v0.11.1

Open Science v0.11.1

On-demand artifact code reconstruction, live permission profile changes during a running turn, project and session archiving with undo, MCP connector OAuth and portable configuration sharing, tool-activity elapsed time, persistent plan call records, adaptive macOS app icons, skill ZIP export, and branded loading indicators — while Windows runtime recovery, session-plan turn completion, web gateway stability, and cross-platform release certification are hardened across the board.

Open Science is an open-source, model-agnostic AI workbench for scientific discovery — a self-hosted desktop app pairing a plan-and-execute agent with persistent compute, durable project/session storage, and inspectable research artifacts.

v0.11.1 is a patch release on top of v0.11.0. It brings an explicit Generate-script action in the Provenance Code tab that runs a bounded, version-scoped reconstruction through an isolated one-shot model session, lets the permission mode control stay editable and take effect live while a turn is running or waiting for approval, introduces reversible project and session archiving with a shared undo surface and confirmed permanent deletion, brings standard remote MCP OAuth sign-in and portable connector configuration import/export, shows per-tool elapsed runtime beside the step count in tool-activity headers, renders successful and in-progress plan calls as persistent compact records in the transcript, adds skill ZIP export for personal and imported skills, introduces adaptive macOS app icons that follow the system theme, and adds branded loading indicators. Under the hood it recovers from Windows managed-runtime access violations, decouples conversation turn completion from session-plan status, suppresses synthetic Codex compaction warnings, keeps runtime setup actions pending through discovery refresh, restores plan tool approval scopes, enables multimodal input for MiniMax M3, fixes streamed-message rendering and web gateway stability, stabilizes import and export feedback, requires cross-platform release certification, and continues the ACP-runtime and settings-store ownership refactor.

✨ Highlights

• On-demand artifact code reconstruction. The Provenance Code tab now has a Generate-script action that builds a bounded, version-scoped context from the immutable execution log, producer run, inputs, and environment metadata, then runs a tool-less, non-persistent, one-shot agent session in an isolated profile to reconstruct a standalone script. Successful results are cached by artifact version plus execution/context checksums and can be downloaded as Python, R, Bash, or text. No model call happens until the user clicks. (#824)
• Live permission profile changes. The permission mode control is now editable while a session is running or waiting for approval. The change applies live through the agent's session mode update, and pending provider tool requests are re-evaluated against the new policy — auto releases only low-risk accepted requests, full releases eligible provider requests, and ask-mode and app-owned approvals continue to require explicit action. (#835)
• Project and session archiving. Projects and sessions can now be archived instead of deleted. Archiving a busy session or a project containing one is blocked. Archived items appear in Settings and can be restored or permanently deleted after confirmation. Archive undo shares the same top-center surface as permission undo. (#800)
• MCP connector OAuth and portable configurations. Remote MCP servers now support standard OAuth sign-in through a browser authorization flow with a state-matched loopback callback, encrypted token persistence, and refresh support. Custom connector definitions can be exported as credential-free portable configurations and imported via drag-and-drop, with collision checks, required-secret prompts, and trust confirmation. Connectors also gain an immutable slug separate from their display name. (#796)
• Skill ZIP export. Imported and personal skills can now be exported as deterministic, import-compatible ZIP packages through a native Save As dialog, with archive limits, sanitized cross-platform filenames, and exclusion of internal metadata. Featured skills remain non-exportable. (#865)
• Adaptive macOS app icons. The installed macOS app now uses an adaptive Icon Composer asset catalog that follows the system theme (Light, Dark, or System) in the Dock and About panel, while the existing independent app-icon picker is preserved on Windows and Linux. (#880)

