Release v0.21.0

Highlights

• Embedded Python on Monty 1.5, with real per-tenant memory limits. The headline of this release. python3 now runs on our own Monty forks (bashkit-monty, bashkit-monty-types, published to crates.io), upgraded from Monty 0.0.19 to 1.4 and re-synced to upstream 1.5.0. Each Python run is charged exactly for its own allocations through bashkit::MeteredAllocator, so one tenant can no longer exhaust another's budget or abort the shared process; the time limit now bounds wall-clock time across host calls; and the forks are covered by multi-tenant stress tests, nightly ASan and soak runs, a fuzz target, a Monty-vs-CPython differential fuzzer, a drift check that allows changes only at marked fork edits, and a daily upstream advisory watch (#2842, #2855, #2853, #2874, #2875, #2861, #2872, #2887). Breaking: embedders using the python feature must install bashkit::MeteredAllocator as the global allocator, or python3 refuses to run.
• TypeScript resource limits enforced. ZapCode never read max_memory, so doubling a string or array, or joining one shared string many times, aborted the whole process with every tenant. Each ts run now has its own heap meter checked at every instruction, output-amplifying builtins size their result first, and max_duration bounds wall-clock time across host calls. ZapCode is vendored in-tree on every target, and padStart/padEnd are capped (#2909, #2910). Breaking: the same MeteredAllocator requirement now applies to the typescript feature.
• Security audit fixes. Bounded eval/compgen/path-script recursion with on-demand stack growth, setuid bits dropped on real mounts, caller Host headers dropped before credential injection, json.dumps indent preflight, markkit/fetchkit honoring the exec deadline, and fetchkit 0.7.2 for linear readable extraction (#2867, #2871, #2869, #2868, #2870, #2914).
• Execution-scoped cancellation for custom builtins in the language bindings (#2893, #2905).
• Embedded runtimes are friendlier to agents. The ~95-call cap on python3/ts per session is gone, time limits exit 124, deep nesting fails cleanly, and timeout_seconds raises the runtime time limit in the Python package (#2832, #2833, #2835, #2873).

