v2026.8.0

Desktop App

Platform	Downloads
macOS	Apple Silicon (DMG) · Intel (DMG)
Windows	Installer (EXE)
Linux	AppImage x64 · AppImage ARM64 · install script
Debian / Ubuntu	x64 (deb) · ARM64 (deb)
Fedora / RHEL	x64 (rpm) · ARM64 (rpm)

Enterprise - Managed deployment (MDM / GPO)

Platform	Downloads
macOS	PKG Apple Silicon · PKG Intel
Windows	MSI

macOS PKGs are signed and notarized; the Windows MSI is Authenticode-signed.

Browser Extension

Browser	Store
Chrome	Chrome Web Store
Firefox	Firefox Add-ons
Edge	Edge Add-ons

Terminal - CLI & TUI

Platform	Download
Linux (x64)	oh-2026.8.0-linux-x64
macOS (Apple Silicon)	oh-2026.8.0-mac-arm64
Windows (x64)	oh-2026.8.0-win-x64.exe

Checksums: SHA256SUMS.txt · GPG signature · signing key

Install scripts & notes

Install script (verifies checksums, installs oh to ~/.local/bin):

curl -fsSL https://updates.openheaders.io/install.sh | sh

Windows (PowerShell):

irm https://updates.openheaders.io/install.ps1 | iex

No Node.js required (npm install -g @openheaders/cli is the Node channel). macOS binaries are signed and notarized; the Windows oh is unsigned — SmartScreen warns on first run (More info → Run anyway). Script copies on this page: install-oh.sh · install-oh.ps1

Team - Server Daemon

Platform	Download
Linux (x64)	ohd-2026.8.0-linux-x64
macOS (Apple Silicon)	ohd-2026.8.0-mac-arm64
Docker	ghcr.io/openheaders/ohd:2026.8.0

Checksums: SHA256SUMS.txt · GPG signature · signing key

Install scripts & notes

Install script (verifies checksums, installs oh + ohd to ~/.local/bin):

curl -fsSL https://updates.openheaders.io/install.sh | sh -s -- --with-daemon

Docker:

docker run -d -p 127.0.0.1:8137:8137 -v oh-data:/data ghcr.io/openheaders/ohd:2026.8.0

---

What's New

Version control

• Git tool window — a workspace bound to a git repository gains a
  full Version Control tool window. The log pane draws the commit
  graph with ref labels for branches and tags, per-pane toolbars with
  filter chips and view options, a sticky branch scope, and a details
  pane for the selected commit.
• Branches rail — an activity-bar rail lists local and remote
  branches with checkout, create, and compare verbs; comparing two
  refs opens as its own tab.
• Commit window — a changes tree with tri-state checkboxes,
  keyboard navigation, and per-row context menus stages exactly what
  you pick; commit and amend run from the tree, and the working diff
  sits beside it. Single-chain directories compress to one row, the
  IDE way.
• Ignore management — Add to .gitignore and Stop Ignoring live on
  the tree's context menus, and ignored rows say which ignore file
  and pattern claimed them.
• Console tab — every git command the app runs is visible in a
  console tab, so nothing happens behind your back.

Traffic

• Capture sessions — the Traffic monitor can record what it
  observes into sealed, encrypted session archives: auto-named at
  seal, deduplicated storage for bodies, a retention budget with
  garbage collection, and recovery of interrupted recordings on next
  launch.
• Replay — a sealed session opens back up in the same viewer the
  live Traffic monitor uses — rows, timings, and bodies resolve from
  the archive even after the browser tab is long gone.
• Sessions in the sidebar — recorded sessions live in a SESSIONS
  section of the sources rail: search, sort, folders, rename and
  organize verbs, and open-on-click replay.
• Redesigned monitor — the Traffic monitor moves into the dock as
  a tool window with a per-source tab row, a sources rail, and a
  start/stop capture control in the header.
• Clear names — the wire vocabulary is now Traffic Interception,
  the system proxy settings group reads Proxy · System, and Install
  CA takes you straight to the trust pane.

AI agents

• Observe traffic over MCP — with an explicit workspace grant, an
  AI agent connected to the app's MCP server can observe captured
  traffic: list sources and requests, pull failures with their
  bodies, diff two requests, wait on traffic matching a predicate,
  and read redirect chains.
• Redaction first — sensitive fields are redacted in everything
  an agent reads, and redacted markers say so honestly; turning a
  captured request into a rule forces a draft whenever redacted
  fields are involved.
• Session tools — agents can list and read sealed capture
  sessions; raw unredacted reads sit behind their own grant, off by
  default, and every raw read is stamped in the observe feed.