🚀 New Features

• On-demand code reconstruction — an explicit Generate-script action in the Provenance Code tab builds a bounded, version-scoped context from the immutable execution log, producer run, inputs, and relevant environment metadata; evidence content is treated as untrusted data; a tool-less, non-persistent one-shot agent session runs in an isolated temporary cwd/profile; successful reconstruction is cached by artifact version plus execution/context/prompt checksums and can be downloaded as Python/R/Bash/text; no model call on save, startup, preview-open, or cache lookup. (#824)
• Live permission profile changes — the permission mode control stays editable while a session is running or waiting for approval; the change applies through the agent's live ACP mode update; pending provider tool requests are re-evaluated against the new policy; auto releases only low-risk accepted requests, full releases eligible provider requests, and ask-mode, high-risk, and app-owned approvals continue to require explicit user action. (#835)
• Project and session archiving — reversible archive state for projects and sessions without changing activity ordering; archiving a busy session or a project containing one is blocked; archived items in Settings support restore or confirmed permanent deletion; shared top-center undo for permission and archive actions. (#800)
• MCP connector OAuth and portable configurations — standard remote MCP OAuth through the SDK with browser authorization, state-matched loopback callback, encrypted token persistence, refresh support, timeout, and cancellation; OAuth connectors stay disabled until sign-in succeeds; validated credential-free connector configuration import/export with drag-and-drop, local-path warnings, required-secret prompts, collision checks, and trust confirmation; immutable connector slug separated from display name. (#796)
• Tool-activity elapsed time — per-tool elapsed runtime is shown beside the existing step count in tool-group headers; each visible tool's own duration is summed, excluding idle gaps between tools; active tools update every 100 ms and freeze at terminal timestamp. (#826)
• Persistent plan call records — successful and in-progress plan-generation calls are projected as standalone transcript items with task summary, steps, feasibility, status, and failure details; compact three-line preview with expand/collapse; chronological placement and selected-branch behavior preserved. (#806)
• Branded loading indicators — the workspace now shows branded loading indicators during initial load and session transitions. (#656)
• Skill ZIP export — imported and personal skills can be exported as deterministic, import-compatible ZIP packages through a native Save As dialog, with archive limits, sanitized cross-platform filenames, and exclusion of internal metadata; featured skills remain non-exportable. (#865)
• Adaptive macOS app icons — the installed macOS app uses an adaptive Icon Composer asset catalog that follows the system theme (Light, Dark, or System) in the Dock and About panel; the DMG volume keeps the legacy icon; the existing independent app-icon picker is preserved on Windows and Linux. (#880)

🔧 Improvements

• The ACP-runtime ownership refactor continues, composing session owner graph, generation and connection owners, connection lifecycle owners, provider session workflows, prompt workflows, session plan commands, prompt plan lifecycle, session environment policy, and independent base owners so lifecycle logic is isolated behind shared, independently testable contracts. (#794, #795, #797, #799, #801, #803, #804, #805, #809, #811, #813, #814)
• The settings-store refactor continues, extracting write coordinator, runtime install lifecycle, runtime discovery, provider auth, preferences, navigation, skills, and connectors slices for independently testable state management. (#825, #833, #836, #839, #841, #843, #847, #849)
• The notebook-runtime refactor continues, extracting package admission policy, package operations, environment management owner, runtime repair lifecycle and policy, session read model, and package mutation lifecycle. (#827, #848, #850, #840, #845, #854, #832)
• Cross-platform release certification is now required, with retry for transient DMG detach failures, stabilized package certification, deterministic release keychain, repaired platform certification gates, and separated portable and native gates. (#802, #846, #851, #884, #887, #889)
• PR and package gates are streamlined, release and platform validation are decoupled, the macOS coverage timeout is extended, and a module ownership manifest drives test-impact selection. (#862, #863, #866, #888, #890)
• The notebook runtime gains session lifecycle owner extraction, transport-aware Windows tests, runtime facade ownership certification, and settings-store slice composition certification. (#858, #860, #861, #864)
• The CONTRIBUTING guide documents the merge queue workflow and nightly post-merge validation. (#837, #842)
• Path assertions in tests are now platform-independent. (#855)

