Added consistent non-empty version output for:

curl --version in packages/bare-os-coreutils/src/curl.js
wget --version in packages/bare-os-coreutils/src/wget.js
openssl version and openssl --version in packages/bare-os-coreutils/src/openssl.js
nano --version (via edit) in packages/bare-os-coreutils/src/edit.js
Updated tar compatibility in packages/bare-os-booter/lib/tar-cli.js:

Added tar --version
Added grouped short-flag parsing (-czf, etc.)
Added first-arg legacy cluster parsing (czf)
Added - archive target support for create/list/extract stream paths
Kept implementation as ustar subset (accepts z for compatibility parsing)
Fixed pipeline/timeout behavior:

Optimized head line mode to stop scanning early (no full split) in packages/bare-os-coreutils/src/head.js
Added bounded safety for yes cap in packages/bare-os-coreutils/src/yes.js
Hardened timeout so timed-out commands reliably produce exit code 124 in packages/bare-os-coreutils/src/timeout.js
Added scoped expr compatibility in shell:

Prevented pathname expansion of bare * only for expr arithmetic-token case in packages/bare-os-booter/lib/shell.js
Added glob option plumbing in packages/bare-os-booter/lib/shell-glob.js

kernel/bin/curl

@@ -93,6 +93,12 @@ function bareOsEmitRaw(ctx, chunk) {
  * `ctx.bareOsRunCurlCli` so behavior stays fetch-based and consistent.
  */
 async function run(ctx, argv) {
+  for (let i = 1; i < argv.length; i++) {
+    if (argv[i] === '--version' || argv[i] === '-V') {
+      ctx.console.log('curl (Bare OS fetch subset) 0.1 — not libcurl')
+      return
+    }
+  }
   if (typeof ctx.bareOsRunCurlCli === 'function') {
     await ctx.bareOsRunCurlCli(argv)
     return

kernel/bin/edit

@@ -1555,6 +1555,11 @@ async function bareOsRunEditTui(ctx, opts) {
 
 async function run(ctx, argv) {
   const args = argv.slice(1)
+  if (args.includes('--version') || args.includes('-V')) {
+    const name = argv[0] || 'edit'
+    ctx.console.log(`${name} (Bare OS editor) 0.1`)
+    return
+  }
   if (args.includes('-h') || args.includes('--help')) {
     ctx.console.log(
       'usage: ' +

kernel/bin/head

@@ -162,6 +162,19 @@ async function run(ctx, argv) {
 
   const files = argv.slice(i).filter((x) => x !== '--')
 
+  const takeFirstLines = (s, maxLines) => {
+    if (maxLines <= 0 || !s) return ''
+    let idx = 0
+    let seen = 0
+    while (seen < maxLines) {
+      const nl = s.indexOf('\n', idx)
+      if (nl === -1) return s
+      seen++
+      idx = nl + 1
+    }
+    return s.slice(0, idx)
+  }
+
   const takeString = (s) => {
     if (mode === 'bytes') {
       const u8 = ctx.b4a.from(s, 'utf8')
@@ -170,11 +183,8 @@ async function run(ctx, argv) {
       if (out) ctx.console.log(out)
       return
     }
-    const lines = s.split('\n')
-    const out = lines.slice(0, n).join('\n')
-    ctx.console.log(
-      out + (out && !out.endsWith('\n') && lines.length > n ? '\n' : '')
-    )
+    const out = takeFirstLines(s, n)
+    if (out) ctx.console.log(out)
   }
 
   const takeU8 = (u8) => {

kernel/bin/nano

@@ -1555,6 +1555,11 @@ async function bareOsRunEditTui(ctx, opts) {
 
 async function run(ctx, argv) {
   const args = argv.slice(1)
+  if (args.includes('--version') || args.includes('-V')) {
+    const name = argv[0] || 'edit'
+    ctx.console.log(`${name} (Bare OS editor) 0.1`)
+    return
+  }
   if (args.includes('-h') || args.includes('--help')) {
     ctx.console.log(
       'usage: ' +