Workbench

• Compact sidebar — denser rows, hover-gated controls, one global
  focus tint, and slimmer dividers across the sidebar trees.
• Speed-search — the sidebar gains an on-demand filter/search
  mode; filtering prunes empty folders and highlights no-match state.
• Tool windows keep their state — switching dock tabs no longer
  resets a tool window's scroll and selection; bodies stay mounted
  and pick up where you left them.
• Bottom panel splits — the bottom panel can hold two tool
  windows at once, side by side or stacked. Pick the arrangement from
  the merged Bottom Panel Layout menu or the panel toolbar, or drag a
  tab onto a drop zone to split in place.
• Reveal means focus — actions that reveal a tool window now
  focus it too, landi...

v2026.8.0-beta.1

This is a beta build for early testing. It may contain bugs.

Desktop App

Platform	Downloads
macOS	Apple Silicon (DMG)
Windows	Installer (EXE)
Linux	AppImage x64 · install script
Debian / Ubuntu	x64 (deb)

---

What's New

Version control

• Git tool window — a workspace bound to a git repository gains a
  full Version Control tool window. The log pane draws the commit
  graph with ref labels for branches and tags, per-pane toolbars with
  filter chips and view options, a sticky branch scope, and a details
  pane for the selected commit.
• Branches rail — an activity-bar rail lists local and remote
  branches with checkout, create, and compare verbs; comparing two
  refs opens as its own tab.
• Commit window — a changes tree with tri-state checkboxes,
  keyboard navigation, and per-row context menus stages exactly what
  you pick; commit and amend run from the tree, and the working diff
  sits beside it. Single-chain directories compress to one row, the
  IDE way.
• Ignore management — Add to .gitignore and Stop Ignoring live on
  the tree's context menus, and ignored rows say which ignore file
  and pattern claimed them.
• Console tab — every git command the app runs is visible in a
  console tab, so nothing happens behind your back.

Traffic

• Capture sessions — the Traffic monitor can record what it
  observes into sealed, encrypted session archives: auto-named at
  seal, deduplicated storage for bodies, a retention budget with
  garbage collection, and recovery of interrupted recordings on next
  launch.
• Replay — a sealed session opens back up in the same viewer the
  live Traffic monitor uses — rows, timings, and bodies resolve from
  the archive even after the browser tab is long gone.
• Sessions in the sidebar — recorded sessions live in a SESSIONS
  section of the sources rail: search, sort, folders, rename and
  organize verbs, and open-on-click replay.
• Redesigned monitor — the Traffic monitor moves into the dock as
  a tool window with a per-source tab row, a sources rail, and a
  start/stop capture control in the header.
• Clear names — the wire vocabulary is now Traffic Interception,
  the system proxy settings group reads Proxy · System, and Install
  CA takes you straight to the trust pane.

AI agents

• Observe traffic over MCP — with an explicit workspace grant, an
  AI agent connected to the app's MCP server can observe captured
  traffic: list sources and requests, pull failures with their
  bodies, diff two requests, wait on traffic matching a predicate,
  and read redirect chains.
• Redaction first — sensitive fields are redacted in everything
  an agent reads, and redacted markers say so honestly; turning a
  captured request into a rule forces a draft whenever redacted
  fields are involved.
• Session tools — agents can list and read sealed capture
  sessions; raw unredacted reads sit behind their own grant, off by
  default, and every raw read is stamped in the observe feed.

Workbench

• Compact sidebar — denser rows, hover-gated controls, one global
  focus tint, and slimmer dividers across the sidebar trees.
• Speed-search — the sidebar gains an on-demand filter/search
  mode; filtering prunes empty folders and highlights no-match state.
• Tool windows keep their state — switching dock tabs no longer
  resets a tool window's scroll and selection; bodies stay mounted
  and pick up where you left them.

v2026.7.29-cli

Standalone CLI (oh) release — this tag ships only the cli stream; the newest suite release carries the desktop app.

