v0.24.0

Open Science v0.24.0

A release about boundaries and everyday speed: notebook and compute code can only reach the network you approve — with in-conversation approval when a new destination appears — while a project quick switcher, device-wide shared credentials, safe default permissions with one-click restore, immutable file generations for notebook and compute runs, and a German interface make the rest of the workbench faster and safer.

Open Science is an open-source, local-first AI research workbench for scientists and researchers. It enables reproducible, inspectable research across models with scientific AI agents, Python and R execution, scientific data connectors, and cross-platform support for macOS, Windows, and Linux.

v0.24.0 is a feature release centered on trust and flow. Notebook and compute runtimes can only reach Open Science defaults and the domains you approve in Settings → Network; when code tries a new destination, the approval lands right in the conversation with Deny, Allow once, and Always allow decisions scoped to the exact command. The workspace project menu becomes a quick switcher — your other active projects appear with title and description previews, on desktop and mobile. Credentials entered once device-wide — API keys, access tokens, and OAuth sign-ins — can be bound to any custom connector's environment variables, headers, or sign-in instead of being stored per connector. Safe default permissions ship seeded, and a Restore defaults action re-adds the missing baseline without touching your other grants. Files created or modified by notebook and compute runs are preserved as immutable, checksum-addressed generations so an earlier result is never silently overwritten. On Windows, first-run setup can start from a suitable secondary data drive instead of the system drive. German joins the interface languages. On the reliability side, agent shell commands across all four supported frameworks flow through the app's own execution path with durable records, remote compute jobs survive restarts and crashes with durable operation receipts and automatic recovery, the reviewer reads evidence within bounds while correction round-trips preserve your responses and the reviewer model identity, and a broad set of runtime, connector, storage, and settings fixes lands throughout.

✨ Highlights

• Move between projects in seconds. The workspace project menu now lists your other active projects with title and description previews, so you can switch projects without leaving the session you are in. (#1957)
• Notebook code stays inside your network boundaries. Notebook and compute runtimes can only reach Open Science defaults and the domains you approve, and when code tries a new destination, you approve or deny it right in the conversation. On Windows, protection applies once the sandbox's one-time administrator setup is complete. (#1911)
• Enter credentials once, reuse them everywhere. API keys, access tokens, and OAuth sign-ins can be stored device-wide and bound to any custom connector's environment variables, headers, or sign-in. (#1948, #1963)
• A German interface. German joins Spanish, French, Chinese (Simplified and Traditional), Japanese, Korean, and Russian, with README translations to match. (#1761)

🚀 New Features

• Project quick switcher — the workspace project menu lists your other active projects with title and description previews; the first five are shown with the rest one click away, on desktop and mobile. (#1957)
• Notebook network sandbox — Settings → Network manages the domains notebook and compute runtimes may reach. Blocked destinations route through the conversation approval flow with Deny, Allow once, and Always allow, and one-time decisions apply only to the exact command that requested them. On macOS and Linux the boundary is enforced out of the box; on Windows it applies after the sandbox's one-time administrator setup. (#1911)
• Device-wide shared credentials — store API keys, access tokens, and OAuth sign-ins once under Settings → Credentials and bind them to custom connectors as environment variables, headers, or OAuth sign-ins. Browser sign-in runs as a separate, cancellable step, and stored values only resolve inside the app. (#1948, #1963)
• Safe default permissions with restore — new installations seed safe grants for skill invocation and for reading literature linked to the current message, and Settings → Permissions gains a Restore defaults action that re-adds only the missing baseline without touching your other grants. (#1931)
• Windows onboarding suggests a data drive — when a suitable secondary drive is available, first-run setup preselects it for the data location instead of the system drive, and the choice survives restarts. (#1930, #1956)

🔧 Improvements

• Files created or modified by notebook and compute runs are preserved as immutable, checksum-addressed generations, so an earlier result is never silently overwritten — the groundwork for upcoming reproducibility checks. (#1902, #1949)
• Agent shell commands across all four supported agent frameworks now flow through the app's own execution path, so every command keeps its durable record and approval boundary. (#1968)
• Remote compute jobs survive restarts and crashes: durable operation receipts, safe cancellation and cleanup, automatic recovery of jobs detached from the app, and enforced lifecycle boundaries on remote hosts. (#1944, #1937, #1921, #1925)
• The reviewer reads evidence within bounds — paged PDF and Office previews, media-aware artifact reads, and file provenance — and correction round-trips preserve both your responses and the reviewer model identity. (#1946, #1959)
• German joins the interface languages, and the German catalog stays in sync with execution evidence. (#1761, #1970)
• Tag creation and editing move to the same Settings page pattern as the rest of the app. (#1928)

