feat(cli): use NotCapable error for permission errors (#25431)

Closes #7394

---------

Co-authored-by: snek <snek@deno.com>

71 files changed, 207 insertions, 206 deletions

diff --git a/Cargo.lock b/Cargo.lock
index 1e2ce3ee5..0453719a4 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1405,9 +1405,9 @@ dependencies = [
 
 [[package]]
 name = "deno_core"
-version = "0.307.0"
+version = "0.308.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "154b0902402807a043579102f949e6dd6f3a09d2d5049929fd710fc3192bf109"
+checksum = "62fc8250fa9da059cc05b18328319a9048c73e4889ca929cc60877a8a1bfc4d4"
 dependencies = [
  "anyhow",
  "bincode",
@@ -1887,9 +1887,9 @@ dependencies = [
 
 [[package]]
 name = "deno_ops"
-version = "0.183.0"
+version = "0.184.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9114f9eb6419839f1ab9668f91c463238945bb974e1998629a703f72b4608daf"
+checksum = "24a465b7d691ad7cae41e8f51bd954b1e3ffd201b84dc30de2c16cf91034946e"
 dependencies = [
  "proc-macro-rules",
  "proc-macro2",
@@ -6257,9 +6257,9 @@ dependencies = [
 
 [[package]]
 name = "serde_v8"
-version = "0.216.0"
+version = "0.217.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1733b8192f123beedd2fc7998efeaf2a0b8bfa35c01537f50b690e786db8024c"
+checksum = "467c0a7bfc67cd918f1f7ab7a5ab70a9e744e466ff428cd728ff2c03bc77874c"
 dependencies = [
  "num-bigint",
  "serde",
@@ -7912,9 +7912,9 @@ dependencies = [
 
 [[package]]
 name = "v8"
-version = "0.105.0"
+version = "0.106.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "692624c4fd58ff50aa6d690c159df18e7881c13970005b9b2bff77dc425fd370"
+checksum = "a381badc47c6f15acb5fe0b5b40234162349ed9d4e4fd7c83a7f5547c0fc69c5"
 dependencies = [
  "bindgen",
  "bitflags 2.6.0",
diff --git a/Cargo.toml b/Cargo.toml
index 8426a3cc2..99c50576d 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -45,7 +45,7 @@ repository = "https://github.com/denoland/deno"
 
 [workspace.dependencies]
 deno_ast = { version = "=0.42.0", features = ["transpiling"] }
-deno_core = { version = "0.307.0" }
+deno_core = { version = "0.308.0" }
 
 deno_bench_util = { version = "0.162.0", path = "./bench_util" }
 deno_lockfile = "=0.23.0"
diff --git a/cli/tsc/dts/lib.deno.ns.d.ts b/cli/tsc/dts/lib.deno.ns.d.ts
index 1cf6667b1..9a77bd188 100644
--- a/cli/tsc/dts/lib.deno.ns.d.ts
+++ b/cli/tsc/dts/lib.deno.ns.d.ts
@@ -175,8 +175,11 @@ declare namespace Deno {
     /**
      * Raised when the underlying operating system indicates the current user
      * which the Deno process is running under does not have the appropriate
-     * permissions to a file or resource, or the user _did not_ provide required
-     * `--allow-*` flag.
+     * permissions to a file or resource.
+     *
+     * Before Deno 2.0, this error was raised when the user _did not_ provide
+     * required `--allow-*` flag. As of Deno 2.0, that case is now handled by
+     * the {@link NotCapable} error.
      *
      * @category Errors */
     export class PermissionDenied extends Error {}
@@ -314,6 +317,15 @@ declare namespace Deno {
      *
      * @category Errors */
     export class NotADirectory extends Error {}
+    /**
+     * Raised when trying to perform an operation while the relevant Deno
+     * permission (like `--allow-read`) has not been granted.
+     *
+     * Before Deno 2.0, this condition was covered by the {@link PermissionDenied}
+     * error.
+     *
+     * @category Errors */
+    export class NotCapable extends Error {}
   }
 
   /** The current process ID of this instance of the Deno CLI.
diff --git a/ext/fs/lib.rs b/ext/fs/lib.rs
index 161eaa367..f4815fd29 100644
--- a/ext/fs/lib.rs
+++ b/ext/fs/lib.rs
@@ -91,7 +91,7 @@ impl FsPermissions for deno_permissions::PermissionsContainer {
     if resolved {
       self
         .check_special_file(path, api_name)
-        .map_err(FsError::PermissionDenied)?;
+        .map_err(FsError::NotCapable)?;
       return Ok(Cow::Borrowed(path));
     }
 
@@ -99,11 +99,11 @@ impl FsPermissions for deno_permissions::PermissionsContainer {
     let read = read || !write;
     if read {
       FsPermissions::check_read(self, path, api_name)
-        .map_err(|_| FsError::PermissionDenied("read"))?;
+        .map_err(|_| FsError::NotCapable("read"))?;
     }
     if write {
       FsPermissions::check_write(self, path, api_name)
-        .map_err(|_| FsError::PermissionDenied("write"))?;
+        .map_err(|_| FsError::NotCapable("write"))?;
     }
     Ok(Cow::Borrowed(path))
   }
diff --git a/ext/fs/ops.rs b/ext/fs/ops.rs
index dc279b60d..8af2f0045 100644
--- a/ext/fs/ops.rs
+++ b/ext/fs/ops.rs
@@ -60,7 +60,7 @@ fn map_permission_error(
   path: &Path,
 ) -> AnyError {
   match error {
-    FsError::PermissionDenied(err) => {
+    FsError::NotCapable(err) => {
       let path = format!("{path:?}");
       let (path, truncated) = if path.len() > 1024 {
         (&path[0..1024], "...(truncated)")
@@ -74,7 +74,7 @@ fn map_permission_error(
         format!(
           "Requires {err} access to {path}{truncated}, run again with the --allow-{err} flag")
       };
-      custom_error("PermissionDenied", msg)
+      custom_error("NotCapable", msg)
     }
     err => Err::<(), _>(err)
       .context_path(operation, path)
diff --git a/ext/io/fs.rs b/ext/io/fs.rs
index 88e4eee47..3798c1429 100644
--- a/ext/io/fs.rs
+++ b/ext/io/fs.rs
@@ -22,7 +22,7 @@ pub enum FsError {
   Io(io::Error),
   FileBusy,
   NotSupported,
-  PermissionDenied(&'static str),
+  NotCapable(&'static str),
 }
 
 impl FsError {
@@ -31,7 +31,7 @@ impl FsError {
       Self::Io(err) => err.kind(),
       Self::FileBusy => io::ErrorKind::Other,
       Self::NotSupported => io::ErrorKind::Other,
-      Self::PermissionDenied(_) => io::ErrorKind::PermissionDenied,
+      Self::NotCapable(_) => io::ErrorKind::Other,
     }
   }
 
@@ -40,7 +40,7 @@ impl FsError {
       FsError::Io(err) => err,
       FsError::FileBusy => io::Error::new(self.kind(), "file busy"),
       FsError::NotSupported => io::Error::new(self.kind(), "not supported"),
-      FsError::PermissionDenied(err) => {
+      FsError::NotCapable(err) => {
         io::Error::new(self.kind(), format!("requires {err} access"))
       }
     }
@@ -65,8 +65,8 @@ impl From<FsError> for AnyError {
       FsError::Io(err) => AnyError::from(err),
       FsError::FileBusy => resource_unavailable(),
       FsError::NotSupported => not_supported(),
-      FsError::PermissionDenied(err) => {
-        custom_error("PermissionDenied", format!("permission denied: {err}"))
+      FsError::NotCapable(err) => {
+        custom_error("NotCapable", format!("permission denied: {err}"))
       }
     }
   }
diff --git a/ext/node/polyfills/_process/process.ts b/ext/node/polyfills/_process/process.ts
index e4b88a11a..6f69139c9 100644
--- a/ext/node/polyfills/_process/process.ts
+++ b/ext/node/polyfills/_process/process.ts
@@ -53,8 +53,8 @@ function denoEnvGet(name: string) {
   } catch (e) {
     if (
       ObjectPrototypeIsPrototypeOf(TypeErrorPrototype, e) ||
-      // TODO(iuioiua): Use `PermissionDeniedPrototype` when it's available
-      ObjectPrototypeIsPrototypeOf(Deno.errors.PermissionDenied.prototype, e)
+      // TODO(iuioiua): Use `NotCapablePrototype` when it's available
+      ObjectPrototypeIsPrototypeOf(Deno.errors.NotCapable.prototype, e)
     ) {
       return undefined;
     }
diff --git a/ext/node/polyfills/internal_binding/pipe_wrap.ts b/ext/node/polyfills/internal_binding/pipe_wrap.ts
index f5c3c5439..3e366b3c7 100644
--- a/ext/node/polyfills/internal_binding/pipe_wrap.ts
+++ b/ext/node/polyfills/internal_binding/pipe_wrap.ts
@@ -160,16 +160,8 @@ export class Pipe extends ConnectionWrap {
         }
       },
       (e) => {
-        // TODO(cmorten): correct mapping of connection error to status code.
-        let code: number;
-
-        if (e instanceof Deno.errors.NotFound) {
-          code = codeMap.get("ENOENT")!;
-        } else if (e instanceof Deno.errors.PermissionDenied) {
-          code = codeMap.get("EACCES")!;
-        } else {
-          code = codeMap.get("ECONNREFUSED")!;
-        }
+        const code = codeMap.get(e.code ?? "UNKNOWN") ??
+          codeMap.get("UNKNOWN")!;
 