---

What's New

Fixes

• oh changelog — the compiled binary ships with its release
  notes embedded again. The 2026.7.28 build printed the no-notes
  fallback even though notes existed; those notes live on the
  website changelog.

v2026.7.28

Desktop App

Platform	Downloads
macOS	Apple Silicon (DMG) · Intel (DMG)
Windows	Installer (EXE)
Linux	AppImage x64 · AppImage ARM64 · install script
Debian / Ubuntu	x64 (deb) · ARM64 (deb)
Fedora / RHEL	x64 (rpm) · ARM64 (rpm)

Enterprise - Managed deployment (MDM / GPO)

Platform	Downloads
macOS	PKG Apple Silicon · PKG Intel
Windows	MSI

macOS PKGs are signed and notarized; the Windows MSI is Authenticode-signed.

Browser Extension

Browser	Store
Chrome	Chrome Web Store
Firefox	Firefox Add-ons
Edge	Edge Add-ons

Terminal - CLI & TUI

Platform	Download
Linux (x64)	oh-2026.7.28-linux-x64
macOS (Apple Silicon)	oh-2026.7.28-mac-arm64
Windows (x64)	oh-2026.7.28-win-x64.exe

Checksums: SHA256SUMS.txt · GPG signature · signing key

Install scripts & notes

Install script (verifies checksums, installs oh to ~/.local/bin):

curl -fsSL https://updates.openheaders.io/install.sh | sh

Windows (PowerShell):

irm https://updates.openheaders.io/install.ps1 | iex

No Node.js required (npm install -g @openheaders/cli is the Node channel). macOS binaries are signed and notarized; the Windows oh is unsigned — SmartScreen warns on first run (More info → Run anyway). Script copies on this page: install-oh.sh · install-oh.ps1

Team - Server Daemon

Platform	Download
Linux (x64)	ohd-2026.7.28-linux-x64
macOS (Apple Silicon)	ohd-2026.7.28-mac-arm64
Docker	ghcr.io/openheaders/ohd:2026.7.28

Checksums: SHA256SUMS.txt · GPG signature · signing key

Install scripts & notes

Install script (verifies checksums, installs oh + ohd to ~/.local/bin):

curl -fsSL https://updates.openheaders.io/install.sh | sh -s -- --with-daemon

Docker:

docker run -d -p 127.0.0.1:8137:8137 -v oh-data:/data ghcr.io/openheaders/ohd:2026.7.28

---

What's New

Requests

• HTTP version control — every request gains an HTTP version
  setting: Auto (the default) negotiates with the server, or pin
  HTTP/1.1, HTTP/2, HTTP/2 (prior knowledge), or HTTP/3. A pinned
  version the server can't speak fails with a clear error naming the
  setting — never a silent downgrade.
• HTTP/3 over QUIC — sends can now ride HTTP/3 end to end, a
  first among API clients. The QUIC engine ships inside the app and
  honors the request's trust settings — SSL verification off, custom
  CAs, and client certificates — so self-signed local endpoints work
  the same as on the other versions.
• Cleartext HTTP/2 — HTTP/2 (prior knowledge) skips negotiation
  and speaks HTTP/2 immediately, including over plain http:// — the
  route to h2c backends and internal services.
• Faster suites — running a collection no longer pays the
  per-origin rate limiter that paces background refreshes, so a
  many-request suite against one host runs at full speed.

Proxy

• Outbound proxy — Settings → Proxy → Outbound Requests routes
  the app's sends through a proxy. System follows the operating
  system's proxy settings and shows a read-only snapshot of what the
  OS reports; Manual takes a single proxy URL speaking HTTP, HTTPS,
  or SOCKS5, with live validation as you type; PAC evaluates a proxy
  auto-config script from a URL or a local file. A resolve preview
  shows the route a URL would take, in every mode.
• Per-request proxy — request settings gain a Proxy setting:
  inherit the app-wide proxy (the default), force a direct
  connection, or name an explicit proxy for just that request.
• Everything rides it — WebSocket and gRPC connections tunnel
  through the proxy too, and OAuth token refreshes and workflow steps
  follow the same rules. The bypass list follows curl's NO_PROXY
  semantics.
• Credentials from the vault — proxy authentication and client
  certificates are picked from vault entries in searchable selects
  with a manage-in-the-vault shortcut; the secret value is read at
  send time, never copied into settings.
• Wire truth — every result says how it actually traveled: the
  network popover and the WebSocket/gRPC meta strips name the proxied
  route, and a direct send shows no badge at all.

