• history and fc under set -o history or bash -i, with HISTSIZE, HISTFILESIZE, histappend and HISTFILE in the VFS. fc reruns commands but opens no editor.
• complete, compgen and compopt with all actions.
• bind with bash’s default emacs bindings.
• ${x@P} prompt decoding.
• A bash -i child shell with PS1, PS2 and PS4 defaults, ~/.bashrc or --rcfile, and --norc.

The Oils spec pass rate went from 89.0% to 92.8%.

See the compatibility scorecard and #2648.

let mut tool = TerminalTool::new(Bash::builder());
let out = tool.call(json!({"input": "vi /tmp/n.txt<Enter>"})).await?;

TerminalTool::with_sessions adds up to 8 named tabs that share the filesystem and keep running in the background. Python (bashkit.Terminal) and Node (Terminal in @everruns/bashkit) expose the same calls.

See Terminal, #2509, #2518, #2521, #2523 and #2548.

Twenty-one commands that used to report “command not found” are added: arch, sum, shasum, egrep, fgrep, link, unlink, chgrp, nohup, nice, flock, getconf, tty, sync, hostid, groups, logname, users, who, uptime and free. cmd N>file with N of 3 or more now opens only fd N.

See the compatibility scorecard, #2551 and #2546.

let mut bash = Bash::builder().cpython().build();

CPython runs as a WebAssembly guest on wasmtime, started per call from a precompiled snapshot, with limits on time, memory, output and the VFS. urllib.request, http.client and Bashkit’s own requests and httpx modules make HTTP calls through the same allowlist and credential injection as curl.

See CPython, #2515, #2568 and #2572.

Pipeline stages that run shell code, such as loops, groups and functions, now stream into each other through a pipe with backpressure. When a reader stops, the writer gets SIGPIPE and exits with 141, so while :; do echo x; done | head -n 2 prints two lines as in bash.

Both are on by default; BashBuilder::concurrent_jobs(false) turns them off.

See the compatibility scorecard, #2527 and #2541.

On Bashkit’s Debian-oracle awk tests, the pass rate went from 51.5% to 93.8%. Resource caps still apply, and split and record splitting count against the memory cap.

See the compatibility scorecard, #2583 and #2561.

Session files take precedence, and the layer uses no quota and is never snapshotted. Turn it off with:

let bash = Bash::builder().rootfs(false).build();

See Filesystem and #2525.

Highlights

• sed is GNU-aligned. The stream editor was rewritten after a differential audit against GNU sed 4.9 found 46 mismatches. It adds the missing commands (y = l n N P D T z F r R w W), GNU range-address semantics, \U \L \u \l \E case conversion, a real getopt (-s, -z, -f, -l, attached -i.bak), and it preserves a missing final newline. -i now writes atomically (#2436).
• Windows path fix. VFS paths use forward slashes on every host (#2435).
• Release pipeline hardening. npm publish verification now outlasts the registry cache (#2426), and untrusted workflow code no longer receives the checkout token (#2420).

• sed is rewritten to follow GNU sed 4.9

See the GitHub release and the full release notes for every pull request in this version.

The same release builds VFS paths with forward slashes on every host, including Windows.

See the compatibility scorecard, #2436 and #2435.

.builtin("get_agent", Box::new(GetAgent))

A tool whose schema sets "additionalProperties": false now rejects an unknown flag with an error that names the valid flags, instead of silently dropping it. clap output is stripped of ANSI codes.

See Scripted tools, clap builtins and #2408.

Highlights

• ScriptedTool builtins can now use clap. ScriptedToolBuilder::builtin(...) registers a raw-argv builtin alongside ToolDef tools, so commands needing positionals, short flags, --, or parse-time required-argument checking work inside a ScriptedTool (#2408).
• Closed schemas reject unknown flags. With "additionalProperties": false, an unrecognised flag is now an error naming the valid flags instead of a silently-dropped property, and clap output is stripped of ANSI codes (#2408).

• ScriptedTool accepts clap-based builtins

See the GitHub release and the full release notes for every pull request in this version.

bash.mount("/corpus", corpus, read_only=True)

C ABI mounts. The C API can mount real host directories, through mounts in the config or bashkit_mount and bashkit_unmount on a running session. Each root must resolve under an allowed_mount_paths prefix and pass the sensitive-path denylist. With no allowlist, every mount is rejected.

See Live mounts, C API, #2393 and #2371.

Highlights

• Security hardening. The Rust update takes russh 0.63.1 security fixes
• C ABI improvements. The C ABI exposes host-directory mounts, bringing native

• Read-only host directory mounts, also over the C ABI

See the GitHub release and the full release notes for every pull request in this version.

Highlights

• The native npm package ships again. @everruns/bashkit stalled at 0.16.0

See the GitHub release and the full release notes for every pull request in this version.

Highlights

• Bashkit runs as a plain wasm component, with no JS engine and no WASI.
• Untrusted input costs bounded work everywhere it is parsed. Script
• Sandbox escapes closed at the host boundary. The host bridge no longer
• **The always-on dependency graph is 21 crates smaller and the browser wasm
• **Every cargo lockfile in the tree is audited, clearing 16 wasmtime

• TLS backend and timezone data become explicit features
• Runs as a WebAssembly component without JS or WASI

Before upgrading, read the breaking changes: TLS backend and timezone data become explicit features.

See the GitHub release and the full release notes for every pull request in this version.

Dependencies that assumed a JavaScript host, such as the clock, timers and entropy source, moved behind a new wasm_js feature that the JS packages enable and other builds leave off. The bashkit crate also builds for wasm32-wasip2, checked in CI.

See the Hyperlight example, #2311 and #2310.

• http_client no longer implies a rustls crypto backend. Add ring (the previous behavior, on by default) or aws-lc-rs for a FIPS-capable backend. Enabling neither is a compile error.
• Timezone data is behind the tzdata feature. Without it, date with TZ=<named zone> exits 1 instead of printing a UTC time.

bashkit = { version = "0.17", default-features = false, features = ["http_client", "ring", "tzdata"] }

Non-ASCII domain names in HTTP allowlists are now rejected rather than normalized; use their punycode form.

See Networking, #2317 and #2321.