🐛 Bug Fixes

• Session-plan turn completion — an agent's normal conversation turn is no longer rejected when its approved session plan is still unfinished; turn completion is now independent from plan status across all frameworks. (#830)
• Windows runtime access-violation recovery — managed-runtime creation that terminates with STATUS_ACCESS_VIOLATION now triggers corrupt-cache recovery: incomplete package directories are removed, the failed prefix is discarded, and the verified bundle is re-seeded before retry. The packaged micromamba is repinned to the 2.8.1-1 release with the missing libpsl dependency. (#815)
• Plan tool approval scopes — the plan-generation and step-status tools are now registered as exact capabilities, so Ask mode exposes once/session/project/global scopes instead of only Allow once. (#810)
• Synthetic Codex compaction warning — the known Codex post-compaction warning is suppressed at the session update projection boundary when it has no message ID and matches the upstream text, so it no longer appears as part of the assistant response. (#816)
• Runtime setup premature completion — explicit per-language provision and repair runs stay in the preparing state until their IPC call returns, and a disabled Finishing-setup action prevents duplicate install requests during the discovery refresh. (#818)
• Routed prompt ownership — routed prompt ownership is preserved through the prompt workflow composition, preventing misattribution after the refactor. (#809)
• Short Windows cache fallback — a short cache fallback prevents spurious Windows runtime cache misses during environment creation. (#823)
• Cross-platform E2E stabilization — packaged certification state is isolated and E2E launches are stabilized across platforms. (#834, #808)
• Web gateway crash on Electron-only APIs — switching the permission profile or navigating to Specialists no longer crashes the web gateway build when it encounters Electron-only event contracts; unavailable event contracts are now stubbed as no-ops. (#857)
• Import and export feedback — GitHub skill scans now show Finding, Scanning, and Importing spinners in the initiating buttons, repository results stay expanded during a scan, skill export recovers from a cancelled overwrite confirmation, and Save As dialogs are properly parented to the invoking window. (#881)
• MiniMax M3 multimodal input — MiniMax M3 and M3[1m] are now classified as multimodal in the provider registry, enabling image attachments when either model is selected. (#883)
• Streamed-message rendering — newly submitted user clarifications no longer disappear while the following streamed Markdown response paints fragments out of order; the off-screen rendering optimization that caused the corruption has been removed from live message rows. (#885)

📦 Install

Requirements: macOS 12+ (Apple Silicon or Intel), Linux x64, or Windows 10/11 x64. On first run, the onboarding wizard checks the environment and can install and configure an app-managed agent runtime. Once installed, the app can update itself in place.

Download the appropriate package from the Assets section below:

Platform	Package
macOS (Apple Silicon)	DMG for ARM64
macOS (Intel)	DMG for x64
Linux	AppImage or Debian package for x64
Windows	Installer for x64

macOS — first launch. Official release builds are Developer ID signed and notarized by Apple, so they open like other trusted applications. A locally built copy is not notarized and may require approval through macOS Privacy & Security.

Windows — first launch (unsigned build). No Authenticode certificate yet, so SmartScreen shows a bypassable "unrecognized app" prompt (More info → Run anyway). Verify that the package came from the official release page before continuing.

Build from source instead:

npm install
npm run build:mac   # or: build:linux / build:win

🧭 What's in this release (maturity)