         try {
           this.afterConnect(req, code);
@@ -207,16 +199,10 @@ export class Pipe extends ConnectionWrap {
     try {
       listener = Deno.listen(listenOptions);
     } catch (e) {
-      if (e instanceof Deno.errors.AddrInUse) {
-        return codeMap.get("EADDRINUSE")!;
-      } else if (e instanceof Deno.errors.AddrNotAvailable) {
-        return codeMap.get("EADDRNOTAVAIL")!;
-      } else if (e instanceof Deno.errors.PermissionDenied) {
+      if (e instanceof Deno.errors.NotCapable) {
         throw e;
       }
-
-      // TODO(cmorten): map errors to appropriate error codes.
-      return codeMap.get("UNKNOWN")!;
+      return codeMap.get(e.code ?? "UNKNOWN") ?? codeMap.get("UNKNOWN")!;
     }
 
     const address = listener.addr as Deno.UnixAddr;
diff --git a/ext/node/polyfills/internal_binding/tcp_wrap.ts b/ext/node/polyfills/internal_binding/tcp_wrap.ts
index 4b57a7e1e..973a1d1c0 100644
--- a/ext/node/polyfills/internal_binding/tcp_wrap.ts
+++ b/ext/node/polyfills/internal_binding/tcp_wrap.ts
@@ -212,16 +212,10 @@ export class TCP extends ConnectionWrap {
     try {
       listener = Deno.listen(listenOptions);
     } catch (e) {
-      if (e instanceof Deno.errors.AddrInUse) {
-        return codeMap.get("EADDRINUSE")!;
-      } else if (e instanceof Deno.errors.AddrNotAvailable) {
-        return codeMap.get("EADDRNOTAVAIL")!;
-      } else if (e instanceof Deno.errors.PermissionDenied) {
+      if (e instanceof Deno.errors.NotCapable) {
         throw e;
       }
-
-      // TODO(cmorten): map errors to appropriate error codes.
-      return codeMap.get("UNKNOWN")!;
+      return codeMap.get(e.code ?? "UNKNOWN") ?? codeMap.get("UNKNOWN")!;
     }
 
     const address = listener.addr as Deno.NetAddr;
diff --git a/ext/node/polyfills/internal_binding/udp_wrap.ts b/ext/node/polyfills/internal_binding/udp_wrap.ts
index 7cbd6cabe..db6961ddb 100644
--- a/ext/node/polyfills/internal_binding/udp_wrap.ts
+++ b/ext/node/polyfills/internal_binding/udp_wrap.ts
@@ -337,16 +337,10 @@ export class UDP extends HandleWrap {
     try {
       listener = DenoListenDatagram(listenOptions);
     } catch (e) {
-      if (e instanceof Deno.errors.AddrInUse) {
-        return codeMap.get("EADDRINUSE")!;
-      } else if (e instanceof Deno.errors.AddrNotAvailable) {
-        return codeMap.get("EADDRNOTAVAIL")!;
-      } else if (e instanceof Deno.errors.PermissionDenied) {
+      if (e instanceof Deno.errors.NotCapable) {
         throw e;
       }
-
-      // TODO(cmorten): map errors to appropriate error codes.
-      return codeMap.get("UNKNOWN")!;
+      return codeMap.get(e.code ?? "UNKNOWN") ?? codeMap.get("UNKNOWN")!;
     }
 
     const address = listener.addr as Deno.NetAddr;
diff --git a/runtime/js/01_errors.js b/runtime/js/01_errors.js
index bfcb540e2..ea567a5d0 100644
--- a/runtime/js/01_errors.js
+++ b/runtime/js/01_errors.js
@@ -1,7 +1,7 @@
 // Copyright 2018-2024 the Deno authors. All rights reserved. MIT license.
 
 import { core, primordials } from "ext:core/mod.js";
-const { BadResource, Interrupted, PermissionDenied } = core;
+const { BadResource, Interrupted, NotCapable } = core;
 const { Error } = primordials;
 
 class NotFound extends Error {
@@ -116,6 +116,13 @@ class Busy extends Error {
   }
 }
 
+class PermissionDenied extends Error {
+  constructor(msg) {
+    super(msg);
+    this.name = "PermissionDenied";
+  }
+}
+
 class NotSupported extends Error {
   constructor(msg) {
     super(msg);
@@ -176,6 +183,7 @@ const errors = {
   IsADirectory,
   NetworkUnreachable,
   NotADirectory,
+  NotCapable,
 };
 
 export { errors };
diff --git a/runtime/js/99_main.js b/runtime/js/99_main.js
index f81ab3d8f..4b17635bb 100644
--- a/runtime/js/99_main.js
+++ b/runtime/js/99_main.js
@@ -294,6 +294,7 @@ core.registerErrorClass("NotConnected", errors.NotConnected);
 core.registerErrorClass("AddrInUse", errors.AddrInUse);
 core.registerErrorClass("AddrNotAvailable", errors.AddrNotAvailable);
 core.registerErrorClass("BrokenPipe", errors.BrokenPipe);
+core.registerErrorClass("PermissionDenied", errors.PermissionDenied);
 core.registerErrorClass("AlreadyExists", errors.AlreadyExists);
 core.registerErrorClass("InvalidData", errors.InvalidData);
 core.registerErrorClass("TimedOut", errors.TimedOut);
diff --git a/runtime/ops/process.rs b/runtime/ops/process.rs
index c2fa212d3..d7058a053 100644
--- a/runtime/ops/process.rs
+++ b/runtime/ops/process.rs
@@ -609,7 +609,7 @@ fn check_run_permission(
       // we don't allow users to launch subprocesses with any LD_ or DYLD_*
       // env vars set because this allows executing code (ex. LD_PRELOAD)
       return Err(deno_core::error::custom_error(
-        "PermissionDenied",
+        "NotCapable",
         format!(
           "Requires --allow-all permissions to spawn subprocess with {} environment variable{}.",
           env_var_names.join(", "),
diff --git a/runtime/permissions/lib.rs b/runtime/permissions/lib.rs
index c5cfbff70..36750ae38 100644
--- a/runtime/permissions/lib.rs
+++ b/runtime/permissions/lib.rs
@@ -144,7 +144,7 @@ impl PermissionState {
         name
       )
     };
-    custom_error("PermissionDenied", msg)
+    custom_error("NotCapable", msg)
   }
 
   /// Check the permission state. bool is whether a prompt was issued.
@@ -1999,10 +1999,7 @@ fn parse_run_list(
 }
 
 fn escalation_error() -> AnyError {
-  custom_error(
-    "PermissionDenied",
-    "Can't escalate parent thread permissions",
-  )
+  custom_error("NotCapable", "Can't escalate parent thread permissions")
 }
 
 #[derive(Debug, Eq, PartialEq)]
diff --git a/tests/integration/compile_tests.rs b/tests/integration/compile_tests.rs
index 54a82b913..215b956fd 100644
--- a/tests/integration/compile_tests.rs
+++ b/tests/integration/compile_tests.rs
@@ -367,7 +367,7 @@ fn standalone_runtime_flags() {
     .run()
     .assert_stdout_matches_text("0.147205063401058\n")
     .assert_stderr_matches_text(
-      "[WILDCARD]PermissionDenied: Requires write access to[WILDCARD]",
+      "[WILDCARD]NotCapable: Requires write access to[WILDCARD]",
     )
     .assert_exit_code(1);
 }
diff --git a/tests/integration/run_tests.rs b/tests/integration/run_tests.rs
index e18428575..9a680b944 100644
--- a/tests/integration/run_tests.rs
+++ b/tests/integration/run_tests.rs
@@ -3145,7 +3145,7 @@ fn issue9750() {
       console.write_line_raw("n");
       console.expect_all(&[
         "Denied env access to \"SECRET\".",
-        "PermissionDenied: Requires env access to \"SECRET\", run again with the --allow-env flag",
+        "NotCapable: Requires env access to \"SECRET\", run again with the --allow-env flag",
       ]);
     });
 }
@@ -4051,7 +4051,7 @@ async fn test_resolve_dns() {
     let out = String::from_utf8_lossy(&output.stdout);
     assert!(!output.status.success());
     assert!(err.starts_with("Check file"));
-    assert!(err.contains(r#"error: Uncaught (in promise) PermissionDenied: Requires net access to "127.0.0.1:4553""#));
+    assert!(err.contains(r#"error: Uncaught (in promise) NotCapable: Requires net access to "127.0.0.1:4553""#));
     assert!(out.is_empty());
   }
 
