..d3309ae6192 100644
--- a/doc/api/cli.md
+++ b/doc/api/cli.md
@@ -297,8 +297,10 @@ The valid arguments for the `--allow-fs-read` flag are:

 Examples can be found in the [File System Permissions][] documentation.

-The initializer module and custom `--require` modules has a implicit
-read permission.
+The initializer module and custom `--require` modules have an implicit
+read permission. The entrypoint is granted as passed on the command line,
+without the module loader's resolution; see the [File System Permissions][]
+documentation for details.

 ```console
 $ node --permission -r custom-require.js -r custom-require-2.js index.js
diff --git a/doc/api/permissions.md b/doc/api/permissions.md
index d02e443fbd8..2cf99bd167a 100644
--- a/doc/api/permissions.md
+++ b/doc/api/permissions.md
@@ -238,6 +238,13 @@ $ node -r /path/to/custom-require.js --permission index.js
   list.
 * `index.js` will be included in the allowed file system read list.

+The entrypoint is granted as passed on the command line, without the module
+loader's resolution. If it is a directory, such as in `node --permission .`,
+read access is granted to everything inside that directory, recursively. If it
+omits the file extension, such as in `node --permission index`, the resolved
+`index.js` is not granted. Pass the full path of the file, or use
+[`--allow-fs-read`][], to grant exactly what the application needs.
+
 The valid arguments for both flags are:

 * `*` - To allow all `FileSystemRead` or `FileSystemWrite` operations,
diff --git a/doc/node.1 b/doc/node.1
index 7a32ece46d2..444da29eed3 100644
--- a/doc/node.1
+++ b/doc/node.1
@@ -186,8 +186,10 @@ Multiple paths can be allowed using multiple \fB--allow-fs-read\fR flags.
 Example \fB--allow-fs-read=/folder1/ --allow-fs-read=/folder2/\fR
 .El
 Examples can be found in the File System Permissions documentation.
-The initializer module and custom \fB--require\fR modules has a implicit
-read permission.
+The initializer module and custom \fB--require\fR modules have an implicit
+read permission. The entrypoint is granted as passed on the command line,
+without the module loader's resolution; see the File System Permissions
+documentation for details.
 .Bd -literal
 $ node --permission -r custom-require.js -r custom-require-2.js index.js
 .Ed