• ✅ Implemented: a local-first desktop, localhost-web, headless, CLI, and task-SDK surface over persistent projects and sessions with selectable message branches, branching into a new session, and reversible archiving; selectable Claude Code, OpenCode, and Codex agent frameworks behind a shared provider turn-adapter interface; review-gated session plans with durable execution contracts and persistent plan call records; hot-switching of compatible models and providers without reconnecting the agent process; agent-aware context replay respecting each framework's context path; multi-provider model configuration with combined model/reasoning selection; persistent Python/R/REPL kernels and remote SSH execution with read-only installed-package inventories; immutable artifact versions with inspectable audit evidence and on-demand LLM-driven code reconstruction; multi-format previews including TIFF and code syntax highlighting; file-based skills with conversational imports, keyword search from GitHub URLs, and ZIP export; permissioned scientific connectors with standard remote OAuth sign-in and portable configuration import/export; opt-in review and bounded correction; personal specialist agent profiles with scoped capabilities, conversational customization, immediate in-flight handoff, and package import/export; scoped permission management with global, project, and session grants and live profile changes during a running turn; conversation export as Markdown and PDF; selective session-artifact downloads; per-turn token usage; message timing metadata; tool-activity elapsed time; completed-turn agent and model identification; context-usage persistence across restarts; a project-scoped command palette; collapsible side panels; split-view file preview beside the session; prompt history navigation; session link favicons; branded loading indicators; mobile remote access through Remote.It pairing; configurable storage; diagnostic coverage for user-visible failure boundaries; and installers for macOS, Windows, and Linux.
• 🚧 Partial: R remains managed-only; provider choice remains constrained by the active framework's endpoint compatibility; remote compute is SSH-only; skills remain local; specialist roles are personal-only (no cross-machine sharing); and review is opt-in and record-scoped.
• 🗺️ Roadmap: a unified model gateway, a public skills commons and cross-machine specialist sharing, Slurm/cloud-GPU execution, stronger sandboxing and credential isolation, and collaborative research workflows.

🐢 Known Limitations

• R is managed-only. A bring-your-own R interpreter path is not built yet.
• Remote compute is SSH-only. Slurm, cloud GPU, and parallel sub-agent fan-out are not built yet.
• Provider choice is per framework, not one unified gateway. The available protocol depends on the selected agent backend.
• Hot-switching applies only to registered compatible targets. Framework, auth-lane, wire-route, or unsafe capability changes still require a reconnect.
• Code reconstruction is LLM-generated. It does not replace deterministic reproduction; portable environment locks and full-fidelity session replay remain open.
• Specialist roles are personal-only. There is no shared public commons or cross-machine specialist forking yet.
• The task SDK is a first-generation surface. Task creation, polling, and artifact retrieval work; broader orchestration remains open.
• Switching agent backends cannot transfer in-flight tool state. Existing conversation history can replay, but a running action is not migrated.
• Skills are local only. There is no shared public commons, cross-machine forking, or user-facing version pinning yet.
• The reviewer is opt-in and record-scoped. It does not replace domain-specific validation of citations, units, statistics, or methods.
• Scoped permissions cover allow-grants only. Network sandboxing, directory-level file access control, and a credential vault are not built yet.
• Windows builds are unsigned. SmartScreen may warn on first launch; official macOS builds are notarized.
• No local GPU compute backend.
• No multi-user real-time collaboration.

🙏 Acknowledgements

Thanks to @ewen-poch, @wen2zhou, @daanveer-tech, @justemu, and everyone in Discord, X, and Discussions.