Request settings

• Redesigned settings tab — every setting sits in a scannable row
  with its own reset and undo, groups fold from the keyboard, and an
  info popover per setting previews how an example send behaves.
  Inputs state their defaults, show an example format, and validate
  live; an out-of-bounds value explains the violated bound.
• Honest saves — invalid settings block the save and keep the
  draft marked dirty, and clearing a setting truly unsets it instead
  of storing an empty value.
• Unsaved changes at a glance — tabs, badges, and the scripts
  rail mark unsaved edits in one distinct tone until you save.

Response

• Wire truth on every send — the Network popover now always shows
  the HTTP version that was actually negotiated on the wire, whichever
  version carried the send.

Polish

• Menu-bar icon — the tray icon is now a proper template image on
  macOS, so it matches light and dark menu bars.

v2026.7.28-beta.1

This is a beta build for early testing. It may contain bugs.

Desktop App

Platform	Downloads
macOS	Apple Silicon (DMG)
Windows	Installer (EXE)
Linux	AppImage x64 · install script
Debian / Ubuntu	x64 (deb)

---

What's New

Requests

• HTTP version control — every request gains an HTTP version
  setting: Auto (the default) negotiates with the server, or pin
  HTTP/1.1, HTTP/2, HTTP/2 (prior knowledge), or HTTP/3. A pinned
  version the server can't speak fails with a clear error naming the
  setting — never a silent downgrade.
• HTTP/3 over QUIC — sends can now ride HTTP/3 end to end, a
  first among API clients. The QUIC engine ships inside the app and
  honors the request's trust settings — SSL verification off, custom
  CAs, and client certificates — so self-signed local endpoints work
  the same as on the other versions.
• Cleartext HTTP/2 — HTTP/2 (prior knowledge) skips negotiation
  and speaks HTTP/2 immediately, including over plain http:// — the
  route to h2c backends and internal services.

Response

• Wire truth on every send — the Network popover now always shows
  the HTTP version that was actually negotiated on the wire, whichever
  version carried the send.

v2026.7.27

Desktop App

Platform	Downloads
macOS	Apple Silicon (DMG) · Intel (DMG)
Windows	Installer (EXE)
Linux	AppImage x64 · AppImage ARM64 · install script
Debian / Ubuntu	x64 (deb) · ARM64 (deb)
Fedora / RHEL	x64 (rpm) · ARM64 (rpm)

Enterprise - Managed deployment (MDM / GPO)

Platform	Downloads
macOS	PKG Apple Silicon · PKG Intel
Windows	MSI

macOS PKGs are signed and notarized; the Windows MSI is Authenticode-signed.

Browser Extension

Browser	Store
Chrome	Chrome Web Store
Firefox	Firefox Add-ons
Edge	Edge Add-ons

Terminal - CLI & TUI

Platform	Download
Linux (x64)	oh-2026.7.27-linux-x64
macOS (Apple Silicon)	oh-2026.7.27-mac-arm64
Windows (x64)	oh-2026.7.27-win-x64.exe

Checksums: SHA256SUMS.txt · GPG signature · signing key

Install scripts & notes

Install script (verifies checksums, installs oh to ~/.local/bin):

curl -fsSL https://updates.openheaders.io/install.sh | sh

Windows (PowerShell):

irm https://updates.openheaders.io/install.ps1 | iex

No Node.js required (npm install -g @openheaders/cli is the Node channel). macOS binaries are signed and notarized; the Windows oh is unsigned — SmartScreen warns on first run (More info → Run anyway). Script copies on this page: install-oh.sh · install-oh.ps1

Team - Server Daemon

Platform	Download
Linux (x64)	ohd-2026.7.27-linux-x64
macOS (Apple Silicon)	ohd-2026.7.27-mac-arm64
Docker	ghcr.io/openheaders/ohd:2026.7.27

Checksums: SHA256SUMS.txt · GPG signature · signing key

Install scripts & notes

Install script (verifies checksums, installs oh + ohd to ~/.local/bin):

curl -fsSL https://updates.openheaders.io/install.sh | sh -s -- --with-daemon

Docker:

docker run -d -p 127.0.0.1:8137:8137 -v oh-data:/data ghcr.io/openheaders/ohd:2026.7.27

---

What's New

Streams

• Grouped timelines — WebSocket messages can group by event and
  direction (Socket.IO events get their own axis), and gRPC streams
  group by message type and direction. Collapsed groups show the
  newest rows with a Show older toggle at the top edge, and you
  can pick how many rows each group keeps in Settings → Requests.
• Easier scanning — sticky group headers now clear the scrollbar,
  and stream rows highlight on hover.

