v0.11.0

Open Science v0.11.0

Review-gated session plans, hot-switching models and providers without reconnecting the agent process, agent-aware context replay that respects each framework's context path, prompt history navigation, and a settings keyboard shortcut — while Windows auto-update and local RPC, logger data redaction, artifact provenance binding, and notebook process-group cleanup are hardened across the board.

Open Science is an open-source, model-agnostic AI workbench for scientific discovery — a self-hosted desktop app pairing a plan-and-execute agent with persistent compute, durable project/session storage, and inspectable research artifacts.

v0.11.0 is a feature release on top of v0.10.1. It introduces a durable, user-reviewable Session Plan contract so multi-step agent work has an explicit execution plan that persists across restarts and context compaction, lets compatible model and provider changes apply to the running session without reconnecting the agent process, rebuilds context replay to be agent-aware so each framework receives a bounded, role-preserving transcript, and adds prompt history navigation, session link favicons, and a standard settings keyboard shortcut. Under the hood it restores silent Windows auto-update, routes Windows app-local RPC through authenticated named pipes, redacts sensitive data at the logger boundary, binds artifact provenance to the correct prompt runtime segment, gives each notebook shell command a private process group for honest timeout cleanup, remediates all production dependency vulnerabilities, and continues the ACP ownership refactor with provider prompt-execution, session-creator, session-resumer, session-adopter, connection-lifecycle, and capability-provision owners.

✨ Highlights

• Review-gated session plans. A new Session Plan contract gives multi-step agent work a durable, user-reviewable execution plan. The agent generates a plan, the user reviews it card-by-card with revise, approve, or reject decisions, and an approved plan binds execution authority to the current interaction until all required steps are terminal. Active plan projections persist across restarts and context compaction, require explicit continuation before an unfinished plan can resume, and block turn completion while required steps remain unfinished. A compact running-progress indicator and a Plan First entry point are available in the workspace. (#777)
• Hot-switch models and providers without reconnect. Changing a model or provider no longer reconnects the agent process when the target is a registered compatible option. The in-flight message finishes on its original model; the new selection applies after generation activity drains, and new prompts wait at an admission barrier. Compatible Claude, OpenCode, and Codex API-key providers route through generation-owned loopback transports so endpoint, credential, and model changes occur without exposing real keys. Fail-closed reconnect is preserved for framework, auth-lane, wire-route, or unsafe capability changes. (#751)
• Agent-aware context replay. When an ACP session cannot be resumed after switching agents or starting a replacement session, replay is now classified by target (Claude Code, OpenCode, Codex Responses, or Codex bridge) and built from user-led turns with a bounded token budget derived from the target's advertised context window. The original task is retained, role labels are preserved, oversized messages are truncated within their role, and attachments and images are replayed only when their source message survives selection. A one-shot notebook continuity block is injected on the first replayed prompt. (#754)
• Prompt history navigation. Up and Down arrows in the composer recall prior prompts, restoring text, skill, and explicit file-reference parts while excluding turns with top-level uploads. Deleted or specialist-disallowed skills are downgraded to readable plain text. History is isolated across sessions and projects, and an unsent scratch draft is restored exactly when browsing begins and resumes. (#768)