What's Changed

• fix(deps): pick up fetchkit 0.7.2 linear readable extraction (#2914) by @chaliy
• fix(ts): enforce max_memory and wall-clock limit for TypeScript (#2910) by @chaliy
• fix(typescript): vendor ZapCode on every target and cap padStart/padEnd (#2909) by @chaliy
• fix(examples): read pydantic-ai run result from .output (#2908) by @chaliy
• docs(readme): move homepage link into badge row (#2907) by @chaliy
• docs: describe bashkit as part of the Everruns community ecosystem (#2906) by @chaliy
• fix(bindings): abort the builtin signal when the native deadline wins (#2905) by @chaliy
• chore(deps): bump flate2 to 1.1.11 with the vet exemption it needs (#2904) by @chaliy
• chore(deps): bump flate2 from 1.1.10 to 1.1.11 in /crates/bashkit/fuzz in the fuzz-dependencies group (#2897) by @app/dependabot
• chore(deps): bump @langchain/core from 1.3.4 to 1.3.5 in /crates/bashkit-js in the js-npm group (#2898) by @app/dependabot
• chore(deps): bump the examples-npm group across 1 directory with 3 updates (#2899) by @app/dependabot
• chore(deps): bump the site-npm group in /site with 3 updates (#2900) by @app/dependabot
• chore(ci): bump taiki-e/install-action from 2.90.1 to 2.90.2 in the github-actions group (#2901) by @app/dependabot
• chore(ci): move Monty release-drift check to maintenance, keep advisories daily (#2894) by @chaliy
• fix(test): stop comparing an implementation-defined cp leftover to the host (#2903) by @chaliy
• feat(bindings): execution-scoped cancellation for custom builtins (#2893) by @chaliy
• fix(builtins): port uutils' thiserror messages and shared clap args (#2895) by @chaliy
• chore(deps): bump the examples-npm group across 2 directories (#2890) by @app/dependabot
• chore(deps): bump the docs-grep-agent-uv group in /examples/docs-grep-agent (#2889) by @app/dependabot
• chore(deps): bump wrangler from 4.157.0 to 4.158.0 in /site (#2888) by @app/dependabot
• chore(ci): bump softprops/action-gh-release from 3.0.3 to 3.0.4 (#2891) by @app/dependabot
• ci(workflows): retry the Doppler CLI install once (#2892) by @chaliy
• chore(deps): re-sync the Monty forks to upstream 1.5.0 (#2887) by @chaliy
• chore(deps): bump russh to 0.65.1 and signal-hook to 0.4.6 (#2886) by @chaliy
• chore(deps): bump toml and toml_writer, refreshing their publisher facts (#2884) by @chaliy
• chore(deps): bump wrangler from 4.156.2 to 4.157.0 in /site (#2877) by @app/dependabot
• chore(ci): bump taiki-e/install-action to v2.90.1 (#2882) by @app/dependabot
• fix(test): make the python regex DoS wall-clock bounds hang detectors, not budgets (#2883) by @chaliy
• chore(deps): unify pyo3 on 0.30 with compatible companions (#2863) by @chaliy
• chore(deps): bump the js-npm group in /crates/bashkit-js with 4 updates (#2878) by @app/dependabot
• chore(deps): bump the examples-npm group across 1 directory with 3 updates (#2879) by @app/dependabot
• fix(ci): migrate nightly jobs to the new dtolnay/rust-toolchain schema (#2850) by @chaliy
• fix(deps): let a Monty fork dependency move ahead of upstream when marked (#2876) by @chaliy
• test(python): differential fuzz Monty against CPython (#2875) by @chaliy
• fix(python): let timeout_seconds raise the embedded runtime time limit (#2873) by @chaliy
• ci(python): sanitize Monty under ASan and soak tenant stress nightly (#2874) by @chaliy
• ci(python): watch upstream Monty releases and advisories (#2872) by @chaliy
• fix(builtins): markkit/fetchkit respect the exec deadline off the async worker (#2870) by @chaliy
• fix(python): preflight json.dumps indent and separators (#2868) by @chaliy
• fix(interpreter): bound eval/compgen/path-script recursion and grow stack on demand (#2867) by @chaliy
• fix(realfs): drop setuid bits on host files, keep FsLimits on root mounts (#2871) by @chaliy
• fix(network): drop caller Host headers and refuse encoded slashes in path rules (#2869) by @chaliy
• fix(python): mark the Monty fork edits that turned main red (#2865) by @chaliy
• chore(python): CI check that the Monty forks drift only at marked edits (#2861) by @chaliy
• fix(python): stop shared-graph repr/compare outliving the time limit (#2857) by @chaliy
• test(rg): warm up rg before measuring its bounded-memory walk (#2862) by @chaliy
• chore(deps): bump the examples-npm group across 1 directory with 2 updates (#2859) by @app/dependabot
• fix(python...

Release v0.20.3

Highlights

• markkit and fetchkit builtins. Opt-in markkit and fetchkit features register both tools with the same CLI as the standalone binaries. Files come from the VFS and every HTTP hop goes through the sandbox HTTP client; host-only flags fail closed (#2803). Bumped to markkit 0.3.1 and fetchkit 0.7.1 for RUSTSEC-2026-0436 (#2823).
• Fewer round trips on remote filesystems. Tree walkers (rg, find, du, grep -r, tar, cp -r, ls -R, tree) use a bounded bulk walk hook, trust read_dir metadata and stay within memory and entry budgets on remote backends (#2816, #2819, #2820, #2821).
• Execution output to a VFS file. Execution::output_file writes combined output into a capped VFS file; Python execute/execute_sync accept output_file, and the Deep Agents backend offloads large output natively (#2818).
• Deep Agents backend improvements. Per-call timeouts (ExecOptions::timeout, Python timeout_seconds) that can only tighten the configured limit, base64 binary reads, and structured file-operation error codes, plus a new integration guide (#2817, #2824).
• Python exit crash fixed. A timed-out async callback no longer races interpreter finalization and aborts the process on CPython < 3.13 (#2802).
• crates.io trusted publishing. Rust crates publish through GitHub OIDC instead of a stored token (#2801).