Compose

• Wrap toggle — every editor pane gets its own Wrap control next
  to Beautify, with an indent cue on continuation lines. The new
  Editor dropdown in the toolbar also exposes the global display
  settings, applied live.
• Line endings — a new editor setting paints an end-of-line glyph
  on real newlines, so trailing characters and missing final newlines
  are visible at a glance.
• Bearer auth — the scheme prefix is now a fixed label instead of
  editable text, and masked token fields can be revealed while editing.

Response

• Status at a glance — the status chip is now a filled pill tinted
  by status class, and shows the canonical reason phrase when the
  server omits one.
• Tidier toolbar — Save Response moved into the overflow menu in
  the response panel and the gRPC/WebSocket result panes.

gRPC

• Spec switching — change the API spec straight from the method
  picker or the Service definition tab, and import definitions from
  either place.

Devices

• Safer peer execute — running requests on another device is now a
  two-tier opt-in: browsers on this machine are allowed by default,
  other devices start off. A refusal now says which host declined and
  jumps you to the matching opt-in row.

Activity

• Quieter unread cue — the activity tab now marks unseen entries
  with a small grey dot instead of a numeric badge, so background
  activity no longer reads as an alert.

Traffic

• Connection detail — captured desktop requests now record the
  dial: socket phases, negotiated protocol, local and remote
  endpoints, and request size.

v2026.7.27-beta.3

This is a beta build for early testing. It may contain bugs.

Desktop App

Platform	Downloads
macOS	Apple Silicon (DMG)
Windows	Installer (EXE)
Linux	AppImage x64 · AppImage ARM64 · install script
Debian / Ubuntu	x64 (deb) · ARM64 (deb)
Fedora / RHEL	x64 (rpm) · ARM64 (rpm)

Terminal - CLI & TUI

Platform	Download
Linux (x64)	oh-2026.7.27-linux-x64
macOS (Apple Silicon)	oh-2026.7.27-mac-arm64
Windows (x64)	oh-2026.7.27-win-x64.exe

Checksums: SHA256SUMS.txt · GPG signature · signing key

Install scripts & notes

Install script (verifies checksums, installs oh to ~/.local/bin):

curl -fsSL https://updates.openheaders.io/install.sh | sh

Windows (PowerShell):

irm https://updates.openheaders.io/install.ps1 | iex

No Node.js required (npm install -g @openheaders/cli is the Node channel). macOS binaries are signed and notarized; the Windows oh is unsigned — SmartScreen warns on first run (More info → Run anyway). Script copies on this page: install-oh.sh · install-oh.ps1

Team - Server Daemon

Platform	Download
Linux (x64)	ohd-2026.7.27-linux-x64
macOS (Apple Silicon)	ohd-2026.7.27-mac-arm64
Docker	ghcr.io/openheaders/ohd:2026.7.27

Checksums: SHA256SUMS.txt · GPG signature · signing key

Install scripts & notes

Install script (verifies checksums, installs oh + ohd to ~/.local/bin):

curl -fsSL https://updates.openheaders.io/install.sh | sh -s -- --with-daemon

Docker:

docker run -d -p 127.0.0.1:8137:8137 -v oh-data:/data ghcr.io/openheaders/ohd:2026.7.27

---

What's New

Streams

• Grouped timelines — WebSocket messages can group by event and
  direction (Socket.IO events get their own axis), and gRPC streams
  group by message type and direction. Collapsed groups show the
  newest rows with a Show older toggle at the top edge, and you
  can pick how many rows each group keeps in Settings → Requests.
• Easier scanning — sticky group headers now clear the scrollbar,
  and stream rows highlight on hover.

Compose

• Wrap toggle — every editor pane gets its own Wrap control next
  to Beautify, with an indent cue on continuation lines. The new
  Editor dropdown in the toolbar also exposes the global display
  settings, applied live.
• Line endings — a new editor setting paints an end-of-line glyph
  on real newlines, so trailing characters and missing final newlines
  are visible at a glance.
• Bearer auth — the scheme prefix is now a fixed label instead of
  editable text, and masked token fields can be revealed while editing.