kernel/bin/openssl

@@ -91,6 +91,16 @@ function bareOsEmitRaw(ctx, chunk) {
  * OpenSSL CLI compatibility via booter `openssl-cli.js` (bare-crypto).
  */
 async function run(ctx, argv) {
+  for (let i = 1; i < argv.length; i++) {
+    if (argv[i] === '--version' || argv[i] === '-V') {
+      ctx.console.log('OpenSSL (Bare OS crypto subset) 0.1')
+      return
+    }
+  }
+  if (argv[1] === 'version' && argv.length === 2) {
+    ctx.console.log('OpenSSL (Bare OS crypto subset) 0.1')
+    return
+  }
   if (typeof ctx.bareOsRunOpensslCli === 'function') {
     await ctx.bareOsRunOpensslCli(argv)
     return

kernel/bin/timeout

@@ -129,7 +129,12 @@ async function run(ctx, argv) {
     24 * 3600 * 1000
   )
   const ac = new AbortController()
-  const timer = setTimeout(() => ac.abort(), timeoutMs)
+  let timedOut = false
+  const timer = setTimeout(() => {
+    timedOut = true
+    ac.abort()
+  }, timeoutMs)
+  const priorExit = Number(ctx.exitCode) || 0
   try {
     if (typeof ctx.runBinCommand !== 'function') {
       ctx.console.error('timeout: runBinCommand is not available')
@@ -140,15 +145,20 @@ async function run(ctx, argv) {
       signal: ac.signal,
       timeoutMs: timeoutMs + 500
     })
+    if (timedOut) {
+      ctx.exitCode = 124
+    }
   } catch (e) {
     const name = e && /** @type {{ name?: string }} */ (e).name
     const msg = String((e && e.message) || e || '')
-    if (name === 'AbortError' || /abort/i.test(msg)) {
+    if (timedOut || name === 'AbortError' || /abort/i.test(msg)) {
       ctx.exitCode = 124
     } else {
       ctx.exitCode = 1
     }
   } finally {
     clearTimeout(timer)
+    if (timedOut && ctx.exitCode !== 124) ctx.exitCode = 124
+    if (!timedOut && ctx.exitCode == null) ctx.exitCode = priorExit
   }
 }

kernel/bin/wget

@@ -92,6 +92,12 @@ function bareOsEmitRaw(ctx, chunk) {
  * Fallback uses `ctx.bareOsRunWgetCli` for the same Fetch-based implementation.
  */
 async function run(ctx, argv) {
+  for (let i = 1; i < argv.length; i++) {
+    if (argv[i] === '--version' || argv[i] === '-V') {
+      ctx.console.log('wget (Bare OS fetch subset) 0.1 — not GNU wget2')
+      return
+    }
+  }
   if (typeof ctx.bareOsRunWgetCli === 'function') {
     await ctx.bareOsRunWgetCli(argv)
     return

kernel/bin/yes

@@ -97,7 +97,10 @@ async function run(ctx, argv) {
     }
   }
   const msg = argv.slice(1).join(' ') || 'y'
+  const rawCap = parseInt(ctx.vfs.env.BARE_OS_YES_MAX_LINES || '50000', 10)
   const cap =
-    parseInt(ctx.vfs.env.BARE_OS_YES_MAX_LINES || '100000', 10) || 100000
+    Number.isFinite(rawCap) && rawCap > 0
+      ? Math.min(rawCap, 200000)
+      : 50000
   for (let n = 0; n < cap; n++) ctx.console.log(msg)
 }

kernel/etc/bare-os/posix_utilities.json

@@ -1,7 +1,7 @@
 {
   "schema": 2,
   "profileId": "bare-os-posix-like",
-  "generatedAt": "2026-04-27T11:57:59.596Z",
+  "generatedAt": "2026-04-27T12:05:37.921Z",
   "note": "Sparse POSIX Issue 7 coverage hints for /bin utilities. Omitted command names are not yet profiled here.",
   "commandIndex": [
     {

kernel/lib/bare/shell-completion.json

@@ -1,6 +1,6 @@
 {
   "schema": 1,
-  "atMs": 1777291079595,
+  "atMs": 1777291537920,
   "commands": [
     "agent",
     "appctl",