chore(release): bump version to 3.6.0

- Bump Rust/Node/Python package versions + lockfiles to 3.6.0
- Finalize CHANGELOG [3.6.0]: Boundaries + <env> + with_llm_client seam,
  tool-arg log redaction, stderr fix, Planner pruning
- README: add 'What's new in 3.6'

Author: claude

CHANGELOG.md

@@ -5,7 +5,11 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [Unreleased]
+## [3.6.0] - 2026-06-14
+
+A system-prompt hardening pass plus framework-vs-host boundary tightening:
+inject safety boundaries and live environment grounding, redact secrets from
+logs, and wire the LLM-client extension seam through the public API.
 
 ### Added
 

Cargo.lock

@@ -33,6 +33,31 @@ Intent -> Context -> Action -> Observation -> Verification -> Compaction
 
 Everything else is an extension of that loop.
 
+### What's new in 3.6
+
+- **Safety boundaries in every prompt** — a single-source `## Boundaries` block
+  (treat file/tool/web content as untrusted **data**, not instructions; never
+  hardcode/commit/echo/log secrets; defensive-security only) is injected into
+  every assembled system prompt, across all agent styles and delegated
+  subagents.
+- **`<env>` grounding block** — each turn the system prompt carries today's date,
+  host platform, and working directory, computed fresh (no shell-out). Pins the
+  current date the model cannot infer past its training cutoff, cutting date /
+  path / platform mistakes.
+- **`SessionOptions::with_llm_client`** (Rust embedding API) — inject a custom
+  `Arc<dyn LlmClient>` (unsupported provider, deterministic record/replay client,
+  or proxy/audit wrapper). The Action-layer backend is now object-injectable like
+  workspace/memory/store/security; the `provider/model` config stays the default
+  (and remains the way SDK hosts pick a backend).
+- **Secret-safe logging** — tool invocations no longer log raw argument values
+  (which were also OTLP-exported); only the tool name, argument field names, and
+  payload size are logged at `info!`. Sharper tool-usage and response guidance
+  (prefer dedicated tools over shelling out; confirm a dependency before using
+  it; don't re-print already-read code or write unsolicited report files).
+- **Pruning** — the framework no longer writes to the host's stderr (a stray
+  debug `eprintln!` is now structured `tracing`), and the dead `Planner` trait
+  was removed.
+
 ### What's new in 3.5
 
 - **Programmable Workflow facade** — `AgentSession::workflow()` returns a

README.md

@@ -1,6 +1,6 @@
 [package]
 name = "a3s-code-core"
-version = "3.5.0"
+version = "3.6.0"
 edition = "2021"
 authors = ["A3S Lab Team"]
 license = "MIT"

core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "a3s-code-node"
-version = "3.5.0"
+version = "3.6.0"
 edition = "2021"
 authors = ["A3S Lab Team"]
 license = "MIT"
@@ -11,7 +11,7 @@ description = "A3S Code Node.js bindings - Native addon via napi-rs"
 crate-type = ["cdylib"]
 
 [dependencies]
-a3s-code-core = { version = "3.5.0", path = "../../core", features = ["ahp", "s3"] }
+a3s-code-core = { version = "3.6.0", path = "../../core", features = ["ahp", "s3"] }
 napi = { version = "2", features = ["async", "napi6", "serde-json"] }
 napi-derive = "2"
 tokio = { version = "1.35", features = ["full"] }

sdk/node/Cargo.toml

@@ -1,6 +1,6 @@
 {
   "name": "@a3s-lab/code",
-  "version": "3.5.0",
+  "version": "3.6.0",
   "description": "A3S Code - Native Node.js bindings for the coding-agent runtime",
   "main": "index.js",
   "types": "index.d.ts",
@@ -43,11 +43,11 @@
     "test:helpers": "node test-helpers.mjs"
   },
   "optionalDependencies": {
-    "@a3s-lab/code-darwin-arm64": "3.5.0",
-    "@a3s-lab/code-linux-x64-gnu": "3.5.0",
-    "@a3s-lab/code-linux-x64-musl": "3.5.0",
-    "@a3s-lab/code-linux-arm64-gnu": "3.5.0",
-    "@a3s-lab/code-linux-arm64-musl": "3.5.0",
-    "@a3s-lab/code-win32-x64-msvc": "3.5.0"
+    "@a3s-lab/code-darwin-arm64": "3.6.0",
+    "@a3s-lab/code-linux-x64-gnu": "3.6.0",
+    "@a3s-lab/code-linux-x64-musl": "3.6.0",
+    "@a3s-lab/code-linux-arm64-gnu": "3.6.0",
+    "@a3s-lab/code-linux-arm64-musl": "3.6.0",
+    "@a3s-lab/code-win32-x64-msvc": "3.6.0"
   }
 }

sdk/node/examples/package-lock.json

@@ -7,7 +7,7 @@ name = "a3s-code"
 # Keep in sync with crates/code core release. The bootstrap loader fetches
 # the matching native wheel from `https://github.com/AI45Lab/Code/releases/tag/v<version>`
 # at import time.
-version = "3.5.0"
+version = "3.6.0"
 description = "A3S Code Python SDK — pure-Python bootstrap that fetches the native wheel from GitHub Releases"
 readme = "README.md"
 license = {text = "MIT"}

sdk/node/package-lock.json

@@ -31,7 +31,7 @@
 
 # Version is the bootstrap's own version, which equals the matching native
 # wheel version on GH Releases. Bumped by the release workflow.
-__version__ = "3.5.0"
+__version__ = "3.6.0"
 
 _DEFAULT_BASE_URL = "https://github.com/AI45Lab/Code/releases/download"
 _REQUEST_TIMEOUT_S = 120