What's Changed

• chore(deps): bump russh to 0.65.0 and the napi group, with vet audits (#2826) by @chaliy
• docs(python): add Deep Agents integration guide (#2824) by @chaliy
• fix(deps): bump markkit to 0.3.1 and fetchkit to 0.7.1 for RUSTSEC-2026-0436 (#2823) by @chaliy
• fix(fs): walk directories in path order so prefetch matches consumers (#2821) by @chaliy
• test(fs): large-tree stress tests; stream rg's walk, cap ls at the stdout limit (#2820) by @chaliy
• fix(builtins): list ls -R and tree through bounded bulk walk batches (#2819) by @chaliy
• fix(fs): cut round trips and bound memory for tree walkers on remote backends (#2816) by @chaliy
• feat: tee execution output to a VFS file; native capture offload for Deep Agents (#2818) by @chaliy
• feat(python): per-call timeout and multimodal reads for the Deep Agents backend (#2817) by @chaliy
• feat(builtins): add markkit and fetchkit builtins with the upstream CLI (#2803) by @chaliy
• chore(deps): bump the examples-npm group across 1 directory with 6 updates (#2812) by @app/dependabot
• chore(ci): bump the github-actions group with 2 updates (#2811) by @app/dependabot
• chore(deps): bump fancy-regex to 0.20.0 across all three lockfiles (#2813) by @chaliy
• chore(deps): bump the js-npm group in /crates/bashkit-js with 5 updates (#2809) by @app/dependabot
• chore(deps): bump the site-npm group in /site with 4 updates (#2808) by @app/dependabot
• chore(deps): bump the docs-grep-agent-uv group in /examples/docs-grep-agent with 3 updates (#2807) by @app/dependabot
• chore(builtins): sync uutils/coreutils argument surfaces and vendored modules (#2805) by @chaliy
• ci: pin nightly jobs to nightly-2026-10-30 (#2804) by @chaliy
• fix(python): drain abandoned callback dispatch before interpreter exit (#2802) by @chaliy
• ci(release): use crates.io trusted publishing (#2801) by @chaliy

Full Changelog: v0.20.2...v0.20.3

Release v0.20.2

Highlights

• Patched CPython sandbox engine. Wasmtime 48.0.8 addresses RUSTSEC-2026-0422, RUSTSEC-2026-0423 and RUSTSEC-2026-0424; the embedded CPython artifact is rebuilt with the same exact engine version (#2798).
• Signed Windows Python wheels. Windows native modules receive Authenticode signatures and timestamps, verified before the final wheel is tested and published (#2799).
• Binary-safe HTTP output. curl downloads and curl/wget stdout preserve bytes through redirections and pipelines, including compressed responses (#2778).
• Correct directory-content copies. cp -r source/. destination copies contents into an existing destination without adding a source-directory layer (#2796).

What's Changed

• chore(python): sign Windows release wheels with Authenticode (#2799) by @chaliy
• Fix Wasmtime security advisories (#2798) by @chaliy
• fix(testing): render the diagnostic slot in the fuzz echo gate (#2797) by @chaliy
• fix(cp): preserve directory-dot contents operands (#2796) by @chaliy
• ci(npm): re-publish an existing release tag via a tag input (#2794) by @chaliy
• fix(deps): clear the seroval script-injection advisories in the site lockfile (#2795) by @chaliy
• chore(python): document Smart App Control workaround and reproduction (#2793) by @chaliy
• chore(deps): bump the rust-dependencies group and record its vet audits (#2792) by @chaliy
• ci(npm): publish via npm trusted publishing (GitHub OIDC) (#2791) by @chaliy
• chore(deps): bump vt100 to 0.18 and migrate the NonZero screen API (#2789) by @chaliy
• fix(ci): retry the Rosetta cross build through toolchain segfaults (#2788) by @chaliy
• chore(ci): bump the github-actions group across 1 directory with 4 updates (#2787) by @app/dependabot
• chore(deps): bump the examples-npm group across 2 directories with 7 updates (#2785) by @app/dependabot
• fix(js): size the host-callback timeout for the slowest shipped lane (#2780) by @chaliy
• chore(deps): bump the fuzz-dependencies group in /crates/bashkit/fuzz with 3 updates (#2784) by @app/dependabot
• chore(deps): bump the site-npm group in /site with 4 updates (#2783) by @app/dependabot
• chore(deps): bump the docs-grep-agent-uv group in /examples/docs-grep-agent with 2 updates (#2782) by @app/dependabot
• chore(deps): bump the js-npm group in /crates/bashkit-js with 4 updates (#2781) by @app/dependabot
• chore(builtins): sync uutils/coreutils argument surfaces and vendored modules (#2779) by @chaliy
• fix(http): preserve binary download and stream output (#2778) by @chaliy

Full Changelog: v0.20.1...v0.20.2

Release v0.20.1

Highlights

• Windows CPython builds. The embedded CPython module uses a plain static slice on Windows and caches a 64 KiB-aligned copy at runtime, avoiding the Rust compiler trap when generating Windows COFF objects. Python and the hosted integration catalog remain available (#2777).
• Complete npm runtime files. The npm publish artifact includes runtime-functions.js and its declarations so importing the package succeeds (#2776).