@@ -4072,7 +4072,7 @@ async fn test_resolve_dns() {
     let out = String::from_utf8_lossy(&output.stdout);
     assert!(!output.status.success());
     assert!(err.starts_with("Check file"));
-    assert!(err.contains(r#"error: Uncaught (in promise) PermissionDenied: Requires net access to "127.0.0.1:4553""#));
+    assert!(err.contains(r#"error: Uncaught (in promise) NotCapable: Requires net access to "127.0.0.1:4553""#));
     assert!(out.is_empty());
   }
 
diff --git a/tests/specs/bench/allow_none/allow_none.out b/tests/specs/bench/allow_none/allow_none.out
index d92fb1469..51bb70d72 100644
--- a/tests/specs/bench/allow_none/allow_none.out
+++ b/tests/specs/bench/allow_none/allow_none.out
@@ -6,16 +6,16 @@ Runtime | Deno [WILDLINE] ([WILDLINE])
 
 benchmark   time/iter (avg)        iter/s      (min … max)           p75      p99     p995
 ----------- ----------------------------- --------------------- --------------------------
-read        error: PermissionDenied: Can't escalate parent thread permissions
+read        error: NotCapable: Can't escalate parent thread permissions
 [WILDCARD]
-write       error: PermissionDenied: Can't escalate parent thread permissions
+write       error: NotCapable: Can't escalate parent thread permissions
 [WILDCARD]
-net         error: PermissionDenied: Can't escalate parent thread permissions
+net         error: NotCapable: Can't escalate parent thread permissions
 [WILDCARD]
-env         error: PermissionDenied: Can't escalate parent thread permissions
+env         error: NotCapable: Can't escalate parent thread permissions
 [WILDCARD]
-run         error: PermissionDenied: Can't escalate parent thread permissions
+run         error: NotCapable: Can't escalate parent thread permissions
 [WILDCARD]
-ffi         error: PermissionDenied: Can't escalate parent thread permissions
+ffi         error: NotCapable: Can't escalate parent thread permissions
 [WILDCARD]
 error: Bench failed
diff --git a/tests/specs/bench/no_prompt_by_default/no_prompt_by_default.out b/tests/specs/bench/no_prompt_by_default/no_prompt_by_default.out
index b39b4e1ba..e7bbd206d 100644
--- a/tests/specs/bench/no_prompt_by_default/no_prompt_by_default.out
+++ b/tests/specs/bench/no_prompt_by_default/no_prompt_by_default.out
@@ -5,6 +5,6 @@ Runtime | Deno [WILDCARD] ([WILDCARD])
 
 benchmark   time/iter (avg)        iter/s      (min … max)           p75      p99     p995
 ----------- ----------------------------- --------------------- --------------------------
-no prompt   error: PermissionDenied: Requires read access to "./some_file.txt", run again with the --allow-read flag
+no prompt   error: NotCapable: Requires read access to "./some_file.txt", run again with the --allow-read flag
 [WILDCARD]
 error: Bench failed
diff --git a/tests/specs/bench/no_prompt_with_denied_perms/no_prompt_with_denied_perms.out b/tests/specs/bench/no_prompt_with_denied_perms/no_prompt_with_denied_perms.out
index 182fcc4f1..656832863 100644
--- a/tests/specs/bench/no_prompt_with_denied_perms/no_prompt_with_denied_perms.out
+++ b/tests/specs/bench/no_prompt_with_denied_perms/no_prompt_with_denied_perms.out
@@ -5,6 +5,6 @@ Runtime | Deno [WILDCARD] ([WILDCARD])
 
 benchmark   time/iter (avg)        iter/s      (min … max)           p75      p99     p995
 ----------- ----------------------------- --------------------- --------------------------
-no prompt   error: PermissionDenied: Requires read access to "./some_file.txt", run again with the --allow-read flag
+no prompt   error: NotCapable: Requires read access to "./some_file.txt", run again with the --allow-read flag
 [WILDCARD]
 error: Bench failed
diff --git a/tests/specs/compile/permissions_denied/main.out b/tests/specs/compile/permissions_denied/main.out
index e9ea45c81..669272972 100644
--- a/tests/specs/compile/permissions_denied/main.out
+++ b/tests/specs/compile/permissions_denied/main.out
@@ -1,2 +1,2 @@
-error: Uncaught (in promise) PermissionDenied: Requires run access to "deno", specify the required permissions during compilation using `deno compile --allow-run`
+error: Uncaught (in promise) NotCapable: Requires run access to "deno", specify the required permissions during compilation using `deno compile --allow-run`
 [WILDCARD]
\ No newline at end of file
diff --git a/tests/specs/permission/path_not_permitted/main.out b/tests/specs/permission/path_not_permitted/main.out
index 77f800158..b057d0a63 100644
--- a/tests/specs/permission/path_not_permitted/main.out
+++ b/tests/specs/permission/path_not_permitted/main.out
@@ -1,11 +1,11 @@
 Running...
-PermissionDenied: Requires run access to "deno", run again with the --allow-run flag
+NotCapable: Requires run access to "deno", run again with the --allow-run flag
     [WILDCARD]
     at file:///[WILDLINE]/sub.ts:15:5 {
-  name: "PermissionDenied"
+  name: "NotCapable"
 }
-PermissionDenied: Requires run access to "deno", run again with the --allow-run flag
+NotCapable: Requires run access to "deno", run again with the --allow-run flag
     [WILDCARD]
     at file:///[WILDLINE]/sub.ts:23:22 {
-  name: "PermissionDenied"
+  name: "NotCapable"
 }
diff --git a/tests/specs/permission/special/main.js b/tests/specs/permission/special/main.js
index 59ec4f7b5..721e0c392 100644
--- a/tests/specs/permission/special/main.js
+++ b/tests/specs/permission/special/main.js
@@ -7,10 +7,10 @@ const testCases = [
   [["darwin", "linux"], null, "/etc/passwd"],
   [["windows"], null, "\\\\.\\nul"],
   // Denied, requires `--allow-all`
-  [["darwin", "linux"], /PermissionDenied/, "/dev/ptmx"],
-  [["linux"], /PermissionDenied/, "/proc/self/environ"],
-  [["linux"], /PermissionDenied/, "/proc/self/mem"],
-  [["windows"], /PermissionDenied/, "\\\\.\\PhysicalDrive0"],
+  [["darwin", "linux"], /NotCapable/, "/dev/ptmx"],
+  [["linux"], /NotCapable/, "/proc/self/environ"],
+  [["linux"], /NotCapable/, "/proc/self/mem"],
+  [["windows"], /NotCapable/, "\\\\.\\PhysicalDrive0"],
 ];
 
 const os = Deno.build.os;
diff --git a/tests/specs/permission/write_allow_binary/main.out b/tests/specs/permission/write_allow_binary/main.out
index e7c47f288..0432ee6c9 100644
--- a/tests/specs/permission/write_allow_binary/main.out
+++ b/tests/specs/permission/write_allow_binary/main.out
@@ -1,5 +1,5 @@
 Running...
-error: Uncaught (in promise) PermissionDenied: Requires write access to "binary[WILDLINE]", run again with the --allow-write flag
+error: Uncaught (in promise) NotCapable: Requires write access to "binary[WILDLINE]", run again with the --allow-write flag
 Deno.writeTextFileSync(binaryName, "");
      ^
     at [WILDCARD]
diff --git a/tests/specs/run/ld_preload/env_arg.out b/tests/specs/run/ld_preload/env_arg.out
index 3df781a8e..945737e65 100644
--- a/tests/specs/run/ld_preload/env_arg.out
+++ b/tests/specs/run/ld_preload/env_arg.out
@@ -1,8 +1,8 @@
-PermissionDenied: Requires --allow-all permissions to spawn subprocess with LD_PRELOAD environment variable.
+NotCapable: Requires --allow-all permissions to spawn subprocess with LD_PRELOAD environment variable.
     [WILDCARD]
-  name: "PermissionDenied"
+  name: "NotCapable"
 }
-PermissionDenied: Requires --allow-all permissions to spawn subprocess with LD_PRELOAD environment variable.
+NotCapable: Requires --allow-all permissions to spawn subprocess with LD_PRELOAD environment variable.
     [WILDCARD]
-  name: "PermissionDenied"
+  name: "NotCapable"
 }
diff --git a/tests/specs/run/ld_preload/set_with_allow_env.out b/tests/specs/run/ld_preload/set_with_allow_env.out
index 60dba7cff..f89582d6c 100644
--- a/tests/specs/run/ld_preload/set_with_allow_env.out
+++ b/tests/specs/run/ld_preload/set_with_allow_env.out
@@ -1,8 +1,8 @@
-PermissionDenied: Requires --allow-all permissions to spawn subprocess with LD_PRELOAD environment variable.
+NotCapable: Requires --allow-all permissions to spawn subprocess with LD_PRELOAD environment variable.
   [WILDCARD]
-  name: "PermissionDenied"
+  name: "NotCapable"
 }
-PermissionDenied: Requires --allow-all permissions to spawn subprocess with DYLD_FALLBACK_LIBRARY_PATH, LD_PRELOAD environment variables.
+NotCapable: Requires --allow-all permissions to spawn subprocess with DYLD_FALLBACK_LIBRARY_PATH, LD_PRELOAD environment variables.
   [WILDCARD]
-  name: "PermissionDenied"
+  name: "NotCapable"
 }
diff --git a/tests/testdata/bench/allow_none.out b/tests/testdata/bench/allow_none.out
index 9499e234a..2a75ab5fd 100644
--- a/tests/testdata/bench/allow_none.out
+++ b/tests/testdata/bench/allow_none.out
@@ -6,16 +6,16 @@ Runtime | Deno [WILDCARD] ([WILDCARD])
 
