v0.18.0

Open Science v0.18.0

Cross-resource catalog tags with favorites and drag ordering, a redesigned skill management experience, a streamlined Specialist marketplace with instant cached browsing and capability icons, quick Specialist appearance editing, SSH password authentication for compute hosts, Korean localization, and multilingual README and contribution guides — alongside faster marketplace and connector loading, incremental runtime event streaming, protected skill deletion, onboarding data-root atomic persistence, and recovery hardening across startup, sessions, compute, and the updater.

Open Science is an open-source, local-first AI research workbench for scientists and researchers. It enables reproducible, inspectable research across models with scientific AI agents, Python and R execution, scientific data connectors, and cross-platform support for macOS, Windows, and Linux.

v0.18.0 is a feature release. Skills, connectors, and specialists gain cross-resource catalog tags: any resource can belong to multiple tags, a protected localized Favorites tag gives every catalog a quick pin, tag order is controlled by drag with Favorites fixed first, and a Settings → Capabilities → Tags browser manages create/edit/delete with type counts, search, and navigation. Skill management is redesigned — one combined agent/specialist filter, compact actual-user avatar stacks replacing verbose scope copy, consolidated row actions, and confirmed bulk deletion that protects built-in and specialist-linked skills. The Specialist marketplace becomes peer-segmented with Installed and Marketplace views, compact clickable rows with metadata tags, direct install without a redundant review page, instant cached rendering with a visible refresh action, and a shared 32-icon capability set that also powers quick appearance editing from any specialist row. Capability rows in the specialist editor navigate directly to the matching settings detail page. Compute hosts gain SSH password authentication with OS-encrypted credential storage and revision-fenced connection leases, so key-based access is no longer required. The interface adds Korean alongside Chinese ( Simplified and Traditional ) and Japanese, and the repository gains fully translated README and contribution guides in four languages. On the reliability side, runtime events stream incrementally instead of as large snapshots, the main process terminates after fatal errors, the onboarding data root persists atomically, exclusively-used skills are protected from deletion, stale PID process-tree kills are prevented in the CLI, and recovery is hardened across startup, session persistence, compute, remote access, and the updater.

✨ Highlights

• Cross-resource catalog tags. Skills, connectors, and runnable specialists can each belong to many tags — including a protected, localized Favorites tag — with assignment menus, badges, filters, and a Settings → Capabilities → Tags browser for create/edit/delete, type counts, search, and navigation. Tag order is user-controlled by pointer and keyboard drag with Favorites fixed first, persisted transactionally, and assignments are cleaned at resource-deletion boundaries. Includes immutable migration 0011_cross_resource_tags. (#1399, #1441, #1415, #1439, #1424)
• Redesigned skill management. The Skills panel combines main agent and specialists in one filter, moves search and filters to a compact toolbar, replaces verbose scope copy with an actual-user avatar stack and a bounded "Used by" popover, consolidates row actions into a menu, and adds confirmed bulk deletion for personal and imported skills — built-in and specialist-linked skills stay protected. (#1447, #1431)
• Streamlined Specialist marketplace. Installed and Marketplace become peer segmented views; marketplace listings use compact clickable rows with initials, official/author/version metadata, and explicit source management; installation goes directly from the detail view without a redundant review page; the verified cache renders instantly with a manual refresh action, so a weak network no longer blocks re-entry. (#1394, #1418)
• SSH password authentication for compute hosts. Compute SSH hosts support explicit username/password authentication alongside keys, storing only OS-encrypted credential ciphertext, with revision-fenced connection leases, centralized error classification, transactional create/reset/switch/remove, and automatic probe refresh after authentication changes. (#1375, #1380, #1392)
• Korean localization and multilingual docs. A complete 3,000+ key Korean catalog with native quality guards joins Chinese (Simplified and Traditional) and Japanese across the interface, native Electron messages, date formatting, and persisted language selection; the repository README and contribution guides are fully translated into all four languages. (#1426, #1440)

