[roomote-roomote]

​Opened on behalf of @mrubens. Follow up by mentioning @roomote-roomote, in the web UI, or in Slack.

What changed

Prepare the normal patch release 1.20.1 → 1.20.2 from audited develop 2a8e409e799eec6063476d4add3fcb6c3bce4b02, including merged #3684 and #3679. Generate the root version and changelog with pnpm run version, consume the existing patch changeset, and polish the in-app summary and highlights. No workspace package versions change.

Release summary and highlights

Roomote 1.20.2 keeps long-running tasks moving, restores resumable work after safety stops, and includes a security update for file-pattern matching.

• Long tasks continue beyond 200 tool calls or 100 model steps.
• Resume retained work after repetition or time stops while preserving the lifetime request ceiling.
• Includes a security fix for excessive resource use when processing file-matching patterns.

Patch changes

• Long tasks are no longer stopped after 200 tool calls or 100 model steps, and replying to a task stopped for repeated activity resumes it from its retained work. The 1,000-request lifetime ceiling and repetition detection still apply.

The dependency-only #3679 is included in the audited base and highlighted above: minimatch 11.0.3 paired with glob 14.0.3 addresses GHSA-g3hv-75wg-m249. No duplicate dependency changeset is added. Earlier security fixes #3649 and #3625 are already in published v1.20.1.

Documentation coverage

• Long-task limits and reply-to-resume after safety stops: Tasks — safety stops, already current in [Fix] Long tasks stop at 200 tool calls and cannot be resumed #3684. Reviewed retained work, time/repetition stops, and the persistent request ceiling against source behavior.
• [Chore] Patch minimatch amplification across affected consumers #3679 is dependency-only security maintenance with no new setup or public workflow.
• Every included change and pending note reviewed; no additional release-blocking docs, navigation, or provider-icon updates needed.

Squash-merging this PR cuts the release and automatically opens the frozen Promote v1.20.2 to production PR against main. That candidate needs its own current-head CI and review checks. This PR does not authorize promotion or publication. If develop advances before merge, regenerate and re-audit from its new tip.

How it was tested

• pnpm run version succeeded: 1.20.1 → 1.20.2, consuming exactly one existing changeset after normalizing its package attribution.
• Release artifact checks passed: expected version and top changelog section, summary/highlights/patch note present, all pending notes consumed, README retained, only root package.json/CHANGELOG.md and consumed changeset deletion changed, no workspace versions changed.
• git diff --check passed. Ordinary pre-commit hook passed.
• Ordinary pre-push hook ran exactly once and passed oxlint, residual web/worker ESLint, all 27 type-check tasks, and Knip. Non-failing existing circular-package and Knip configuration hints were emitted.
• Source PR [Fix] Long tasks stop at 200 tool calls and cannot be resumed #3684 CI and Docs passed; [Chore] Patch minimatch amplification across affected consumers #3679 current-head CI, Docs and automated review passed before its observed merge. No duplicate release-script tests, docs validation, full tests, or static gates were invoked manually; release PR CI remains required before merge.

Checklist

• The PR title follows the repo convention: [Fix], [Feat], [Improve], [Refactor], [Docs], or [Chore] followed by a user-facing description
  • Uses the release workflow's required title, Release Roomote 1.20.2.
• This PR is small and scoped to one change
• pnpm lint and pnpm check-types pass locally
  • Normal fast static gates passed through the one ordinary push hook; full formatting-inclusive commands intentionally deferred to CI per release workflow.
• I added tests or included a clear manual validation note above
• I removed secrets, tokens, private keys, and customer data from code, logs, and screenshots
• If this change should appear in the changelog, I ran pnpm changeset
  • Consumed the existing changeset through pnpm run version; no duplicate note needed.

[roomote-community]

No code issues found. Reviewed the root-only 1.20.2 version bump, consumed changeset, and changelog claims against the release tooling and task safety/resume implementation. Test, app Docker build, and JavaScript/TypeScript CodeQL checks were still running; completed checks had no failures. See session

_{Reviewed b4dc520}