What's Changed

• fix(cpython): avoid unsupported over-aligned statics on Windows (EVE-1311).
• fix(release): ship runtime-functions.js in the npm publish artifact (#2776).

Release v0.20.0

Highlights

• Live command I/O and async output sinks. Rust, Python, JavaScript, C and browser WASM consumers can stream command input/output while preserving shell routing and execution budgets (#2741, #2749).
• Host functions for embedded runtimes. Python and TypeScript scripts can call application-provided functions across native and browser bindings (#2739, #2740, #2742, #2743).
• Security updates across runtime graphs. Wasmtime 48.0.7, patched TLS validation/root bundles, Tokio 1.53.3 in the standalone Hyperlight guest, constant-time crypto fixes and supported Node security patches are included in the release source/build recipes. Unsoundness findings now fail every Cargo lockfile audit (#2767, #2768, #2772, #2773, #2774).
• Optional runtime warm-up. Embedders can initialize feature-enabled runtimes before serving requests with warm_up() (#2750).

Breaking Rust API change: the static-analysis enum analysis::CommandContext is now analysis::CommandPlacement. Before: use bashkit::analysis::CommandContext; and CommandContext::Direct. After: use bashkit::analysis::CommandPlacement; and CommandPlacement::Direct. Update annotations for AnalyzedCommand.context accordingly. The root bashkit::CommandContext now describes a live host-command invocation; it is not the analysis enum. Serialized context field names and values remain unchanged. See the streaming guide (#2741).

Remaining dependency caveats: optional SSH still uses RSA affected by Marvin (RUSTSEC-2023-0071); upstream has no published fix. Prefer Ed25519 to avoid RSA private-key operations. atomic-polyfill remains an unmaintained transitive dependency. Node is supplied by the embedding application: Node 18/20 compatibility does not imply security support; use a patched supported runtime. Downstream Rust applications should refresh their own lockfiles and rebuild. This release does not claim every dependency is vulnerability-free (#2774).

What's Changed

• fix(release): recover publication from immutable tags by @chaliy
• fix(builtins): track uucore quoting-style rename in printf shim (#2738) by @chaliy
• feat(python): expose embedded runtime host functions to agent tools (#2739) by @chaliy
• feat(js): add Python and TypeScript runtime host functions (#2740) by @chaliy
• feat(capi): add Python and TypeScript runtime host functions (#2742) by @chaliy
• feat(streaming): add live command I/O and async output sinks (#2741) by @chaliy
• fix(capi): export runtime callbacks in Windows import libraries (#2744) by @chaliy
• feat(wasm): add Python and TypeScript runtime host functions (#2743) by @chaliy
• fix(ci): open a new coreutils drift PR when the previous one was closed (#2745) by @chaliy
• chore(builtins): sync uutils/coreutils argument surfaces and vendored modules (#2746) by @chaliy
• fix(testing): attribute fuzz canary echoes to the script that caused them (#2747) by @chaliy
• fix(testing): keep killed CLI children out of tarpaulin's coverage merge (#2748) by @chaliy
• fix(streaming): enforce budgets and preserve routed byte output (#2749) by @chaliy
• feat(bashkit): add feature-gated warm_up() entry point (#2750) by @chaliy
• fix(builtins): read od's generated args under either clap value type (#2754) by @chaliy
• chore(ci): bump taiki-e/install-action from 2.87.28 to 2.87.29 in the github-actions group (#2756) by @app/dependabot
• chore(deps): bump the site-npm group in /site with 3 updates (#2751) by @app/dependabot
• chore(deps): bump the docs-grep-agent-uv group in /examples/docs-grep-agent with 4 updates (#2757) by @app/dependabot
• chore(deps): bump the js-npm group in /crates/bashkit-js with 4 updates (#2752) by @app/dependabot
• chore(deps): bump the examples-npm group across 1 directory with 6 updates (#2753) by @app/dependabot
• chore(deps): bump the fuzz-dependencies group in /crates/bashkit/fuzz with 2 updates (#2755) by @app/dependabot
• chore(builtins): sync uutils/coreutils argument surfaces and vendored modules (#2759) by @chaliy
• fix(ci): open coreutils drift PRs with a token permitted to create them (#2760) by @chaliy
• chore(deps): land the safe rust-dependencies bumps and hold oxc at 0.117.x (#2761) by @chaliy
• chore(deps): bump wrangler from 4.151.0 to 4.151.1 in /site in the site-npm group (#2762) by @app/dependabot
• chore(deps): bump the docs-grep-agent-uv group in /examples/docs-grep-agent with 2 updates (#2763) by @app/dependabot
• chore(deps): bump the examples-npm group across 1 directory with 4 updates (#2764) by @app/dependabot
• fix(deps): bump wasmtime to 48.0.7 for RUSTSEC-2026-0379 and -0378 (#2767) by @chaliy
• fix(ci): unbreak main after the ubuntu-26.04 roll and the October advisories (#2768) by @chaliy
• chore(deps): bump rustyline from 18.0.1 to 19.0.0 (#2765) by @app/dependabot
• fix(builtins): read shuf's input range under either generated value type (#2770) by @chaliy
• chore(builtins): sync uutils/coreutils argument surfaces and vendored modules (#2771) by @chaliy
• fix(deps): clear the 2026-10-23 constant-time and npm advisories (#2773) by @chaliy
• fix(ci): pin supported Node security patch versions (#2772) by @chaliy
• fix(security): complete standalone runtime audits (#2774) by @chaliy