🚀 New Features

• Cross-resource catalog tags — many-to-many tags across skills, connectors, and runnable specialists; a protected localized Favorites system tag; assignment menus, badges, and filters across panels and detail views; a Tags settings browser with type counts, search, aggregation, and navigation; tag-filtered specialist capability candidates; immutable migration 0011_cross_resource_tags with deletion-boundary cleanup and reconciliation. (#1399)
• Persistent tag drag ordering — one global tag order with unique integer positions; Favorites fixed at position 0; pointer/touch drag handles with insertion feedback; new tags append, deletions compact, and reorders persist transactionally. (#1441)
• Direct tag unlinking and navigation — tag entries navigate to their resources and can be unlinked directly from resource rows. (#1415)
• Redesigned skill management — a combined agent/specialist filter replacing separate scope filters; filters and search on one toolbar row; actual-user avatar stacks with a bounded popover replacing verbose scope copy; named specialist entries navigate to their settings detail; consolidated row actions with a focused deletion tooltip; confirmed bulk deletion for personal and imported skills with built-in and specialist-linked protection. (#1447)
• Protected exclusively-used skills — skills used exclusively by one specialist are deleted together with that specialist instead of blocking deletion. (#1431)
• Streamlined marketplace discovery and installation — peer Installed/Marketplace segmented views; compact clickable marketplace rows with initials and metadata tags; manual refresh with remote-first listing and verified-cache fallback; collapsed skills and connectors in the detail view; direct installation without a redundant review page. (#1394)
• Instant cached marketplace browsing — the verified marketplace snapshot persists across navigation and renders instantly with a visible refresh action; the root and signature fetch concurrently; release details reuse the list view's root. (#1418)
• Shared capability icon set — a 32-icon grouped registry (Science / Research / Roles / Engineering) replaces the six hardcoded specialist icons and provides the shared icon surface for specialist avatars, quick pickers, and future features. (#1413)
• Quick appearance picker — each custom specialist row's avatar opens a compact popover with the full icon registry and color choices, so icon and color changes no longer require the full editor. (#1414)
• Capability-row navigation — selected skill and connector rows in the specialist editor navigate through settings history to the matching detail page, resolving legacy custom-server names to canonical ids. (#1430)
• SSH password authentication — explicit authentication modes per compute host; OS-encrypted credential ciphertext in a main-process-owned credential record; revision-fenced connection leases with retry suppression; transactional, replay-safe create/reset/switch/remove; settings flows for password setup, reset, recovery, and destructive removal with automatic probe refresh. (#1375)
• Korean localization — a complete independently translated Korean catalog with terminology, placeholder, plural, and safety-copy guards; Korean registered across locale detection, renderer resources, language controls, persisted preferences, and native Electron messages; CLDR date formatting and relaunch persistence verified end-to-end. (#1426)
• Multilingual README and contribution guides — a five-language switcher at the top of the root README and complete README + CONTRIBUTING translations for zh-Hans, zh-Hant, ja, and ko with adjusted repository-relative links. (#1440)
• Active specialist emphasis in composer — the composer makes the active specialist visually prominent. (#1379)
• Connector catalog interaction alignment — connector catalog actions align with the redesigned skill management patterns. (#1456)

🔧 Improvements

• Runtime events stream incrementally instead of being delivered as large snapshots, reducing event-drain stalls. (#1444)
• Connector round trips for agent context are reduced, speeding up session startup. (44b9e81)
• Project operation queues are isolated per project, improving persistence throughput. (#1365)
• Windows signing gains a SignPath dry-run CI lane with self-signed certificate verification. (#1411, #1416)
• The macOS x64 packaging lane raises the Vite heap limit to avoid intermittent bundling failures. (#1409)
• The README opening paragraph and Quick Start were rewritten for clarity. (#1427, #1425)

