chore(release): bump version to 1.0.2

- Add CHANGELOG entries for v1.0.1 and v1.0.2
- Align index.d.ts with Rust Node.js binding (13 missing methods)
- Bump all package versions to 1.0.2
- Convert Node.js examples from .js to .ts
- Update Python examples to sync API
- Add memory tier APIs, queue metrics, security hardening

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: hikejs

cli/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "a3s-code-cli"
-version = "1.0.0"
+version = "1.0.2"
 edition = "2021"
 authors = ["A3S Lab Team"]
 license = "MIT"

core/CHANGELOG.md

@@ -7,6 +7,40 @@ This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.htm
 
 ---
 
+## [1.0.2] - 2026-03-04
+
+### New Features
+
+- **HCL `env()` function** — `env("VAR")` resolves environment variables at parse time; returns null if unset.
+- **HCL verbatim blocks** — `env {}` and `headers {}` blocks preserve keys verbatim (no camelCase conversion).
+- **Memory tier APIs** — `getWorking()`, `clearWorking()`, `getShortTerm()`, `clearShortTerm()` exposed in Node.js and Python SDKs.
+- **Queue metrics** — `queueMetrics()` returns a `MetricsSnapshot` with counters, gauges, and histograms.
+
+### Improvements
+
+- **Security hardening** — Enhanced default redaction patterns and robust regex in grep/ls tools.
+- **Windows path compatibility** — `canonicalize()` now strips `\\?\` UNC prefix on Windows.
+- **RwLock poison recovery** — `read_or_recover()` / `write_or_recover()` prevent panics from poisoned locks.
+- **Node.js TypeScript definitions** — Added 13 missing method declarations to `index.d.ts` (lane queue, memory API, session metadata).
+- **Documentation** — All example pages updated: Python sync API, TypeScript code blocks, correct event field names.
+
+---
+
+## [1.0.1] - 2026-03-03
+
+### New Features
+
+- **MCP live tool injection** — Agent loop refreshes tool list from live `ToolExecutor` each turn.
+- **MCP error tracking** — `McpManager.connect_errors` tracks per-server failures, exposed in `mcpStatus()`.
+- **SDK introspection** — `toolNames()`, `toolDefinitions()`, `refreshMcpTools()` in both Node.js and Python SDKs.
+- **MCP removal** — `removeMcpServer()` for session-level MCP cleanup.
+
+### Bug Fixes
+
+- **Node.js stream fix** — `stream()` return type corrected to `Promise<EventStream>` in TypeScript definitions.
+
+---
+
 ## [1.0.0] - 2026-03-02
 
 ### New Features

core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "a3s-code-core"
-version = "1.0.1"
+version = "1.0.2"
 edition = "2021"
 authors = ["A3S Lab Team"]
 license = "MIT"

core/src/agent_api.rs

@@ -819,9 +819,10 @@ impl Agent {
 
         // Register task delegation tools (task, parallel_task).
         // These require an LLM client to spawn isolated child agent loops.
+        // When MCP manager is available, pass it through so child sessions inherit MCP tools.
         {
             use crate::subagent::{load_agents_from_dir, AgentRegistry};
-            use crate::tools::register_task;
+            use crate::tools::register_task_with_mcp;
             let agent_registry = AgentRegistry::new();
             for dir in self
                 .code_config
@@ -833,11 +834,12 @@ impl Agent {
                     agent_registry.register(agent);
                 }
             }
-            register_task(
+            register_task_with_mcp(
                 tool_executor.registry(),
                 Arc::clone(&llm_client),
                 Arc::new(agent_registry),
                 canonical.display().to_string(),
+                opts.mcp_manager.clone(),
             );
         }
 

core/src/permissions.rs

@@ -42,7 +42,14 @@ pub enum PermissionDecision {
 /// - `Read(src/**/*.rs)` - matches Rust files in src/
 /// - `Grep(*)` - matches all grep invocations
 /// - `mcp__pencil` - matches all pencil MCP tools
-#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+///
+/// Deserialization supports both plain strings and `{rule: "..."}` objects:
+/// ```yaml
+/// allow:
+///   - read                   # plain string
+///   - rule: "Bash(cargo:*)"  # struct form
+/// ```
+#[derive(Debug, Clone, Serialize, PartialEq, Eq)]
 pub struct PermissionRule {
     /// The original rule string
     pub rule: String,
@@ -54,6 +61,28 @@ pub struct PermissionRule {
     arg_pattern: Option<String>,
 }
 
