# L4 0.2.12 > Projects, scoped tool discovery and GitHub App setup are now available for independent Servers. This release also tightens Agent privacy and authorization, fixes Task and Inbox behavior, and updates vulnerable… Source: https://llll.gg/changelog/v0.2.12 Projects, scoped tool discovery and GitHub App setup are now available for independent Servers. This release also tightens Agent privacy and authorization, fixes Task and Inbox behavior, and updates vulnerable dependencies. It is a foundation for Software Factory, not a completed autonomous coding workflow. ## Projects and Git providers - Server-local Projects contain multiple provider-qualified repository references and L4 Tasks. Project scope intersects existing board, repository, Role and delegation authority across HTTP, discussions, sockets and Agent execution. Archiving a Project stops execution; repository configuration changes revoke earlier snapshots. - Roles group permissions and resource selectors into Projects, Data, Chat, Email, Apps, Agents, Integrations and Server. Email retains its existing per-mailbox policy. The Role editor opens correctly with reactive resource scopes, and Owner metadata reports effective permissions without rewriting stored Roles. - Ordinary GitHub development uses a dedicated branch in the same repository. Forks are optional. GitLab, Gitea and Cursor Git hosting can be recorded as repository references; their executable adapters are not implemented. - The human Server Owner can create a dedicated private GitHub App from Settings → Repositories, authorize selected repositories on GitHub and explicitly select that connection in L4. The encrypted App key stays on the Server. Setup has expiring, single-use, Owner/origin-bound state and supports sign-in in a separate tab. Disabling a selected connection blocks later calls without falling back to another App; uninstalling the App on GitHub remains a separate action. Worker logs redact callback query parameters. ## Agent tools, privacy and review - Agents discover authorized tools and load their schemas on demand. Server Settings → Tools manages scoped outbound MCP connections, reviewed contracts, exposure previews and private/redacted audit history. Bounded result handling preserves useful evidence from large MCP responses. These facilities do not bypass the sensitive-action gate. - Untrusted context is derived across current and historical Session activity. Private prompts, results, transcripts and working files stay with the initiating human; continuation cannot silently import another conversation's private context. Shared conversations receive a safe Run notice instead of automatic model output. - The initiating human with Approve Agent actions can review and explicitly publish the exact completed result, with destination/audience, digest, expiry, current-authority checks and an idempotent receipt. Uncertain publication outcomes are never retried automatically. The Owner can inspect usage/audit metadata without gaining another human's private Run content. - Model-selected Server writes and outbound payloads, including code publication, remain blocked pending exact-action review. General durable approval wait/resume, reviewed code publication, per-branch merge/release policy and the complete Software Factory cycle remain open under #307, #309 and #310. No live L4 GitHub App or end-to-end external coding acceptance is claimed. - Saved Run results render as safe Markdown. Scoped Agent Role editing and a bounded Task Role preset are available. Internal AI functions have explicit model assignments, and configured model choices and local callbacks work consistently. ## Tasks, communication and reliability - Task-backed execution uses the Task discussion by default and explains blocked starts. Execution deadlines begin at admission, queue expiry is separate, and finalization handles authorized Agent-owned Task edits. Queue controls refresh independently of model discovery; terminal policy/budget denials are not retried as transient inference errors. - Cancellation reports failures and preserves finished Run state. Removed or paused Agents are excluded from active directories. Server-side Role/resource checks refresh after management changes, and App publishers cannot exceed their source/delegation scope. - Inbox unread counts and conversation activity ordering agree with message reads, and one failing source no longer hides other conversations. Live events and push audiences honor conversation resource access. Live leave stays private and RealtimeKit REST calls have bounds. - MCP transport updates preserve concurrent client isolation. Authorized table schemas are visible through MCP/Agent discovery. Document creation, checkbox filters and default data reads are corrected. Local stack shutdown reaps stopped children. ## Installation, migrations and validation The official web, Shell, installer, standalone Server, portable Linux amd64 runtime and version-pinned Docs share **0.2.12**. New installations can use their operator's own Cloudflare account or VPS. Customer Servers remain pinned until the operator completes the backup/update flow. Preserve the original Server encryption secret: restored Git and model credentials require it. Native iOS/macOS publication remains frozen. This release appends Server migrations **0017–0022** within the existing `server-v1` lineage for Task edit state, outbound MCP, context security, result publication reviews, Projects and Git connections. Merged migration SQL is unchanged, including the historical one-time backfill in 0019; runtime trust checks do not depend on that backfill. Earlier pre-`server-v1` schemas are not upgrade targets. Validation of the accumulated main includes **1259 tests in 198 files**, real workerd GitHub transport, two-Server HTTP authorization and revocation, encrypted backup/restore with R2 and KV storage, desktop/mobile browser checks, native Git-built web/Server Previews, self-host cold restore and local stack verification. Release CI additionally rebuilds the exact versioned artifacts and verifies checksums before publication and production promotion. Protocol fixtures do not establish a real GitHub App installation, live customer OAuth or full external Software Factory acceptance. Security updates include the inbound MIME parser, Nuxt runtime dependencies, MCP transport, esbuild, happy-dom, desktop rustls and sharp/libvips. The existing dependency-audit findings remain tracked in #300, including node-forge without a patched npm release at the time of this release preparation; no advisory or security check is suppressed.