NotCapable: Requires env access to "Symbol(Deno.customInspect)"

[Lohann]

Version: Deno 2.5.2

deno --version

# deno --version
deno 2.5.2 (stable, release, aarch64-apple-darwin)
v8 14.0.365.5-rusty
typescript 5.9.2

file: main.ts

console.log(globalThis.process);

Then run deno --deny-env ./main.ts

[Internal Formatting Error] NotCapable: Requires env access to "Symbol(Deno.customInspect)", run again with the --allow-env flag
    at Object.getEnv [as get] (ext:deno_os/30_os.js:124:10)
    at denoEnvGet (ext:deno_node/_process/process.ts:27:21)
    at Object.has (ext:deno_node/_process/process.ts:68:32)
    at has (<anonymous>)
    at formatValue (ext:deno_console/01_console.js:475:7)
    at formatProperty (ext:deno_console/01_console.js:1650:11)
    at formatRaw (ext:deno_console/01_console.js:960:9)
    at formatValue (ext:deno_console/01_console.js:545:10)
    at inspectArgs (ext:deno_console/01_console.js:3074:17)
    at console.log (ext:deno_console/01_console.js:3143:7)

I don't want NodeJS globals to be imported in this project... and I can't find a way to avoid that, I already tried:

• change the compilerOptions in the deno.json
• run using DENO_COMPAT=0 deno --deny-env ./main.ts
• create a .env file then use --env-file=.env..
• change the compilerOptions.lib
  Nothing worked...

[sigmaSd]

So the problem is process being available at all ? or the problem is that it requires env permission ?

process is a node global so I'm not sure I follow the example when you try to log it, and it requires env because of process.env , you can remove env from it if you want to bypass the permission

process.env = undefined
undefined
> process
EventEmitter [process] {

[Lohann]

@sigmaSd The problem is that it changes the behavior of libraries that use process to check the current environment, my project target is the browser, but the results in tests and in the browser are inconsistent.

For example this is how the typescript check if it is running in a node environment:

• https://github.com/microsoft/TypeScript/blob/v5.9.3/src/compiler/core.ts#L2585-L2593

export function isNodeLikeSystem(): boolean {
    // This is defined here rather than in sys.ts to prevent a cycle from its
    // use in performanceCore.ts.
    return typeof process !== "undefined"
        && !!process.nextTick
        && !(process as any).browser
        && typeof require !== "undefined";
}

Simply doing process.env = undefined or globalThis.process = undefined doesn't work.. I tried:

delete globalThis.process;
delete globalThis.require;

// typescript still have access to `process` and `require`...
import ts from 'npm:typescript@5.9.2';

console.log(ts.isNodeLikeSystem()); // returns true

And it completely changes how typescript behaves:
https://github.com/microsoft/TypeScript/blob/v5.9.3/src/compiler/sys.ts#L1484-L1485

[bartlomieju]

Simply doing process.env = undefined or globalThis.process = undefined doesn't work.. I tried:

This is because the code is imported before the delete ... statements are executed. You can remove these globals in a separate script that you can call with --preload flag:

// delete_globals.js
delete globalThis.process;
delete globalThis.require;

// main.ts
import ts from 'npm:typescript@5.9.2';

console.log(ts.isNodeLikeSystem()); // returns true

$ deno run --preload delete_globals.js main.ts

[sigmaSd]

You can also do this in the same file without preload by putting this as the first line

import "data:text/javascript,delete globalThis.process;delete globalThis.process;"

[Lohann]

it worked! thank you @bartlomieju and @sigmaSd !
I'm not familiar with the lifecycle of import statements, I think it should be documented somewhere, or maybe Deno could provide a more intuitive way to edit the initial state of the global scope.

Once my issue is solved I will close this thread, thanks again!

[Lohann]

Reopening this issue, it stopped working and I have no clues why:

deno 2.5.4 (stable, release, aarch64-apple-darwin)
v8 14.0.365.5-rusty
typescript 5.9.2

Steps to reproduce:

1. Create a new project:

mkdir example && cd example
deno init --lib
mkdir src

2. Create the files src/preload.js and src/codeBuilder.ts

// src/preload.js
delete globalThis.process.env;
delete globalThis.process;
delete globalThis.Buffer;
// delete globalThis.Deno;
delete globalThis.require;
delete globalThis.clearImmediate;
delete globalThis.global;
delete globalThis.module;
delete globalThis.setImmediate;
delete globalThis.SharedArrayBuffer;

function isNodeLikeSystem() {
  return typeof process !== "undefined" && !!process.nextTick && !process.browser && typeof require !== "undefined";
}
console.log("preload: process", typeof process);
console.log("preload: isNodeLikeSystem", isNodeLikeSystem());

// src/codeBuilder.ts
import * as ts from "npm:typescript@5.9.3";
console.log("isNodeLikeSystem", ts.isNodeLikeSystem());