 benchmark   time/iter (avg)        iter/s      (min … max)           p75      p99     p995
 ----------- ----------------------------- --------------------- --------------------------
-read        error: PermissionDenied: Can't escalate parent thread permissions
+read        error: NotCapable: Can't escalate parent thread permissions
 [WILDCARD]
-write       error: PermissionDenied: Can't escalate parent thread permissions
+write       error: NotCapable: Can't escalate parent thread permissions
 [WILDCARD]
-net         error: PermissionDenied: Can't escalate parent thread permissions
+net         error: NotCapable: Can't escalate parent thread permissions
 [WILDCARD]
-env         error: PermissionDenied: Can't escalate parent thread permissions
+env         error: NotCapable: Can't escalate parent thread permissions
 [WILDCARD]
-run         error: PermissionDenied: Can't escalate parent thread permissions
+run         error: NotCapable: Can't escalate parent thread permissions
 [WILDCARD]
-ffi         error: PermissionDenied: Can't escalate parent thread permissions
+ffi         error: NotCapable: Can't escalate parent thread permissions
 [WILDCARD]
 error: Bench failed
diff --git a/tests/testdata/bench/no_prompt_by_default.out b/tests/testdata/bench/no_prompt_by_default.out
index 3a2574e28..d9e83cf25 100644
--- a/tests/testdata/bench/no_prompt_by_default.out
+++ b/tests/testdata/bench/no_prompt_by_default.out
@@ -5,6 +5,6 @@ Runtime | Deno [WILDCARD] ([WILDCARD])
 
 benchmark   time/iter (avg)        iter/s      (min … max)           p75      p99     p995
 ----------- ----------------------------- --------------------- --------------------------
-no prompt   error: PermissionDenied: Requires read access to "./some_file.txt", run again with the --allow-read flag
+no prompt   error: NotCapable: Requires read access to "./some_file.txt", run again with the --allow-read flag
 [WILDCARD]
 error: Bench failed
diff --git a/tests/testdata/bench/no_prompt_with_denied_perms.out b/tests/testdata/bench/no_prompt_with_denied_perms.out
index 0d1e41077..81db3068a 100644
--- a/tests/testdata/bench/no_prompt_with_denied_perms.out
+++ b/tests/testdata/bench/no_prompt_with_denied_perms.out
@@ -5,6 +5,6 @@ Runtime | Deno [WILDCARD] ([WILDCARD])
 
 benchmark   time/iter (avg)        iter/s      (min … max)           p75      p99     p995
 ----------- ----------------------------- --------------------- --------------------------
-no prompt   error: PermissionDenied: Requires read access to "./some_file.txt", run again with the --allow-read flag
+no prompt   error: NotCapable: Requires read access to "./some_file.txt", run again with the --allow-read flag
 [WILDCARD]
 error: Bench failed
diff --git a/tests/testdata/npm/deno_run_cowsay_no_permissions.out b/tests/testdata/npm/deno_run_cowsay_no_permissions.out
index 837394d49..6434620e2 100644
--- a/tests/testdata/npm/deno_run_cowsay_no_permissions.out
+++ b/tests/testdata/npm/deno_run_cowsay_no_permissions.out
@@ -1,2 +1,2 @@
-error: Uncaught PermissionDenied: Requires read access to <CWD>, specify the required permissions during compilation using `deno compile --allow-read`
+error: Uncaught NotCapable: Requires read access to <CWD>, specify the required permissions during compilation using `deno compile --allow-read`
 [WILDCARD]
diff --git a/tests/testdata/run/059_fs_relative_path_perm.ts.out b/tests/testdata/run/059_fs_relative_path_perm.ts.out
index b23628cd6..0d0412208 100644
--- a/tests/testdata/run/059_fs_relative_path_perm.ts.out
+++ b/tests/testdata/run/059_fs_relative_path_perm.ts.out
@@ -1,4 +1,4 @@
-[WILDCARD]error: Uncaught (in promise) PermissionDenied: Requires read access to "non-existent", run again with the --allow-read flag
+[WILDCARD]error: Uncaught (in promise) NotCapable: Requires read access to "non-existent", run again with the --allow-read flag
 Deno.readFileSync("non-existent");
      ^
     at [WILDCARD]
diff --git a/tests/testdata/run/089_run_allow_list.ts.out b/tests/testdata/run/089_run_allow_list.ts.out
index 68a4a2ac5..8b07d6e04 100644
--- a/tests/testdata/run/089_run_allow_list.ts.out
+++ b/tests/testdata/run/089_run_allow_list.ts.out
@@ -1,3 +1,3 @@
-[WILDCARD]PermissionDenied: Requires run access to "ls", run again with the --allow-run flag
+[WILDCARD]NotCapable: Requires run access to "ls", run again with the --allow-run flag
 [WILDCARD]
 true
diff --git a/tests/testdata/run/node_env_var_allowlist.ts.out b/tests/testdata/run/node_env_var_allowlist.ts.out
index ea66a2965..2dcffd67b 100644
--- a/tests/testdata/run/node_env_var_allowlist.ts.out
+++ b/tests/testdata/run/node_env_var_allowlist.ts.out
@@ -1,5 +1,5 @@
 ok
-[WILDCARD]error: Uncaught (in promise) PermissionDenied: Requires env access to "NOT_NODE_DEBUG", run again with the --allow-env flag
+[WILDCARD]error: Uncaught (in promise) NotCapable: Requires env access to "NOT_NODE_DEBUG", run again with the --allow-env flag
 Deno.env.get("NOT_NODE_DEBUG");
          ^
     at [WILDCARD]
diff --git a/tests/testdata/test/allow_none.out b/tests/testdata/test/allow_none.out
index aaea9aea3..37ed8548a 100644
--- a/tests/testdata/test/allow_none.out
+++ b/tests/testdata/test/allow_none.out
@@ -10,27 +10,27 @@ ffi ... FAILED [WILDCARD]
  ERRORS 
 
 read => ./test/allow_none.ts:[WILDCARD]
-error: PermissionDenied: Can't escalate parent thread permissions
+error: NotCapable: Can't escalate parent thread permissions
 [WILDCARD]
 
 write => ./test/allow_none.ts:[WILDCARD]
-error: PermissionDenied: Can't escalate parent thread permissions
+error: NotCapable: Can't escalate parent thread permissions
 [WILDCARD]
 
 net => ./test/allow_none.ts:[WILDCARD]
-error: PermissionDenied: Can't escalate parent thread permissions
+error: NotCapable: Can't escalate parent thread permissions
 [WILDCARD]
 
 env => ./test/allow_none.ts:[WILDCARD]
-error: PermissionDenied: Can't escalate parent thread permissions
+error: NotCapable: Can't escalate parent thread permissions
 [WILDCARD]
 
 run => ./test/allow_none.ts:[WILDCARD]
-error: PermissionDenied: Can't escalate parent thread permissions
+error: NotCapable: Can't escalate parent thread permissions
 [WILDCARD]
 
 ffi => ./test/allow_none.ts:[WILDCARD]
-error: PermissionDenied: Can't escalate parent thread permissions
+error: NotCapable: Can't escalate parent thread permissions
 [WILDCARD]
 
  FAILURES 
diff --git a/tests/testdata/test/no_prompt_by_default.out b/tests/testdata/test/no_prompt_by_default.out
index a35e3f7ae..cd40fab53 100644
--- a/tests/testdata/test/no_prompt_by_default.out
+++ b/tests/testdata/test/no_prompt_by_default.out
@@ -4,7 +4,7 @@ no prompt ... FAILED ([WILDCARD]s)
  ERRORS 
 
 no prompt => ./test/no_prompt_by_default.ts:[WILDCARD]
-error: PermissionDenied: Requires read access to "./some_file.txt", run again with the --allow-read flag
+error: NotCapable: Requires read access to "./some_file.txt", run again with the --allow-read flag
 [WILDCARD]
 
  FAILURES 
diff --git a/tests/testdata/test/no_prompt_with_denied_perms.out b/tests/testdata/test/no_prompt_with_denied_perms.out
index 4293ff1bb..f6c8ec826 100644
--- a/tests/testdata/test/no_prompt_with_denied_perms.out
+++ b/tests/testdata/test/no_prompt_with_denied_perms.out
@@ -4,7 +4,7 @@ no prompt ... FAILED ([WILDCARD]s)
  ERRORS 
 
 no prompt => ./test/no_prompt_with_denied_perms.ts:[WILDCARD]
-error: PermissionDenied: Requires read access to "./some_file.txt", run again with the --allow-read flag
+error: NotCapable: Requires read access to "./some_file.txt", run again with the --allow-read flag
 [WILDCARD]
 
  FAILURES 
diff --git a/tests/unit/chmod_test.ts b/tests/unit/chmod_test.ts
index df3771bbc..9ff6301e2 100644
--- a/tests/unit/chmod_test.ts
+++ b/tests/unit/chmod_test.ts
@@ -94,7 +94,7 @@ Deno.test({ permissions: { write: true } }, function chmodSyncFailure() {
 Deno.test({ permissions: { write: false } }, function chmodSyncPerm() {
   assertThrows(() => {
     Deno.chmodSync("/somefile.txt", 0o777);
-  }, Deno.errors.PermissionDenied);
+  }, Deno.errors.NotCapable);
 });
 
