Promote v0.35.0 to production

[mrubens]

Promote v0.35.0

Frozen at f4deead3bf63163e17726cf63da2bfecbd5caddf — the commit where 0.35.0 was versioned. Commits merged to develop afterward require an explicit candidate refresh or ship in the next release.

• Merge this PR with a merge commit (do not squash or rebase).
• If multiple promote PRs are open, merge them in version order (oldest first).
• Merging publishes a GitHub Release for v0.35.0 and triggers the existing GHCR v* image publish (latest channel).
• The release/v0.35.0 branch can be deleted after this PR merges.

Changelog

0.35.0 (2026-08-06)

This release expands source-control setup and review workflows, adds a direct homepage feedback path, and improves reliability across automations, Slack routing, and self-hosted sandboxes.

Highlights

• Review pull requests with line-anchored comments across GitHub, GitLab, Gitea, Bitbucket, and Azure DevOps.
• Configure and safely disconnect every supported source-control provider from Settings.
• Share feedback directly from the homepage without interrupting normal task workflows.
• Scan and run custom automations more easily with clearer schedules, destinations, and independent controls.

Minor changes

• Add a dismissible homepage feedback prompt that lets users book time with the founders or send feedback by email without interrupting their normal workflow.
• Post line-anchored inline pull-request review comments across GitHub, GitLab, Gitea, Bitbucket, and Azure DevOps, with provider-aware suggestions and safe fallback when an anchor is rejected.
• Let administrators configure non-GitHub source-control providers with complete callback guidance and safely remove persisted GitHub, GitLab, Gitea, Bitbucket, or Azure DevOps connections from Settings.

Patch changes

• Make custom automations easier to scan with human-readable schedules and clearer destinations, and keep creation and other run controls available while an automation is being queued.
• Keep sandbox HTTP and WebSocket traffic reachable on LAN-hosted deployments and fall back to the task API when a live sandbox connection cannot stop an active task.
• Keep OpenCode task sessions consistently identified as Roomote while preserving the current workflow and implementation guidance.
• Explain when automatic Slack routing is temporarily unavailable instead of silently showing the workspace picker, while keeping sensitive provider errors out of user-facing messages.
• Stop task closeouts from promising a follow-up self-review when every selected GitHub repository is excluded from automated processing.
• Let administrators disconnect GitLab, Gitea, and Bitbucket OAuth connections when provider client credentials come from runtime configuration.
• Preserve deleted-line review thread anchors on Bitbucket and Azure DevOps so later reviews can match and reply to existing inline comments.
• Let sync reviews resolve Roomote-authored inline threads after verifying the flagged code was fixed, including when GitHub marks the original anchor outdated.

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
roomote	🟢 Ready	View Preview	Aug 6, 2026, 2:35 PM

💡 Tip: Enable Workflows to automatically generate PRs for you.

[roomote-community]

No new code issues found. See task

• packages/sdk/src/server/lib/pull-requests/source-control-pull-request-writes.ts:1482 Left-side Bitbucket comments are created with inline.from, but the reader only parses and exposes inline.to. Later reviews receive line: null, so they cannot match or reply to an existing deleted-line thread.
• packages/sdk/src/server/lib/pull-requests/source-control-pull-request-writes.ts:1731 Azure DevOps left-side comments use leftFileStart, while the read contract only retains rightFileStart. These newly created deleted-line threads also lose their line anchor on every subsequent review.
• apps/web/src/trpc/commands/source-control/index.ts:1170 Runtime-configured GitLab, Gitea, and Bitbucket integrations return before OAuth connection cleanup. Their access tokens live in deployment_secrets, not environment variables, so a connected provider with runtime-only client credentials cannot be disconnected and its active repositories remain enabled.

_{Reviewed 37351dd}

[roomote-roomote]

Addressed all three outstanding review findings in follow-up draft PR #1133, branched from develop as requested. The changes preserve deleted-line anchors for Bitbucket and Azure DevOps review threads and fully disconnect persisted GitLab, Gitea, and Bitbucket OAuth state when client credentials are runtime-configured. See commit 72b9c766.