chore(release): prepare v0.20.3

CHANGELOG.md

@@ -1,5 +1,41 @@
 # Changelog
 
+## [0.20.3] - 2026-11-04
+
+### Highlights
+
+- **`markkit` and `fetchkit` builtins.** Opt-in `markkit` and `fetchkit` features register both tools with the same CLI as the standalone binaries. Files come from the VFS and every HTTP hop goes through the sandbox HTTP client; host-only flags fail closed ([#2803](https://github.com/everruns/bashkit/pull/2803)). Bumped to markkit 0.3.1 and fetchkit 0.7.1 for RUSTSEC-2026-0436 ([#2823](https://github.com/everruns/bashkit/pull/2823)).
+- **Fewer round trips on remote filesystems.** Tree walkers (`rg`, `find`, `du`, `grep -r`, `tar`, `cp -r`, `ls -R`, `tree`) use a bounded bulk walk hook, trust `read_dir` metadata and stay within memory and entry budgets on remote backends ([#2816](https://github.com/everruns/bashkit/pull/2816), [#2819](https://github.com/everruns/bashkit/pull/2819), [#2820](https://github.com/everruns/bashkit/pull/2820), [#2821](https://github.com/everruns/bashkit/pull/2821)).
+- **Execution output to a VFS file.** `Execution::output_file` writes combined output into a capped VFS file; Python `execute`/`execute_sync` accept `output_file`, and the Deep Agents backend offloads large output natively ([#2818](https://github.com/everruns/bashkit/pull/2818)).
+- **Deep Agents backend improvements.** Per-call timeouts (`ExecOptions::timeout`, Python `timeout_seconds`) that can only tighten the configured limit, base64 binary reads, and structured file-operation error codes, plus a new integration guide ([#2817](https://github.com/everruns/bashkit/pull/2817), [#2824](https://github.com/everruns/bashkit/pull/2824)).
+- **Python exit crash fixed.** A timed-out async callback no longer races interpreter finalization and aborts the process on CPython < 3.13 ([#2802](https://github.com/everruns/bashkit/pull/2802)).
+- **crates.io trusted publishing.** Rust crates publish through GitHub OIDC instead of a stored token ([#2801](https://github.com/everruns/bashkit/pull/2801)).
+
+### What's Changed
+
+* chore(deps): bump russh to 0.65.0 and the napi group, with vet audits ([#2826](https://github.com/everruns/bashkit/pull/2826)) by @chaliy
+* docs(python): add Deep Agents integration guide ([#2824](https://github.com/everruns/bashkit/pull/2824)) by @chaliy
+* fix(deps): bump markkit to 0.3.1 and fetchkit to 0.7.1 for RUSTSEC-2026-0436 ([#2823](https://github.com/everruns/bashkit/pull/2823)) by @chaliy
+* fix(fs): walk directories in path order so prefetch matches consumers ([#2821](https://github.com/everruns/bashkit/pull/2821)) by @chaliy
+* test(fs): large-tree stress tests; stream rg's walk, cap ls at the stdout limit ([#2820](https://github.com/everruns/bashkit/pull/2820)) by @chaliy
+* fix(builtins): list ls -R and tree through bounded bulk walk batches ([#2819](https://github.com/everruns/bashkit/pull/2819)) by @chaliy
+* fix(fs): cut round trips and bound memory for tree walkers on remote backends ([#2816](https://github.com/everruns/bashkit/pull/2816)) by @chaliy
+* feat: tee execution output to a VFS file; native capture offload for Deep Agents ([#2818](https://github.com/everruns/bashkit/pull/2818)) by @chaliy
+* feat(python): per-call timeout and multimodal reads for the Deep Agents backend ([#2817](https://github.com/everruns/bashkit/pull/2817)) by @chaliy
+* feat(builtins): add markkit and fetchkit builtins with the upstream CLI ([#2803](https://github.com/everruns/bashkit/pull/2803)) by @chaliy
+* chore(deps): bump the examples-npm group across 1 directory with 6 updates ([#2812](https://github.com/everruns/bashkit/pull/2812)) by @app/dependabot
+* chore(ci): bump the github-actions group with 2 updates ([#2811](https://github.com/everruns/bashkit/pull/2811)) by @app/dependabot
+* chore(deps): bump fancy-regex to 0.20.0 across all three lockfiles ([#2813](https://github.com/everruns/bashkit/pull/2813)) by @chaliy
+* chore(deps): bump the js-npm group in /crates/bashkit-js with 5 updates ([#2809](https://github.com/everruns/bashkit/pull/2809)) by @app/dependabot
+* chore(deps): bump the site-npm group in /site with 4 updates ([#2808](https://github.com/everruns/bashkit/pull/2808)) by @app/dependabot
+* chore(deps): bump the docs-grep-agent-uv group in /examples/docs-grep-agent with 3 updates ([#2807](https://github.com/everruns/bashkit/pull/2807)) by @app/dependabot
+* chore(builtins): sync uutils/coreutils argument surfaces and vendored modules ([#2805](https://github.com/everruns/bashkit/pull/2805)) by @chaliy
+* ci: pin nightly jobs to nightly-2026-10-30 ([#2804](https://github.com/everruns/bashkit/pull/2804)) by @chaliy
+* fix(python): drain abandoned callback dispatch before interpreter exit ([#2802](https://github.com/everruns/bashkit/pull/2802)) by @chaliy
+* ci(release): use crates.io trusted publishing ([#2801](https://github.com/everruns/bashkit/pull/2801)) by @chaliy
+
+**Full Changelog**: https://github.com/everruns/bashkit/compare/v0.20.2...v0.20.3
+
 ## [0.20.2] - 2026-10-30
 