Command:
deno run --deny-env --preload src/preload.js src/codeBuilder.ts

deno run --preload src/preload.js src/codeBuilder.ts 
preload: process undefined
preload: isNodeLikeSystem false
❌ Denied read access to "<...>/cACHES/DENO/NPM/REGISTRY.NPMJS.ORG/TYPESCRIPT/5.9.3/LIB/TYPESCRIPT.JS".
error: Uncaught (in promise) TypeError: Cannot read properties of undefined (reading 'TSC_WATCHFILE')
    at getNodeSystem (file://<...>/deno/npm/registry.npmjs.org/typescript/5.9.3/lib/typescript.js:8299:33)
    at file:///<...>/deno/npm/registry.npmjs.org/typescript/5.9.3/lib/typescript.js:8665:12
    at file://<...>/deno/npm/registry.npmjs.org/typescript/5.9.3/lib/typescript.js:8671:3
    at file://<...>/deno/npm/registry.npmjs.org/typescript/5.9.3/lib/typescript.js:200275:3
    at Object.<anonymous> (file://<...>/deno/npm/registry.npmjs.org/typescript/5.9.3/lib/typescript.js:200278:3)
    at Module._compile (node:module:757:34)
    at loadMaybeCjs (node:module:782:10)
    at Object.Module._extensions..js (node:module:767:12)
    at Module.load (node:module:675:32)
    at Module._load (node:module:533:12

The TSC_WATCHFILE is inside getNodeSystem, this function can only be executed when ts.isNodeLikeSystem() is true.
https://github.com/microsoft/TypeScript/blob/v5.9.3/src/compiler/sys.ts#L1516

I debbuged my typescript/5.9.3/libtypescript.js locally, and confirmed that globalThis.process exists, even so I excluded it in the preload.js, and confirmed with the logs above the preload.js executed before everything.

cc: @bartlomieju @sigmaSd

[Lohann]

tested on deno 2.5.6 and same issue.

[bartlomieju]

You called delete process.env so that property is undefined and it makes sense that process.env.TSC_WATCHFILE raises an error like this.

[Lohann]

But that line should not be reachable if typeof process === 'undefined', notice this error happened inside getNodeSystem, and there's just one way to execute this function:
https://github.com/microsoft/TypeScript/blob/v5.9.3/src/compiler/sys.ts#L1956-L1958

if (isNodeLikeSystem()) {
    sys = getNodeSystem();
}

https://github.com/microsoft/TypeScript/blob/main/src/compiler/core.ts#L2586-L2593

function isNodeLikeSystem(): boolean {
    // This is defined here rather than in sys.ts to prevent a cycle from its
    // use in performanceCore.ts.
    return typeof process !== "undefined"
        && !!process.nextTick
        && !(process as any).browser
        && typeof require !== "undefined";
}

the test isNodeLikeSystem returns false in my local files, but inside npm:typescript@5.9.3 it returns true, seems it is ignoring the globalThis defined in the preload.

[Lohann]

Now I tried like this:

// delete_globals.js
delete globalThis.process;
delete globalThis.require;

// main.ts
import ts from 'npm:typescript@5.9.2';
console.log(ts.isNodeLikeSystem()); // returns true

command:
DENO_TRACE_PERMISSIONS=1 deno run -A --preload delete_globals.js main.ts

true

Now if I replace the -A flag by --deny-env:
DENO_TRACE_PERMISSIONS=1 deno run --deny-env --allow-read --preload delete_globals.js main.ts

error: Uncaught (in promise) NotCapable: Requires env access to "TSC_WATCHFILE", run again with the --allow-env flag
    at Object.getEnv [as get] (ext:deno_os/30_os.js:124:10)
    at denoEnvGet (ext:deno_node/_process/process.ts:30:21)
    at Object.get (ext:deno_node/_process/process.ts:47:22)
    at getNodeSystem (file://<...>/example/node_modules/.deno/typescript@5.9.2/node_modules/typescript/lib/typescript.js:8299:33)
    at file://<...>/example/node_modules/.deno/typescript@5.9.2/node_modules/typescript/lib/typescript.js:8665:12
    at file://<...>/example/node_modules/.deno/typescript@5.9.2/node_modules/typescript/lib/typescript.js:8671:3
    at file://<...>/example/node_modules/.deno/typescript@5.9.2/node_modules/typescript/lib/typescript.js:200252:3
    at Object.<anonymous> (file://<...>/example/node_modules/.deno/typescript@5.9.2/node_modules/typescript/lib/typescript.js:200255:3)
    at Module._compile (node:module:757:34)
    at loadMaybeCjs (node:module:782:10)

[Lohann]

I've found just one way to make isNodeLikeSystem return false, I need this to make typescript behave in Deno the same way it behaves in the browser, but is ugly and have several limitations:

import vm from 'node:vm';
import type * as TS from "npm:typescript@5.9.3";

// Read typescript file
const typescriptFile = import.meta.resolve('npm:typescript@5.9.3').substring(7);
const typescriptCode = await Deno.readTextFile(typescriptFile);

// Run typescript inside dedicated VM
const context = { ts: undefined as unknown as typeof TS };
vm.createContext(context, { microtaskMode: "afterEvaluate" });
vm.runInContext(typescriptCode, context);

// FINALLY!
const { ts } = context;
console.log(ts.isNodeLikeSystem()); // returns false