L4 0.0.3

Items, nested subtasks, control over chat attention, a safer VPS, and security fixes. It adds one migration. Take the pre-update backup as usual.

Data

• Items: pages, records and Canvases are one model at /items/:id. A page can gain Database properties or move back out and keep its address, body, children and history.
• Trash and purge work on large Databases.

Tasks

• Nested subtasks have their own status, assignee, priority, due date and discussion. A child stays on its parent's Board and Project, and cycles are refused.
• Saving a Task sends only what you changed, so it can't write an old status back over an Agent's move.

Chat

• Follow or unfollow a Thread on purpose, and see them in Inbox → My threads. Threads you had already read stay followed.
• Notifications per conversation: Default, All messages, Mentions only or Off.
• Mark unread, and read previews in Inbox without marking anything read.

Running a Server

• Docker and VPS: the Server runs as UID 10001 on a read-only filesystem with no capabilities. An older Compose file still starts after a tag change: the image takes over its volume and then gives up root.
• llll doctor checks a VPS install and changes nothing.
• Faster cold starts: the Cloudflare SDK, Turndown and the mail parser load on first use.

Security

• Inbound mail keeps a sender verdict from the hop that received it, and a pass counts only for the domain in From. Failing mail never joins a conversation. Unverified mail joins only if its sender is already in the conversation, and adds no participants or Reply-To. On paths with no verdict (Mailgun, Postmark, the bridge, the gateway) every message is unverified.
• Removing an Agent now needs Manage agents and cleans up its schedules, keys and Tasks.
• The Task assignee list follows the same rule as the Agent directory.
• Lookalike names are refused, including non-Latin letters that look alike.
• Webhook Agents must have granted access.
• Local Chromium checks every request against the addresses it resolves to. Run it on an isolated network as well.

Changes to check

• Old links to documents, Canvases and database records no longer work.
• Page covers are gone: an external image told its host who viewed the page.

Update from Server settings → Deployment → Updates, or by the image tag on Docker and llll upgrade on a VPS.