Response

• Status at a glance — the status chip is now a filled pill tinted
  by status class, and shows the canonical reason phrase when the
  server omits one.
• Tidier toolbar — Save Response moved into the overflow menu in
  the response panel and the gRPC/WebSocket result panes.

gRPC

• Spec switching — change the API spec straight from the method
  picker or the Service definition tab, and import definitions from
  either place.

Devices

• Safer peer execute — running requests on another device is now a
  two-tier opt-in: browsers on this machine are allowed by default,
  other devices start off. A refusal now says which host declined and
  jumps you to the matching opt-in row.

Activity

• Quieter unread cue — the activity tab now marks unseen entries
  with a small grey dot instead of a numeric badge, so background
  activity no longer reads as an alert.

Traffic

• Connection detail — captured desktop requests now record the
  dial: socket phases, negotiated protocol, local and remote
  endpoints, and request size.

v2026.7.27-beta.2

This is a beta build for early testing. It may contain bugs.

Desktop App

Platform	Downloads
macOS	Apple Silicon (DMG)
Windows	Installer (EXE)
Linux	AppImage x64 · AppImage ARM64 · install script
Debian / Ubuntu	x64 (deb) · ARM64 (deb)
Fedora / RHEL	x64 (rpm) · ARM64 (rpm)

Terminal - CLI & TUI

Platform	Download
Linux (x64)	oh-2026.7.27-linux-x64
macOS (Apple Silicon)	oh-2026.7.27-mac-arm64
Windows (x64)	oh-2026.7.27-win-x64.exe

Checksums: SHA256SUMS.txt · GPG signature · signing key

Install scripts & notes

Install script (verifies checksums, installs oh to ~/.local/bin):

curl -fsSL https://updates.openheaders.io/install.sh | sh

Windows (PowerShell):

irm https://updates.openheaders.io/install.ps1 | iex

No Node.js required (npm install -g @openheaders/cli is the Node channel). macOS binaries are signed and notarized; the Windows oh is unsigned — SmartScreen warns on first run (More info → Run anyway). Script copies on this page: install-oh.sh · install-oh.ps1

Team - Server Daemon

Platform	Download
Linux (x64)	ohd-2026.7.27-linux-x64
macOS (Apple Silicon)	ohd-2026.7.27-mac-arm64
Docker	ghcr.io/openheaders/ohd:2026.7.27

Checksums: SHA256SUMS.txt · GPG signature · signing key

Install scripts & notes

Install script (verifies checksums, installs oh + ohd to ~/.local/bin):

curl -fsSL https://updates.openheaders.io/install.sh | sh -s -- --with-daemon

Docker:

docker run -d -p 127.0.0.1:8137:8137 -v oh-data:/data ghcr.io/openheaders/ohd:2026.7.27

---

What's New

Streams

• Grouped timelines — WebSocket messages can group by event and
  direction (Socket.IO events get their own axis), and gRPC streams
  group by message type and direction. Collapsed groups show the
  newest rows with a Show older toggle at the top edge, and you
  can pick how many rows each group keeps in Settings → Requests.
• Easier scanning — sticky group headers now clear the scrollbar,
  and stream rows highlight on hover.

Compose

• Wrap toggle — every editor pane gets its own Wrap control next
  to Beautify, with an indent cue on continuation lines. The new
  Editor dropdown in the toolbar also exposes the global display
  settings, applied live.
• Line endings — a new editor setting paints an end-of-line glyph
  on real newlines, so trailing characters and missing final newlines
  are visible at a glance.
• Bearer auth — the scheme prefix is now a fixed label instead of
  editable text, and masked token fields can be revealed while editing.

Response

• Status at a glance — the status chip is now a filled pill tinted
  by status class, and shows the canonical reason phrase when the
  server omits one.
• Tidier toolbar — Save Response moved into the overflow menu in
  the response panel and the gRPC/WebSocket result panes.

gRPC

• Spec switching — change the API spec straight from the method
  picker or the Service definition tab, and import definitions from
  either place.

Devices

• Safer peer execute — running requests on another device is now a
  two-tier opt-in: browsers on this machine are allowed by default,
  other devices start off. A refusal now says which host declined and
  jumps you to the matching opt-in row.

