chore(release): prepare v0.7.0

[chaliy]

Release v0.7.0

100 commits since v0.6.0. Minor bump — additive APIs, no breaking changes.

Highlights

• Ripgrep (rg) parity push — ~80 PRs landed expanding the rg builtin to near-feature-parity with upstream ripgrep: pcre2, multiline, encoding, glob brace/character-class/globstar, comprehensive default file types, ignore-file precedence (parent + global git ignore), preprocessor controls, hyperlink prefixes, ansi/hex colour styles, sort-by-modified, stats, max-filesize, mmap/engine flags, gzip search, follow-symlinks, plus many output-mode and binary-search fixes.
• Host-owned BuiltinRegistry API — embedders (JS, Python, Rust) can now register and remove builtins at any point in the interpreter's lifetime via Bash::builder().builtin_registry(...) and addBuiltin / removeBuiltin on Bash / BashTool. Replaces the rebuild-on-register approach that silently wiped the in-memory VFS. Brought to Python parity via add_builtin / remove_builtin (feat(core,js): host-owned mutable BuiltinRegistry #1721, feat(js): guardrail against executeSync + custom builtin deadlock #1732, feat(python): wire custom builtins through BuiltinRegistry #1733).
• VFS read-only enforcement for live mounts — readonly_filesystem now reliably blocks runtime mount writes (fix(fs): enforce readonly_filesystem for runtime live mounts #1691).
• Maintenance pass — turso 0.5.3→0.6.0, langchain examples to v1.x, fuzz leak-guard hardening, dependency-edge cleanup (chore: deep-maintenance pass — fuzz fix, dep bumps, doc sync #1632, chore: deep-maintenance follow-ups — just vet, count drift, TM-INF-018, deps #1635, chore(deps): bump turso_core 0.5.3 → 0.6.0 #1636, refactor(deps): remove unused dependency edges #1639).

Publish-readiness report

Check	Status
Commit count via GitHub compare API (v0.6.0...main)	100 (matches local after git fetch --unshallow)
CI on main (parent b960f5e)	all green — CI, Coverage, JS, Python
cargo fmt --check	PASS
cargo publish --dry-run -p bashkit (post-publish.yml sed-strip)	PASS at v0.7.0 (packaged successfully)
Doppler secrets — CARGO_REGISTRY_TOKEN, NPM_TOKEN, GITHUB_TOKEN, HOMEBREW_TAP_GITHUB_TOKEN	all present
GitHub env release-python (PyPI OIDC)	exists
Toolchain pin 1.95.0 in rust-toolchain.toml ↔ all workflows	aligned
Version sync — Cargo.toml, crates/bashkit-cli/Cargo.toml, package.json, package-lock.json, Cargo.lock × 7 crates	all at 0.7.0
Registries at 0.6.0 (will be superseded by 0.7.0) — crates.io, PyPI, npm, Homebrew	aligned baseline

Note on cargo dry-run: the workspace monty git dep and python feature cause local cargo publish --dry-run to fail by design; the publish.yml workflow strips them with sed before publishing. I verified the post-strip dry-run packages bashkit v0.7.0 successfully.

Other changes in this PR

• Sync TM-INF-026 entry into the public crates/bashkit/docs/threat-model.md (was only in specs/threat-model.md).
• specs/release-process.md: add step 0 reminding the agent to unshallow the git history and cross-check commit counts against the GitHub compare API — cloud sandboxes ship a shallow clone (depth ≈ 50) which silently hid half the commits during this release prep.

Test plan

• CI green on this PR
• Merge → release.yml creates GitHub Release + tag v0.7.0
• publish.yml, publish-python.yml, publish-js.yml, cli-binaries.yml all complete
• All four registries report v0.7.0: crates.io (bashkit + bashkit-cli), PyPI, npm @everruns/bashkit, Homebrew tap

Full Changelog: v0.6.0...v0.7.0

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	b22ba36	Commit Preview URL Branch Preview URL	May 25 2026, 12:53 AM