 Deno.test(
@@ -186,5 +186,5 @@ Deno.test({ permissions: { write: true } }, async function chmodFailure() {
 Deno.test({ permissions: { write: false } }, async function chmodPerm() {
   await assertRejects(async () => {
     await Deno.chmod("/somefile.txt", 0o777);
-  }, Deno.errors.PermissionDenied);
+  }, Deno.errors.NotCapable);
 });
diff --git a/tests/unit/chown_test.ts b/tests/unit/chown_test.ts
index 033d4592d..eda4d3403 100644
--- a/tests/unit/chown_test.ts
+++ b/tests/unit/chown_test.ts
@@ -26,7 +26,7 @@ Deno.test(
     const filePath = "chown_test_file.txt";
     await assertRejects(async () => {
       await Deno.chown(filePath, 1000, 1000);
-    }, Deno.errors.PermissionDenied);
+    }, Deno.errors.NotCapable);
   },
 );
 
diff --git a/tests/unit/command_test.ts b/tests/unit/command_test.ts
index c11761fe7..0a7891493 100644
--- a/tests/unit/command_test.ts
+++ b/tests/unit/command_test.ts
@@ -382,7 +382,7 @@ Deno.test(
       await new Deno.Command(Deno.execPath(), {
         args: ["eval", "console.log('hello world')"],
       }).output();
-    }, Deno.errors.PermissionDenied);
+    }, Deno.errors.NotCapable);
   },
 );
 
@@ -393,7 +393,7 @@ Deno.test(
       new Deno.Command(Deno.execPath(), {
         args: ["eval", "console.log('hello world')"],
       }).outputSync();
-    }, Deno.errors.PermissionDenied);
+    }, Deno.errors.NotCapable);
   },
 );
 
diff --git a/tests/unit/copy_file_test.ts b/tests/unit/copy_file_test.ts
index ad467f510..9405184e3 100644
--- a/tests/unit/copy_file_test.ts
+++ b/tests/unit/copy_file_test.ts
@@ -84,7 +84,7 @@ Deno.test(
   function copyFileSyncPerm1() {
     assertThrows(() => {
       Deno.copyFileSync("/from.txt", "/to.txt");
-    }, Deno.errors.PermissionDenied);
+    }, Deno.errors.NotCapable);
   },
 );
 
@@ -93,7 +93,7 @@ Deno.test(
   function copyFileSyncPerm2() {
     assertThrows(() => {
       Deno.copyFileSync("/from.txt", "/to.txt");
-    }, Deno.errors.PermissionDenied);
+    }, Deno.errors.NotCapable);
   },
 );
 
@@ -197,7 +197,7 @@ Deno.test(
   async function copyFilePerm1() {
     await assertRejects(async () => {
       await Deno.copyFile("/from.txt", "/to.txt");
-    }, Deno.errors.PermissionDenied);
+    }, Deno.errors.NotCapable);
   },
 );
 
@@ -206,7 +206,7 @@ Deno.test(
   async function copyFilePerm2() {
     await assertRejects(async () => {
       await Deno.copyFile("/from.txt", "/to.txt");
-    }, Deno.errors.PermissionDenied);
+    }, Deno.errors.NotCapable);
   },
 );
 
diff --git a/tests/unit/dir_test.ts b/tests/unit/dir_test.ts
index 4aaadfb12..1e702f549 100644
--- a/tests/unit/dir_test.ts
+++ b/tests/unit/dir_test.ts
@@ -43,7 +43,7 @@ Deno.test({ permissions: { read: false } }, function dirCwdPermError() {
     () => {
       Deno.cwd();
     },
-    Deno.errors.PermissionDenied,
+    Deno.errors.NotCapable,
     "Requires read access to <CWD>, run again with the --allow-read flag",
   );
 });
diff --git a/tests/unit/error_test.ts b/tests/unit/error_test.ts
index 9ba09ce0d..bf0ef5062 100644
--- a/tests/unit/error_test.ts
+++ b/tests/unit/error_test.ts
@@ -22,6 +22,7 @@ Deno.test("Errors work", () => {
   assert(new Deno.errors.Http("msg") instanceof Error);
   assert(new Deno.errors.Busy("msg") instanceof Error);
   assert(new Deno.errors.NotSupported("msg") instanceof Error);
+  assert(new Deno.errors.NotCapable("msg") instanceof Error);
 });
 
 Deno.test("Errors have some tamper resistance", () => {
diff --git a/tests/unit/fetch_test.ts b/tests/unit/fetch_test.ts
index 35d5e563f..35517911c 100644
--- a/tests/unit/fetch_test.ts
+++ b/tests/unit/fetch_test.ts
@@ -124,7 +124,7 @@ Deno.test({ permissions: { net: true } }, async function fetchJsonSuccess() {
 Deno.test({ permissions: { net: false } }, async function fetchPerm() {
   await assertRejects(async () => {
     await fetch("http://localhost:4545/assets/fixture.json");
-  }, Deno.errors.PermissionDenied);
+  }, Deno.errors.NotCapable);
 });
 
 Deno.test({ permissions: { net: true } }, async function fetchUrl() {
@@ -1637,7 +1637,7 @@ Deno.test(
 Deno.test({ permissions: { read: false } }, async function fetchFilePerm() {
   await assertRejects(async () => {
     await fetch(import.meta.resolve("../testdata/subdir/json_1.json"));
-  }, Deno.errors.PermissionDenied);
+  }, Deno.errors.NotCapable);
 });
 
 Deno.test(
@@ -1645,7 +1645,7 @@ Deno.test(
   async function fetchFilePermDoesNotExist() {
     await assertRejects(async () => {
       await fetch(import.meta.resolve("./bad.json"));
-    }, Deno.errors.PermissionDenied);
+    }, Deno.errors.NotCapable);
   },
 );
 
diff --git a/tests/unit/ffi_test.ts b/tests/unit/ffi_test.ts
index 70a914c0a..98338b15e 100644
--- a/tests/unit/ffi_test.ts
+++ b/tests/unit/ffi_test.ts
@@ -24,10 +24,10 @@ Deno.test({ permissions: { ffi: true } }, function dlopenInvalidArguments() {
   }, TypeError);
 });
 
-Deno.test({ permissions: { ffi: false } }, function ffiPermissionDenied() {
+Deno.test({ permissions: { ffi: false } }, function ffiNotCapable() {
   assertThrows(() => {
     Deno.dlopen("/usr/lib/libc.so.6", {});
-  }, Deno.errors.PermissionDenied);
+  }, Deno.errors.NotCapable);
   const fnptr = new Deno.UnsafeFnPointer(
     // @ts-expect-error: Not NonNullable but null check is after permissions check.
     null,
@@ -38,44 +38,44 @@ Deno.test({ permissions: { ffi: false } }, function ffiPermissionDenied() {
   );
   assertThrows(() => {
     fnptr.call(123, null);
-  }, Deno.errors.PermissionDenied);
+  }, Deno.errors.NotCapable);
   assertThrows(() => {
     Deno.UnsafePointer.of(new Uint8Array(0));
-  }, Deno.errors.PermissionDenied);
+  }, Deno.errors.NotCapable);
   const ptrView = new Deno.UnsafePointerView(
     // @ts-expect-error: Not NonNullable but null check is after permissions check.
     null,
   );
   assertThrows(() => {
     ptrView.copyInto(new Uint8Array(0));
-  }, Deno.errors.PermissionDenied);
+  }, Deno.errors.NotCapable);
   assertThrows(() => {
     ptrView.getCString();
-  }, Deno.errors.PermissionDenied);
+  }, Deno.errors.NotCapable);
   assertThrows(() => {
     ptrView.getUint8();
-  }, Deno.errors.PermissionDenied);
+  }, Deno.errors.NotCapable);
   assertThrows(() => {
     ptrView.getInt8();
-  }, Deno.errors.PermissionDenied);
+  }, Deno.errors.NotCapable);
   assertThrows(() => {
     ptrView.getUint16();
-  }, Deno.errors.PermissionDenied);
+  }, Deno.errors.NotCapable);
   assertThrows(() => {
     ptrView.getInt16();
-  }, Deno.errors.PermissionDenied);
+  }, Deno.errors.NotCapable);
   assertThrows(() => {
     ptrView.getUint32();
-  }, Deno.errors.PermissionDenied);
+  }, Deno.errors.NotCapable);
   assertThrows(() => {
     ptrView.getInt32();
-  }, Deno.errors.PermissionDenied);
+  }, Deno.errors.NotCapable);
   assertThrows(() => {
     ptrView.getFloat32();
-  }, Deno.errors.PermissionDenied);
+  }, Deno.errors.NotCapable);
   assertThrows(() => {
     ptrView.getFloat64();
-  }, Deno.errors.PermissionDenied);
+  }, Deno.errors.NotCapable);
 });
 
 Deno.test({ permissions: { ffi: true } }, function pointerOf() {
diff --git a/tests/unit/files_test.ts b/tests/unit/files_test.ts
index c79397109..6692415d4 100644
--- a/tests/unit/files_test.ts
+++ b/tests/unit/files_test.ts
@@ -127,7 +127,7 @@ Deno.test(
     for (const options of openOptions) {
       await assertRejects(async () => {
         await Deno.open(filename, options);
-      }, Deno.errors.PermissionDenied);
+      }, Deno.errors.NotCapable);
     }
   },
 );
@@ -170,7 +170,7 @@ Deno.test(async function openOptions() {
 Deno.test({ permissions: { read: false } }, async function readPermFailure() {
   await assertRejects(async () => {
     await Deno.open("package.json", { read: true });
-  }, Deno.errors.PermissionDenied);
+  }, Deno.errors.NotCapable);
 });
 
