Promote v1.0.0 to production

.docker/caddy/Caddyfile

@@ -11,14 +11,24 @@
 # Intentionally out of scope compared to production:
 # - TLS: ngrok terminates TLS in front of this listener.
 # - Preview subdomains: the local preview proxy keeps its own port (18081).
-# - MinIO artifact routing: dev presigned S3 URLs point directly at MinIO.
 {
 	auto_https off
 }
 
 :18080 {
 	encode zstd gzip
 
+	@artifact_storage {
+		path /{$S3_BUCKET_ARTIFACTS:roomote-artifacts} /{$S3_BUCKET_ARTIFACTS:roomote-artifacts}/*
+	}
+
+	handle @artifact_storage {
+		reverse_proxy minio:9000 {
+			# Presigned S3 URLs sign the bucket path and Host header.
+			header_up Host {http.request.host}
+		}
+	}
+
 	@api {
 		path /_roomote-api /_roomote-api/*
 	}

.env.production.example

@@ -84,6 +84,7 @@ DEFAULT_COMPUTE_PROVIDER=docker
 # DOCKER_WORKER_RELEASE_PATH=/roomote/releases/worker-current.tar.gz
 # DOCKER_WORKER_CPU_LIMIT=2
 # DOCKER_WORKER_MEMORY_LIMIT=4g
+# DOCKER_TASK_DAEMON_MEMORY_LIMIT=8g
 # DOCKER_WORKER_PIDS_LIMIT=512
 # DOCKER_WORKER_DISK_LIMIT=20g
 # DOCKER_WORKER_ALLOW_UNBOUNDED_DISK=false
@@ -125,7 +126,8 @@ DEFAULT_COMPUTE_PROVIDER=docker
 # R_GITHUB_CLIENT_ID=
 # R_GITHUB_CLIENT_SECRET=
 # R_GITHUB_WEBHOOK_SECRET=
-# GITLAB_TOKEN=
+# GITLAB_CLIENT_ID=
+# GITLAB_CLIENT_SECRET=
 # GITLAB_WEBHOOK_SECRET=
 # GITLAB_WEBHOOK_SIGNING_TOKEN=
 

AGENTS.md

@@ -4,6 +4,14 @@ This file provides a quick-start guide for AI agents working with the Roomote co
 
 Roomote is a product centered on **Roomote agents**. Those agents are the core user-facing product: they can be configured in the web app, triggered from the web UI, and interacted with through integrations such as Slack, Teams, Telegram, Linear, and GitHub.
 
+## Open source and public surfaces
+
+This repository is open source. Treat GitHub and other public surfaces as fully public:
+
+- Do not put customer names, customer data, private deployment details, secrets, credentials, or internal maintainer discussion into commits, PR titles/bodies, PR/issue comments, review replies, or other public artifacts.
+- Prefer private channels (for example Slack or the task UI) for anything that is customer-specific, confidential, or only meaningful as internal discussion.
+- When writing public text, keep it general enough for an open-source audience and omit private context even when it was available in the private task thread.
+
 ## Setup
 
 - `mise install && pnpm install` (requires mise for repo tool versions)
@@ -40,3 +48,9 @@ Roomote is a product centered on **Roomote agents**. Those agents are the core u
 - Treat absolute home-directory skill paths such as `/home/roomote/.agents/skills/...` as activated or installed runtime copies, not as the checked-in source of truth for repository changes.
 - Treat workflow prompts and instructions as a first-class control surface. When agent behavior is off, debug prompt clarity before defaulting to code enforcement.
 - `apps/docs/` is the public product documentation site (published at `https://docs.roomote.dev`) and should be kept in sync with user-facing product changes.
+
+## Slack message formatting
+
+- Present LLM / agent narrative output in Slack as `markdown` blocks (`{ type: 'markdown', text }`) with standard markdown (`[label](url)`, `**bold**`, lists, tables, code fences) whenever possible. Do not convert that body text into legacy mrkdwn (`*bold*`, `<url|label>`) before posting a `markdown` block.
+- Do not migrate hardcoded product UI Block Kit (routing confirmations, sticky footers, unfurls, accessory sections, etc.) for style alone; keep `mrkdwn` there when those builders already rely on it or Slack requires it (for example `section` text with an `accessory`).
+- When reading inbound Slack message blocks, continue to accept both `markdown` blocks and legacy `mrkdwn` text objects.

