async_hooks: add --allow-async-hooks flag

[mcollina]

Summary

Add a new --allow-async-hooks flag that must be passed to enable async_hooks.createHook(). This is a breaking change - createHook is now disabled by default.

Changes

• Added --allow-async-hooks CLI flag (disabled by default)
• async_hooks.createHook() now throws ERR_ASYNC_HOOKS_CREATE_HOOK_DISABLED when called without the flag
• Updated all existing tests that use createHook() to include the flag
• Added new tests for both enabled and disabled behaviors

Breaking Change

async_hooks.createHook() now requires the --allow-async-hooks flag to be passed when starting Node.js.

Most APM tools should now use AsyncLocalStorage instead, which is not affected by this change.

Migration

Add --allow-async-hooks to your Node.js command line or NODE_OPTIONS:

node --allow-async-hooks app.js
# or
NODE_OPTIONS="--allow-async-hooks" node app.js

[nodejs-github-bot]

Review requested:

• @nodejs/config

[mcollina]

Opening up to discuss this. I think this is the best path forward as they are extremely problematic to execute without somebody knowing what they are doing. I'm not sure if we would eventually remove themm, but this is the next step.

Given that most APMs are actually using AsyncLocalStorage now, this is viable.

[marco-ippolito]

I agree this is a problematic api, we should get rid of it in the future, so +1

[jasnell]

I'm also +1 on this.

[bengl]

This should be --enable-async-hooks, right? (and elsewhere in this PR)

[Flarna]

I think we should either get rid of internal use in domain first (see here) or at least document there that use of domain requires this command line option set.

[Flarna]

I think there is one more internal use: if --no-async-context-frame is given AsyncLocalStore uses async hooks.

I think this case should be handled to adapt --no-async-context-frame to implicit set --allow-async-hooks and add a line in the docs to clarify that.

[RafaelGSS]

I'm +1 on this, but I think we should also have a runtime API to enable this. Most APM tools offer the possibility of requiring their module to instrument the user's application. Enabling it via a CLI will cause them to create a wrapper for the user's application or make it a requirement in the user's configuration.