 ### Highlights

Cargo.toml

@@ -7,7 +7,7 @@ resolver = "2"
 members = ["crates/*"]
 
 [workspace.package]
-version = "0.20.2"
+version = "0.20.3"
 edition = "2024"
 license = "MIT"
 authors = ["Mykhailo Chalyi <mike@chaliy.name>", "Everruns"]

README.md

@@ -442,7 +442,7 @@ Enable the `sqlite` feature to embed [Turso](https://github.com/tursodatabase/tu
 
 ```toml
 [dependencies]
-bashkit = { version = "0.20.2", features = ["sqlite"] }
+bashkit = { version = "0.20.3", features = ["sqlite"] }
 ```
 
 ```rust

crates/bashkit-cli/Cargo.toml

@@ -39,7 +39,7 @@ interactive = ["dep:rustyline", "dep:terminal_size", "dep:signal-hook"]
 # `tzdata` is listed explicitly: an interactive shell must keep honouring
 # named `TZ=` zones in `date`, which stopped being implied when chrono-tz
 # moved behind a feature.
-bashkit = { path = "../bashkit", version = "0.20.2", default-features = false, features = ["http_client", "ring", "git", "jq", "tzdata"] }
+bashkit = { path = "../bashkit", version = "0.20.3", default-features = false, features = ["http_client", "ring", "git", "jq", "tzdata"] }
 tokio = { workspace = true, features = ["macros", "net", "rt", "rt-multi-thread", "time", "io-std"] }
 clap.workspace = true
 anyhow.workspace = true

crates/bashkit-js/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everruns/bashkit",
-  "version": "0.20.2",
+  "version": "0.20.3",
   "description": "Sandboxed bash interpreter for JavaScript/TypeScript",
   "packageManager": "pnpm@10.33.0",
   "main": "wrapper.js",

crates/bashkit-scripted-tool/Cargo.toml

@@ -30,7 +30,7 @@ jq = ["bashkit/jq"]
 tracing = ["dep:tracing"]
 
 [dependencies]
-bashkit = { path = "../bashkit", version = "0.20.2", default-features = false, features = ["bash_tool"] }
+bashkit = { path = "../bashkit", version = "0.20.3", default-features = false, features = ["bash_tool"] }
 tokio = { workspace = true }
 async-trait = { workspace = true }
 tower = { workspace = true }

crates/bashkit-wasm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everruns/bashkit-wasm",
-  "version": "0.20.2",
+  "version": "0.20.3",
   "description": "Sandboxed bash interpreter for the browser (WebAssembly). Single-threaded \u2014 no SharedArrayBuffer, no COOP/COEP headers.",
   "type": "module",
   "main": "index.js",

crates/bashkit/Cargo.toml

@@ -143,7 +143,7 @@ monty = { version = "=0.0.19", optional = true }
 
 # Real CPython 3.14 as a WASI guest, precompiled to Pulley (cpython feature).
 # See knowledge/runtimes/cpython-wasm.md.
-bashkit-cpython-wasm = { path = "../bashkit-cpython-wasm", version = "0.20.2", optional = true }
+bashkit-cpython-wasm = { path = "../bashkit-cpython-wasm", version = "0.20.3", optional = true }
 wasmtime = { workspace = true, optional = true, features = ["pooling-allocator"] }
 monty-types = { version = "=0.0.19", optional = true }
 # Monty's ruff AST uses compact_str 0.9; get-size2 >=0.10.2 only implements

crates/bashkit/docs/cpython.md

@@ -19,7 +19,7 @@ Enable the `cpython` cargo feature and register the builtins:
 
