Append a single argument.

Override the child's `argv[0]` independently of `Program` (multicall binaries, login-shell conventions). Unix-only: a set value fails a Windows spawn with `ProcessError.Unsupported`, as does combining it with a `Uid`/`Gid`/`Groups`/`KillOnParentDeath` drop, `Pty`, or a cgroup-backend run — none of their re-`exec`ing helpers has a seam for a distinct `argv[0]`. See `Command.Arg0`.

Append several arguments, in order.

Tear a CANCELLED run down gracefully: soft signal, up to `grace` to leave, then the hard kill. Independent of `timeoutGrace`; the outcome stays `ProcessError.Cancelled` either way.

Also cancel the run when `cancellationToken` fires.

Choose the soft signal that opens a `cancelGrace` window (default `Signal.Term`). Inert without `cancelGrace`, and independent of `stopSignal`.

Shape each decoded line as it enters the capture backlog (redaction at capture); handlers, tees, the streaming verbs and raw byte captures still see the unshaped line. See `Command.CapturePolicy`.

Create a command for the given program.

Windows: run the child with `CREATE_NO_WINDOW` (no effect on Unix).

Set the working directory for the run.

Encode text stdin and decode both captured streams with `encoding`.

Set an environment variable for the child.

Start the child's environment empty instead of inheriting the parent's.

Remove an inherited environment variable from the child.

Add a POSIX full-duplex parent/child channel at child fd `targetFd` (3 or greater). Claim the parent stream once with `RunningProcess.TakeExtraFd(targetFd)` after starting the command.

Run the child under this Unix group id (`setgid`). Unix-only, same notes as `uid`. See `Command.Gid`.

Set the child's Unix supplementary groups, replacing the inherited set — the third leg of a privilege drop. Meaningful only alongside a `Uid`/`Gid` drop (else `ProcessError.Spawn`); Unix-only (a set value fails a Windows spawn with `ProcessError.Unsupported`). See `Command.Groups`.

Kill the run when it produces no output (stdout or stderr) for `duration` — reset by each chunk of output — independent of the total `Command.Timeout`.

Hand the child the parent process's own standard input directly (inherited, no pipe/feeder), for interactive/console programs. See `Command.InheritStdin`.

Set the child's **Linux I/O-scheduling** priority (`ioprio_set(2)`) — the block-device axis, not the CPU one `priority` sets. Build the value with `IoPriority.Idle`/`IoPriority.BestEffort`/ `IoPriority.RealTime`. In force from the child's first disk request and inherited by its descendants. Linux-only: a set value fails a Windows/macOS/BSD spawn — and a detached launch — with `ProcessError.Unsupported`. See `Command.IoPriority`.

Keep the child's stdin pipe open after the source is exhausted.

Opt in to reaping this child when the parent process dies suddenly (SIGKILL/crash/`TerminateProcess`). Windows reaps the whole Job tree with no extra action; Linux the direct child only via `PR_SET_PDEATHSIG` (`setpriv --pdeathsig`); macOS/BSD fail the spawn with `ProcessError.Unsupported`. Query the platform-fixed scope with `Command.KillOnParentDeathScope`. See `Command.KillOnParentDeath`.

The platform-fixed scope of `KillOnParentDeath` cleanup — `WholeTree` (Windows), `DirectChildOnly` (Linux), or `Nothing` (macOS/BSD) — independent of whether the verb was set. See `Command.KillOnParentDeathScope`.

Frame both captured/streamed streams' lines with `terminator` (default `LineTerminator.Lf`).

Emit structured lifecycle events to `logger` (argv/env never logged).

Merge the child's stderr into its stdout at the OS level (like a shell `2>&1`); the two streams then interleave byte-for-byte on the single stdout stream, and there is no separate stderr stream. See `Command.MergeStderr`.

Replace the success exit-code set with these codes (default `{0}`; include `0` to keep it). An empty set is rejected at the builder boundary with `ArgumentException`. See `Command.OkCodes`.

Invoke `handler` for each captured stderr line.

Invoke `handler` for each captured stdout line.

Bound the in-memory backlog of captured lines.

Add `directory` to the prefer-local search list, consulted before `PATH` when resolving the command's bare-name program (searched in the order added; a match is launched by its resolved absolute path). See `Command.PreferLocal`.

Launch the child (and its spawned tree) at a lower/higher CPU-scheduling priority (Windows priority class / Unix nice). Supported on both platforms; the default leaves the OS default.

Run the child under a pseudo-terminal (PTY) with the default 80×24 geometry (echo on) — a single merged stdout+stderr terminal stream, for tools that demand a tty. Windows: ConPTY (Win10 1809+); POSIX: a real controlling pty via `openpty` + the `setsid --ctty` helper (util-linux); a host missing that ctty helper or the pty devfs (macOS/BSD) fails with `ProcessError.Unsupported`. See `Command.Pty`.