🚀 New Features

• Review-gated session plans — an app-owned Session Plan contract, service, and MCP surface for plan generation, revision feedback, approval, and rejection; persisted active projections recovered after restart or compaction; explicit continuation authority before an approved unfinished plan resumes; completion blocked while required steps remain unfinished; Plan First entry points, review cards, restored-plan actions, and a running-progress indicator in the workspace. (#777)
• Hot-switch ACP models and providers — compatible model and provider targets apply to the existing ACP generation and session without reconnecting; the in-flight message stays on its original model, a latest-wins pending target applies after activity drains, and new prompts wait at an admission barrier; compatible API-key providers route through generation-owned loopback transports; fail-closed reconnect preserved for incompatible or unsafe changes. (#751)
• Agent-aware context replay — replay targets are classified as Claude Code, OpenCode, Codex Responses, or Codex bridge; a bounded token budget is derived per target; replay is built from user-led turns retaining the original task; role labels preserved, oversized messages truncated within role; attachments and images replayed only when their source survives; a one-shot notebook continuity block injected on the first replayed prompt. (#754)
• Prompt history navigation — Up/Down arrows recall prior prompts from the current visible branch; text, skill, and explicit file-reference parts restored; turns with top-level uploads excluded; deleted or specialist-disallowed skills downgraded to readable plain text; scratch draft restored on navigation; history isolated across sessions and projects. (#768)
• Session link favicons — links inside assistant session messages now show the destination site's favicon with hover, focus, active, and disabled states; favicons are lazy-loaded without a referrer and fall back to a globe icon on failure; same-hostname URLs coalesce to a single request. (#770)
• Settings keyboard shortcut — Cmd+, on macOS and Ctrl+, on Windows and Linux open the Settings panel; the shortcut is ignored until startup is interactive or while another top-level modal is active; Cmd/Ctrl+W routes through dismissible surfaces before preview panes and the window. (#763)

🔧 Improvements

• The ACP ownership refactor continues, extracting provider prompt-execution, prompt-preparation, session-creator, session-resumer, session-adopter, session-deletion, session-replacement, connection-close, connection-lifecycle-bootstrap, client-callback, live-effort, startup-session-configurator, turn-scoped Skill, context-usage turn, session-update projection, capability-provision, and process-candidate owners so framework-specific lifecycle logic is isolated behind shared, independently testable contracts. (#736, #739, #741, #742, #743, #744, #745, #747, #748, #749, #750, #752, #756, #759, #769, #772, #775, #778)
• CI validation enforces a portable-suite outcome in the PR Gate, platform-sensitive workflow tests are stabilized, the Claude ACP patch integrity check runs in CI, and all production dependency vulnerabilities are remediated. (#753, #755, #757, #773)

🐛 Bug Fixes

• Silent Windows auto-update — in-place updates on Windows now pass the silent and force-run-after flags so electron-updater completes the update and relaunches automatically instead of opening the installer wizard. (#780)
• Windows local RPC through named pipes — app-local Notebook, Artifact, Skill, and control-REPL RPC now use authenticated Windows named pipes, resolving opaque fetch failed errors that affected notebook execution, artifact provenance, skill import, and reviewer findings on Windows. (#738, #740, #746)
• Artifact provenance bound to prompt runtime segment — finalization now resolves the runtime segment from the requested prompt node instead of always declaring the newest segment, preventing ownership-proof failures after a runtime switch or resume. (#779)
• Case-folded lineage bytes — artifact-provenance lineage routing now handles case-folded bytes correctly, preventing checksum mismatches on case-insensitive filesystems. (#761)
• Logger sensitive-data redaction — the main-process JSONL logger now enforces recursive redaction at the serialization boundary, scrubbing authorization headers, tokens, cookies, credential-bearing URLs, and oversized text from both file and console output while preserving error categories, status codes, run IDs, and correlation identifiers. (#758)
• Claude refusal attribution — Claude refusal responses are now attributed correctly instead of being misclassified as successful completions. (#774)
• Notebook process-group cleanup — each POSIX notebook shell command now gets a private process group, so timeout cleanup signals the entire group with SIGTERM and escalates to SIGKILL after two seconds, preventing descendants that ignore SIGTERM from surviving. (#762)
• Notebook stream truncation — agent-facing notebook output truncation is relaxed so legitimate long outputs are not cut prematurely. (#765)
• Notebook connector result handoff — connector execution results are now handed off to the notebook runtime correctly, preventing dropped or mismatched results. (#764)
• Web session re-entry — remote-access Web sessions no longer fail on re-entry, preventing spurious errors when returning to an active session. (#767)
• Global search page context — the search dialog now respects the active page context, so searches are scoped correctly instead of searching across unrelated surfaces. (#760)
• Session link color — the link color inside session messages is restored to the correct semantic token after the favicon treatment was added. (#771)
• Specialist contribution template portability — the contribution template path test is now portable across platforms. (#737)

📦 Install

Requirements: macOS 12+ (Apple Silicon or Intel), Linux x64, or Windows 10/11 x64. On first run, the onboarding wizard checks the environment and can install and configure an app-managed agent runtime. Once installed, the app can update itself in place.