 ```toml
 [dependencies]
-bashkit = { version = "0.20.2", features = ["cpython"] }
+bashkit = { version = "0.20.3", features = ["cpython"] }
 ```
 
 ```rust
@@ -242,7 +242,7 @@ executable memory. Enable `cpython-native` instead of `cpython` to compile it
 to machine code for your target at build time:
 
 ```toml
-bashkit = { version = "0.20.2", features = ["cpython-native"] }
+bashkit = { version = "0.20.3", features = ["cpython-native"] }
 ```
 
 Calls get 4-10x faster (`print(1)` ~1 ms instead of ~4 ms; CPU-bound code

crates/bashkit/docs/logging.md

@@ -14,7 +14,7 @@ Add the `logging` feature to your `Cargo.toml`:
 
 ```toml
 [dependencies]
-bashkit = { version = "0.20.2", features = ["logging"] }
+bashkit = { version = "0.20.3", features = ["logging"] }
 tracing-subscriber = "0.3"  # or your preferred subscriber
 ```
 

crates/bashkit/docs/markkit-fetchkit.md

@@ -12,7 +12,7 @@ as their standalone binaries**:
 Both are **off by default**. Enable the Cargo features:
 
 ```toml
-bashkit = { version = "0.20.2", features = ["markkit", "fetchkit"] }
+bashkit = { version = "0.20.3", features = ["markkit", "fetchkit"] }
 ```
 
 ```bash

crates/bashkit/docs/sqlite.md

@@ -13,7 +13,7 @@ the `sqlite` feature. The engine is [Turso](https://github.com/tursodatabase/tur
 
 ```toml
 # Cargo.toml
-bashkit = { version = "0.20.2", features = ["sqlite"] }
+bashkit = { version = "0.20.3", features = ["sqlite"] }
 ```
 
 ```rust,ignore

crates/bashkit/src/lib.rs

@@ -323,7 +323,7 @@
 //!
 //! ```toml
 //! [dependencies]
-//! bashkit = { version = "0.20.2", features = ["git"] }
+//! bashkit = { version = "0.20.3", features = ["git"] }
 //! ```
 //!
 //! ```rust,ignore
@@ -354,7 +354,7 @@
 //!
 //! ```toml
 //! [dependencies]
-//! bashkit = { version = "0.20.2", features = ["python"] }
+//! bashkit = { version = "0.20.3", features = ["python"] }
 //! ```
 //!
 //! ```rust,ignore

docs/builtin_typescript.md

@@ -12,7 +12,7 @@ Add the `typescript` feature to your `Cargo.toml`:
 
 ```toml
 [dependencies]
-bashkit = { version = "0.20.2", features = ["typescript"] }
+bashkit = { version = "0.20.3", features = ["typescript"] }
 ```
 
 Enable TypeScript in the builder:

docs/migrating-scripted-tool.md

@@ -23,8 +23,8 @@ features = ["scripted_tool", "python", "typescript", "jq"]
 After:
 
 ```toml
-bashkit = { version = "0.20.2", features = ["python", "typescript", "jq"] }
-bashkit-scripted-tool = { version = "0.20.2", features = ["python", "typescript", "jq"] }
+bashkit = { version = "0.20.3", features = ["python", "typescript", "jq"] }
+bashkit-scripted-tool = { version = "0.20.3", features = ["python", "typescript", "jq"] }
 ```
 
 Keep `bashkit` only if you use it directly (`Bash`, `BashTool`, the `Tool`