[{"data":1,"prerenderedAt":18},["ShallowReactive",2],{"release:0.3.0":3},{"version":4,"title":5,"description":6,"date":7,"url":8,"markdownPath":9,"prerelease":10,"html":11,"newer":12,"older":15},"0.3.0","L4 0.3.0","This release turns L4 into a workspace for teams and their agents and starts the server-v2 database lineage. Landing, Shell, installer, Server, portable runtime and Docs share 0.3.0. Customer Servers update only when…","2026-10-28","\u002Fchangelog\u002Fv0.3.0","\u002Fchangelog\u002Fv0.3.0.md",false,"\u003Cp>This release turns L4 into a workspace for teams and their agents and starts the \u003Ccode>server-v2\u003C\u002Fcode> database lineage. Landing, Shell, installer, Server, portable runtime and Docs share \u003Cstrong>0.3.0\u003C\u002Fstrong>. Customer Servers update only when their operator chooses an update.\u003C\u002Fp>\n\u003Ch2 id=\"fresh-servers-only\">\u003Ca class=\"heading-anchor\" href=\"#fresh-servers-only\">Fresh Servers only\u003C\u002Fa>\u003C\u002Fh2>\n\u003Cp>Server migrations are squashed into one \u003Ccode>server-v2\u003C\u002Fcode> baseline. A 0.3.0 Server requires a fresh database: it refuses a \u003Ccode>server-v1\u003C\u002Fcode> database, and the release declares \u003Ccode>llll-server-schema-v2\u003C\u002Fcode>, so the installer neither installs nor updates across lineages. Install a new Server for 0.3.0; Servers on 0.2.x stay on their selected release. Durable Object migrations are unchanged.\u003C\u002Fp>\n\u003Ch2 id=\"agents-and-code-work\">\u003Ca class=\"heading-anchor\" href=\"#agents-and-code-work\">Agents and code work\u003C\u002Fa>\u003C\u002Fh2>\n\u003Cul>\n\u003Cli>Agents work on repository Tasks through a connected Compute Node or Lizard VM and open draft pull requests. Server settings group Agents, Models, Repositories, Compute and Tools, with a setup checklist.\u003C\u002Fli>\n\u003Cli>Roles are collections of reusable policies; the Owner can extend Admin and Member with policies.\u003C\u002Fli>\n\u003Cli>Agents can be deleted. The Runs page lists your own Runs. A Task can be created from a chat message, linked both ways.\u003C\u002Fli>\n\u003Cli>Agents receive mentions as names; a bare mention is a ping.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch2 id=\"inbox-chat-and-mail\">\u003Ca class=\"heading-anchor\" href=\"#inbox-chat-and-mail\">Inbox, chat and mail\u003C\u002Fa>\u003C\u002Fh2>\n\u003Cul>\n\u003Cli>Inbox is a queue of what needs you: approvals, unread mentions, your agent work, Tasks assigned to you or waiting for your review, unread mail and unread chats, with Mark as read.\u003C\u002Fli>\n\u003Cli>Server-wide message search; role mentions (opt-in per Role); channel archiving; visibility changes and reordering for channels; live channel updates; one 1:1 DM per pair; edit mentions notify only new people.\u003C\u002Fli>\n\u003Cli>Message moderation for channel managers, chat rate limits, emoji-only reactions.\u003C\u002Fli>\n\u003Cli>Mail: push notifications for new inbox mail, folder search, Cc\u002FBcc and forward.\u003C\u002Fli>\n\u003Cli>Data and Apps are paused in this release and shown as coming soon; their APIs and stored data are unchanged.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch2 id=\"live-and-schedules\">\u003Ca class=\"heading-anchor\" href=\"#live-and-schedules\">Live and Schedules\u003C\u002Fa>\u003C\u002Fh2>\n\u003Cul>\n\u003Cli>Live rooms always end, reconnect after a dropped connection, expose host remove\u002Fmute and use clearer errors and incoming-call controls.\u003C\u002Fli>\n\u003Cli>Schedules retry with visible errors, report the real block reason, notify the person who set a reminder, handle time zones and DST, and can be paused, resumed and inspected.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch2 id=\"security\">\u003Ca class=\"heading-anchor\" href=\"#security\">Security\u003C\u002Fa>\u003C\u002Fh2>\n\u003Cul>\n\u003Cli>Sign-in, signup, password reset, recovery and Owner claim are rate-limited per address and per account and fail closed. Self-host gateways no longer trust a client-sent \u003Ccode>CF-Connecting-IP\u003C\u002Fcode>.\u003C\u002Fli>\n\u003Cli>Role-mode agents cannot reach arbitrary web or MCP destinations after reading private data; private-source answers post only in the initiator's DM.\u003C\u002Fli>\n\u003Cli>\u003Ccode>read_url\u003C\u002Fcode> blocks IPv6, mapped, NAT64, CGNAT and single-label internal addresses and rechecks the final URL.\u003C\u002Fli>\n\u003Cli>Content-Security-Policy without inline-script \u003Ccode>'unsafe-inline'\u003C\u002Fcode>, HSTS and Permissions-Policy. Every Server document, including the PWA's cached shell, carries the Server's \u003Ccode>frame-ancestors\u003C\u002Fcode>; the build publishes no static HTML.\u003C\u002Fli>\n\u003Cli>Cookie-authenticated mutations require a same-site \u003Ccode>Origin\u003C\u002Fcode> or \u003Ccode>Sec-Fetch-Site\u003C\u002Fcode>. \u003Ccode>\u002Fapi\u002Fsetup\u002Fhealth\u003C\u002Fcode> is read-only.\u003C\u002Fli>\n\u003Cli>Mention pushes from mailboxes and Task discussions reach only people who can read them.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch2 id=\"runtime\">\u003Ca class=\"heading-anchor\" href=\"#runtime\">Runtime\u003C\u002Fa>\u003C\u002Fh2>\n\u003Cp>The Cloudflare Agents SDK is removed; MCP uses the MCP SDK directly. celld is 0.6.3. npm advisories are patched. Container images move to Caddy 2.11.7, AWS CLI 2.38.5, Node 26.12.0 and Docker CLI 29.9.2.\u003C\u002Fp>\n",{"title":13,"url":14},"L4 0.3.1","\u002Fchangelog\u002Fv0.3.1",{"title":16,"url":17},"L4 0.2.21","\u002Fchangelog\u002Fv0.2.21",1793335827008]