Download the appropriate package from the Assets section below:

Platform	Package
macOS (Apple Silicon)	DMG for ARM64
macOS (Intel)	DMG for x64
Linux	AppImage or Debian package for x64
Windows	Installer for x64

macOS — first launch. Official release builds are Developer ID signed and notarized by Apple, so they open like other trusted applications. A locally built copy is not notarized and may require approval through macOS Privacy & Security.

Windows — first launch (unsigned build). No Authenticode certificate yet, so SmartScreen shows a bypassable "unrecognized app" prompt (More info → Run anyway). Verify that the package came from the official release page before continuing.

Build from source instead:

npm install
npm run build:mac   # or: build:linux / build:win

🧭 What's in this release (maturity)

• ✅ Implemented: a local-first desktop, localhost-web, headless, CLI, and task-SDK surface over persistent projects and sessions with selectable message branches and branching into a new session; selectable Claude Code, OpenCode, and Codex agent frameworks behind a shared provider turn-adapter interface; review-gated session plans with durable execution contracts; hot-switching of compatible models and providers without reconnecting the agent process; agent-aware context replay respecting each framework's context path; multi-provider model configuration with combined model/reasoning selection and native Responses API support for DeepSeek flash; persistent Python/R/REPL kernels and remote SSH execution with read-only installed-package inventories; immutable artifact versions with inspectable audit evidence; multi-format previews including TIFF and code syntax highlighting; file-based skills with conversational imports and keyword search from GitHub URLs; permissioned scientific connectors; opt-in review and bounded correction; personal specialist agent profiles with scoped capabilities, conversational customization, immediate in-flight handoff, and package import/export; scoped permission management with global, project, and session grants; conversation export as Markdown and PDF; selective session-artifact downloads; per-turn token usage; message timing metadata; completed-turn agent and model identification; context-usage persistence across restarts; a project-scoped command palette; collapsible side panels; split-view file preview beside the session; prompt history navigation; session link favicons; mobile remote access through Remote.It pairing; configurable storage; diagnostic coverage for user-visible failure boundaries; and installers for macOS, Windows, and Linux.
• 🚧 Partial: R remains managed-only; provider choice remains constrained by the active framework's endpoint compatibility; remote compute is SSH-only; skills remain local; specialist roles are personal-only (no cross-machine sharing); and review is opt-in and record-scoped.
• 🗺️ Roadmap: a unified model gateway, a public skills commons and cross-machine specialist sharing, Slurm/cloud-GPU execution, stronger sandboxing and credential isolation, and collaborative research workflows.

🐢 Known Limitations

• R is managed-only. A bring-your-own R interpreter path is not built yet.
• Remote compute is SSH-only. Slurm, cloud GPU, and parallel sub-agent fan-out are not built yet.
• Provider choice is per framework, not one unified gateway. The available protocol depends on the selected agent backend.
• Hot-switching applies only to registered compatible targets. Framework, auth-lane, wire-route, or unsafe capability changes still require a reconnect.
• Specialist roles are personal-only. There is no shared public commons or cross-machine specialist forking yet.
• The task SDK is a first-generation surface. Task creation, polling, and artifact retrieval work; broader orchestration remains open.
• Switching agent backends cannot transfer in-flight tool state. Existing conversation history can replay, but a running action is not migrated.
• Skills are local only. There is no shared public commons, cross-machine forking, or user-facing version pinning yet.
• The reviewer is opt-in and record-scoped. It does not replace domain-specific validation of citations, units, statistics, or methods.
• Scoped permissions cover allow-grants only. Network sandboxing, directory-level file access control, and a credential vault are not built yet.
• Windows builds are unsigned. SmartScreen may warn on first launch; official macOS builds are notarized.
• No local GPU compute backend.
• No multi-user real-time collaboration.