Full Changelog: v0.19.0...v0.20.0

Release v0.19.0

Highlights

• Interactive terminals for applications and agents. In-process terminals provide screen text, scrollback, input, interrupts, and editor/pager commands; Rust, Python, and JavaScript bindings expose the terminal alongside TerminalTool (#2509, #2518, #2521, #2523).
• Real CPython in the sandbox. The opt-in cpython feature runs CPython 3.14 as python3 through WebAssembly, with VFS access and HTTP routed through Bashkit's egress boundary. The existing lightweight Python runtime remains available (#2515, #2568).
• Broader shell and utility compatibility. Concurrent pipelines and background jobs, a default root filesystem, symlink traversal, additional everyday commands, and GNU-oriented awk/coreutils behavior expand the scripts Bashkit can run (#2524, #2525, #2526, #2527, #2541, #2583).
• Resource and dependency hardening. Expanded allocation, recursion, input, and output accounting makes resource refusals explicit across the interpreter and builtins; dependency updates address published advisories (#2452, #2468, #2725, #2733, #2734, #2696).
• Breaking change: ScriptedTool moves to its own package. Rust callers replace bashkit's scripted_tool feature and imports with bashkit-scripted-tool = "0.19" / bashkit_scripted_tool; replace builder.tool_registry(registry) with registry.install(builder). Python imports move from bashkit to bashkit.scripted; JavaScript imports move from @everruns/bashkit to @everruns/bashkit/scripted. See the migration guide (#2519, #2520).

