Promote v0.35.0 to production

.docker/caddy/Caddyfile

@@ -50,8 +50,8 @@
 
 	handle @local_sandbox {
 		rewrite * {re.local_sandbox.2}
-		reverse_proxy host.docker.internal:18081 {
-			header_up Host {re.local_sandbox.1}-sandbox-server.roomotepreview.localhost:18081
+		reverse_proxy host.docker.internal:{$ROOMOTE_PREVIEW_PROXY_PORT:18081} {
+			header_up Host {re.local_sandbox.1}-sandbox-server.{$ROOMOTE_PREVIEW_DOMAIN:roomotepreview.localhost}:{$ROOMOTE_PREVIEW_PROXY_PORT:18081}
 			lb_try_duration 10s
 			lb_try_interval 250ms
 		}

CHANGELOG.md

@@ -2,6 +2,34 @@
 
 This file tracks product releases for Roomote (single monorepo version). Automated release entries are prepended by `pnpm run version`.
 
+## 0.35.0 (2026-08-06)
+
+This release expands source-control setup and review workflows, adds a direct homepage feedback path, and improves reliability across automations, Slack routing, and self-hosted sandboxes.
+
+### Highlights
+
+- Review pull requests with line-anchored comments across GitHub, GitLab, Gitea, Bitbucket, and Azure DevOps.
+- Configure and safely disconnect every supported source-control provider from Settings.
+- Share feedback directly from the homepage without interrupting normal task workflows.
+- Scan and run custom automations more easily with clearer schedules, destinations, and independent controls.
+
+### Minor changes
+
+- Add a dismissible homepage feedback prompt that lets users book time with the founders or send feedback by email without interrupting their normal workflow.
+- Post line-anchored inline pull-request review comments across GitHub, GitLab, Gitea, Bitbucket, and Azure DevOps, with provider-aware suggestions and safe fallback when an anchor is rejected.
+- Let administrators configure non-GitHub source-control providers with complete callback guidance and safely remove persisted GitHub, GitLab, Gitea, Bitbucket, or Azure DevOps connections from Settings.
+
+### Patch changes
+
+- Make custom automations easier to scan with human-readable schedules and clearer destinations, and keep creation and other run controls available while an automation is being queued.
+- Keep sandbox HTTP and WebSocket traffic reachable on LAN-hosted deployments and fall back to the task API when a live sandbox connection cannot stop an active task.
+- Keep OpenCode task sessions consistently identified as Roomote while preserving the current workflow and implementation guidance.
+- Explain when automatic Slack routing is temporarily unavailable instead of silently showing the workspace picker, while keeping sensitive provider errors out of user-facing messages.
+- Stop task closeouts from promising a follow-up self-review when every selected GitHub repository is excluded from automated processing.
+- Let administrators disconnect GitLab, Gitea, and Bitbucket OAuth connections when provider client credentials come from runtime configuration.
+- Preserve deleted-line review thread anchors on Bitbucket and Azure DevOps so later reviews can match and reply to existing inline comments.
+- Let sync reviews resolve Roomote-authored inline threads after verifying the flagged code was fixed, including when GitHub marks the original anchor outdated.
+
 ## 0.34.0 (2026-08-04)
 
 This release adds Granola and Requesty connections, introduces Mind reader mode for expanded model thoughts, and improves task reliability across mixed-provider workspaces and chat delivery failures.

SELF_HOSTING.md

@@ -238,6 +238,12 @@ the last upgrade without touching the database; the pre-upgrade bundle plus
 application and schema versions are visible under Settings -> Deployment ->
 Diagnostics.
 
