diff --git a/.claude-plugin/plugin.json b/.claude-plugin/plugin.json
index e7489e2..8fa7ef5 100644
--- a/.claude-plugin/plugin.json
+++ b/.claude-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "sshx",
-  "version": "0.20.0",
+  "version": "0.20.1",
   "description": "Agent-oriented remote host execution over SSH — JSON results, dry-run plans, safety rails, audit trail, MCP server, and an installable Agent skill.",
   "author": {
     "name": "talkincode",
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3c638bd..8eb88ca 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -78,6 +78,18 @@ jobs:
               -o "$output" \
               ./cmd/sshx
 
+            # Earlier artifacts must not make later builds appear modified.
+            # Reject missing or dirty VCS evidence before signing/publishing.
+            go version -m "$output" > /tmp/sshx-build-metadata.txt
+            if ! grep -Fq 'vcs.modified=false' /tmp/sshx-build-metadata.txt; then
+              echo "Release binary lacks clean VCS provenance: $output" >&2
+              exit 1
+            fi
+            if ! grep -Fq "vcs.revision=$(git rev-parse HEAD)" /tmp/sshx-build-metadata.txt; then
+              echo "Release binary VCS revision differs from the release commit" >&2
+              exit 1
+            fi
+
             cp skills/sshx/SKILL.md dist/SKILL.md
 
             # 压缩二进制文件
diff --git a/.gitignore b/.gitignore
index 075d000..d050e6e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -8,5 +8,6 @@ coverage.out
 __debug_bin*
 coverage.*
 bin/*
+/dist/
 /sshx
 /book
diff --git a/CHANGELOG.md b/CHANGELOG.md
index ca316ed..8793922 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.20.1] - 2026-10-27
+
+### Fixed
+
+- Keep release output under an ignored `dist/` directory so packaging an
+  earlier platform cannot mark later binaries as dirty builds.
+- Fail the release before signing or publishing unless every binary records
+  `vcs.modified=false` and the exact release commit. Runtime behavior retains
+  the v0.20.0 execution-safety fixes and Go 1.26.10 baseline.
+
 ## [0.20.0] - 2026-10-27
 
 ### Security
@@ -894,7 +904,8 @@ diagnostics).
 - CI/CD workflow and automated release process
 - Tag creation script
 
-[Unreleased]: https://github.com/talkincode/sshx/compare/v0.20.0...HEAD
+[Unreleased]: https://github.com/talkincode/sshx/compare/v0.20.1...HEAD
+[0.20.1]: https://github.com/talkincode/sshx/compare/v0.20.0...v0.20.1
 [0.20.0]: https://github.com/talkincode/sshx/compare/v0.19.1...v0.20.0
 [0.19.1]: https://github.com/talkincode/sshx/compare/v0.19.0...v0.19.1
 [0.19.0]: https://github.com/talkincode/sshx/compare/v0.18.0...v0.19.0
diff --git a/plugin.json b/plugin.json
index b2f1487..111ddd5 100644
--- a/plugin.json
+++ b/plugin.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "sshx",
-  "version": "0.20.0",
+  "version": "0.20.1",
   "description": "Agent-oriented remote host execution over SSH — JSON results, dry-run plans, safety rails, audit trail, MCP server, and an installable Agent skill.",
   "author": {
     "name": "talkincode",