[wxy]

Summary

• Bump the nine public @appilot-labs/* packages, internal ranges, root desktop and local CLI to 1.3.0.
• Update the changelog, README, release notes and npm publishing guide while keeping the downloadable macOS DMG at v1.2.0.
• Make MCP serverInfo.version read its own package manifest and assert it through the real stdio end-to-end test.

Verification

• npm run lint: 0 errors; 1,913 existing warnings
• npm run typecheck: passed
• TMPDIR="$TMPDIR/a13" npm test: passed, including scheduler process, CLI and MCP end-to-end tests
• npm run build: passed
• npm pack --dry-run --json --ignore-scripts: all nine packages include package.json and dist; the DSH plugin also includes client files
• README SVG XML, Chrome render and visual inspection: passed

The first full test run used a long task temp directory, making the scheduler Unix socket path 107 bytes. The process test and full suite passed with the short task temp directory. Reproducible commands, inputs and results are in docs/verification/npm-1.3.0-release.md.

This PR prepares an npm-only release. After merge and green CI, tag the merged master commit to trigger publish.yml. It does not create a new DMG or GitHub Release.

Postpublish consumer verification — 2026-09-26

Environment: macOS arm64, Node v26.7.0, npm 11.19.0; new consumer directory under $TMPDIR/appilot-npm-1.3.0-20260926/consumer with only a private package.json. Input: all nine @appilot-labs/*@1.3.0 packages from the public npm registry, outside the repository.

• The tag publish workflow completed with successful preflight and publish jobs. Its log has nine + @appilot-labs/...@1.3.0 confirmations.
• Direct npm registry package metadata returned latest=1.3.0, dist.integrity, and dist.attestations.provenance for each of the nine packages.
• A first npm install returned ETARGET for headless while stale package metadata was still cached. Retrying from the same clean consumer directory with a new task-scoped cache succeeded:

  cd "$TMPDIR/appilot-npm-1.3.0-20260926/consumer"
  npm_config_cache="$TMPDIR/appilot-npm-1.3.0-20260926/consumer-cache" npm install --prefer-online --no-audit --no-fund \
    @appilot-labs/appilot-core@1.3.0 @appilot-labs/appilot-headless@1.3.0 \
    @appilot-labs/appilot-common@1.3.0 @appilot-labs/appilot-project@1.3.0 \
    @appilot-labs/appilot-release@1.3.0 @appilot-labs/appilot@1.3.0 \
    @appilot-labs/appilot-headless-cli@1.3.0 @appilot-labs/appilot-scheduler@1.3.0 \
    @appilot-labs/appilot-mcp@1.3.0

  Result: 51 packages installed. Reading node_modules/@appilot-labs/*/package.json confirmed all nine at 1.3.0 and none were workspace symlinks.
• ./node_modules/.bin/appilot-headless --help printed the installed CLI commands. An installed @appilot-labs/appilot-mcp/dist/mcp.js child process received JSON-RPC initialize with protocol version 2025-03-26 and returned serverInfo={name:"appilot-mcp",version:"1.3.0"}.

The task-specific consumer directory and npm caches are removed after verification.

[github-actions]

Appilot CLA v1.0 accepted. Thank you for contributing. / Appilot CLA 1.0 已接受，感谢贡献。
_{Posted by the CLA Assistant Lite bot.}