Run the child under a pseudo-terminal (PTY) with a full `PtyConfig` (geometry, echo). See `Command.Pty(PtyConfig)`.

Run the child under a pseudo-terminal (PTY) with the given initial geometry (echo on). See `Command.Pty(cols, rows)`.

Run the command up to `maxAttempts` times in total (initial run plus retries), waiting `delay` between attempts (`0`/`1` both mean a single run). A negative `maxAttempts` or `delay` is rejected with `ArgumentOutOfRangeException`; delays beyond the maximum armable timer interval are clamped when the retry runs. If the predicate throws, the consuming verb returns `ProcessError.RetryPredicate` with the original attempt error in `Original`, and no further attempt runs.

Run the command with exponential retry backoff: `baseDelay × factor^n`, capped at `maxDelay` before optional jitter. A negative `maxAttempts` is rejected with `ArgumentOutOfRangeException`; `0` and `1` both mean a single run. Retry timers use the command's `TimeProvider`. If the predicate throws, the consuming verb returns `ProcessError.RetryPredicate` with the original attempt error in `Original`, and no further attempt runs.

Explicitly disable retrying for this command, overriding any inherited `Retry` policy (e.g. from a `CliClient.WithDefaults` template). The command always runs exactly once.

Cap one Unix per-process resource for the child (`setrlimit(2)`): `soft` is the value in force, `hard` the ceiling the child may raise it back to, both in the resource's native unit (bytes, seconds, or a count). Different resources accumulate; the same one replaces in place. Unix-only: a set limit fails a Windows spawn with `ProcessError.Unsupported`, and a POSIX host without the util-linux `prlimit` helper fails with `ProcessError.ResourceLimit`. Combined with a whole-tree `ResourceLimits.CpuTimeMax`, the stricter CPU-time value wins. See `Command.Rlimit`.

Detach the child into a new session (`setsid()`). Unix-only: a set request fails a Windows spawn with `ProcessError.Unsupported`. Containment is preserved. See `Command.Setsid`.

Set how the child's standard error is connected.

Decode captured stderr with `encoding`.

Frame captured/streamed stderr lines with `terminator` (default `LineTerminator.Lf`).

Copy raw captured stderr bytes to `sink`.

Redirect the child's stderr straight to the file at `path` at the OS level — the stderr mirror of `stdoutToFile`. See `Command.StderrToFile`.

Feed the child's standard input from `source`. A one-shot source feeds at most one incarnation (see `Command.Stdin`).

Encode text sent to stdin with `encoding`.

Set how the child's standard output is connected.

Decode captured stdout with `encoding`.

Frame captured/streamed stdout lines with `terminator` (default `LineTerminator.Lf`).

Copy raw captured stdout bytes to `sink`.

Redirect the child's stdout straight to the file at `path` at the OS level (no parent pump — the file outlives the parent). `append` chooses create/truncate (`false`) or append (`true`). Leaves no parent-side stdout stream, so it is rejected with `StdoutTee`/`OnStdoutLine`/`MergeStderr`/`Pty`. See `Command.StdoutToFile`.

Choose the soft signal used by graceful stop paths before hard-kill escalation.

Opt in to a bounded/backpressure channel for the streaming verbs (default stays unbounded).

Use `timeProvider` for retry delays, readiness probes, `PtySession` pattern deadlines, and supervision.

Kill the run `duration` after it was spawned.

Terminate gracefully on timeout, force-killing only after `grace`.

Run the child under this Unix user id (`setuid`). Unix-only: a set uid fails a Windows spawn with `ProcessError.Unsupported`; dropping needs privilege (else `ProcessError.Spawn`). See `Command.Uid`.

Set the child's Unix file-mode creation mask (`umask(2)`). Unix-only: a set mask fails a Windows spawn with `ProcessError.Unsupported`. The default leaves the inherited umask untouched.

Inside a pipeline, allow this stage to exit non-zero without failing the pipeline.

Run the child under this Unix user and group id (the privilege-drop pair). See `Command.User`.

Windows: register a ConPTY child as the target for best-effort CTRL+BREAK through `ProcessGroup.Signal(Signal.Int/Term)`; ConPTY children already have process-group isolation. Regular children are put in a new process group. No effect on Unix. See `Command.WindowsCtrlSignals`.

Lower the child's Windows mandatory integrity level, denying it write access to anything labelled above that level. Windows-only: a set request fails a POSIX spawn with `ProcessError.Unsupported`. See `Command.WindowsIntegrityLevel`.

Append a trusted Windows command-line fragment verbatim after every ordinary argument. Never place untrusted input in `fragment`; a POSIX spawn and an automatically resolved batch wrapper return typed `Unsupported`.

Run the child with a restricted token (`CreateRestrictedToken` + `DISABLE_MAX_PRIVILEGE`), keeping the caller's identity but none of its privileges. Windows-only: a set request fails a POSIX spawn with `ProcessError.Unsupported`. See `Command.WindowsRestrictedToken`.