chore(release): 3.6.1 — pin SDK build toolchain, refresh SDK locks (#70)

3.6.0 published a3s-code-core to crates.io but the native SDK builds failed:
brotli 8.0.3 (transitive via tower-http under ahp/s3) no longer compiles on the
newest stable Rust, so npm/PyPI/GH Release were skipped. This ships them.

- Pin publish-{node,python}.yml to dtolnay/rust-toolchain@1.94.1 + maturin-action
  rust-toolchain: 1.94.1 (known-good; matches earlier releases)
- Refresh sdk/{node,python}/Cargo.lock to a3s-code-core 3.6.1 (were stale at
  3.5.0, forcing a dep re-resolution that pulled a duplicate alloc-no-stdlib)
- Bump version surface 3.6.0 -> 3.6.1
- Verified locally: cargo check on both SDK manifests compiles on rustc 1.94.1

Co-authored-by: Claude <claude@anthropic.com>

Author: ZhiXiao-Lin

.github/workflows/publish-node.yml

@@ -42,7 +42,10 @@ jobs:
           node-version: 20
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
+        # Pinned: brotli 8.0.3 (transitive via tower-http, ahp/s3 features) fails
+        # to compile on newer stable rustc; 1.94.1 is the known-good build that
+        # shipped earlier releases. Revisit when the brotli/toolchain break clears.
+        uses: dtolnay/rust-toolchain@1.94.1
         with:
           targets: ${{ matrix.settings.target }}
 

.github/workflows/publish-python.yml

@@ -60,7 +60,10 @@ jobs:
             3.13
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
+        # Pinned: brotli 8.0.3 (transitive via tower-http, ahp/s3 features) fails
+        # to compile on newer stable rustc; 1.94.1 is the known-good build that
+        # shipped earlier releases. Revisit when the brotli/toolchain break clears.
+        uses: dtolnay/rust-toolchain@1.94.1
         with:
           targets: ${{ matrix.settings.target }}
 
@@ -82,6 +85,9 @@ jobs:
           target: ${{ matrix.settings.target }}
           args: --release --out dist --manifest-path sdk/python/Cargo.toml -i python3.10 -i python3.11 -i python3.12 -i python3.13
           manylinux: ${{ matrix.settings.manylinux || 'auto' }}
+          # Pin the toolchain maturin installs (incl. inside the manylinux
+          # container) so brotli 8.0.3 compiles. See "Install Rust" note above.
+          rust-toolchain: 1.94.1
 
       - name: Upload wheels to GitHub Releases
         uses: actions/upload-artifact@v4

CHANGELOG.md

@@ -5,6 +5,25 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [3.6.1] - 2026-06-14
+
+Release-engineering fix for 3.6.0 (no library code changes). The 3.6.0 tag
+published `a3s-code-core` to crates.io, but the native SDK build jobs failed
+because **brotli 8.0.3** (pulled transitively via `tower-http` under the
+`ahp`/`s3` features) no longer compiles on the newest stable Rust — so the npm,
+PyPI, and GitHub Release artifacts were skipped. This release ships those.
+
+### Fixed
+
+- **Pin the SDK build toolchain** — `publish-node.yml` / `publish-python.yml`
+  now use `dtolnay/rust-toolchain@1.94.1` (and pass `rust-toolchain: 1.94.1` to
+  `maturin-action`) instead of `@stable`, restoring the known-good build that
+  shipped earlier releases. Revisit when the upstream brotli/toolchain break
+  clears.
+- **Refresh the SDK lockfiles** — `sdk/{node,python}/Cargo.lock` now pin
+  `a3s-code-core` to the release version (previously left stale, which forced a
+  dependency re-resolution that pulled a second `alloc-no-stdlib`).
+
 ## [3.6.0] - 2026-06-14
 
 A system-prompt hardening pass plus framework-vs-host boundary tightening:

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "a3s-code-core"
-version = "3.6.0"
+version = "3.6.1"
 edition = "2021"
 authors = ["A3S Lab Team"]
 license = "MIT"

core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "a3s-code-node"
-version = "3.6.0"
+version = "3.6.1"
 edition = "2021"
 authors = ["A3S Lab Team"]
 license = "MIT"
@@ -11,7 +11,7 @@ description = "A3S Code Node.js bindings - Native addon via napi-rs"
 crate-type = ["cdylib"]
 
 [dependencies]
-a3s-code-core = { version = "3.6.0", path = "../../core", features = ["ahp", "s3"] }
+a3s-code-core = { version = "3.6.1", path = "../../core", features = ["ahp", "s3"] }
 napi = { version = "2", features = ["async", "napi6", "serde-json"] }
 napi-derive = "2"
 tokio = { version = "1.35", features = ["full"] }

sdk/node/Cargo.toml

@@ -1,6 +1,6 @@
 {
   "name": "@a3s-lab/code",
-  "version": "3.6.0",
+  "version": "3.6.1",
   "description": "A3S Code - Native Node.js bindings for the coding-agent runtime",
   "main": "index.js",
   "types": "index.d.ts",
@@ -43,11 +43,11 @@
     "test:helpers": "node test-helpers.mjs"
   },
   "optionalDependencies": {
-    "@a3s-lab/code-darwin-arm64": "3.6.0",
-    "@a3s-lab/code-linux-x64-gnu": "3.6.0",
-    "@a3s-lab/code-linux-x64-musl": "3.6.0",
-    "@a3s-lab/code-linux-arm64-gnu": "3.6.0",
-    "@a3s-lab/code-linux-arm64-musl": "3.6.0",
-    "@a3s-lab/code-win32-x64-msvc": "3.6.0"
+    "@a3s-lab/code-darwin-arm64": "3.6.1",
+    "@a3s-lab/code-linux-x64-gnu": "3.6.1",
+    "@a3s-lab/code-linux-x64-musl": "3.6.1",
+    "@a3s-lab/code-linux-arm64-gnu": "3.6.1",
+    "@a3s-lab/code-linux-arm64-musl": "3.6.1",
+    "@a3s-lab/code-win32-x64-msvc": "3.6.1"
   }
 }

sdk/node/examples/package-lock.json

@@ -7,7 +7,7 @@ name = "a3s-code"
 # Keep in sync with crates/code core release. The bootstrap loader fetches
 # the matching native wheel from `https://github.com/AI45Lab/Code/releases/tag/v<version>`
 # at import time.
-version = "3.6.0"
+version = "3.6.1"
 description = "A3S Code Python SDK — pure-Python bootstrap that fetches the native wheel from GitHub Releases"
 readme = "README.md"
 license = {text = "MIT"}