---

What's Changed

• refactor(acp): delegate permission and reviewer routing by @ewen-poch in #794
• refactor(acp): deepen provider and context routing by @ewen-poch in #795
• feat(connectors): add OAuth and portable custom configurations by @ewen-poch in #796
• refactor(acp-runtime): compose independent base owners by @ewen-poch in #797
• refactor(acp-runtime): compose generation and connection owners by @ewen-poch in #799
• feat(archive): add project and session archive by @ewen-poch in #800
• refactor(acp-runtime): extract session environment policy by @ewen-poch in #801
• ci(release): require cross-platform release certification by @ewen-poch in #802
• refactor(acp-runtime): compose session owner graph by @ewen-poch in #803
• refactor(acp-runtime): compose connection lifecycle owners by @ewen-poch in #804
• refactor(acp-runtime): compose provider session workflows by @ewen-poch in #805
• feat(session): render persistent Plan call records by @wen2zhou in #806
• fix(e2e): stabilize cross-platform E2E launches by @ewen-poch in #808
• fix(acp): preserve routed prompt ownership by @ewen-poch in #809
• fix(permissions): restore Plan tool approval scopes by @wen2zhou in #810
• refactor(acp-runtime): compose prompt workflows by @ewen-poch in #811
• refactor(acp-runtime): compose session plan commands by @ewen-poch in #813
• refactor(acp-runtime): compose prompt plan lifecycle by @ewen-poch in #814
• fix(acp): suppress synthetic Codex compaction warning by @ewen-poch in #816
• fix(notebook): recover Windows runtime access violations by @ewen-poch in #815
• fix(runtimes): keep setup actions pending until refresh by @ewen-poch in #818
• docs(readme): clarify scientific coverage by @daanveer-tech in #819
• test(settings-store): characterize renderer contracts by @ewen-poch in #821
• test(notebook): characterize runtime facade contracts by @ewen-poch in #822
• fix(notebook): add short Windows cache fallback by @ewen-poch in #823
• feat(artifact-provenance): add on-demand code reconstruction by @ewen-poch in #824
• refactor(settings-store): extract write coordinator by @ewen-poch in #825
• feat(workspace): show tool activity elapsed time by @ewen-poch in #826
• refactor(notebook): extract package admission policy by @ewen-poch in #827
• fix(session-plan): decouple turn completion from plan status by @wen2zhou in #830
• refactor(notebook): own package mutation lifecycle by @ewen-poch in #832
• refactor(settings-store): extract runtime install lifecycle by @ewen-poch in #833
• fix(e2e): isolate packaged certification state by @ewen-poch in #834
• feat(permissions): allow live permission profile changes by @ewen-poch in #835
• refactor(settings-store): extract runtime discovery slice by @ewen-poch in #836
• docs(contributing): document merge queue workflow by @ewen-poch in #837
• refactor(settings-store): extract provider auth slice by @ewen-poch in #839
• refactor(notebook): centralize runtime repair policy by @ewen-poch in #840
• refactor(settings-store): extract preferences slice by @ewen-poch in #841
• docs(contributing): document nightly post-merge validation by @ewen-poch in #842
• refactor(settings-store): extract navigation slice by @ewen-poch in #843
• refactor(notebook): own runtime repair lifecycle by @ewen-poch in #845
• fix(release): stabilize package certification by @ewen-poch in #846
• refactor(settings-store): extract Skills slice by @ewen-poch in #847
• refactor(notebook): compose package operations by @ewen-poch in #848
• refactor(settings-store): extract Connectors slice by @ewen-poch in #849
• refactor(notebook): extract environment management owner by @ewen-poch in #850
• fix(release): retry transient DMG detach failures by @ewen-poch in #851
• refactor(notebook): extract session read model by @ewen-poch in #854
• test(paths): make path assertions platform-independent by @ewen-poch in #855
• feat(agent): add branded loading indicators by @ewen-poch in #656
• ci(pr-gate): extend macOS coverage timeout by @ewen-poch in #863
• ci(workflows): decouple release and platform validation by @ewen-poch in #862
• test(notebook): make Windows tests transport-aware by @ewen-poch in #861
• refactor(notebook): extract session lifecycle owner by @ewen-poch in #860
• test(settings-store): certify slice composition by @ewen-poch in #858
• test(notebook): certify runtime facade ownership by @ewen-poch in #864
• feat(settings): add Skill ZIP export by @ewen-poch in #865
• ci(validation): streamline PR and package gates by @ewen-poch in #866
• fix(web): prevent crash when accessing Electron-only APIs via web gateway by @justemu in #857
• fix(settings): stabilize import and export feedback by @ewen-poch in #881
• feat(app-icon): add adaptive app icons and emphasize Remote.It download by @ewen-poch in #880
• fix(settings): enable multimodal input for MiniMax M3 by @ewen-poch in #883
• fix(release): repair platform certification gates by @ewen-poch in #884
• fix(conversation): keep streamed messages in normal paint flow by @ewen-poch in #885
• ci(test-impact): define module ownership manifest by @ewen-poch in #888
• fix(macOS-signing): prepare deterministic release keychain by @ewen-poch in #887
• ci(release): separate portable and native gates by @ewen-poch in #889
• test(test-impact): add module test commands by @ewen-poch in #890

Full Changelog: v0.11.0...v0.11.1