chore(release): prepare v0.6.0

[chaliy]

Release v0.6.0

Bumps workspace version 0.5.0 → 0.6.0, regenerates Cargo.lock, syncs bashkit-cli path-dep pin, crates/bashkit-js/package.json + package-lock.json, and adds the v0.6.0 entry to CHANGELOG.md.

Highlights

• Continue coreutils adoption experiment — Extends codegen beyond uu_app() args to vendor whole upstream uutils modules with a manifest and drift-detection CI. tee, mktemp, realpath, stat, and od now flow through codegen; printf runs on a vendored copy of uucore's format implementation; and env is ported through a virtual-env shim (TM-INF-024) (feat(builtins): port uutils env-default surface via virtual-env shim (TM-INF-024) #1592, feat(coreutils-port): add module-vendor mode with manifest and drift CI #1593, refactor(builtins): port tee/mktemp/realpath/stat/od to codegen args #1594).
• MCP server mode removed from CLI — bashkit mcp and its CLI transport are gone; embed bashkit via the library bindings instead (breaking — see below).
• Security hardening across the sandbox — Fail-closed fixes across realfs, snapshot/restore, sqlite (VACUUM rejected, row caps, engine cache invalidation), network (SSRF precheck fails closed, IPv4-mapped IPv6 normalization), jq (halt replaced; fancy-regex + file-binding caps), and ssh (sftp ls escaping, try none-auth first). The final 6 OPEN threat-model entries are now mitigated (docs(threat-model): mark final 6 OPEN entries mitigated #1568).

Breaking Changes

• CLI MCP server mode removed: the bashkit mcp subcommand and bundled MCP server transport are gone. Migrate by embedding bashkit via the library bindings (bashkit crate, @everruns/bashkit on npm, bashkit on PyPI) and exposing tools through your own MCP server.

Publish-readiness report

• Manifest version sync — Cargo.toml, crates/bashkit-cli/Cargo.toml (path-dep pin), crates/bashkit-js/package.json, crates/bashkit-js/package-lock.json (top-level + packages.""), and Cargo.lock all read 0.6.0.
• Registry freshness — cargo search bashkit / cargo search bashkit-cli / npm view @everruns/bashkit version / pip index versions bashkit all return 0.5.0; 0.6.0 is the next version on every registry.
• cargo fmt --check — clean.
• cargo clippy --all-targets --all-features -- -D warnings — clean.
• cargo test --workspace — passes (workspace + doctests; CARGO_PROFILE_*_DEBUG=0 set locally so test binaries fit in the runner's disk).
• cargo publish --dry-run -p bashkit --allow-dirty — passes after the same monty/python-feature strip that .github/workflows/publish.yml performs at publish time (matches the existing CI flow).
• cargo publish --dry-run -p bashkit-cli --allow-dirty — fails locally with failed to select a version for the requirement bashkit = "^0.6.0" because bashkit 0.6.0 isn't on crates.io yet. This is the expected order — publish-bashkit runs first in publish.yml, then publish-bashkit-cli resolves the new version. No action needed.
• PyPI / npm packaging — no packaging-touching changes in this release, so the maturin build / napi build smoke tests were skipped per specs/release-process.md step 5.

Post-merge

Once merged, release.yml will tag v0.6.0, publish a GitHub Release from the changelog entry, and dispatch publish.yml, publish-python.yml, publish-js.yml, and cli-binaries.yml. I'll watch the workflows and verify all four targets (crates.io, PyPI, npm, Homebrew) report 0.6.0 before declaring the release shipped.

Full Changelog: v0.5.0...v0.6.0

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	4de8403	Commit Preview URL Branch Preview URL	May 17 2026, 12:29 AM