node-cmd 6.0.1

Node-only boundary and engineering evidence

• Declared the Node.js-only runtime boundary across package metadata, documentation, examples, and every site page. Browser entries, import maps, native Chrome execution, and browser dependency-conflict scenarios are not applicable because the API requires node:child_process and operating-system process access.
• Added a runtime-contract gate that preserves all 53 tests, checks runtime import specifiers, rejects accidental browser metadata, and keeps the no-runtime-dependency boundary explicit.
• Strengthened packed-consumer smoke testing to verify exact tarball contents, the Node engine, zero runtime dependencies, and bare-package execution through CommonJS and native Node.js ESM.
• Updated the JavaScript suite and native Node coverage from vanilla-test 2.0.0 to 2.1.0.
• Published normalized, ANSI-free test-results.json beside the engineer-readable HTML coverage report.
• Added five independently runnable Behavioral scenarios for shell composition, partial failure output, buffer limits, direct-process timeouts, and output observed before stream completion, bringing the suite to 53 cases.
• Added a dependency-free benchmark harness for all seven execution paths, including raw paired samples and separate JavaScript-dispatch measurements.
• Published the Node.js 22.12.0 benchmark charts, methodology, and raw results in the README and on a dedicated engineer-facing page. Runtime implementation files remain unchanged.

Command-line power for JavaScript

The sections below preserve the exact 6.0.0 release record, including the vanilla-test 2.0.0 toolchain and coverage figures measured for that release.

New execution capabilities

• Native Node.js CommonJS and ES module entry points through conditional package exports.
• Named ESM exports alongside the compatible default API object.
• Optional Node child_process options for asynchronous and synchronous command execution.
• runPromise() with runPromisified as an exact compatibility alias.
• Immediate ChildProcess access through .child on Promises returned by Promise APIs.
• runFile(), runFileSync(), and runFilePromise() for direct executable-and-argument execution without a shell by default.
• runFilePromisified as an exact alias of runFilePromise().
• runStream() as an unbuffered spawn() wrapper for long-running, high-output, and interactive programs.
• Forwarding for AbortSignal, timeout, cwd, environment, encoding, shell, maxBuffer, kill signal, window visibility, and other supported Node options.

Tests, coverage, packaging, and documentation

• A 17-case JavaScript API suite powered by the author’s vanilla-test 2.0.0 module.
• Native Node coverage gates: 100% statements, 95.23% branches, 100% functions, and 100% lines.
• CI across Node 22.12 and Node 24 on Linux, macOS, and Windows.
• A packed-package smoke test that installs the tarball into a clean consumer and verifies CommonJS, ESM, contents, and dependency isolation.
• A multi-page engineering site with API, testing, coverage, security, migration, and changelog references.
• Private vulnerability reporting and a documented command-execution trust boundary.

Modernized without discarding the classic API

• The minimum supported Node.js version moves from 6.4 to 22.12.
• Package metadata now exposes deliberate CommonJS, ESM, deep-path, and package-manifest entry points.
• run(command, options?, callback?) accepts either the original callback form or an options object followed by a callback.
• Direct-file callbacks use the familiar (error, data, stderr) shape.
• Synchronous defaults capture stderr and return string output unless a buffer encoding is explicitly requested.
• Promise rejection, output buffering, cancellation, process control, shell differences, and privilege inheritance are documented explicitly.

Preserved contracts

• require('node-cmd') still returns the familiar API object.
• run(command, callback) remains valid and returns the immediate ChildProcess.
• runSync(command) retains {err, data, stderr}.
• require('node-cmd/cmd') and require('node-cmd/cmd.js') remain exported.
• runPromisified() and runFilePromisified() remain exact aliases.

Explicit execution boundaries

• Direct executable APIs let callers keep variable data out of shell command strings.
• runStream() is direct and no-shell by default; opting into options.shell restores shell parsing and its risks.
• Security guidance now covers shell injection, executable resolution, environment inheritance, working directories, secrets, output capture, timeouts, cancellation, descendant processes, and privilege inheritance.

Legacy runtime support

Node.js releases older than 22.12 are no longer supported.