 Deno.test(
@@ -229,7 +229,7 @@ Deno.test(
     const filename = "tests/hello.txt";
     await assertRejects(async () => {
       await Deno.open(filename, { read: true });
-    }, Deno.errors.PermissionDenied);
+    }, Deno.errors.NotCapable);
   },
 );
 
diff --git a/tests/unit/fs_events_test.ts b/tests/unit/fs_events_test.ts
index 3a867f07e..148688215 100644
--- a/tests/unit/fs_events_test.ts
+++ b/tests/unit/fs_events_test.ts
@@ -7,7 +7,7 @@ import { assert, assertEquals, assertThrows, delay } from "./test_util.ts";
 Deno.test({ permissions: { read: false } }, function watchFsPermissions() {
   assertThrows(() => {
     Deno.watchFs(".");
-  }, Deno.errors.PermissionDenied);
+  }, Deno.errors.NotCapable);
 });
 
 Deno.test({ permissions: { read: true } }, function watchFsInvalidPath() {
diff --git a/tests/unit/link_test.ts b/tests/unit/link_test.ts
index 6048b8add..dfa72479c 100644
--- a/tests/unit/link_test.ts
+++ b/tests/unit/link_test.ts
@@ -87,7 +87,7 @@ Deno.test(
   function linkSyncReadPerm() {
     assertThrows(() => {
       Deno.linkSync("oldbaddir", "newbaddir");
-    }, Deno.errors.PermissionDenied);
+    }, Deno.errors.NotCapable);
   },
 );
 
@@ -96,7 +96,7 @@ Deno.test(
   function linkSyncWritePerm() {
     assertThrows(() => {
       Deno.linkSync("oldbaddir", "newbaddir");
-    }, Deno.errors.PermissionDenied);
+    }, Deno.errors.NotCapable);
   },
 );
 
@@ -181,7 +181,7 @@ Deno.test(
   async function linkReadPerm() {
     await assertRejects(async () => {
       await Deno.link("oldbaddir", "newbaddir");
-    }, Deno.errors.PermissionDenied);
+    }, Deno.errors.NotCapable);
   },
 );
 
@@ -190,6 +190,6 @@ Deno.test(
   async function linkWritePerm() {
     await assertRejects(async () => {
       await Deno.link("oldbaddir", "newbaddir");
-    }, Deno.errors.PermissionDenied);
+    }, Deno.errors.NotCapable);
   },
 );
diff --git a/tests/unit/make_temp_test.ts b/tests/unit/make_temp_test.ts
index 2c771177b..32383387b 100644
--- a/tests/unit/make_temp_test.ts
+++ b/tests/unit/make_temp_test.ts
@@ -42,7 +42,7 @@ Deno.test({ permissions: { write: false } }, function makeTempDirSyncPerm() {
   // makeTempDirSync should require write permissions (for now).
   assertThrows(() => {
     Deno.makeTempDirSync({ dir: "/baddir" });
-  }, Deno.errors.PermissionDenied);
+  }, Deno.errors.NotCapable);
 });
 
 Deno.test(
@@ -117,7 +117,7 @@ Deno.test({ permissions: { write: false } }, function makeTempFileSyncPerm() {
   // makeTempFileSync should require write permissions (for now).
   assertThrows(() => {
     Deno.makeTempFileSync({ dir: "/baddir" });
-  }, Deno.errors.PermissionDenied);
+  }, Deno.errors.NotCapable);
 });
 
 Deno.test(
diff --git a/tests/unit/mkdir_test.ts b/tests/unit/mkdir_test.ts
index 0948a1a84..def77cd3e 100644
--- a/tests/unit/mkdir_test.ts
+++ b/tests/unit/mkdir_test.ts
@@ -36,7 +36,7 @@ Deno.test(
 Deno.test({ permissions: { write: false } }, function mkdirSyncPerm() {
   assertThrows(() => {
     Deno.mkdirSync("/baddir");
-  }, Deno.errors.PermissionDenied);
+  }, Deno.errors.NotCapable);
 });
 
 Deno.test(
diff --git a/tests/unit/net_test.ts b/tests/unit/net_test.ts
index 6265579a2..b7230da25 100644
--- a/tests/unit/net_test.ts
+++ b/tests/unit/net_test.ts
@@ -100,7 +100,7 @@ Deno.test(
       assert(socket.addr.transport === "unix");
       assertEquals(socket.addr.path, filePath);
       socket.close();
-    }, Deno.errors.PermissionDenied);
+    }, Deno.errors.NotCapable);
   },
 );
 
@@ -119,7 +119,7 @@ Deno.test(
       assert(socket.addr.transport === "unixpacket");
       assertEquals(socket.addr.path, filePath);
       socket.close();
-    }, Deno.errors.PermissionDenied);
+    }, Deno.errors.NotCapable);
   },
 );
 
diff --git a/tests/unit/os_test.ts b/tests/unit/os_test.ts
index 52aa2ce77..4f760ecf8 100644
--- a/tests/unit/os_test.ts
+++ b/tests/unit/os_test.ts
@@ -48,16 +48,16 @@ Deno.test({ permissions: { env: true } }, function avoidEmptyNamedEnv() {
   assertThrows(() => Deno.env.delete("a\0a"), TypeError);
 });
 
-Deno.test({ permissions: { env: false } }, function envPermissionDenied1() {
+Deno.test({ permissions: { env: false } }, function envPerm1() {
   assertThrows(() => {
     Deno.env.toObject();
-  }, Deno.errors.PermissionDenied);
+  }, Deno.errors.NotCapable);
 });
 
-Deno.test({ permissions: { env: false } }, function envPermissionDenied2() {
+Deno.test({ permissions: { env: false } }, function envPerm2() {
   assertThrows(() => {
     Deno.env.get("PATH");
-  }, Deno.errors.PermissionDenied);
+  }, Deno.errors.NotCapable);
 });
 
 // This test verifies that on Windows, environment variables are
@@ -191,7 +191,7 @@ Deno.test({ permissions: { read: false } }, function execPathPerm() {
     () => {
       Deno.execPath();
     },
-    Deno.errors.PermissionDenied,
+    Deno.errors.NotCapable,
     "Requires read access to <exec_path>, run again with the --allow-read flag",
   );
 });
@@ -206,7 +206,7 @@ Deno.test(
       () => {
         Deno.readTextFileSync("/proc/net/dev");
       },
-      Deno.errors.PermissionDenied,
+      Deno.errors.NotCapable,
       `Requires all access to "/proc/net/dev", run again with the --allow-all flag`,
     );
   },
@@ -223,7 +223,7 @@ Deno.test(
 Deno.test({ permissions: { sys: false } }, function loadavgPerm() {
   assertThrows(() => {
     Deno.loadavg();
-  }, Deno.errors.PermissionDenied);
+  }, Deno.errors.NotCapable);
 });
 
 Deno.test(
@@ -253,7 +253,7 @@ Deno.test(
 Deno.test({ permissions: { sys: false } }, function hostnamePerm() {
   assertThrows(() => {
     Deno.hostname();
-  }, Deno.errors.PermissionDenied);
+  }, Deno.errors.NotCapable);
 });
 
 Deno.test(
@@ -266,7 +266,7 @@ Deno.test(
 Deno.test({ permissions: { sys: false } }, function releasePerm() {
   assertThrows(() => {
     Deno.osRelease();
-  }, Deno.errors.PermissionDenied);
+  }, Deno.errors.NotCapable);
 });
 
 Deno.test({ permissions: { sys: ["osUptime"] } }, function osUptime() {
@@ -278,7 +278,7 @@ Deno.test({ permissions: { sys: ["osUptime"] } }, function osUptime() {
 Deno.test({ permissions: { sys: false } }, function osUptimePerm() {
   assertThrows(() => {
     Deno.osUptime();
-  }, Deno.errors.PermissionDenied);
+  }, Deno.errors.NotCapable);
 });
 
 Deno.test(
diff --git a/tests/unit/process_test.ts b/tests/unit/process_test.ts
index 0d14c9ce7..93736e9ba 100644
--- a/tests/unit/process_test.ts
+++ b/tests/unit/process_test.ts
@@ -17,7 +17,7 @@ Deno.test(
       Deno.run({
         cmd: [Deno.execPath(), "eval", "console.log('hello world')"],
       });
-    }, Deno.errors.PermissionDenied);
+    }, Deno.errors.NotCapable);
   },
 );
 
@@ -517,7 +517,7 @@ Deno.test({ permissions: { run: false } }, function killPermissions() {
     // process - assuming that Deno does not have a special handler set for it
     // and will just continue even if a signal is erroneously sent.
     Deno.kill(Deno.pid, "SIGCONT");
-  }, Deno.errors.PermissionDenied);
+  }, Deno.errors.NotCapable);
 });
 