🙏 Acknowledgements

Thanks to @ewen-poch, @wen2zhou, and everyone in Discord, X, and Discussions.

---

What's Changed

• refactor(acp): provision session capabilities through owner handle by @ewen-poch in #736
• fix(specialists): make contribution template path test portable by @ewen-poch in #737
• fix(local-rpc): route Windows app tools through named pipes by @ewen-poch in #738
• refactor(acp): extract startup session configurator by @ewen-poch in #739
• fix(mcp-runtime): diagnose Windows startup failures by @ewen-poch in #740
• refactor(acp): extract live effort configuration by @ewen-poch in #741
• refactor(acp): deepen context usage turn ownership by @ewen-poch in #742
• refactor(acp): project session updates through ordered effects by @ewen-poch in #743
• refactor(acp): own turn-scoped Skill lifecycle by @ewen-poch in #744
• refactor(acp): extract client callback adapter by @ewen-poch in #745
• fix(local-rpc): stabilize Windows transport tests by @ewen-poch in #746
• refactor(acp): transfer process candidates once by @ewen-poch in #747
• refactor(acp): bind process diagnostics in adapter by @ewen-poch in #748
• refactor(acp): isolate connection lifecycle bootstrap by @ewen-poch in #749
• refactor(acp): extract connection close workflow by @ewen-poch in #750
• feat(agent-runtime): hot-switch ACP models and providers by @ewen-poch in #751
• refactor(acp): extract provider session creator by @ewen-poch in #752
• ci(dependencies): verify Claude ACP patch integrity by @ewen-poch in #753
• feat(acp): make context replay agent aware by @ewen-poch in #754
• build(dependency-security): remediate production audit findings by @ewen-poch in #755
• refactor(acp): extract provider session adopter by @ewen-poch in #756
• ci(pr-gate): enforce portable suite outcome by @ewen-poch in #757
• fix(logger): redact sensitive data at log boundary by @ewen-poch in #758
• refactor(acp): extract provider session resumer by @ewen-poch in #759
• fix(global-search): respect page context in search dialog by @ewen-poch in #760
• fix(artifact-provenance): route case-folded lineage bytes by @ewen-poch in #761
• fix(notebook-runtime): terminate timed-out process groups by @ewen-poch in #762
• feat(settings): add settings keyboard shortcut by @ewen-poch in #763
• fix(notebook): correct connector result handoff by @ewen-poch in #764
• fix(notebook): relax agent-facing stream truncation by @ewen-poch in #765
• fix(remote-access): prevent Web session re-entry failures by @ewen-poch in #767
• feat(composer): add prompt history navigation by @ewen-poch in #768
• refactor(acp): extract session replacement workflow by @ewen-poch in #769
• feat(markdown): add session link favicons by @ewen-poch in #770
• fix(markdown): restore session link color by @ewen-poch in #771
• refactor(acp): extract session deletion workflow by @ewen-poch in #772
• test(ci): stabilize platform-sensitive workflow tests by @ewen-poch in #773
• fix(acp): correct Claude refusal attribution by @ewen-poch in #774
• refactor(acp): extract prompt preparation owner by @ewen-poch in #775
• feat(session-plan): add review-gated branch-aware plan execution by @wen2zhou in #777
• refactor(acp): extract provider prompt executor by @ewen-poch in #778
• fix(artifact-provenance): bind context to prompt runtime segment by @ewen-poch in #779
• fix(updater): restore silent Windows auto-update by @ewen-poch in #780

Full Changelog: v0.10.1...v0.11.0