🐛 Bug Fixes

• Sessions and the agent runtime — restored sessions rebind to their persisted project (#1950); cancelled work no longer leaves stale state behind (#1939, #1965); a provider resume timeout no longer takes down unrelated work (#1947); Codex child processes handle signals cleanly (#1954); loopback model-call details are preserved (#1929); the CLI recovers status and tooltip focus (#1941); and confirmed quits, renderer load failures, and system shutdown recovery are handled explicitly. (#1942, #1945)
• Skills and memory — a failing skill load no longer leaves the editor stuck, and listing skills no longer rewrites imported catalog metadata (#1936); skills import cleanly in kernel environments (#1961); the global memory gate is honored in conversation controls (#1958); and skill validation preserves UTF-8 input. (#1962)
• Connectors and credentials — credential integrity is enforced across the connector lifecycle (#1922, #1923, #1933), custom connector operations are restricted to the app (#1932), and unreadable device credentials are surfaced instead of failing silently. (#1978)
• Storage and settings — persisted data integrity is enforced (#1940); unsupported settings documents are rejected with a clear message (#1973); compute bookmarks survive reloads (#1971); and the Windows data-drive recommendation is bounded and persists after startup. (#1956, #1972)
• Artifacts and execution — publishing an artifact version can no longer deadlock (#1960), the REPL kernel finds its runtime roots again (#1951), and execution activity capture is hardened against crashes. (#1949)
• Updates and the workspace — failed uninstalls route through recovery (#1967); update transfer progress clears after cancellation (#1979); review and file action failures are surfaced in the workspace (#1943); and streamed responses render reliably during long turns. (#1969)

📦 Install

Requirements: macOS 12+ (Apple Silicon or Intel), Linux x64, or Windows 10/11 x64. On first run, the onboarding wizard checks the environment and can install and configure an app-managed agent runtime. Once installed, the app can update itself in place.

Download the appropriate package from the Assets section below:

Platform	Package
macOS (Apple Silicon)	DMG for ARM64
macOS (Intel)	DMG for x64
Linux	AppImage or Debian package for x64
Windows	Installer for x64

macOS — first launch. Official release builds are Developer ID signed and notarized by Apple, so they open like other trusted applications. A locally built copy is not notarized and may require approval through macOS Privacy & Security.

Windows — first launch (unsigned build). No Authenticode certificate yet, so SmartScreen shows a bypassable "unrecognized app" prompt (More info → Run anyway). Verify that the package came from the official release page before continuing.

Build from source instead:

npm install
npm run build:mac   # or: build:linux / build:win

🧭 What's in this release (maturity)

