Release Roomote 0.8.0

[roomote-roomote]

Opened on behalf of Matt Rubens. Follow up by mentioning @roomote-roomote, in the web UI, or in Slack.

Release Roomote 0.8.0

Cuts product version 0.7.1 → 0.8.0 (minor).

Previous release

• Tag: v0.7.1
• Changelog section: 0.7.1

Changelog

Minor changes

• Route task-sandbox inference through a control-plane gateway for every deployment: provider API keys and ChatGPT subscription auth stay server-side, sandboxes call /api/inference with a run-scoped token, and the InferenceGateway feature flag is removed so this is always on.
• Allow self-hosted operators to set the paid-seat license key via the R_LICENSE_KEY environment variable (takes precedence over Settings → Users).
• Add provider-local model mapping presets in Settings so operators can choose labeled mapping sets (including OpenRouter Balanced and Quick turnaround), confirm the selected mapping before it applies, and automatically add or enable referenced models.
• Remove the authorship-rules feature (settings UI, compiler, and enqueue-time evaluation). Task commit authors and PR assignees now always use default attribution.

Patch changes

• Automation labels spell the CodeQL brand correctly, so codeql_triage surfaces as “CodeQL Triage” instead of “Codeql Triage” in task filters, analytics, and attribution.
• Temporarily disable Google Vertex AI and remove legacy direct Mistral execution. Model-provider credentials now enter task sandboxes only through the selected runtime provider allowlist, while unrelated task environment variables remain available.
• Clarify the Discord install flow (including dropping the permissions integer from operator-facing guidance) and recover the Discord gateway when a deployment never received a gateway secret instead of staying stuck offline.
• When both an OpenAI API key and a ChatGPT subscription are connected, Settings again shows a separate OpenAI provider section instead of folding every openai/ model under ChatGPT (subscription).
• Tasks no longer abort when OpenCode surfaces a provider rate-limit as a terminal session error; the worker treats those limits as retryable and continues the run after backoff.
• OpenRouter Connect works for self-hosted deployments whose public app URL is a loopback address, instead of failing the OAuth handoff in that configuration.
• Refresh the shipped worker runtime when restoring task snapshots so snapshots created by an older release remain compatible with current runtime protocols such as the inference gateway.
• Shared links into the product app now resolve to short static page titles and one-line descriptions (task, settings, history, sign-in, setup, onboarding) instead of the generic global fallback.
• Harden high-confidence security gaps: shell-escape untrusted git and GitHub CLI arguments, tighten OAuth account linking, and strengthen run-token authentication used by sandbox runtime traffic.
• Slack transcript decoding no longer hangs when thread activity contains crafted or pathological input.

Validation

• Audited v0.7.1..origin/develop first-parent merges
• Generated version/changelog exclusively via pnpm run version (no hand edits)
• Confirmed root package.json only bumped to 0.8.0; workspace package versions unchanged
• Pending base-branch changesets consumed; .changeset/README.md retained
• pnpm run test:release-scripts passed (8/8)

Ship notes

Squash-merge this PR into develop to cut the release. CI will freeze release/v0.8.0 and open the Promote v0.8.0 to production PR against main. Do not push to release/v* manually.

[roomote-roomote]

No code issues found. See task

_{Reviewed 9b76ff8}