+impl<'de> Deserialize<'de> for PermissionRule {
+    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+    where
+        D: serde::Deserializer<'de>,
+    {
+        /// Helper enum to accept both `"read"` and `{rule: "read"}` in YAML/JSON.
+        #[derive(Deserialize)]
+        #[serde(untagged)]
+        enum RuleRepr {
+            Plain(String),
+            Struct { rule: String },
+        }
+
+        let rule_str = match RuleRepr::deserialize(deserializer)? {
+            RuleRepr::Plain(s) => s,
+            RuleRepr::Struct { rule } => rule,
+        };
+        // `new()` calls `parse_rule()` to populate tool_name and arg_pattern.
+        Ok(PermissionRule::new(&rule_str))
+    }
+}
+
 impl PermissionRule {
     /// Create a new permission rule from a pattern string
     pub fn new(rule: &str) -> Self {
@@ -827,6 +856,55 @@ mod tests {
         assert!(policy.is_allowed("Grep", &json!({"pattern": "foo"})));
     }
 
+    // ========================================================================
+    // PermissionRule Deserialization Tests
+    // ========================================================================
+
+    #[test]
+    fn test_rule_deserialize_plain_string() {
+        // YAML: `- read`
+        let rule: PermissionRule = serde_yaml::from_str("read").unwrap();
+        assert_eq!(rule.rule, "read");
+        assert!(rule.matches("read", &json!({})));
+        assert!(!rule.matches("write", &json!({})));
+    }
+
+    #[test]
+    fn test_rule_deserialize_plain_string_with_pattern() {
+        // YAML: `- "Bash(cargo:*)"`
+        let rule: PermissionRule = serde_yaml::from_str("\"Bash(cargo:*)\"").unwrap();
+        assert_eq!(rule.rule, "Bash(cargo:*)");
+        assert!(rule.matches("Bash", &json!({"command": "cargo build"})));
+    }
+
+    #[test]
+    fn test_rule_deserialize_struct_form() {
+        // YAML: `- rule: read`
+        let rule: PermissionRule = serde_yaml::from_str("rule: read").unwrap();
+        assert_eq!(rule.rule, "read");
+        assert!(rule.matches("read", &json!({})));
+    }
+
+    #[test]
+    fn test_rule_deserialize_in_policy() {
+        // Full policy YAML with mixed formats
+        let yaml = r#"
+allow:
+  - read
+  - "Bash(cargo:*)"
+  - rule: grep
+deny:
+  - write
+"#;
+        let policy: PermissionPolicy = serde_yaml::from_str(yaml).unwrap();
+        assert_eq!(policy.allow.len(), 3);
+        assert_eq!(policy.deny.len(), 1);
+        assert!(policy.is_allowed("read", &json!({})));
+        assert!(policy.is_allowed("Bash", &json!({"command": "cargo build"})));
+        assert!(policy.is_allowed("grep", &json!({})));
+        assert!(policy.is_denied("write", &json!({})));
+    }
+
     // ========================================================================
     // PermissionManager Tests
     // ========================================================================

core/src/subagent.rs

@@ -643,6 +643,35 @@ permissions:
         assert_eq!(agent.name, "restricted-agent");
         assert_eq!(agent.permissions.allow.len(), 2);
         assert_eq!(agent.permissions.deny.len(), 1);
+        // Verify that deserialized rules actually match (tool_name populated)
+        assert!(agent.permissions.allow[0].matches("read", &serde_json::json!({})));
+        assert!(agent.permissions.allow[1].matches("grep", &serde_json::json!({})));
+        assert!(agent.permissions.deny[0].matches("write", &serde_json::json!({})));
+    }
+
+    #[test]
+    fn test_parse_agent_yaml_with_plain_string_permissions() {
+        // Users naturally write plain strings in allow/deny lists
+        let yaml = r#"
+name: plain-agent
+description: Agent with plain string permissions
+permissions:
+  allow:
+    - read
+    - grep
+    - "Bash(cargo:*)"
+  deny:
+    - write
+"#;
+        let agent = parse_agent_yaml(yaml).unwrap();
+        assert_eq!(agent.name, "plain-agent");
+        assert_eq!(agent.permissions.allow.len(), 3);
+        assert_eq!(agent.permissions.deny.len(), 1);
+        // Verify rules are functional
+        assert!(agent.permissions.allow[0].matches("read", &serde_json::json!({})));
+        assert!(agent.permissions.allow[1].matches("grep", &serde_json::json!({})));
+        assert!(agent.permissions.allow[2].matches("Bash", &serde_json::json!({"command": "cargo build"})));
+        assert!(agent.permissions.deny[0].matches("write", &serde_json::json!({})));
     }
 
