From a68bf1daa4b440373f5a8873cb3ac2c7534d7cf8 Mon Sep 17 00:00:00 2001
From: avivkeller <me@aviv.sh>
Date: Fri, 25 Sep 2026 11:58:46 -0400
Subject: [PATCH] repl: support suppressing default commands

Signed-off-by: avivkeller <me@aviv.sh>
---
 doc/api/repl.md                               |  9 ++++
 lib/repl.js                                   |  4 +-
 .../test-repl-define-default-commands.mjs     | 52 +++++++++++++++++++
 3 files changed, 64 insertions(+), 1 deletion(-)
 create mode 100644 test/parallel/test-repl-define-default-commands.mjs

diff --git a/doc/api/repl.md b/doc/api/repl.md
index 7a57af57442..0e5048a1abe 100644
--- a/doc/api/repl.md
+++ b/doc/api/repl.md
@@ -677,6 +677,9 @@ npx codemod@latest @nodejs/repl-builtin-modules
 <!-- YAML
 added: v0.1.91
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/66289
+    description: The `defineDefaultCommands` option has been added.
   - version:
      - v25.9.0
     pr-url: https://github.com/nodejs/node/pull/62188
@@ -770,6 +773,11 @@ changes:
       The `'unhandled'` value may or may not be desirable in situations
       where the `REPLServer` instance has been closed, depending on the particular
       use case.
+  * `defineDefaultCommands` {boolean} If `false`, the built-in commands
+    (`.break`, `.clear`, `.editor`, `.exit`, `.help`, `.load` and `.save`)
+    are not registered, so the REPL starts without any commands. Custom
+    commands can still be added with [`replServer.defineCommand()`][].
+    **Default:** `true`.
 * Returns: {repl.REPLServer}
 
 The `repl.start()` method creates and starts a [`repl.REPLServer`][] instance.
@@ -1150,6 +1158,7 @@ Original code from <https://gist.github.com/TooTallNate/2053342>.
 [`readline.InterfaceCompleter`]: readline.md#use-of-the-completer-function
 [`repl.ReplServer`]: #class-replserver
 [`repl.start()`]: #replstartoptions
+[`replServer.defineCommand()`]: #replserverdefinecommandkeyword-cmd
 [`reverse-i-search`]: #reverse-i-search
 [`util.inspect()`]: util.md#utilinspectobject-options
 [custom evaluation functions]: #custom-evaluation-functions
diff --git a/lib/repl.js b/lib/repl.js
index 4c227a0c17d..2312903950a 100644
--- a/lib/repl.js
+++ b/lib/repl.js
@@ -391,7 +391,9 @@ class REPLServer extends Interface {
     self.resetContext();
 
     this.commands = { __proto__: null };
-    defineDefaultCommands(this);
+    if (options.defineDefaultCommands !== false) {
+      defineDefaultCommands(this);
+    }
 
     // Figure out which "writer" function to use
     self.writer = options.writer || module.exports.writer;
diff --git a/test/parallel/test-repl-define-default-commands.mjs b/test/parallel/test-repl-define-default-commands.mjs
new file mode 100644
index 00000000000..237d1dbd7bf
--- /dev/null
+++ b/test/parallel/test-repl-define-default-commands.mjs
@@ -0,0 +1,52 @@
+import { mustCall, mustNotCall } from '../common/index.mjs';
+import { startNewREPLServer } from '../common/repl.js';
+import assert from 'node:assert';
+
+const defaultCommands =
+  ['break', 'clear', 'editor', 'exit', 'help', 'load', 'save'];
+
+// By default, and when `defineDefaultCommands` is explicitly `true`, the
+// built-in commands are registered.
+for (const defineDefaultCommands of [undefined, true]) {
+  const { replServer } = startNewREPLServer({ defineDefaultCommands });
+  assert.deepStrictEqual(
+    Object.keys(replServer.commands).sort(),
+    defaultCommands,
+  );
+  replServer.close();
+}
+
+// When `defineDefaultCommands` is `false`, no commands are registered.
+{
+  const { replServer, output, run } = startNewREPLServer({
+    defineDefaultCommands: false,
+  });
+  assert.deepStrictEqual(Object.keys(replServer.commands), []);
+
+  // The built-in commands are treated as unknown keywords rather than run.
+  replServer.on('exit', mustNotCall('.exit should not close the REPL'));
+  await run(['.exit\n']);
+  assert.match(output.accumulator, /Invalid REPL keyword/);
+
+  output.accumulator = '';
+  await run(['.help\n']);
+  assert.match(output.accumulator, /Invalid REPL keyword/);
+
+  // Custom commands can still be defined, including ones that reuse a
+  // built-in name.
+  replServer.defineCommand('help', {
+    help: 'custom help',
+    action: mustCall(function() {
+      this.output.write('custom help output\n');
+      this.displayPrompt();
+    }),
+  });
+  assert.deepStrictEqual(Object.keys(replServer.commands), ['help']);
+
+  output.accumulator = '';
+  await run(['.help\n']);
+  assert.match(output.accumulator, /custom help output/);
+
+  replServer.removeAllListeners('exit');
+  replServer.close();
+}