[janicduplessis]

Description

The maintainer approved npm 1.20.2 on 2026-10-10. npm has 1.20.1 on latest. This release carries the doctor security fix (#3393), the stale EAS ledger cleanup in gc (#3408), the new workspace.hidden setting (#3407), exec time budgets (#3361, #3421), the producer-side workspace stage for macOS apps (#3328), two guide fixes (#3412, #3413) and the Release workflow's tag-on-main check (#3401).

Solution

• pnpm run release:prep 1.20.2 bumps the seven package manifests.
• docs/releases/1.20.2.md lists every user-facing package change since v1.20.1, plus ci: refuse to publish a release tag that is not on main #3401, which changes the release process rather than a package. Desktop, phone and test-only merges are not listed.
• apps/mobile/src/generated/licenses.json is regenerated; only the @stim-cli/core version changes.

Pre-tag QA is omitted, as with 1.18.0 to 1.20.1; the notes' QA section says so. This tag is the first run of #3401's tag-on-main job, and the tag will sit on the squash-merge commit on main.

Test plan

Local on this commit: format:check, lint, build, typecheck, knip, release:prep --check, CLI --version (1.20.2), --help, guide agent, settings get workspace.hidden (prints false), licenses:check, and pnpm tarball inspection of the seven packages (README and LICENSE present, versions 1.20.2, no workspace: ranges). Unit, e2e, runtime and the full Windows suite run in CI on the exact main commit that gets tagged.

[janicduplessis]

Fresh review of 287ba7b (not the author). Result: clear.

Checked:

• The diff is the seven package.json version lines (1.20.1 to 1.20.2), apps/mobile/src/generated/licenses.json (version only) and docs/releases/1.20.2.md. Nothing else.
• Notes against the real diffs: fix: skip doctor's fingerprint parity check when it would run project code #3393 (doctor parity skip, both the outside-resolution case and the npx react-native config Android/no-ios case), feat: share a hidden workspace flag through workspace.hidden #3407 (workspace.hidden: workspace scope, default false, hidden: true in status, cleared by recordWorkspaceUse), fix: gc forgets EAS ledger entries with an invalid id and a missing workspace #3408 (non-UUID id plus missing absolute root on a mounted volume, re-checked under the ledger lock, sections.staleEasLedgerEntries), refactor(cli): require a time budget on every exec call and route git through one helper #3361 and fix(cli): narrow error types to restore the type-assertion ratchet #3421 (10 s default, --no-optional-locks, six at a time, 60 s removal reads, "a git safety check timed out"), refactor: derive workspace stage, app presence and git chip only in stim #3328 (macOS running/orphaned maps to stage: running, since = build end), ci: refuse to publish a release tag that is not on main #3401, docs: verify the tutorial app with the size control #3412, docs: wait for LaunchServices before agent-device opens a stim macos app #3413. SHAs and behavior descriptions match. No overclaims found.
• node scripts/release-qa-matrix.mjs v1.20.1 gives 193 changed paths, 50 mapped, 0 unclassified, 8 of 8 rows required. Matches the QA section.
• Every package-touching commit since v1.20.1 is either listed or internal. One unlisted: 8a95df8 (feat(desktop): tutorial glows follow the user, Open Agent Actions and Open Logs #3426) changes the delete ask text in packages/stim-cli/src/guide/tutorial-data.ts ("Remove the test app: run stim worktree remove on {base}..."). Minor wording, optional to add; not blocking.

review: needs-human: not required. This PR changes versions and notes only. The ownership/gc/exec/release.yml changes it describes were merged earlier through their own PRs and are not in this diff.

The QA waiver is stated in the notes and is the maintainer's call.