• ✅ Implemented: a local-first desktop, localhost-web, headless, CLI, and task-SDK surface over persistent projects and sessions with selectable message branches, branching into a new session from user messages or completed agent messages with persisted source lineage, composer session references (#) with turn-scoped read access, reversible archiving with keyboard undo, project pinning, a project quick switcher listing other active projects with title and description previews, collapsed long user messages, persistent side conversations with advisories injected into running main turns, generated and editable session details, session hover previews in the sidebar, and SQLite-indexed summary-first session startup; in-app sandboxed previews for source links in agent responses; selectable Claude Code, OpenCode, Codex, and CodeBuddy agent frameworks (CodeBuddy app-managed and login-free) behind a shared provider turn-adapter interface, with agent shell commands routed through the app's own execution path on every framework; text, image, and PDF annotations that send selected context into conversations with click-to-reveal evidence in the source document, a session reading context that links up to three PDFs the agent can read, page through, and search, with agent configuration change markers in the timeline; opt-in persistent agent memory with project-scoped categories recalled across sessions and managed from Settings; production subagent delegation with durable messaging, restart recovery, structured output, artifact and review evidence, and camelCase delegation APIs; review-gated session plans with CLI plan controls; a unified composer lane with a session-scoped message queue, unified draft undo and redo history, active-specialist emphasis, and mid-turn Send now through native follow-up steering; hot-switching of compatible models and providers; multi-provider model configuration including Tencent Coding Plan and Token Plan subscription providers, an xAI OAuth subscription, a dedicated Vision model selector with persistent evidence relay, custom token limits, and a consolidated Scenario models card; per-model-call usage details with a per-call context-window chart; a token usage dashboard with persisted per-run attribution that includes auxiliary model calls outside the main conversation; centralized credential management for GitHub tokens, connector keys, and connector sign-ins with guided recovery, plus device-wide shared credentials (API keys, access tokens, and OAuth sign-ins) that custom connectors bind to as environment variables, headers, or sign-ins; a configurable reviewer model policy with an isolated review runtime, durable assessment snapshots, and empty initial checks, with bounded evidence reads and correction round-trips that preserve your responses and the reviewer model identity; context-window composition insights with compaction boundaries; persistent Python/R/REPL kernels with bounded run-history payloads, a read-only live variable browser for running kernels, live variable-name suggestions in the shared terminal, a docked Variables pane in wide notebook previews, notebook and compute network access limited to Open Science defaults and user-approved domains with in-conversation approvals for blocked destinations (enforced out of the box on macOS and Linux; on Windows after the sandbox's administrator setup), immutable generations for files created or modified by notebook and compute runs, separated approval and execution state, cross-run dependency tracking, package-installation progress, progressive history loading, terminated read-only previews, session-scoped remote SSH execution with key or password authentication (including Windows), harvest ceasing, and remote file-staging cleanup, with remote compute jobs that survive restarts and crashes through durable operation receipts and automatic recovery; a user terminal shared with the agent; app-managed and bring-your-own environments for Python and R with notebook workload caches under the configured data-storage location; immutable, session-scoped artifact versions with checksummed content, producer code, execution history, exact input references, environment inventory, producing message-branch context, version-scoped reviewer evidence, and on-demand LLM-driven code reconstruction; rich in-app previews for scientific data, documents, images, source code, molecular structures, and notebook history with right-click tab actions and full-screen mode; file attachments up to 10 GB with streaming upload; skills with conversational creation, import, marketplace browsing, and explicit / selection, plus provenance-aware figure workflows for styling, composition, and paper narratives; 24 built-in research connectors plus custom MCP servers with import/export of standard MCP client configurations; durable scoped permissions with allow grants, safe seeded defaults, and a restore-defaults action for the baseline; remote-access pairing; interface localization in German, Spanish, French, Chinese (Simplified and Traditional), Japanese, Korean, and Russian; and auto-update with prominent update reminders and localized release notes.
• 🚧 Partial: R remains managed-only; provider choice remains constrained by the active framework's endpoint compatibility; remote compute is SSH-only; skills remain local (no hosted public discovery commons); reproducibility stops at preserved evidence — captured file generations are groundwork, not yet automated reruns; and review is opt-in and record-scoped.
• 🗺️ Roadmap: a unified model gateway, a hosted public skills and specialist discovery commons, Slurm/cloud-GPU execution, stronger sandboxing and credential isolation, and collaborative research workflows.

🐢 Known Limitations

• Network sandboxing covers the app's notebook and compute runtimes, not the whole system. Processes you launch outside these runtimes are not subject to the domain allowlist. On Windows, the boundary applies only after the sandbox's one-time administrator setup; until then, notebook and compute code runs without it.
• Immutable file generations preserve earlier results, but deterministic reruns are still ahead. Captured generations are the groundwork; portable environment locks and full-fidelity session replay remain open.
• R is managed-only. A bring-your-own R interpreter path is not built yet.
• Remote compute is SSH-only. Slurm and cloud GPU submission are not built yet.
• Provider choice is per framework, not one unified gateway. The available protocol depends on the selected agent backend.
• Hot-switching applies only to registered compatible targets. Framework, auth-lane, wire-route, or unsafe capability changes still require a reconnect.
• Code reconstruction is LLM-generated. It does not replace deterministic reproduction.
• No hosted public specialist discovery commons. Specialist packages are portable across machines via import/export and the signed marketplace; what is not built yet is a hosted public discovery and forking hub.
• The task SDK is a first-generation surface. Task creation, polling, artifact retrieval, run progress, and cancellation work; broader orchestration remains open.
• Switching agent backends cannot transfer in-flight tool state. Existing conversation history can replay, but a running action is not migrated.
• Skills are local only. There is no shared public commons, cross-machine forking, or user-facing version pinning yet.
• The reviewer is opt-in and record-scoped. It does not replace domain-specific validation of citations, units, statistics, or methods.
• Scoped permissions cover allow-grants only. Directory-level file access control is not built yet; notebook network sandboxing is the first enforced network boundary.
• Windows builds are unsigned. SmartScreen may warn on first launch; official macOS builds are notarized.
• No local GPU compute backend.
• No multi-user real-time collaboration.

🙏 Acknowledgements

Thanks to @ewen-poch, @wen2zhou, @daanveer-tech, @justemu, and everyone in Discord, X, and Discussions.

---

Full Changelog: https://github.com/aipoch/open-science/commits/v0.24.0