What's Changed

• fix(hextools): report a missing operand the way real od does (#2438) by @chaliy
• fix(parser): keep } inside a word unless it stands alone (#2439) by @chaliy
• fix(builtins): report unreadable operands with the real errno text (#2440) by @chaliy
• fix(grep): send read diagnostics to stderr and exit 2 (#2441) by @chaliy
• fix(grep): align with GNU grep and gate the spec suite against it (#2442) by @chaliy
• fix(interpreter): terminate command-resolution diagnostics with a newline (#2443) by @chaliy
• fix(head,tail): support GNU count forms (negative, suffixes, tail -c) (#2449) by @chaliy
• fix(interpreter): read file for $(<file) and run redirect-only commands (#2450) by @chaliy
• fix(awk): treat multi-char FS and split() separators as regexes (#2451) by @chaliy
• fix(builtins): report resource caps instead of truncating silently (#2452) by @chaliy
• fix(awk): cap string, field and variable memory growth (#2453) by @chaliy
• fix(jq): meter live values so growth stops at a limit (#2454) by @chaliy
• fix(awk): make expression format errors fatal (#2458) by @chaliy
• fix(limits): bound shell recursion by host stack safety (#2464) by @chaliy
• fix(limits): fail execution on rejected scalar assignment (#2466) by @chaliy
• fix(release): drop unsupported forwarded CLI features (#2461) by @chaliy
• fix(wasm): bound blocking sleep by execution timeout (#2460) by @chaliy
• fix(python): bound Deep Agents VFS searches (#2457) by @chaliy
• fix(sed): bound output growth during execution (#2455) by @chaliy
• fix(limits): meter array contents against the variable byte budget (#2468) by @chaliy
• fix(jq): bound recursive filter execution (#2467) by @chaliy
• fix(interpreter): meter resource usage for $(<file) command substitutions (#2469) by @chaliy
• test(jq): pin cap-test timeouts so sanitizer builds cannot race the deadline (#2470) by @chaliy
• chore(deps): resync auxiliary workspace lockfiles with the workspace (#2471) by @chaliy
• chore(deps): bump the site-npm group in /site with 3 updates (#2472) by @app/dependabot
• chore(deps): bump the js-npm group in /crates/bashkit-js with 6 updates (#2473) by @app/dependabot
• chore(deps): bump the docs-grep-agent-uv group in /examples/docs-grep-agent with 4 updates (#2474) by @app/dependabot
• chore(deps): bump the examples-npm group across 2 directories with 6 updates (#2475) by @app/dependabot
• chore(ci): bump the github-actions group with 2 updates (#2478) by @app/dependabot
• fix(deps): patch wasmtime for RUSTSEC-2026-0315 and RUSTSEC-2026-0316 (#2486) by @chaliy
• fix(awk): meter reopened getline inputs (#2479) by @chaliy
• fix(headtail): avoid line offset allocation (#2480) by @chaliy
• fix(scripted-tool): sanitize custom builtin errors (#2481) by @chaliy
• fix(changelog): parse asterisk bullets for stale PRs (#2482) by @chaliy
• fix(realfs): protect Windows home mounts (#2484) by @chaliy
• fix(python): reject read-only self mounts (#2483) by @chaliy
• fix(grep): skip operands for quiet zero match limit (#2485) by @chaliy
• chore(deps): bump turso_core from 0.8.0-pre.11 to 0.8.0-pre.13 (#2477) by @app/dependabot
• chore(deps): bump the rust-dependencies group with 7 updates (#2476) by @app/dependabot
• fix(grep): apply -m per file, as GNU does (#2487) by @chaliy
• fix(deps): clear seven dependency advisories across npm and PyPI lockfiles (#2488) by @chaliy
• fix(ci): scan npm and PyPI advisories beside cargo (#2489) by @chaliy
• fix(deps): cover the python random-fs workspace in dependabot (#2490) by @chaliy
• fix(deps): clear the three advisory clusters that turned nightly red (#2498) by @chaliy
• chore(ci): bump taiki-e/install-action from 2.87.20 to 2.87.22 in the github-actions group (#2497) by @app/dependabot
• chore(deps): bump the site-npm group in /site with 2 updates (#2491) by @app/dependabot
• chore(deps): bump the examples-npm group across 1 directory with 4 updates (#2494) by @app/dependabot
• chore(deps): bump the js-npm group in /crates/bashkit-js with 3 updates (#2492) by @app/dependabot
• chore(deps): bump langchain from 1.4.2 to 1.4.3 in /examples/docs-grep-agent in the docs-grep-agent-uv group (#2493) by @app/dependabot
• chore(deps): bump bigdecimal from 0.4.10 to 0.4.11 in the rust-dependencies group (#2495) by @app/dependabot
• chore(deps): bump turso_core from 0.8.0-pre.14 to 0.8.0 (#2496) by @app/dependabot
• fix(deps): unbreak nightly ASan, and clear the http-cache-semantics advisory (#2499) by @chaliy
• chore(deps): bump @langchain/core from 1.2.13 to 1.2.14 in /crates/bashkit-js in the js-npm group (#2500) by @app/dependabot
• chore(deps): bump wrangler from 4.143.0 to 4.145.0 in /site in the site-npm group (#2501) by @app/dependabot
• chore(deps): bump the docs-gre...

Release v0.18.2

Highlights

• sed is GNU-aligned. The stream editor was rewritten after a differential audit against GNU sed 4.9 found 46 mismatches. It adds the missing commands (y = l n N P D T z F r R w W), GNU range-address semantics, \U \L \u \l \E case conversion, a real getopt (-s, -z, -f, -l, attached -i.bak), and it preserves a missing final newline. -i now writes atomically (#2436).
• Windows path fix. VFS paths use forward slashes on every host (#2435).
• Release pipeline hardening. npm publish verification now outlasts the registry cache (#2426), and untrusted workflow code no longer receives the checkout token (#2420).

