v2.9.0

Lific can now associate a repository with its project, route one agent connection to several trackers, and move complete projects between instances. Publish a project's current issues and pages for anyone to read in the same web UI. Sidebar ordering becomes personal, and CLI diagnostics and account recovery get stricter. Read the upgrade notes before changing a container or automated client.

Repository bindings and git hooks

• lific bind [PROJECT] associates the current repository with a project, locally or through --backend http. With no project argument it reports the binding; --create creates the project first. Locally computed aliases identify the normalized origin remote and the root commit of HEAD's first-parent history. Moving a checkout does not break its binding. Shallow clones omit the root alias. The server stores aliases, never directory paths; it never runs git or inspects your filesystem.
• A bound stdio MCP session announces its project. list_issues, create_issue, get_board, create_plan, and project-scoped list_resources calls can omit project. Explicit projects win. Search remains cross-project when unscoped, create_page can still create workspace pages, and destructive tools do not gain an implicit project.
• lific mcp --remote --url <URL> provides a local stdio proxy to a remote server. It resolves the checkout locally and supplies its bound project where allowed, reuses CLI credentials, and reports remote failures as JSON-RPC errors. Credentialed non-loopback connections require HTTPS.
• Binding APIs support resolution, listing, removal and merging. Resolution respects project visibility; binding requires project lead or admin authority, and merging requires authority over both projects. Aliases are lookup keys, not ownership claims, and new aliases are never accumulated automatically.
• Invoke lific git-hook from your hook or CI job to close references such as closes PRO-42, fixes PRO-42, or resolves PRO-42. It accepts a message on stdin or reads commits with --range A..B; --dry-run previews the changes. Writing a commit message alone does nothing. POST /api/git-hook provides the remote endpoint with per-issue authorization. Closures use ordinary status updates, including history and live notifications.
• Generated lific agents-md guidance now describes MCP and CLI roles rather than calling the CLI a fallback: tracker operations through MCP, machine-local work through the CLI.

One MCP connection, several instances

lific mcp --instances <FILE> exposes one tool set backed by named servers. Each alias explicitly selects its own environment-token source, stored login, or unauthenticated connection. Repository bindings are resolved separately for each server; neither projects nor credentials spill into another alias.

With multiple backends, writes require an explicit instance; allowlisted reads may use a default. Failed calls never redirect elsewhere. Results identify their source alias. A synthetic list_instances tool reports hosts, authentication state and repository bindings without revealing credentials.

Startup requires exactly matching complete tool definitions across all backends, including descriptions, annotations and schemas. Even a wording difference fails. This mode routes tools, not MCP resources or prompts. See multi-instance MCP for configuration and limits.

Complete project archives

Move a project with lific project-archive export and import, or download its archive from the project overview and import it through New project in the browser. Browser exports require a signed-in project lead or instance admin; browser imports require an instance admin. CLI imports name the destination admin with --user. There is no MCP archive tool.

• Archives include issues, pages, plans and steps, comments, project structure, internal links, linked files, content history and status transitions. Deleted content travels with its tombstones. Readable identifiers and timestamps survive; internal IDs and attachment references are remapped. Missing external references are reported rather than silently attached to unrelated destination records.
• Import creates a new private project and makes the destination admin its lead. It never merges, overwrites a colliding identifier, or deletes the source. Imported authors remain names marked (imported), not accounts with permissions, even if a destination username matches. Source accounts, credentials, memberships and permission grants do not transfer; neither do repository bindings or saved views.
• The browser allows at most 128 MiB compressed and 50,000 rows; the local CLI allows 2 GiB compressed and 200,000 rows. Expanded data and files have separate limits. Invalid relationships, unsafe paths and damaged blobs stop the import before a partial project becomes visible.
• Browser transfers show upload progress and retain their result when you leave and return within the same tab. Losing the connection during import leaves its outcome unknown: check the project list before retrying. The server may already have committed it.

Archives contain historical text removed from today's descriptions. Treat them as private data. Review the reference report and imported files before switching writers. Project archives documents limits and cutover.

Public projects

A project lead or instance admin can enable Public view in the project overview. Publication is off by default and exposes every current issue, page, comment and linked file in that project, including content written before publication. This is public access, not a secret-link permission scheme. Review existing content before confirming.

Readers get the ordinary issue list, board, page tree and detail views, with filtering, sorting and project-local search. Editing and commenting controls are absent. Plans, audit history, trash, account records, membership and cross-project relations stay outside the public surface. Comments show display names, not account identifiers.

Public Markdown prevents automatic third-party media loads; local attachment references use public download routes. External links remain clickable. Unpublishing stops subsequent requests, but cannot recall saved files or pages. Publication does not secure an otherwise open instance: require authentication and disable browser auto-login before exposing the server. See public projects.