+Use `roomote upgrade` instead of updating application image references alone.
+The upgrade refreshes the release's Compose and Caddy configuration together;
+mixing newer application images with an older Caddyfile can leave routes used
+by the new controller unavailable until the deployment configuration is also
+updated.
+
 `roomote upgrade` prunes old Roomote images after a successful upgrade. It
 keeps the current release plus the newest local Roomote image tags for a total
 of `ROOMOTE_IMAGE_RETENTION_RELEASES` retained tags (default `3`); set that

apps/api/package.json

@@ -43,11 +43,11 @@
     "@sentry/node": "10.45.0",
     "@trpc/client": "^11.15.0",
     "@trpc/server": "^11.15.0",
-    "hono": "4.12.27",
+    "hono": "4.12.34",
     "jose": "^6.2.3",
     "p-map": "^7.0.4",
     "snowflake-sdk": "^2.4.3",
-    "undici": "^7.28.0",
+    "undici": "^7.29.0",
     "zod": "^3.25.76"
   },
   "devDependencies": {

apps/api/src/handlers/custom-automations/index.ts

@@ -25,6 +25,8 @@ import type {
   CustomAutomationScheduleMode,
   OptionalAutomationTarget,
 } from '@roomote/types';
+import { toActivationAutomationDestinationProvider } from '@roomote/telemetry';
+import { captureActivationCustomAutomationChanged } from '@roomote/telemetry/server';
 
 import type { Variables } from '../../types';
 import type { McpAuth } from '../mcp/middleware';
@@ -329,6 +331,10 @@ customAutomationsRouter.post('/', async (c) => {
       target: buildTarget(parsed.data),
       createdByUserId: adminId(c),
     });
+    void captureActivationCustomAutomationChanged(
+      'created',
+      parsed.data.targetProvider ?? null,
+    );
     return c.json({ automation, resolution: schedule.resolution }, 201);
   } catch (error) {
     const known = knownErrorResponse(c, error);
@@ -415,6 +421,10 @@ customAutomationsRouter.delete('/:id', async (c) => {
   if (!existing)
     return c.json({ error: 'Custom automation was not found.' }, 404);
   await deleteCustomAutomation(existing.id);
+  void captureActivationCustomAutomationChanged(
+    'deleted',
+    toActivationAutomationDestinationProvider(existing.target.provider),
+  );
   return c.json({ deleted: { id: existing.id, name: existing.name } });
 });
 

apps/api/src/handlers/slack/events/auto-route-fallback.ts

@@ -1,6 +1,7 @@
 import type { SlackInstallation, SlackUserMapping } from '@roomote/db/server';
 import {
   showTaskConfiguration,
+  SLACK_ROUTING_UNAVAILABLE_NOTICE,
   type SlackEvent,
   type SlackNotifier,
   type StartAutoRoutedSlackTaskResult,
@@ -54,6 +55,10 @@ export async function showManualPickerForAutoRouteFallback(params: {
       : {}),
   };
 
+  const routingFailedFromException =
+    params.result.status === 'not_started' &&
+    params.result.routingFallback?.cause === 'exception';
+
   await showTaskConfiguration({
     event,
     slackInstallation: params.slackInstallation as SlackInstallation,
@@ -62,6 +67,9 @@ export async function showManualPickerForAutoRouteFallback(params: {
     skipRouting: true,
     skipMcpSetupSuggestion: true,
     processingReactionName: params.processingReactionName,
+    ...(routingFailedFromException
+      ? { routingFailureNoticeText: SLACK_ROUTING_UNAVAILABLE_NOTICE }
+      : {}),
   });
 
   return true;

apps/api/src/handlers/slack/events/member-joined.ts

@@ -15,6 +15,7 @@ import type {
   SlackMemberJoinedChannelEvent,
   SlackNotifier,
 } from '@roomote/slack';
+import { captureActivationAutomationChanged } from '@roomote/telemetry/server';
 
 import { SLACK_WELCOME_MESSAGE_CHANNEL_LIMIT } from '../constants.js';
 
@@ -234,4 +235,16 @@ export async function maybePostSlackChannelWelcome(params: {
 
     throw error;
   }
+
+  if (shouldEnableStarterAutomations) {
+    for (const [automation, wasEnabled] of [
+      ['suggester', settings.suggesterFrequency !== 'off'],
+      ['announcer', settings.announcerFrequency !== 'off'],
+      ['manager_stats', settings.managerStatsFrequency !== 'off'],
+    ] as const) {
+      if (!wasEnabled) {
+        void captureActivationAutomationChanged('enabled', automation);
+      }
+    }
+  }
 }