What's Changed

• fix(sed): GNU-align the stream editor and add the missing commands in #2436
• chore(deps): bump the rust-dependencies group with 5 updates in #2431
• chore(deps): bump the site-npm group in /site with 3 updates in #2428
• chore(deps): bump langchain from 1.4.0 to 1.4.1 in /examples/docs-grep-agent in the docs-grep-agent-uv group in #2430
• chore(deps): bump the examples-npm group across 1 directory with 4 updates in #2432
• chore(deps): bump the js-npm group in /crates/bashkit-js with 5 updates in #2429
• chore(deps): bump clap from 4.6.6 to 4.6.7 in /examples/hyperlight in the example-cargo group across 1 directory in #2434
• chore(ci): bump the github-actions group with 2 updates in #2433
• fix(fs): build VFS paths with forward slashes on every host in #2435
• fix(ci): let npm publish verification outlast the registry cache in #2426
• docs(readme): point computerwelt link to curiosity-ai org in #2424
• test(bench): retry the stub-shell exec past ETXTBSY in #2423
• test(ci): scope the broad-token probe to the injected token in #2422
• fix(ci): un-quarantine the bun canary job in #2421
• fix(ci): stop handing the checkout token to untrusted workflow code in #2420

Full Changelog: v0.18.1...v0.18.2

Release v0.18.1

Highlights

• ScriptedTool builtins can now use clap. ScriptedToolBuilder::builtin(...) registers a raw-argv builtin alongside ToolDef tools, so commands needing positionals, short flags, --, or parse-time required-argument checking work inside a ScriptedTool (#2408).
• Closed schemas reject unknown flags. With "additionalProperties": false, an unrecognised flag is now an error naming the valid flags instead of a silently-dropped property, and clap output is stripped of ANSI codes (#2408).

What's Changed

• chore(deps): bump actions/download-artifact from 6 to 7 in #2414
• chore(deps): bump actions/upload-artifact from 5 to 6 in #2413
• chore(deps): bump pypa/gh-action-pypi-publish from 1.12.1 to 1.13.0 in #2412
• chore(deps): bump actions/checkout from 5 to 6 in #2411
• chore(deps): bump actions/setup-node from 5 to 6 in #2410
• chore(deps): bump actions/setup-python from 5 to 6 in #2409
• feat(scripted_tool): let ScriptedTool builtins use clap in #2408
• chore(deps): bump github/codeql-action from 3 to 4 in #2406
• chore(deps): bump pypa/cibuildwheel from 3.1 to 3.2 in #2405
• chore(deps): bump actions/cache from 4 to 5 in #2404
• chore(deps): bump ast-grep from 0.40.1 to 0.41.0 in #2403
• chore(deps): bump the npm_and_yarn group with 2 updates in #2402
• chore(deps): bump actions/stale from 9 to 10 in #2401
• fix(docs-grep-agent): reject zero-context matches with a helpful error in #2400
• fix(capi): make trybuild a dev-dependency with idiomatic assertions in #2399
• chore(deps): bump astral-sh/setup-uv from 6 to 7 in #2398
• chore(deps): bump crate-ci/typos from 1.35 to 1.36 in #2397
• docs(eval): record variadic builtins limitation L30 in #2395

Full Changelog: v0.18.0...v0.18.1

Release v0.18.0

[0.18.0] - 2026-09-10

Highlights

• Security hardening. The Rust update takes russh 0.63.1 security fixes
  (#2365), sqlite budgets account
  for work performed inside a single engine step (TM-SQL-014)
  (#2369), the host-environment hole
  in builtins is closed
  (#2385), and tabled 0.22 retires
  RUSTSEC-2026-0173
  (#2379).
• C ABI improvements. The C ABI exposes host-directory mounts, bringing native
  embeddings to parity with other host bindings
  (#2371).