🐛 Bug Fixes

• Workspace facade architecture gates restored. (#1455)
• Preview persistence writes serialized. Concurrent preview-state writes could interleave and lose updates; they are now serialized. (#1448)
• Main process terminates after fatal errors. A fatal main-process error now terminates instead of lingering in an undefined state. (#1449)
• Onboarding data root persisted atomically. An interrupted onboarding could leave a partially written data-root choice; persistence is now atomic. (#1450)
• Runtime caches recovered despite invalid package metadata. (#1453)
• Stale PID process-tree kills prevented. The CLI could kill an unrelated process that reused a stale PID; process-tree kills now verify staleness. (#1445)
• Reviewer MCP protocol isolated per transport. Reviewer MCP connections no longer share protocol state across transports. (#1438)
• Interrupted-turn admission deadlock prevented. A turn interrupted mid-admission could deadlock future turns. (#1435)
• Quit aborted on recoverable flush failures. A recoverable persistence flush failure no longer loses data on quit. (#1434)
• Kernel state preserved on persistence failure. A failed persistence write no longer discards notebook kernel state. (#1401)
• Updater install guarded by ready state / completed downloads preserved. The updater no longer installs from an unready state and no longer discards completed downloads during checks. (#1395, #1402)
• Remote access hardened. Remote access fails closed on unreadable configuration, fences shutdown from in-flight operations, and prevents a remote information disclosure. (#1398, #1396, d3f9f2e)
• Stale session snapshots rejected / quarantined ownership preserved. (#1391, #1385)
• Database gate recovered after IPC rejection. A startup database gate could stall after an IPC rejection; it now recovers. (#1390)
• SSH runner termination bounded / cleanup waits limited. (#1400, #1403)
• Specialist appearance saves complete before catalog refresh / Marketplace provenance distinguished. (#1428, #1397)
• Responses bridge reasoning cache isolated per session. (#1388)
• Folder access radio semantics completed / native sensitive-path confirmation replaced. (#1407, #1387)
• Prompts acknowledged after provider admission / positive context usage preserved across zero updates / follow-on actions gated until branched replay. (#1408, #1373, #1374)
• Skill authoring accepts normalized context-reset replay / staged migrations recovered after restart / directory entries sorted before truncating / notebook RPC cancellation propagated. (#1372, #1356, #1360, #1354)
• Micromamba trees reaped before retry / web shutdown bounded with active requests / renderer flush timeout extended. (#1383, #1384, #1386)
• Raw IPC errors hidden from project load and delete / settings failure recovery and keyboard access improved / desktop panel spacing tightened / message queue held until transcript reveal settles. (#1393, #1389, #1420, #1422)
• Locale preference ownership unified / product terminology normalized / compute and storage translations corrected / Korean catalog backfilled. (#1376, #1369, #1377, #1436, #1437, #1410)

📦 Install

Requirements: macOS 12+ (Apple Silicon or Intel), Linux x64, or Windows 10/11 x64. On first run, the onboarding wizard checks the environment and can install and configure an app-managed agent runtime. Once installed, the app can update itself in place.

Download the appropriate package from the Assets section below:

Platform	Package
macOS (Apple Silicon)	DMG for ARM64
macOS (Intel)	DMG for x64
Linux	AppImage or Debian package for x64
Windows	Installer for x64

macOS — first launch. Official release builds are Developer ID signed and notarized by Apple, so they open like other trusted applications. A locally built copy is not notarized and may require approval through macOS Privacy & Security.

Windows — first launch (unsigned build). No Authenticode certificate yet, so SmartScreen shows a bypassable "unrecognized app" prompt (More info → Run anyway). Verify that the package came from the official release page before continuing.

