Release v1.3.1: workspace reliability and compatible security patches - #5755

Problem and result

Prepare an expedited v1.3.1 patch release from main baseline73f429aad3399db9e52768e953de2743d02b2f73. Existing installs need a distinct package/tag for the merged Chat, workspace, collaboration and desktop fixes. The version owners, generated manpage and bilingual developer-book anchors move together to1.3.1.

The dashboard applies seroval1.6.8, source-map-js1.2.2 and linkify-it6.1.0. The root fix uses the new named LinkifyIt export and bundled types, removes the obsolete @types package, and explicitly sets urlAuth:true to preserve existing authenticated-URL recognition. Complete-address checks, dangerous-protocol refusal, inert HTML and existing rendering regressions pass. No state/authority contract changes. The dependency-only #5753 build failure remains documented at its original head.

Validation boundary

Version/CLI-manpage/release-document/developer-book smokes, semantic advisory and diff hygiene pass; the initial missing book-index anchors were corrected and the existing smoke rerun passed.81 focused Python regressions pass. Packaged frontend build and npm audit pass after the two dependency patches (zero dashboard vulnerabilities). Exact-head quality, focused UI regressions and merge-readiness passed before the authorized admin merge. PR CI is not queried. Full Python/public smoke, new paid model matrix and unavailable backend/platform qualification are not rerun for this expedited release; v1.3.0 evidence remains prior-version evidence, not a certificate for the new source.

No new framework/helper is needed: existing version and dependency owners suffice. Rollback is the previous immutable package/tag; persisted data is not automatically migrated or restored by a package downgrade.

Community Contributors

• @Duang777 — External contributor: stopped-Goal admission, message replay refusal, runtime locks/artifact verification, manual desktop updates and torn-journal recovery. #5705, #5706, #5709, #5712, #5717, #5733, #5742
• @dependabot[bot] — Dependency automation: frontend and desktop dependency maintenance. #5590, #5741, #5744
• @loopx-agent — Project automation: control-plane settlement, canonical Todo isolation, workspace/research journeys, captured heartbeat transport and benchmark/release tooling. #5571, #5575, #5593, #5609, #5660, #5665, #5668, #5669, #5673, #5690, #5692, #5701, #5703, #5710, #5715, #5716, #5719, #5720, #5721, #5722, #5723, #5724, #5726, #5727, #5736, #5737, #5739, #5740, #5746, #5747, #5748, #5749, #5750, #5755
• @mikamikasuki — External contributor: read-only Chat executor scope, registered workspace routing, wake replay protection, Windows diagnostics and cadence hydration. #5596, #5730, #5732, #5734, #5738

中文说明

快速发布1.3.1：对齐两个版本源、生成 manpage 和中英文开发者手册锚点，收录基线 main 已合入的修复。依赖更新 seroval、source-map-js 和 linkify-it6.1；根因修复采用命名导出和内置类型，移除旧 @types 包，显式 urlAuth:true 保留原链接识别策略。生产构建及完整／截断 userinfo、危险协议和惰性 HTML 的原有回归通过。定向验证与来源／制品回读继续执行；不把1.3.0的全量与模型结果重新标为1.3.1通过。

社区贡献者

• @Duang777 — 外部贡献者：已停止 Goal 准入、消息冲突拒绝、runtime 锁／制品校验、桌面手动更新与破损日志恢复。 #5705, #5706, #5709, #5712, #5717, #5733, #5742
• @dependabot[bot] — 依赖自动化：前端与桌面依赖维护。 #5590, #5741, #5744
• @loopx-agent — 项目自动化贡献：结算、canonical Todo 隔离、工作区／研究结果旅程、heartbeat 捕获传输与 benchmark／发布工具。 #5571, #5575, #5593, #5609, #5660, #5665, #5668, #5669, #5673, #5690, #5692, #5701, #5703, #5710, #5715, #5716, #5719, #5720, #5721, #5722, #5723, #5724, #5726, #5727, #5736, #5737, #5739, #5740, #5746, #5747, #5748, #5749, #5750, #5755
• @mikamikasuki — 外部贡献者：只读 Chat executor 范围、注册工作区路由、wake 重放保护、Windows 诊断与复核编辑器初始化。 #5596, #5730, #5732, #5734, #5738

Companion: Personal 1.3.1 illustrated upgrade guide, with verified ownership and current-tag screenshots. All 12 public assets, GitHub/PyPI hash equivalence, actual 1.3.0-to-1.3.1 upgrades, signed desktop-stable feed and a fresh CLI stable installation/source-manifest readback passed; this is an explicitly expedited qualification, not a new full model matrix.

配套：个人 1.3.1 图文升级指南，ownership 与当前 tag 截图已回读。12个公开资产、GitHub／PyPI哈希、实际1.3.0→1.3.1升级、签名desktop-stable feed及CLI stable全新安装／来源manifest均已回读；本次为明确授权的加速资格化，未新增完整模型矩阵。