Promote v0.37.0 to production

.docker/sandbox/install-browser-agent.sh

@@ -441,10 +441,10 @@ collect_preview_urls() {
   local name value
   while IFS='=' read -r name value; do
     case "$name" in
-      ROOMOTE_EDITOR_HOST|ROOMOTE_SANDBOX_SERVER_HOST)
+      ROOMOTE_EDITOR_HOST|ROOMOTE_SANDBOX_SERVER_HOST|ROOMOTE_SANDBOX_SERVER_PREVIEW_URL)
         continue
         ;;
-      ROOMOTE_*_HOST)
+      ROOMOTE_*_HOST|ROOMOTE_*_PREVIEW_URL)
         case "$value" in
           http://*|https://*)
             printf '%s\n' "$value"
@@ -475,6 +475,7 @@ seed_preview_cookies() {
   local session_hash
   local cache_file
   local url
+  local -a cookie_security_args
 
   cache_key="$(printf '%s\0' "$AGENT_BROWSER_SESSION_VALUE" "$header_name" "$bypass_value" "${AGENT_BROWSER_PREFIX_ARGS[*]}" "${preview_urls[@]}" | sha256sum | awk '{print $1}')"
   session_hash="$(hash_value "$AGENT_BROWSER_SESSION_VALUE")"
@@ -488,11 +489,16 @@ seed_preview_cookies() {
   resolve_cli_paths
 
   for url in "${preview_urls[@]}"; do
+    cookie_security_args=()
+    case "$url" in
+      https://*) cookie_security_args+=(--secure) ;;
+    esac
+
     if [ -n "$bypass_value" ]; then
-      AGENT_BROWSER_HEADED=false "$AGENT_BROWSER_BIN" "${AGENT_BROWSER_PREFIX_ARGS[@]}" cookies set "$header_name" "$bypass_value" --url "$url" --secure --sameSite Lax >/dev/null
+      AGENT_BROWSER_HEADED=false "$AGENT_BROWSER_BIN" "${AGENT_BROWSER_PREFIX_ARGS[@]}" cookies set "$header_name" "$bypass_value" --url "$url" "${cookie_security_args[@]}" --sameSite Lax >/dev/null
     fi
 
-    AGENT_BROWSER_HEADED=false "$AGENT_BROWSER_BIN" "${AGENT_BROWSER_PREFIX_ARGS[@]}" cookies set "$HIDE_PREVIEW_WIDGET_COOKIE" "1" --url "$url" --secure --sameSite Lax >/dev/null
+    AGENT_BROWSER_HEADED=false "$AGENT_BROWSER_BIN" "${AGENT_BROWSER_PREFIX_ARGS[@]}" cookies set "$HIDE_PREVIEW_WIDGET_COOKIE" "1" --url "$url" "${cookie_security_args[@]}" --sameSite Lax >/dev/null
   done
 
   : > "$cache_file"

AGENTS.md

@@ -48,6 +48,7 @@ This repository is open source. Treat GitHub and other public surfaces as fully
 - Treat absolute home-directory skill paths such as `/home/roomote/.agents/skills/...` as activated or installed runtime copies, not as the checked-in source of truth for repository changes.
 - Treat workflow prompts and instructions as a first-class control surface. When agent behavior is off, debug prompt clarity before defaulting to code enforcement.
 - `apps/docs/` is the public product documentation site (published at `https://docs.roomote.dev`) and should be kept in sync with user-facing product changes.
+- Keep equivalent functionality in sync across supported source-control, communication, and sandbox providers whenever applicable. Do not intentionally make provider-specific exceptions unless the user explicitly requests one.
 - **Schema N-1 rollback guarantee:** Roomote must always be able to roll application code back one release against the current database. Do not drop tables or columns that the previous release still reads or writes in the same release that removes the feature. Stop using the columns in app code first, keep them in `packages/db` with an explicit N-1 comment, and drop them only after the next release is the supported rollback target. See `packages/db/AGENTS.md` for the package-local rules.
 
 ## Slack message formatting

CHANGELOG.md

@@ -2,6 +2,38 @@
 
 This file tracks product releases for Roomote (single monorepo version). Automated release entries are prepended by `pnpm run version`.
 
+## 0.37.0 (2026-08-10)
+
+This release brings voice-driven work to every chat provider, expands organization-wide automations and source-control identity support, and improves task reliability.
+
+### Highlights
+
+- Start tasks and send follow-ups with audio or voice messages across Slack, Discord, Telegram, and Microsoft Teams.
+- Run custom automations across every active repository while routing suggested follow-up tasks to the correct environment.
+- Show verified linked identities and privacy-safe attribution across GitLab, Gitea, Bitbucket, and Azure DevOps.
+- Keep long-running tasks, pull-request reviews, authenticated previews, and chat auto-start flows working more reliably.
+
+### Minor changes
+
+- Run custom automations across all active repositories while routing each suggested follow-up task to the correct repository environment.
+- Start tasks and send follow-ups with audio or voice messages across Slack, Discord, Telegram, and Microsoft Teams, with actionable guidance when transcription is unavailable.
+- Configure deployment incident banners and Slack warnings with a Statuspage-compatible unresolved-incidents feed URL, or leave the feed disabled when no URL is set.
+- Show verified linked identities for GitLab, Gitea, Bitbucket, and Azure DevOps, and use privacy-safe provider attribution for public source-control changes.
+
+### Patch changes
+
+- Let agents open authenticated shareable previews without being redirected to sign-in, including previews that ultimately redirect to direct machine URLs.
+- Add a direct link from model settings to Roomote's model recommendations so users can compare supported choices before configuring task roles.
+- Preserve provider-neutral source context for child tasks so agents can identify the originating conversation without inheriting live reply behavior.
+- Keep pull-request attribution current and privacy-safe across public and private repositories while preserving provider-specific follow-up links. Thanks to @T4cC0re for reporting [#1184](https://github.com/RooCodeInc/Roomote/issues/1184).
+- Refresh supported source-control OAuth credentials before they expire during long-running, resumed, and mixed-provider tasks while keeping temporary provider failures retryable.
+- Keep pull-request review follow-ups running until their queued work settles, release review actions after stale workers stop, and avoid duplicate completion or action notifications.
+- Reply to human-authored Slack and Discord auto-start messages when task classification or startup fails unexpectedly instead of appearing unresponsive.
+- Restore Better Stack monitoring, incident, and telemetry inspection tools in tasks while preserving Roomote's read-only integration boundary.
+- Reuse compute-provider clients across scheduler checks to prevent memory growth and worker restarts on deployments with continuously active tasks.
+- Show every active pull request linked to a task across the web app and supported chat providers instead of displaying only one associated pull request.
+- Let agents discover enabled automation models and reject unavailable model overrides when an automation is configured instead of failing later at launch.
+
 ## 0.36.1 (2026-08-07)
 
 This release improves compatibility across MCP and Anthropic integrations, tightens automation suggestions, and refreshes Gemini recommendations.