CHANGELOG.md

@@ -2,6 +2,31 @@
 
 This file tracks product releases for Roomote (single monorepo version). Automated release entries are prepended by `pnpm run version`.
 
+## 1.0.0 (2026-07-15)
+
+### Major changes
+
+- Roomote 1.0 is the first public product release: the monorepo is open and ready for people to try the product, self-host, and send feedback on web tasks, cloud agents, and chat integrations.
+
+### Minor changes
+
+- Docker Compose and Dockerfile environment projects are first-class: run them on Modal VM sandboxes, stream project logs into the task Logs panel, start them without blocking eligible tasks, and allocate higher sandbox memory when nested Docker is required (renamed from "container projects").
+- Multi-SCM automations and PR tooling: triage, audit, announcer, and manager-stats cover GitHub, GitLab, Gitea, Azure DevOps, and Bitbucket with shared open-PR listing, merged-PR facts, conflict resolution, and digests; reports can land on Slack, Teams, or Telegram, and the automations page shows destinations plus exception-only coverage badges.
+- Environment setup is reworked into the normal task flow: setup completion is observable to the agent and platform, setup logs show in the Logs tab, first-time hosted compute provision no longer blocks creation, excluded sandbox providers stay hidden, and completion messaging no longer shoves users back to a separate /setup page.
+- Experimental settings add a deployment-level Code Mode toggle for coding-agent task behavior.
+- Local Docker can be enabled or disabled from the Local Docker settings surface without leaving that provider’s configuration page.
+- Source-control setup expands provider OAuth and connection flows, simplifies Azure DevOps to organization and PAT by default while preserving full repository identifiers, and prefills the GitHub App description in the manifest setup flow.
+- Slack agent narrative replies prefer modern markdown blocks, the Working on footer posts out of band with notifications when linked PRs close, MCP integration setup becomes a non-blocking suggestion instead of blocking task start (with Zero detection limited to product surfaces), and agents can post to Teams or Telegram channels through a surface-generic channel-post tool.
+- When only one environment exists the homepage starts there instead of Auto, subagent rows expand to show the launch prompt, the router supplies task-relevant kickoff strings, CI failure triage runs as one environment-backed fix task, the coding agent consults the advisor on hard failures and user challenges, and Microsoft Teams onboarding setup copy and flow are refreshed.
+- Daily anonymous product stats include a 7-day PR funnel so deployments can evaluate how effectively agent work turns into shipped pull requests.
+
+### Patch changes
+
+- Hosted Docker runtime provisioning is more reliable across E2B, Blaxel, and related setup paths, with retryable rebuilds that preserve the prior artifact.
+- Setup can back out of earlier choices without wiping later steps when a user revisits a picker, and finishing setup into an onboarding task no longer flashes the home page first.
+- Repository resolution and PR follow-up matching are host- and provider-scoped so same-named repositories on different source-control hosts no longer cross-route, and Slack markdown link conversion no longer uses a ReDoS-prone regex.
+- Local development artifact uploads from hosted workers succeed through the Caddy edge, and presigned upload responses without an S3 ETag are no longer treated as successful.
+
 ## 0.4.2 (2026-07-13)
 
 ### Patch changes

LOCAL_DEVELOPMENT.md

@@ -105,6 +105,13 @@ Roomote uses local defaults for development services:
 - MinIO API: `http://localhost:19000`
 - MinIO console: `http://localhost:19001`
 
+Roomote keeps server-side MinIO access on the local API port. Presigned
+artifact URLs default to `R_PUBLIC_URL`, and the local Caddy edge proxies the
+signed `/<bucket>/*` paths to MinIO. This lets E2B, Modal, Daytona, and other
+hosted workers upload artifacts through the same public edge they use for API
+callbacks. Set `S3_PRESIGN_ENDPOINT` explicitly only when using a separate
+worker-reachable object-storage endpoint.
+
 Start the database, Redis, and artifact-storage services:
 
 ```sh