Build from source instead:

npm install
npm run build:mac   # or: build:linux / build:win

🧭 What's in this release (maturity)

• ✅ Implemented: a local-first desktop, localhost-web, headless, CLI, and task-SDK surface over persistent projects and sessions with selectable message branches, branching into a new session from user messages or completed agent messages with persisted source lineage, reversible archiving, project pinning, and persistent side conversations; selectable Claude Code, OpenCode, and Codex agent frameworks behind a shared provider turn-adapter interface; production subagent delegation with durable messaging, restart recovery, structured output, artifact and review evidence, and camelCase delegation APIs; review-gated session plans with CLI plan controls; a unified composer lane with a session-scoped message queue and active-specialist emphasis; hot-switching of compatible models and providers; multi-provider model configuration with a dedicated Vision model selector and persistent evidence relay; a configurable reviewer model policy with an isolated review runtime and durable assessment snapshots; a token usage dashboard; context-window composition insights; persistent Python/R/REPL kernels with bounded run-history payloads, separated approval and execution state, and remote SSH execution with key or password authentication, harvest ceilings, and a host viewImage capability; frame-scoped Host JavaScript artifact queries, session diagnostics, and model introspection with camelCase Host LLM results; immutable artifact versions with artifact lineage access; multi-format previews with view-in-context navigation and plan-artifact rendering; file-based skills with conversational creation, save-as-skill turns, direct user folder support, a redesigned management experience, and confirmed bulk deletion; cross-resource catalog tags with favorites and drag ordering; permissioned scientific connectors with immutable invocation identities, generated local IDs, and aligned catalog interactions; opt-in review and bounded correction; personal specialist agent profiles with a scoped signed marketplace, instant cached browsing, capability icons, quick appearance editing, and capability-row navigation; scoped permission management; local folder access with cross-drive browsing; Chinese (Simplified and Traditional), Japanese, and Korean interfaces with multilingual README and contribution guides; global proxy settings with connectivity diagnostics; prominent update reminders; a run-marks navigation rail; notifications with attention reasons; empty-conversation placeholder banners; contextual GitHub star prompts; conversation export as Markdown and PDF; a project-scoped command palette; CLI Codex device login; smooth live response rendering; collapsible side panels; split-view file preview; desktop notifications; a cross-surface notification message center; structured agent clarification cards; live session status; and session keyboard shortcuts.
• 🚧 Partial: R remains managed-only; provider choice remains constrained by the active framework's endpoint compatibility; remote compute is SSH-only; skills remain local (no hosted public discovery commons); and review is opt-in and record-scoped.
• 🗺️ Roadmap: a unified model gateway, a hosted public skills and specialist discovery commons, Slurm/cloud-GPU execution, stronger sandboxing and credential isolation, and collaborative research workflows.

🐢 Known Limitations

• R is managed-only. A bring-your-own R interpreter path is not built yet.
• Remote compute is SSH-only. Slurm and cloud GPU submission are not built yet.
• Provider choice is per framework, not one unified gateway. The available protocol depends on the selected agent backend.
• Hot-switching applies only to registered compatible targets. Framework, auth-lane, wire-route, or unsafe capability changes still require a reconnect.
• Code reconstruction is LLM-generated. It does not replace deterministic reproduction; portable environment locks and full-fidelity session replay remain open.
• No hosted public specialist discovery commons. Specialist packages are portable across machines via import/export and the signed marketplace; what is not built yet is a hosted public discovery and forking hub.
• The task SDK is a first-generation surface. Task creation, polling, artifact retrieval, run progress, and cancellation work; broader orchestration remains open.
• Switching agent backends cannot transfer in-flight tool state. Existing conversation history can replay, but a running action is not migrated.
• Skills are local only. There is no shared public commons, cross-machine forking, or user-facing version pinning yet.
• The reviewer is opt-in and record-scoped. It does not replace domain-specific validation of citations, units, statistics, or methods.
• Scoped permissions cover allow-grants only. Network sandboxing, directory-level file access control, and a credential vault are not built yet.
• Windows builds are unsigned. SmartScreen may warn on first launch; official macOS builds are notarized.
• No local GPU compute backend.
• No multi-user real-time collaboration.

🙏 Acknowledgements

Thanks to @ewen-poch, @wen2zhou, @roxi3906, @daanveer-tech, @justemu, @LJLJ111, @Ada-Liu, and everyone in Discord, X, and Discussions.