Web UI

• Sidebar project ordering now belongs to each user instead of rearranging everybody's sidebar. Group metadata and order responses are filtered to projects the caller can see. Project and group action buttons expose move-up and move-down commands without requiring a drag or right-click; failed saves report errors and restore the previous order.
• Desktop navigation separates project expansion from destination links, which support opening another tab. Recent items have their own collapsible section. Group naming uses explicit Save and Cancel controls instead of saving on blur. The default sidebar width follows text size without replacing a width you deliberately saved, and selected-row metadata remains readable across accent colors.
• Mobile navigation participates in browser history: Back returns to the project list before closing the drawer. Focus stays inside the active pane and returns to its trigger on dismissal. Context menus and other overlays no longer compete for shortcuts.
• Account edits update the shell without a reload. Settings and navigation share the current theme preference, including system changes and changes from another tab. The sidebar theme button now offers explicit choices rather than cycling blindly through them.
• Connected Tools accepts custom tools and separately named connections for the same agent. Each connection keeps its own identity and lifecycle controls; renaming the owner no longer hides stored connections.
• The command palette answers from the current project's loaded issue and page index immediately, adding server search when local results are sparse. Late responses from an earlier query or project cannot replace the current results.
• Issue selection has visible controls and a select-all control in the desktop sub-tab strip. Ctrl/Cmd+A selects visible list rows when the list owns the shortcut. Only titles and identifiers navigate on a plain click. Selected issues download as one Markdown file with canonical metadata and comments, capped at 16 MiB. Failed exports report an error without downloading a partial file.
• Linked issue chips show status and refresh it as issues change (PRs #47 and #49 by @mjc). Issue detail now displays both duplicate directions. Malformed project or module icons fall back safely instead of breaking rendering.

CLI, comments and recovery

• CLI credential files now fail closed on malformed or unsafe data instead of treating corruption as an empty store or overwriting it. Writes use private storage and reject unsafe links (PR #51 by @mjc). Help names the API-key environment variable without printing its value.
• lific doctor inspects the database without migrating it by default. --repair explicitly applies pending migrations. Configuration failures stay visible rather than quietly selecting the default database, and schema inspection uses one read snapshot (PR #52 by @mjc, with follow-up fixes).
• Local CLI content writes reconcile attachments and mentions through the same transactional query paths as REST and MCP. Local and HTTP JSON output also share web-link formatting.
• Interactive comment pages now have a 2 MiB byte budget as well as a row limit. Continuation metadata tells clients whether more remain; a short page no longer means the thread ended. MCP measures the encoded response, including formatting. An individually oversized comment fails explicitly with continuation instructions instead of disappearing. Comment bodies allow at most 256 distinct mention tokens and 256 distinct attachment IDs; older oversized bodies can be edited without growing.
• WebSockets revalidate credentials before protected live deliveries, cached activity reads and every replay frame. Account recovery performed through the CLI therefore stops delivery without waiting for the idle revalidation timer. Enabling auto-login through the CLI now applies the same exposure checks as the web API; disabling it remains available for recovery.
• MCP issue-list rows include module names. Plan instructions clarify that step_id takes the database ID printed by get_plan, as an integer, not the step's position.
• Export streams tolerate repeated end-of-file polls, fixing a panic when compression asks for trailers after the body has finished.

First run and containers

Ordinary local commands, including bare mcp and start, now refuse a missing database and name the expected path instead of leaving an empty tracker in the current repository. init --db records the actual absolute database path in its config and reports conflicts with an existing configured path.

lific init can also update an existing writable config file when its parent directory is read-only, as with a container-mounted config.

For containers, explicit start --init-if-missing supports first boot on an empty volume. The supplied image uses it. Creation requires a deliberately selected database location, an existing writable parent directory, and both LIFIC_INIT_ADMIN_NAME and LIFIC_INIT_ADMIN_PASSWORD. Bootstrap creates a password-protected admin with signup and auto-login off, without printing an operator key. An interrupted bootstrap can resume; an instance that already has its admin ignores the initialization variables.

Development

CLI process-contract tests cover help, completion, output and exit behavior (PR #53 by @mjc). MCP contract tests check parameter naming, required definitions and README coverage. CI now runs frontend unit tests, browser archive round-trips, public-project isolation, and sidebar, mobile-navigation and context-menu contracts. Documentation navigation, local links and the MCP tool count are checked on pull requests as well as pushes.

Upgrading

• Back up before upgrading. Four migrations, 049 through 052, add repository bindings, archive attribution, publication and personal project ordering. Rolling back requires the pre-upgrade backup, not just an older binary. Existing projects remain private.
• Automation must initialize deliberately: use lific init, restore a backup, or opt into the guarded start --init-if-missing path above. HTTP-backed commands still need no local database. Supply both admin variables for a fresh container volume. Diagnostic checks no longer migrate databases unless you request doctor --repair.
• Repair malformed credential storage or unsafe filesystem paths before retrying login-dependent commands. The CLI will no longer silently discard that state.
• Comment clients must follow continuation metadata rather than infer completion from page length. REST exposes x-comment-has-more, x-comment-returned and next-offset or cursor headers. Imported comments can report user_id: -1, meaning no destination account, not a user to resolve.
• Upgrade multi-instance backends together to matching tool definitions. Equal version numbers or compatible parameter schemas alone do not satisfy the proxy's exact-definition check.