Activity

• Quieter unread cue — the activity tab now marks unseen entries
  with a small grey dot instead of a numeric badge, so background
  activity no longer reads as an alert.

Traffic

• Connection detail — captured desktop requests now record the
  dial: socket phases, negotiated protocol, local and remote
  endpoints, and request size.

v2026.7.27-beta.1

This is a beta build for early testing. It may contain bugs.

Desktop App

Platform	Downloads
macOS	Apple Silicon (DMG)
Windows	Installer (EXE)
Linux	AppImage x64 · AppImage ARM64 · install script
Debian / Ubuntu	x64 (deb) · ARM64 (deb)
Fedora / RHEL	x64 (rpm) · ARM64 (rpm)

Terminal - CLI & TUI

Platform	Download
Linux (x64)	oh-2026.7.27-linux-x64
macOS (Apple Silicon)	oh-2026.7.27-mac-arm64
Windows (x64)	oh-2026.7.27-win-x64.exe

Checksums: SHA256SUMS.txt · GPG signature · signing key

Install scripts & notes

Install script (verifies checksums, installs oh to ~/.local/bin):

curl -fsSL https://updates.openheaders.io/install.sh | sh

Windows (PowerShell):

irm https://updates.openheaders.io/install.ps1 | iex

No Node.js required (npm install -g @openheaders/cli is the Node channel). macOS binaries are signed and notarized; the Windows oh is unsigned — SmartScreen warns on first run (More info → Run anyway). Script copies on this page: install-oh.sh · install-oh.ps1

Team - Server Daemon

Platform	Download
Linux (x64)	ohd-2026.7.27-linux-x64
macOS (Apple Silicon)	ohd-2026.7.27-mac-arm64
Docker	ghcr.io/openheaders/ohd:2026.7.27

Checksums: SHA256SUMS.txt · GPG signature · signing key

Install scripts & notes

Install script (verifies checksums, installs oh + ohd to ~/.local/bin):

curl -fsSL https://updates.openheaders.io/install.sh | sh -s -- --with-daemon

Docker:

docker run -d -p 127.0.0.1:8137:8137 -v oh-data:/data ghcr.io/openheaders/ohd:2026.7.27

v2026.7.26

Desktop App

Platform	Downloads
macOS	Apple Silicon (DMG) · Intel (DMG)
Windows	Installer (EXE)
Linux	AppImage x64 · AppImage ARM64 · install script
Debian / Ubuntu	x64 (deb) · ARM64 (deb)
Fedora / RHEL	x64 (rpm) · ARM64 (rpm)

Enterprise - Managed deployment (MDM / GPO)

Platform	Downloads
macOS	PKG Apple Silicon · PKG Intel
Windows	MSI

macOS PKGs are signed and notarized; the Windows MSI is Authenticode-signed.

Browser Extension

Browser	Store
Chrome	Chrome Web Store
Firefox	Firefox Add-ons
Edge	Edge Add-ons

Terminal - CLI & TUI

Platform	Download
Linux (x64)	oh-2026.7.26-linux-x64
macOS (Apple Silicon)	oh-2026.7.26-mac-arm64
Windows (x64)	oh-2026.7.26-win-x64.exe

Checksums: SHA256SUMS.txt · GPG signature · signing key

Install scripts & notes

Install script (verifies checksums, installs oh to ~/.local/bin):

curl -fsSL https://updates.openheaders.io/install.sh | sh

Windows (PowerShell):

irm https://updates.openheaders.io/install.ps1 | iex

No Node.js required (npm install -g @openheaders/cli is the Node channel). macOS binaries are signed and notarized; the Windows oh is unsigned — SmartScreen warns on first run (More info → Run anyway). Script copies on this page: install-oh.sh · install-oh.ps1

Team - Server Daemon

Platform	Download
Linux (x64)	ohd-2026.7.26-linux-x64
macOS (Apple Silicon)	ohd-2026.7.26-mac-arm64
Docker	ghcr.io/openheaders/ohd:2026.7.26

Checksums: SHA256SUMS.txt · GPG signature · signing key

Install scripts & notes

Install script (verifies checksums, installs oh + ohd to ~/.local/bin):

curl -fsSL https://updates.openheaders.io/install.sh | sh -s -- --with-daemon

Docker:

docker run -d -p 127.0.0.1:8137:8137 -v oh-data:/data ghcr.io/openheaders/ohd:2026.7.26