# Write nodes using modern tooling

**URL:** <https://discourse.nodered.org/t/write-nodes-using-modern-tooling/98739>\
**Category:** Developing Nodes\
**Created:** [19 August 2025 21:19 UTC](https://discourse.nodered.org/t/write-nodes-using-modern-tooling/98739 "2025-08-19T21:19:37Z")\
**Posts on this page:** 6\
**Page:** 2

<div class="post-metadata">

**Author:** ![AllanOricil](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/allanoricil/32/106911_2.png) [@AllanOricil](https://discourse.nodered.org/u/AllanOricil)\
**Post date:** [29 August 2025 14:13 UTC](https://discourse.nodered.org/t/write-nodes-using-modern-tooling/98739/21 "2025-08-29T14:13:37Z")

</div>

Good analogy. You made my mind reframe that thought. Thanks for your view.

---

<div class="post-metadata">

**Author:** ![dceejay](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/dceejay/32/38_2.png) [@dceejay](https://discourse.nodered.org/u/dceejay)\
**Post date:** [29 August 2025 14:39 UTC](https://discourse.nodered.org/t/write-nodes-using-modern-tooling/98739/22 "2025-08-29T14:39:49Z")

</div>

> [@jbudd](#):
>
> blocking exec is sufficient protection is deluded

indeed - but every little helps - even it’s it just to protect against idiots doing dumb things accidentally. Also calls to OS are less portable across platforms - so only having to search and fix them in one type of node makes it easier than having to fix inside multiple types.

Hey - I’m all for fixing and enhancing core nodes… Pull requests always welcome after a discussion on here. (and just because I said I don’t like it doesn’t mean it won’t ever go ahead).

---

<div class="post-metadata">

**Author:** ![gregorius](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/gregorius/32/73816_2.png) [@gregorius](https://discourse.nodered.org/u/gregorius)\
**Post date:** [29 August 2025 14:44 UTC](https://discourse.nodered.org/t/write-nodes-using-modern-tooling/98739/23 "2025-08-29T14:44:00Z")

</div>

> [@dceejay](#):
>
> search and fix

Can I search for a JSONata command, e.g., `$exec`, in the Node-RED search? Hm it seems so:

 ![Screenshot 2025-08-29 at 16.42.27](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/9/8/983db3719737467b56a8d010496eb7f452cfb46b.png)

again I didn't say anything, I was thinking outloud.

---

<div class="post-metadata">

**Author:** ![jbudd](https://avatars.discourse-cdn.com/v4/letter/j/5f8ce5/32.png) [@jbudd](https://discourse.nodered.org/u/jbudd)\
**Post date:** [29 August 2025 15:34 UTC](https://discourse.nodered.org/t/write-nodes-using-modern-tooling/98739/24 "2025-08-29T15:34:21Z")

</div>

> [@gregorius](#):
>
> > [@jbudd](#):
> >
> > An organisation that thinks blocking exec is sufficient protection is deluded.
> 
> An exec node also has spawn mode which is non-blocking.

Different meaning of "blocking" I think? I should have said "blocking access to the exec node"

> [@gregorius](#):
>
> what about an `$exec(..)` or `$shell(...)` command in JSONata?

Is there such a command in Jsonata?  
I come from a Unix background, where I am familiar with assembling a process by piping together the input and output of discrete commands to build a greater whole.  
I saw an echo of that approach in Node-red where you pass a message from node to node, performing various manipulations along the flow.  
That's why I welcomed the release of Node-red.

Jsonata on the other hand, while handy in some cases to manipulate json data, looks like a complete (special purpose) language embedded within Node-red.  
This is contrary to the chain of compact single purpose tools paradigm of a Unix shell and Node-red, perhaps even windows commands (who knows?).

If you could pass a payload to an operating system command within a change node you could combine NR processing with any interpreted language you are familiar with, in preference to learning Jsonata.

Years ago I did suggest this as an enhancement and it was scorned on the spurious grounds that you would have to build a Bash interpreter into Node-red.  
Since then, the danger of allowing OS access has become ever clearer, so of course this should never be implemented in the core.  
And as Dave says there is an issue of portability across platforms.

For these reasons I will make it clear once again that I am not suggesting a change to core nodes.

> [@dceejay](#):
>
> but every little helps

So where is the list of NR core and contrib nodes that an organisation should consider blocking access to? It might be incomplete or out of date, but every little helps!

---

<div class="post-metadata">

**Author:** ![gregorius](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/gregorius/32/73816_2.png) [@gregorius](https://discourse.nodered.org/u/gregorius)\
**Post date:** [29 August 2025 16:11 UTC](https://discourse.nodered.org/t/write-nodes-using-modern-tooling/98739/25 "2025-08-29T16:11:50Z")

</div>

> [@jbudd](#):
>
> Is there such a command in Jsonata?

Nope, this was me thinking out-loud since it would be a "simpler" solution than adding a new field type. However an extra `$exec(...)` JSONata command would open a totally new can of worms, i.e., how to map those commands to various OS's - Window v. Linux v. MacOS v. Docker etc.

For simple commands such as `ls -la | grep fubar` it won't be a problem but more complex stuff you're better off using the exec node. But having said that, JSONata itself is a simplification of JS functionality. So if one were to say that an `$exec` command would be a bit like a [busybox](https://en.wikipedia.org/wiki/BusyBox) and only support a minimal number of commands, then it might well be something that could be implemented for various platforms. Also all the shell complexities would definitely not be supported by an `$exec` command, e.g. `2>&1`.

> [@jbudd](#):
>
> Jsonata on the other hand, while handy in some cases to manipulate json data, looks like a complete (special purpose) language embedded within Node-red.

JSONata is a simplification so that a function node doesn't always have to be used. It's not just data manipulation, especially since it can modify flow and global contexts. Or on the other hand, Node-RED is only about data manipulation - so JSONata is a big part of that 😉

> [@jbudd](#):
>
> Years ago I did suggest this as an enhancement and it was scorned on the spurious grounds that you would have to build a Bash interpreter into Node-red.

It's not trivial but on the other hand, it's not rocket science. It's somewhere in between!

I say this having created a [jsonata parser](https://github.com/gorenje/erlang-red-jsonata) for Erlang and an [exec](https://github.com/gorenje/erlang-red/blob/main/src/nodes/ered_node_exec.erl) node for Erlang, I can honestly say that to have an `$exec` JSONata command in Erlang-Red won't be that much of an issue. But that's because I'm using a [library](https://hexdocs.pm/erlexec/readme.html) that abstracts the OS away for me, if that doesn't work on windows, then so be it 😉 I.e. Erlang-Red doesn't _need_ to work on windows - at this stage.

So I do have a comfort zone and can definitely understand the reluctancy of Dave and Nick.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [28 October 2025 16:12 UTC](https://discourse.nodered.org/t/write-nodes-using-modern-tooling/98739/26 "2025-10-28T16:12:06Z")

</div>

Closed on 28 October 2025 16:12 UTC

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.

[Previous page](https://discourse.nodered.org/t/write-nodes-using-modern-tooling/98739.md?page=1)