What's Changed

• fix(host-call): enforce the execution deadline while parked by @chaliy in #2349
• chore(ci): bump taiki-e/install-action from 2.86.3 to 2.86.5 in the github-actions group by @app/dependabot in #2354
• chore(deps): bump @langchain/core from 1.2.8 to 1.2.9 in /crates/bashkit-js in the js-npm group by @app/dependabot in #2350
• chore(deps): bump the site-npm group in /site with 3 updates by @app/dependabot in #2352
• chore(deps): bump the examples-npm group across 2 directories with 6 updates by @app/dependabot in #2353
• chore(deps): bump wasmtime from 47.0.4 to 48.0.0 in /examples/hyperlight/host in the example-cargo group across 1 directory by @app/dependabot in #2355
• chore(deps): bump turso_core from 0.8.0-pre.4 to 0.8.0-pre.7 by @chaliy in #2356
• chore(deps): move chacha20 off yanked 0.10.1 by @chaliy in #2357
• chore(security): record why the rsa advisory suppression stops matching by @app/claude in #2358
• chore(deps): bump the js-npm group in /crates/bashkit-js with 2 updates by @app/dependabot in #2359
• chore(deps): bump the site-npm group in /site with 3 updates by @app/dependabot in #2361
• chore(deps): bump the examples-npm group across 1 directory with 4 updates by @app/dependabot in #2362
• chore(ci): bump taiki-e/install-action from 2.86.5 to 2.87.0 in the github-actions group by @app/dependabot in #2363
• chore(deps): bump the example-cargo group across 2 directories with 3 updates by @app/dependabot in #2364
• fix(deps): bump rust-dependencies group, taking russh 0.63.1 security fixes by @chaliy in #2365
• fix(bindings): canonicalize runtime mount replay keys by @chaliy in #2366
• fix(sqlite): count work performed inside a single engine step (TM-SQL-014) by @chaliy in #2369
• fix(docs): render inline SVG diagrams correctly by @chaliy in #2368
• chore(bench): add vm-linux-x86_64 benchmark run 2026-09-02 by @chaliy in #2370
• feat(capi): expose host-directory mounts over the C ABI by @tersePrompts in #2371
• chore(maintenance): refresh dependencies and resolve security findings by @chaliy in #2378
• chore(deps): upgrade tabled to 0.22 and retire RUSTSEC-2026-0173 by @chaliy in #2379
• chore(ci): bump the github-actions group with 2 updates by @app/dependabot in #2383
• chore(deps): bump the example-cargo group across 1 directory with 3 updates by @app/dependabot in #2384
• chore(deps): bump the examples-npm group across 1 directory with 3 updates by @app/dependabot in #2382
• fix(builtins): sync uutils coreutils drift and close host-env hole by @chaliy in #2385
• chore(deps): stop dependabot reopening the unbuildable get-size2 bump by @chaliy in #2386
• docs(readme): add Java and Elixir community bindings by @chaliy in #2390
• fix(fs): set RealFs mtime with FILE_WRITE_ATTRIBUTES on Windows by @chaliy in #2391
• fix(awk): stop number lexer swallowing following +/- operators by @chaliy in #2392
• feat(bindings): add read-only filesystem mounts by @chaliy in #2393

Full Changelog: v0.17.1...v0.18.0

Release v0.17.1

Highlights

• The native npm package ships again. @everruns/bashkit stalled at 0.16.0
  during the v0.17.0 release because the publish workflow tested Node 20 in
  ways CI no longer did; the release path and CI now agree, and a check fails
  when they drift apart again.

Fixed

• The npm native package publishes again: publish-js.yml no longer runs the
  ava suites on Node 20, which ava 8 dropped support for. Node 20 keeps running
  the runtime-compat suite against the shipped binding, matching how js.yml
  already split them; that suite runs under bash so the Windows runner
  expands its glob, which Node 20 cannot do itself.
• The JS runtime-compat mount and unmount test mounts a real temporary
  directory instead of a hardcoded /tmp, so it passes on the Windows runners
  the release workflow tests on.

Added

• just check-workflow-parity fails when a release workflow tests a runtime
  version CI does not, when a shared test suite is gated to more versions at
  release time than in CI, or when dtolnay/rust-toolchain pins disagree
  across workflows. This class of drift is otherwise invisible until a tag
  exists and part of the release has already published.

Performance

• Ported coreutils builtins reuse pre-built clap Command definitions instead
  of rebuilding them per invocation
  (#2347).

What's Changed

• perf(builtins): cache pre-built clap Commands for ported coreutils builtins (#2347) by @chaliy
• fix(test): mount a real temp dir in the JS runtime-compat suite (#2346) by @chaliy
• fix(release): run the Node 20 compat suite under bash on Windows (#2345) by @chaliy
• fix(release): unblock the npm native publish and catch release/CI matrix drift (#2344) by @chaliy

Full Changelog: v0.17.0...v0.17.1