ende run

Usage

Run a local file:

ende run main.ts

The run subcommand is optional — you can also just use ende <file>:

ende main.ts

By default, Ende runs programs in a sandbox without access to disk, network or ability to spawn subprocesses. This is because the Ende runtime is secure by default. You can grant or deny required permissions using the --allow-* and --deny-* flags.

Permissions examples

Grant permission to read from disk and listen to network:

ende run --allow-read --allow-net server.ts

Grant permission to read allow-listed files from disk:

ende run --allow-read=/etc server.ts

Grant all permissions this is not recommended and should only be used for testing:

ende run -A server.ts

If your project requires multiple security flags you should consider using a ende task to execute them.

Watch

To watch for file changes and restart process automatically use the --watch flag. Ende's built in application watcher will restart your application as soon as files are changed.

Be sure to put the flag before the file name eg:

ende run --allow-net --watch server.ts

Ende's watcher will notify you of changes in the console, and will warn in the console if there are errors while you work.

The same --watch flag is also accepted by ende test, ende serve, and ende bench.

Running code from stdin

You can pipe code from stdin and run it immediately:

echo "console.log('hello')" | ende run -

Terminate run

To stop the run command use ctrl + c.

Command line usage:

run

Run a JavaScript or TypeScript program, or a task

Options

--cached-only

Require that remote dependencies are already cached.

--cert

Load certificate authority from PEM encoded file.

--check

Enable type-checking. This subcommand does not type-check by default; pass --check=all to also type-check remote modules. Alternatively, use the 'ende check' subcommand.

--config, -c

Configure different aspects of ende including TypeScript, linting, and code formatting. Typically the configuration file will be called ende.json or ende.jsonc and automatically detected; in that case this flag is not necessary.

--coverage

Collect coverage profile data into DIR. If DIR is not specified, it uses 'coverage/'. This option can also be set via the ENDE_COVERAGE_DIR environment variable.

--env-file

Load environment variables from local file Only the first environment variable with a given key is used. Existing process environment variables are not overwritten, so if variables with the same names already exist in the environment, their values will be preserved. Where multiple declarations for the same environment variable exist in your .env file, the first one encountered is applied. This is determined by the order of the files you pass as arguments.

--ext

Set content type of the supplied file.

--frozen-lockfile

Error out if lockfile is out of date.

--hmr

Watch for file changes and hot-replace modules. The process restarts if hot replacement fails. Local files from entry point module graph are watched by default. Additional paths might be watched by passing them as arguments to this flag.

--import-map

Load import map file from local file or remote URL.

--inspect

Activate inspector on host:port [default: 127.0.0.1:9229]. Host and port are optional. Using port 0 will assign a random free port.

--inspect-brk

Activate inspector on host:port, wait for debugger to connect and break at the start of user script.

--inspect-publish-uid

--inspect-wait

Activate inspector on host:port and wait for debugger to connect before running user code.

--location

Value of globalThis.location used by some web APIs.

--lock

Check the specified lock file. (If value is not provided, defaults to "./ende.lock").

--min-dep-age

(Unstable) The age in minutes, ISO-8601 duration or RFC3339 absolute timestamp (e.g. '120' for two hours, 'P2D' for two days, '2025-09-16' for cutoff date, '2025-09-16T12:00:00+00:00' for cutoff time, '0' to disable).

--no-check

Skip type-checking. If the value of "remote" is supplied, diagnostic errors from remote modules will be ignored.

--no-clear-screen

Do not clear terminal screen when under watch mode.

--no-code-cache

Disable V8 code cache feature.

--no-config

Disable automatic loading of the configuration file.

--no-lock

Disable auto discovery of the lock file.

--no-remote

Do not resolve remote modules.

--preload

A list of files that will be executed before the main module.

--reload, -r

Reload source code cache (recompile TypeScript). With no value, reloads everything. Pass a comma-separated list of specifiers to reload only those modules; jsr:@ende/http/file-server,jsr:@ende/assert/equals reloads specific modules.

--seed

Set the random number generator seed.

--unsafely-ignore-certificate-errors

DANGER: Disables verification of TLS certificates.

--v8-flags

To see a list of all available flags use --v8-flags=--help Flags can also be set via the ENDE_V8_FLAGS environment variable. Any flags set with this flag are appended after the ENDE_V8_FLAGS environment variable.

--vendor

Toggles local vendor folder usage for remote modules.

--watch

Watch for file changes and restart process automatically. Local files from entry point module graph are watched by default. Additional paths might be watched by passing them as arguments to this flag.

--watch-exclude

Exclude provided files/patterns from watch mode.