 Deno.test(
diff --git a/tests/unit/read_dir_test.ts b/tests/unit/read_dir_test.ts
index cba9647e5..b00495eb4 100644
--- a/tests/unit/read_dir_test.ts
+++ b/tests/unit/read_dir_test.ts
@@ -35,7 +35,7 @@ Deno.test({ permissions: { read: true } }, function readDirSyncWithUrl() {
 Deno.test({ permissions: { read: false } }, function readDirSyncPerm() {
   assertThrows(() => {
     Deno.readDirSync("tests/");
-  }, Deno.errors.PermissionDenied);
+  }, Deno.errors.NotCapable);
 });
 
 Deno.test({ permissions: { read: true } }, function readDirSyncNotDir() {
@@ -79,7 +79,7 @@ Deno.test({ permissions: { read: true } }, async function readDirWithUrl() {
 Deno.test({ permissions: { read: false } }, async function readDirPerm() {
   await assertRejects(async () => {
     await Deno.readDir("tests/")[Symbol.asyncIterator]().next();
-  }, Deno.errors.PermissionDenied);
+  }, Deno.errors.NotCapable);
 });
 
 Deno.test(
diff --git a/tests/unit/read_file_test.ts b/tests/unit/read_file_test.ts
index 6aea6f7af..7123833e9 100644
--- a/tests/unit/read_file_test.ts
+++ b/tests/unit/read_file_test.ts
@@ -31,7 +31,7 @@ Deno.test({ permissions: { read: true } }, function readFileSyncUrl() {
 Deno.test({ permissions: { read: false } }, function readFileSyncPerm() {
   assertThrows(() => {
     Deno.readFileSync("tests/testdata/assets/fixture.json");
-  }, Deno.errors.PermissionDenied);
+  }, Deno.errors.NotCapable);
 });
 
 Deno.test({ permissions: { read: true } }, function readFileSyncNotFound() {
@@ -63,7 +63,7 @@ Deno.test({ permissions: { read: true } }, async function readFileSuccess() {
 Deno.test({ permissions: { read: false } }, async function readFilePerm() {
   await assertRejects(async () => {
     await Deno.readFile("tests/testdata/assets/fixture.json");
-  }, Deno.errors.PermissionDenied);
+  }, Deno.errors.NotCapable);
 });
 
 Deno.test({ permissions: { read: true } }, function readFileSyncLoop() {
diff --git a/tests/unit/read_link_test.ts b/tests/unit/read_link_test.ts
index 3ed1817bb..c89ffe492 100644
--- a/tests/unit/read_link_test.ts
+++ b/tests/unit/read_link_test.ts
@@ -39,7 +39,7 @@ Deno.test(
 Deno.test({ permissions: { read: false } }, function readLinkSyncPerm() {
   assertThrows(() => {
     Deno.readLinkSync("/symlink");
-  }, Deno.errors.PermissionDenied);
+  }, Deno.errors.NotCapable);
 });
 
 Deno.test({ permissions: { read: true } }, function readLinkSyncNotFound() {
@@ -85,7 +85,7 @@ Deno.test(
 Deno.test({ permissions: { read: false } }, async function readLinkPerm() {
   await assertRejects(async () => {
     await Deno.readLink("/symlink");
-  }, Deno.errors.PermissionDenied);
+  }, Deno.errors.NotCapable);
 });
 
 Deno.test({ permissions: { read: true } }, async function readLinkNotFound() {
diff --git a/tests/unit/read_text_file_test.ts b/tests/unit/read_text_file_test.ts
index cab75fd47..1ec57bde3 100644
--- a/tests/unit/read_text_file_test.ts
+++ b/tests/unit/read_text_file_test.ts
@@ -28,7 +28,7 @@ Deno.test({ permissions: { read: true } }, function readTextFileSyncByUrl() {
 Deno.test({ permissions: { read: false } }, function readTextFileSyncPerm() {
   assertThrows(() => {
     Deno.readTextFileSync("tests/testdata/assets/fixture.json");
-  }, Deno.errors.PermissionDenied);
+  }, Deno.errors.NotCapable);
 });
 
 Deno.test({ permissions: { read: true } }, function readTextFileSyncNotFound() {
@@ -61,7 +61,7 @@ Deno.test({ permissions: { read: true } }, async function readTextFileByUrl() {
 Deno.test({ permissions: { read: false } }, async function readTextFilePerm() {
   await assertRejects(async () => {
     await Deno.readTextFile("tests/testdata/assets/fixture.json");
-  }, Deno.errors.PermissionDenied);
+  }, Deno.errors.NotCapable);
 });
 
 Deno.test({ permissions: { read: true } }, function readTextFileSyncLoop() {
diff --git a/tests/unit/real_path_test.ts b/tests/unit/real_path_test.ts
index b3656a927..783284630 100644
--- a/tests/unit/real_path_test.ts
+++ b/tests/unit/real_path_test.ts
@@ -50,7 +50,7 @@ Deno.test(
 Deno.test({ permissions: { read: false } }, function realPathSyncPerm() {
   assertThrows(() => {
     Deno.realPathSync("some_file");
-  }, Deno.errors.PermissionDenied);
+  }, Deno.errors.NotCapable);
 });
 
 Deno.test({ permissions: { read: true } }, function realPathSyncNotFound() {
@@ -104,7 +104,7 @@ Deno.test(
 Deno.test({ permissions: { read: false } }, async function realPathPerm() {
   await assertRejects(async () => {
     await Deno.realPath("some_file");
-  }, Deno.errors.PermissionDenied);
+  }, Deno.errors.NotCapable);
 });
 
 Deno.test({ permissions: { read: true } }, async function realPathNotFound() {
diff --git a/tests/unit/remove_test.ts b/tests/unit/remove_test.ts
index f4e54dc52..261ff6bd0 100644
--- a/tests/unit/remove_test.ts
+++ b/tests/unit/remove_test.ts
@@ -153,7 +153,7 @@ Deno.test({ permissions: { write: false } }, async function removePerm() {
   for (const method of REMOVE_METHODS) {
     await assertRejects(async () => {
       await Deno[method]("/baddir");
-    }, Deno.errors.PermissionDenied);
+    }, Deno.errors.NotCapable);
   }
 });
 
@@ -233,7 +233,7 @@ Deno.test({ permissions: { write: false } }, async function removeAllPerm() {
   for (const method of REMOVE_METHODS) {
     await assertRejects(async () => {
       await Deno[method]("/baddir", { recursive: true });
-    }, Deno.errors.PermissionDenied);
+    }, Deno.errors.NotCapable);
   }
 });
 
diff --git a/tests/unit/rename_test.ts b/tests/unit/rename_test.ts
index 4f6bb09cf..3162c699c 100644
--- a/tests/unit/rename_test.ts
+++ b/tests/unit/rename_test.ts
@@ -70,7 +70,7 @@ Deno.test(
       const oldpath = "/oldbaddir";
       const newpath = "/newbaddir";
       Deno.renameSync(oldpath, newpath);
-    }, Deno.errors.PermissionDenied);
+    }, Deno.errors.NotCapable);
   },
 );
 
@@ -81,7 +81,7 @@ Deno.test(
       const oldpath = "/oldbaddir";
       const newpath = "/newbaddir";
       Deno.renameSync(oldpath, newpath);
-    }, Deno.errors.PermissionDenied);
+    }, Deno.errors.NotCapable);
   },
 );
 
diff --git a/tests/unit/stat_test.ts b/tests/unit/stat_test.ts
index 950ffa81b..59831a069 100644
--- a/tests/unit/stat_test.ts
+++ b/tests/unit/stat_test.ts
@@ -74,7 +74,7 @@ Deno.test(
 Deno.test({ permissions: { read: false } }, function statSyncPerm() {
   assertThrows(() => {
     Deno.statSync("README.md");
-  }, Deno.errors.PermissionDenied);
+  }, Deno.errors.NotCapable);
 });
 
 Deno.test({ permissions: { read: true } }, function statSyncNotFound() {
@@ -118,7 +118,7 @@ Deno.test({ permissions: { read: true } }, function lstatSyncSuccess() {
 Deno.test({ permissions: { read: false } }, function lstatSyncPerm() {
   assertThrows(() => {
     Deno.lstatSync("assets/hello.txt");
-  }, Deno.errors.PermissionDenied);
+  }, Deno.errors.NotCapable);
 });
 
 Deno.test({ permissions: { read: true } }, function lstatSyncNotFound() {
@@ -200,7 +200,7 @@ Deno.test(
 Deno.test({ permissions: { read: false } }, async function statPerm() {
   await assertRejects(async () => {
     await Deno.stat("README.md");
-  }, Deno.errors.PermissionDenied);
+  }, Deno.errors.NotCapable);
 });
 
 Deno.test({ permissions: { read: true } }, async function statNotFound() {
@@ -244,7 +244,7 @@ Deno.test({ permissions: { read: true } }, async function lstatSuccess() {
 Deno.test({ permissions: { read: false } }, async function lstatPerm() {
   await assertRejects(async () => {
     await Deno.lstat("README.md");
-  }, Deno.errors.PermissionDenied);
+  }, Deno.errors.NotCapable);
 });
 
 Deno.test({ permissions: { read: true } }, async function lstatNotFound() {
diff --git a/tests/unit/symlink_test.ts b/tests/unit/symlink_test.ts
index 0ee4a36fd..47a685ec6 100644
--- a/tests/unit/symlink_test.ts
+++ b/tests/unit/symlink_test.ts
@@ -62,7 +62,7 @@ Deno.test(
   function symlinkSyncPerm() {
     assertThrows(() => {
       Deno.symlinkSync("oldbaddir", "newbaddir");
-    }, Deno.errors.PermissionDenied);
+    }, Deno.errors.NotCapable);
   },
 );
 
