[chaliy]

What changed

Prepare Bashkit 0.20.0 across Rust, Python, native npm, browser npm, CLI and C ABI artifacts. Synchronize version pins and standalone lockfiles; update dependency examples and release notes. Regenerated Python/TypeScript references have no drift.

Highlights: live command I/O/async sinks; embedded Python/TypeScript host callbacks; optional runtime warm-up; Wasmtime 48.0.7, patched TLS/crypto/Tokio and Node build/runtime guidance.

Why

Ship the security fixes and new APIs since 0.19.0. A minor release reflects the Rust analysis API rename: analysis::CommandContext → CommandPlacement. AnalyzedCommand.context keeps its serialized name/values; root CommandContext now means the live invocation context.

Before / After

Preflight registry baseline: 0.19.0. Local packaged 0.20.0 consumer evidence:

native npm archive consumer: 0.20.0, shell pipeline and scripted export OK
Python wheel version and native import: 0.20.0
935 passed, 20 skipped in 12.40s

Publish-readiness:

• just pre-pr: 7,259 Rust tests, script/docs/workflow checks and cargo-vet passed.
• cargo clippy --locked --all-targets --all-features -- -D warnings: passed.
• Exact four-package cargo publish --dry-run --allow-dirty: verified bashkit-cpython-wasm, bashkit, bashkit-cli, bashkit-scripted-tool 0.20.0 together.
• Verified CPython archive: 8,159,855 bytes, below 10 MiB.
• Native npm release build, 681 AVA tests, archive install/shell consumer passed.
• Python release wheel build/install and 935 tests passed; 20 optional integration/platform skips in local tool environment. CI supplies the broader framework/runtime matrix.
• Browser release build: 76 tests passed; runtime-enabled bundle: 24 tests passed. Local Binaryen 130; hosted builds use the existing pinned Binaryen 125.
• All four workspace metadata graphs validate --locked.
• just check-nightly: last three nightly and fuzz runs all green; exact final-head nightly 40145150204 passed Audit, Security Analysis, Miri and AddressSanitizer.

Risk

• Medium: merging this release preparation deliberately triggers the established tag/release/publication workflows. Registry bytes/tags must remain immutable.
• Rust callers using the old static-analysis enum must migrate to CommandPlacement.
• RSA Marvin remains accepted for opt-in SSH without an upstream patch; Ed25519 avoids RSA private operations. atomic-polyfill remains unmaintained. Node 18/20 compatibility is not security support. Downstream Rust lockfiles still need refresh/rebuild.
• No credential or trust-policy changes; no claim that every dependency vulnerability is eliminated.

Checklist

• Existing tests and packaged consumers validated; no implementation code paths changed
• Backward compatibility considered and migration documented
• Security caveats preserved without weakening audit gates
• Exact-head CI/nightly green and review comments resolved before merge (52 passing PR checks; final head 332ac9778c9c07e63724eab493406b4f59e8d936)

After merge: verify immutable tag/source, all four crates, PyPI wheels/sdist, both npm latest tags and archive integrity, CLI/C ABI platform archives/checksums, Homebrew formula, and public consumer smoke. Starting workflows is not completion.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	332ac97	Commit Preview URL Branch Preview URL	Oct 25 2026, 12:03 AM