[mrubens]

Promote v1.20.0

Frozen at 38325e3559771e99e1e0efb7e8406262002b8683 — the commit where 1.20.0 was versioned. Commits merged to develop afterward require an explicit candidate refresh or ship in the next release.

• Merge this PR with a merge commit (do not squash or rebase).
• If multiple promote PRs are open, merge them in version order (oldest first).
• Monitor CI and reviews on this PR's current head, not only the release-preparation PR. Unresolved findings and missing required approvals remain blockers even with green CI.
• After a refresh or CI reconciliation, re-check the new head; monitoring never authorizes merging or publication.
• Merging publishes a GitHub Release for v1.20.0 and triggers the existing GHCR v* image publish (latest channel).
• The release/v1.20.0 branch can be deleted after this PR merges.

Changelog

1.20.0 (2026-11-04)

Roomote 1.20.0 adds MCP connection controls and testing, stops runaway agent activity, and includes security updates for redirects and static-file serving.

Highlights

• Manage connected MCP clients and revoke access immediately. Upgrade the web authorization server before the API; existing clients may need to refresh or reconnect.
• Test saved remote MCP connections from shared or personal integration settings.
• Stop repeated tool-call loops and excessive inference requests while preserving partial work and a visible safety notice.
• Includes security fixes for credential handling across redirects and static-file paths.

Minor changes

• Test a saved remote MCP server's connection on demand from Manage tools in shared or personal integration settings. Each test retrieves a fresh tool catalog using the saved authentication, reports success or failure even for an empty catalog, and leaves tool approval choices and server enablement unchanged. Local stdio servers still need to be checked inside a task sandbox.
• Manage and revoke inbound MCP client authorizations from personal settings or, for admins, by user in users settings, including revoking all clients for a user. Revocation blocks already-issued OAuth access tokens on subsequent requests. Upgrade compatibility: legacy MCP access tokens without client/grant identity receive 401 after API enforcement is deployed. Deploy the updated web authorization server and drain all old issuer instances before upgrading the API. Live legacy refresh sessions are backfilled without extending their original expiry; clients without a usable refresh session, or unable to refresh after a 401, must reconnect and repeat browser consent. In-progress legacy authorization codes also require consent again. Redis outages refuse OAuth access, and lost authorization data requires reconnecting. Rolling back the API removes prompt revocation enforcement; rolling back the authorization server may require reconnecting migrated clients.

Patch changes

• Stop repeated identical tool-call loops and bound subagent passes. Enforce a durable task-wide inference request ceiling before dispatch, retain partial work, and save a visible safety notice without requiring another model response.

[roomote-community]

1 issue outstanding. See session

• P2: Restore Copilot's early provider activation for task helpers — packages/cloud-agents/src/server/opencode-runtime.ts:752: GPT-5.x helpers hit /chat/completions instead of the required /responses; verified with pinned OpenCode and a local synthetic gateway.

_{Reviewed 38325e3}

[roomote-community]

[P2] Enable Copilot before OpenCode registers its endpoint router

Gateway-bound helpers now strip OAuth, but this provider configuration does not supply the early env activation used by mergeInferenceGatewayProviderConfig in apps/worker/src/run-task/agent-home.ts. Consequently OpenCode skips Copilot's custom endpoint router and sends GPT-5.x helper inference to /chat/completions, which Copilot rejects instead of serving it through /responses. A local probe with pinned OpenCode 1.18.30 and synthetic credentials reproduced /api/inference/github-copilot/chat/completions; adding env: ['ROOMOTE_TASK_INFERENCE_TOKEN'] changed it to /api/inference/github-copilot/responses. Apply the equivalent activation here and assert the exact endpoint in the subscription transport regression test; its current prefix-only assertion accepts the broken route.