     #[test]

core/src/tools/builtin/mod.rs

@@ -57,14 +57,32 @@ pub fn register_batch(registry: &Arc<ToolRegistry>) {
 ///
 /// Must be called after the registry is wrapped in Arc. Requires an LLM client
 /// and the workspace path so child agent loops can be spawned inline.
+/// Optionally accepts an MCP manager so child sessions inherit MCP tools.
 pub fn register_task(
     registry: &Arc<ToolRegistry>,
     llm_client: Arc<dyn crate::llm::LlmClient>,
     agent_registry: Arc<crate::subagent::AgentRegistry>,
     workspace: String,
+) {
+    register_task_with_mcp(registry, llm_client, agent_registry, workspace, None);
+}
+
+/// Register the task delegation tools with optional MCP manager.
+///
+/// When `mcp_manager` is provided, child subagent sessions will have access
+/// to all MCP tools from connected servers.
+pub fn register_task_with_mcp(
+    registry: &Arc<ToolRegistry>,
+    llm_client: Arc<dyn crate::llm::LlmClient>,
+    agent_registry: Arc<crate::subagent::AgentRegistry>,
+    workspace: String,
+    mcp_manager: Option<Arc<crate::mcp::manager::McpManager>>,
 ) {
     use crate::tools::task::{ParallelTaskTool, TaskExecutor, TaskTool};
-    let executor = Arc::new(TaskExecutor::new(agent_registry, llm_client, workspace));
+    let executor = Arc::new(match mcp_manager {
+        Some(mcp) => TaskExecutor::with_mcp(agent_registry, llm_client, workspace, mcp),
+        None => TaskExecutor::new(agent_registry, llm_client, workspace),
+    });
     registry.register_builtin(Arc::new(TaskTool::new(Arc::clone(&executor))));
     registry.register_builtin(Arc::new(ParallelTaskTool::new(executor)));
 }

core/src/tools/mod.rs

@@ -15,7 +15,7 @@ mod registry;
 pub mod task;
 mod types;
 
-pub use builtin::register_task;
+pub use builtin::{register_task, register_task_with_mcp};
 pub use registry::ToolRegistry;
 pub use task::{
     parallel_task_params_schema, task_params_schema, ParallelTaskParams, ParallelTaskTool,

core/src/tools/task.rs

@@ -16,6 +16,7 @@
 
 use crate::agent::{AgentConfig, AgentEvent, AgentLoop};
 use crate::llm::LlmClient;
+use crate::mcp::manager::McpManager;
 use crate::subagent::AgentRegistry;
 use crate::tools::types::{Tool, ToolContext, ToolOutput};
 use anyhow::{Context, Result};
@@ -66,6 +67,8 @@ pub struct TaskExecutor {
     llm_client: Arc<dyn LlmClient>,
     /// Workspace path shared with child agents
     workspace: String,
+    /// Optional MCP manager for registering MCP tools in child sessions
+    mcp_manager: Option<Arc<McpManager>>,
 }
 
 impl TaskExecutor {
@@ -79,6 +82,22 @@ impl TaskExecutor {
             registry,
             llm_client,
             workspace,
+            mcp_manager: None,
+        }
+    }
+
+    /// Create a new task executor with MCP manager for tool inheritance
+    pub fn with_mcp(
+        registry: Arc<AgentRegistry>,
+        llm_client: Arc<dyn LlmClient>,
+        workspace: String,
+        mcp_manager: Arc<McpManager>,
+    ) -> Self {
+        Self {
+            registry,
+            llm_client,
+            workspace,
+            mcp_manager: Some(mcp_manager),
         }
     }
 
@@ -109,6 +128,24 @@ impl TaskExecutor {
         // Build a child ToolExecutor. Task tools are intentionally omitted
         // here to prevent unlimited subagent nesting.
         let mut child_executor = crate::tools::ToolExecutor::new(self.workspace.clone());
+
+        // Register MCP tools so child agents can access MCP servers.
+        if let Some(ref mcp) = self.mcp_manager {
+            let all_tools = mcp.get_all_tools().await;
+            let mut by_server: std::collections::HashMap<String, Vec<crate::mcp::protocol::McpTool>> =
+                std::collections::HashMap::new();
+            for (server, tool) in all_tools {
+                by_server.entry(server).or_default().push(tool);
+            }
+            for (server_name, tools) in by_server {
+                let wrappers =
+                    crate::mcp::tools::create_mcp_tools(&server_name, tools, Arc::clone(mcp));
+                for wrapper in wrappers {
+                    child_executor.register_dynamic_tool(wrapper);
+                }
+            }
+        }
+
         if !agent.permissions.allow.is_empty() || !agent.permissions.deny.is_empty() {
             child_executor.set_guard_policy(Arc::new(agent.permissions.clone())
                 as Arc<dyn crate::permissions::PermissionChecker>);