Module process/index

Create a new Command invoking program. The program name is also used as argv[0] unless a different first arg is pushed manually before invocation.

Append a single argument to the argv list.

Append multiple arguments to the argv list.

Set an environment variable for the child (overrides an inherited one).

Run the child with dir as its working directory. POSIX uses posix_spawn_file_actions_addchdir_np (spawn reports ENOSYS on a libc without it — macOS 10.15+/glibc 2.29+/musl 1.2.5+ all have it); Windows passes lpCurrentDirectory.

Stop the child inheriting this process's environment, so it starts from an EMPTY one plus whatever env() supplied — Rust's Command::env_clear.

It does not clear the env() entries already recorded, and Rust's does. This sets a flag that is consulted at spawn time and only suppresses the walk over environ; the overrides are collected separately and always survive. So cmd.env(A, 1).env_clear() runs the child with A=1 here, and with nothing at all in Rust — call order makes no difference in either direction.

With neither this nor any env() call, no envp is constructed at all and the child inherits by the platform's own mechanism.

Configure the child's stdin.

Configure the child's stdout.

Configure the child's stderr.

Spawn the child with stdio inherited from the parent, wait for it to exit, and return its ExitStatus.

Spawn the child with stdout and stderr captured through pipes. Waits for the child to exit and returns the exit status plus the captured bytes.

Spawn the child WITHOUT waiting. Streams configured Stdio.Piped get pipes whose parent ends live on the returned Child; Inherit shares the parent's stream; Null redirects to /dev/null. Call wait() to reap.

The process exit code (0..255 on Unix), or .None when the process was TERMINATED BY A SIGNAL — a signal death is not an exit code of 0 (plans/archive/STD_API_AUDIT.md §4 process row).

Returns the signal number that terminated the process, or 0 if the process exited normally.

Returns true if the child exited with status code 0.

The child's process id.

Take the parent's write end of the child's stdin pipe as a Writer. .None if stdin was not Stdio.Piped, or if it has already been taken or closed.

Taking MOVES the fd out of the Child: wait() no longer closes it, the returned handle owns it, and write_stdin/close_stdin on this Child throw BadFileDescriptor from then on. Dropping the handle closes the pipe, which is the EOF the child is usually waiting for.

Take the parent's read end of the child's stdout pipe as a Reader, so read_to_string, read_exact and BufReader apply. .None if stdout was not Stdio.Piped, or if it has already been taken.

Taking MOVES the fd out of the Child, exactly as take_stdin does.

Take the parent's read end of the child's stderr pipe as a Reader. .None if stderr was not Stdio.Piped, or if it has already been taken.

Write bytes into the child's piped stdin. Requires stdin(Stdio.Piped). Throws BadFileDescriptor once take_stdin() has moved the fd out.

Close the child's stdin pipe — the EOF the child is usually waiting for.

Read the child's piped stdout to EOF. Requires stdout(Stdio.Piped).

Read the child's piped stderr to EOF. Requires stderr(Stdio.Piped).

Send a signal to the child (e.g. 15 = SIGTERM, 9 = SIGKILL). A failure — ESRCH once the child has been reaped, EPERM — is thrown as an IoError through exn, Rust's Child::kill -> io::Result<()>. Until 2026-09-06 this handed back the raw -errno as an i32 (issues/fixed/child-kill-returned-a-raw-errno.md).

Wait for the child to exit and return its status. Closes any pipe fds still open on this handle.

The underlying file descriptor.

Whether the handle has been closed.

Write up to size bytes. Returns the number written.

Close the read end. Safe to call multiple times. Sets the flag after the close, for the reason ChildStdin.close records.

Write up to size bytes. Returns the number written.

A no-op that always succeeds: a pipe write goes straight to the kernel, so there is nothing held here to push. Everything write reported as written is already visible to the child, and flushing is NOT what delivers EOF — close (or dropping the handle) is.

Write a String, in full. File.write_string spells the same convenience.

Release the resources self owns — a file descriptor, a socket, a lock, a buffer the allocator handed out. Called automatically when the last reference to the value goes away, so an implementor never calls it directly and must tolerate being the only one who ever does.

It must be safe to run exactly once: the runtime calls it at refcount zero, and a type that also exposes an explicit close/release is responsible for making the second call a no-op.

The underlying file descriptor.

Whether the handle has been closed.

Read up to size bytes. Returns the number read; 0 means EOF.

Close the read end. Safe to call multiple times. Sets the flag after the close, for the reason ChildStdin.close records.

Read up to size bytes. Returns the number read; 0 means EOF.

Release the resources self owns — a file descriptor, a socket, a lock, a buffer the allocator handed out. Called automatically when the last reference to the value goes away, so an implementor never calls it directly and must tolerate being the only one who ever does.

It must be safe to run exactly once: the runtime calls it at refcount zero, and a type that also exposes an explicit close/release is responsible for making the second call a no-op.

The underlying file descriptor.

Whether the handle has been closed.

Read up to size bytes. Returns the number read; 0 means EOF.

Close the read end. Safe to call multiple times. Sets the flag after the close, for the reason ChildStdin.close records.

Read up to size bytes. Returns the number read; 0 means EOF.

Release the resources self owns — a file descriptor, a socket, a lock, a buffer the allocator handed out. Called automatically when the last reference to the value goes away, so an implementor never calls it directly and must tolerate being the only one who ever does.

It must be safe to run exactly once: the runtime calls it at refcount zero, and a type that also exposes an explicit close/release is responsible for making the second call a no-op.