@@ -152,11 +152,11 @@ Deno.test(
   async function symlinkNoFullWritePermissions() {
     await assertRejects(
       () => Deno.symlink("old", "new"),
-      Deno.errors.PermissionDenied,
+      Deno.errors.NotCapable,
     );
     assertThrows(
       () => Deno.symlinkSync("old", "new"),
-      Deno.errors.PermissionDenied,
+      Deno.errors.NotCapable,
     );
   },
 );
@@ -166,11 +166,11 @@ Deno.test(
   async function symlinkNoFullReadPermissions() {
     await assertRejects(
       () => Deno.symlink("old", "new"),
-      Deno.errors.PermissionDenied,
+      Deno.errors.NotCapable,
     );
     assertThrows(
       () => Deno.symlinkSync("old", "new"),
-      Deno.errors.PermissionDenied,
+      Deno.errors.NotCapable,
     );
   },
 );
diff --git a/tests/unit/tls_test.ts b/tests/unit/tls_test.ts
index 7dcc9abaf..6e80c984a 100644
--- a/tests/unit/tls_test.ts
+++ b/tests/unit/tls_test.ts
@@ -55,7 +55,7 @@ function unreachable(): never {
 Deno.test({ permissions: { net: false } }, async function connectTLSNoPerm() {
   await assertRejects(async () => {
     await Deno.connectTls({ hostname: "deno.land", port: 443 });
-  }, Deno.errors.PermissionDenied);
+  }, Deno.errors.NotCapable);
 });
 
 Deno.test(
@@ -76,7 +76,7 @@ Deno.test(
         port: 443,
         certFile: "tests/testdata/tls/RootCA.crt",
       });
-    }, Deno.errors.PermissionDenied);
+    }, Deno.errors.NotCapable);
   },
 );
 
@@ -116,7 +116,7 @@ Deno.test(
         certFile: "tests/testdata/tls/localhost.crt",
         keyFile: "tests/testdata/tls/localhost.key",
       });
-    }, Deno.errors.PermissionDenied);
+    }, Deno.errors.NotCapable);
   },
 );
 
diff --git a/tests/unit/truncate_test.ts b/tests/unit/truncate_test.ts
index 95b76052d..cebd6e8ee 100644
--- a/tests/unit/truncate_test.ts
+++ b/tests/unit/truncate_test.ts
@@ -76,13 +76,13 @@ Deno.test(
 Deno.test({ permissions: { write: false } }, function truncateSyncPerm() {
   assertThrows(() => {
     Deno.truncateSync("/test_truncateSyncPermission.txt");
-  }, Deno.errors.PermissionDenied);
+  }, Deno.errors.NotCapable);
 });
 
 Deno.test({ permissions: { write: false } }, async function truncatePerm() {
   await assertRejects(async () => {
     await Deno.truncate("/test_truncatePermission.txt");
-  }, Deno.errors.PermissionDenied);
+  }, Deno.errors.NotCapable);
 });
 
 Deno.test(
diff --git a/tests/unit/utime_test.ts b/tests/unit/utime_test.ts
index 5bbb378cc..7a1fee74e 100644
--- a/tests/unit/utime_test.ts
+++ b/tests/unit/utime_test.ts
@@ -176,7 +176,7 @@ Deno.test(
 
     assertThrows(() => {
       Deno.utimeSync("/some_dir", atime, mtime);
-    }, Deno.errors.PermissionDenied);
+    }, Deno.errors.NotCapable);
   },
 );
 
@@ -291,6 +291,6 @@ Deno.test(
 
     await assertRejects(async () => {
       await Deno.utime("/some_dir", atime, mtime);
-    }, Deno.errors.PermissionDenied);
+    }, Deno.errors.NotCapable);
   },
 );
diff --git a/tests/unit/websocket_test.ts b/tests/unit/websocket_test.ts
index 362957b2d..7db876b17 100644
--- a/tests/unit/websocket_test.ts
+++ b/tests/unit/websocket_test.ts
@@ -7,7 +7,7 @@ const serveUrl = `ws://localhost:${servePort}/`;
 Deno.test({ permissions: "none" }, function websocketPermissionless() {
   assertThrows(
     () => new WebSocket("ws://localhost"),
-    Deno.errors.PermissionDenied,
+    Deno.errors.NotCapable,
   );
 });
 
diff --git a/tests/unit/worker_test.ts b/tests/unit/worker_test.ts
index 700f57b6b..88c6ca4c6 100644
--- a/tests/unit/worker_test.ts
+++ b/tests/unit/worker_test.ts
@@ -546,7 +546,7 @@ Deno.test({
         );
         worker.terminate();
       },
-      Deno.errors.PermissionDenied,
+      Deno.errors.NotCapable,
       "Can't escalate parent thread permissions",
     );
   },
diff --git a/tests/unit/write_file_test.ts b/tests/unit/write_file_test.ts
index 29780446c..15e462cca 100644
--- a/tests/unit/write_file_test.ts
+++ b/tests/unit/write_file_test.ts
@@ -57,7 +57,7 @@ Deno.test({ permissions: { write: false } }, function writeFileSyncPerm() {
   // The following should fail due to no write permission
   assertThrows(() => {
     Deno.writeFileSync(filename, data);
-  }, Deno.errors.PermissionDenied);
+  }, Deno.errors.NotCapable);
 });
 
 Deno.test(
@@ -190,7 +190,7 @@ Deno.test(
     // The following should fail due to no write permission
     await assertRejects(async () => {
       await Deno.writeFile(filename, data);
-    }, Deno.errors.PermissionDenied);
+    }, Deno.errors.NotCapable);
   },
 );
 
diff --git a/tests/unit/write_text_file_test.ts b/tests/unit/write_text_file_test.ts
index a58d91997..9e1b75326 100644
--- a/tests/unit/write_text_file_test.ts
+++ b/tests/unit/write_text_file_test.ts
@@ -45,7 +45,7 @@ Deno.test({ permissions: { write: false } }, function writeTextFileSyncPerm() {
   // The following should fail due to no write permission
   assertThrows(() => {
     Deno.writeTextFileSync(filename, "Hello");
-  }, Deno.errors.PermissionDenied);
+  }, Deno.errors.NotCapable);
 });
 
 Deno.test(
@@ -144,7 +144,7 @@ Deno.test(
     // The following should fail due to no write permission
     await assertRejects(async () => {
       await Deno.writeTextFile(filename, "Hello");
-    }, Deno.errors.PermissionDenied);
+    }, Deno.errors.NotCapable);
   },
 );
 
diff --git a/tests/unit_node/fs_test.ts b/tests/unit_node/fs_test.ts
index c94a2447e..b1f7c53e8 100644
--- a/tests/unit_node/fs_test.ts
+++ b/tests/unit_node/fs_test.ts
@@ -88,7 +88,7 @@ Deno.test(
   () => {
     assertThrows(() => {
       existsSync("tests/testdata/assets/fixture.json");
-    }, Deno.errors.PermissionDenied);
+    }, Deno.errors.NotCapable);
   },
 );
 
diff --git a/tests/unit_node/net_test.ts b/tests/unit_node/net_test.ts
index 8196874f3..83d751866 100644
--- a/tests/unit_node/net_test.ts
+++ b/tests/unit_node/net_test.ts
@@ -113,7 +113,7 @@ Deno.test({
       const s = new net.Server();
       s.listen(3000);
     } catch (e) {
-      assert(e instanceof Deno.errors.PermissionDenied);
+      assert(e instanceof Deno.errors.NotCapable);
     }
   },
 });
diff --git a/tests/unit_node/os_test.ts b/tests/unit_node/os_test.ts
index a75b66807..78636e755 100644
--- a/tests/unit_node/os_test.ts
+++ b/tests/unit_node/os_test.ts
@@ -8,6 +8,7 @@ import {
   assertNotEquals,
   assertThrows,
 } from "@std/assert";
+import console from "node:console";
 
 Deno.test({
   name: "build architecture is a string",
@@ -298,7 +299,14 @@ Deno.test({
       args: ["eval", "while (true) { console.log('foo') }"],
     }).spawn();
     assertThrows(
-      () => os.setPriority(child.pid, os.constants.priority.PRIORITY_HIGH),
+      () => {
+        try {
+          os.setPriority(child.pid, os.constants.priority.PRIORITY_HIGH);
+        } catch (err) {
+          console.error(err);
+          throw err;
+        }
+      },
       Deno.errors.PermissionDenied,
     );
     os.getPriority(child.pid);
diff --git a/tests/util/server/src/lib.rs b/tests/util/server/src/lib.rs
index f09e7c224..88e8287e0 100644
--- a/tests/util/server/src/lib.rs
+++ b/tests/util/server/src/lib.rs
@@ -48,7 +48,7 @@ pub use fs::TempDir;
 
 pub const PERMISSION_VARIANTS: [&str; 5] =
   ["read", "write", "env", "net", "run"];
-pub const PERMISSION_DENIED_PATTERN: &str = "PermissionDenied";
+pub const PERMISSION_DENIED_PATTERN: &str = "NotCapable";
 
 static GUARD: Lazy<Mutex<HttpServerCount>> = Lazy::new(Default::default);