Open Science v0.25.0

Open Science v0.25.0

A release that makes research outputs living documents: text artifacts and uploads become editable, with every save published as a new comparable version — alongside a curated NVIDIA Build provider, per-session delegation controls, fuzzy search in the project switcher, safe runtime reinstall with control over agent-created environments, and a broad set of runtime, persistence, and security fixes.

Open Science is an open-source, local-first AI research workbench for scientists and researchers. It enables reproducible, inspectable research across models with scientific AI agents, Python and R execution, scientific data connectors, and cross-platform support for macOS, Windows, and Linux.

v0.25.0 is a feature release centered on editable outputs and control. Text artifacts and uploads — Markdown, plain text, scripts, and source code — gain Edit and Compare actions: edit the raw source in place, and each save publishes a new managed version while the original lineage and predecessor versions stay navigable, so an artifact becomes a living document without losing its history. NVIDIA Build joins the built-in providers with a curated catalog of six agent-capable models led by NVIDIA Nemotron 3.5 Lightning. Delegation moves under your control with a per-session switch in the composer's agent controls, confirmed fail-closed before a new session or message branch runs its first prompt. The project quick switcher gains fuzzy search once the project list grows. App-managed Python and R runtimes can be safely reinstalled from Settings — running kernels drain and sessions rebind durably before the repair starts — and a global toggle decides whether the agent may create runtime environments on its own, while Settings → Runtimes now shows at a glance whether Notebook network protection is active, requires setup, or is unsupported. On the reliability side, multi-version upgrades take one recovery snapshot per batch instead of one per migration step, raw credentials are redacted from tool activity, and a broad set of runtime, persistence, session, and platform fixes lands throughout.

✨ Highlights

• Artifacts you can edit. Markdown, plain text, scripts, and source-code artifacts and uploads can now be edited as raw text — every save publishes a new version that preserves its source lineage, with a Compare action against the predecessor. (#1204)
• NVIDIA Build joins the built-in providers. A curated NVIDIA catalog with six agent-capable models, led by NVIDIA Nemotron 3.5 Lightning. (#2055)
• Runtimes you can repair. App-managed Python and R runtimes can be safely reinstalled from Settings, and a new toggle decides whether the agent may create runtime environments on its own. (#1984, #2058)
• Delegation under your control. A per-session switch in the composer's agent controls decides whether the agent may delegate work. (#2029)

🚀 New Features

• Editable artifact versions — text artifacts and uploads gain Edit and Compare actions: edit the raw source of Markdown, plain text, scripts, and source-code files, and each save publishes a new managed version while the original lineage and predecessor versions stay navigable. (#1204)
• NVIDIA Build provider — an official NVIDIA provider with a curated catalog of six agent-capable models, including NVIDIA Nemotron 3.5 Lightning (the default) and Kimi K3, with multimodal support marked per model. (#2055)
• Session delegation controls — a compact Delegation switch in the composer's agent controls; new sessions and message branches confirm the policy fail-closed before the first prompt runs. (#2029)
• Project switcher search — the workspace project menu gains a fuzzy search field once you have more than a few active projects, ranking title matches above description-only hits and highlighting the matched text. (#1964)
• Safe managed-runtime reinstall — reinstall healthy app-managed Python and R runtimes from Settings → Runtimes: running kernels drain and sessions rebind durably before the repair starts, and external interpreters are never touched. (#1984)
• Control over agent-created environments — a global Settings toggle decides whether the agent may create runtime environments; explicit setup and reinstall stay available either way. (#2058)
• Network protection status in Settings → Runtimes — a status-aware banner shows whether Notebook network protection is active, requires setup, or is unsupported, with a direct path to the domain settings — without overstating protection. (#2011)

🔧 Improvements

• Multi-version upgrades get faster: one recovery snapshot is now taken per upgrade batch instead of one per migration step, cutting upgrade time and disk churn on installs with large research histories. (#2039)
• Data-location migration shows the target drive's capacity and the estimated copy size before you commit. (#1984)
• Settings and About rows reveal their supporting descriptions on hover or keyboard focus instead of competing with primary labels. (#2023, #2026)

🐛 Bug Fixes

• Delegation and side chats — Codex subscription authentication now propagates to delegated work (#1953); archiving is blocked while delegated questions are pending (#2015); quit detection counts active side-chat replies (#2031); and delegated inputs keep stable identities. (#1974)
• Notebook and runtimes — protected kernel startup is restored (#1995); misleading sandbox warnings are gone (#1988); kernels no longer loop recovery attempts (#1998); injected runtime platforms are honored (#1981); runtime targets are respected in gating and restart (#2046); input and artifact file workflows are stabilized (#2050); interrupted responses are handled (#2063); environment preparation is shown after approval (#2036); managed runtimes survive failed updates (#1994); connection resets are contained (#2053); and prompt attachments stay readable in notebooks. (#2045)
• Security and remote access — raw credentials are redacted from tool activity (#2001); replay is scoped to remote authorization (#1999); external access resources are bounded (#2003); and transport boundaries are hardened. (#2035)
• Sessions and storage — project access is gated during data migration (#1996); archiving is blocked during compaction (#2000); retained session workspaces are revealed again (#2002); project deletion waits are scoped (#2038); writes stop flushing after a failure (#2040); session and project state contracts are aligned (#2044); and managed workspace ownership is preserved. (#2042)
• Skills, artifacts, and compute — the skill catalog can no longer deadlock during mutation (#2048); permanent finalization failures are classified correctly (#2061); large SSH commands stream reliably (#2062); and remote-compute examples return values instead of printing. (#2018)
• Updates, platform, and workspace — unsupported release-note languages are skipped cleanly (#2009); locked uninstaller targets are rejected on Windows (#2060); the app exits cleanly after a UI startup failure (#2030); quitting after a persistence failure asks for explicit consent (#2032); small upward scrolls are respected (#2007); notifications survive rejected targets (#2041); generated previews wait for publication (#2054); and the skills search placeholder is readable. (#2052)

📦 Install

Requirements: macOS 12+ (Apple Silicon or Intel), Linux x64, or Windows 10/11 x64. On first run, the onboarding wizard checks the environment and can install and configure an app-managed agent runtime. Once installed, the app can update itself in place.

Download the appropriate package from the Assets section below:

Platform	Package
macOS (Apple Silicon)	DMG for ARM64
macOS (Intel)	DMG for x64
Linux	AppImage or Debian package for x64
Windows	Installer for x64

macOS — first launch. Official release builds are Developer ID signed and notarized by Apple, so they open like other trusted applications. A locally built copy is not notarized and may require approval through macOS Privacy & Security.

Windows — first launch (unsigned build). No Authenticode certificate yet, so SmartScreen shows a bypassable "unrecognized app" prompt (More info → Run anyway). Verify that the package came from the official release page before continuing.

Build from source instead:

npm install
npm run build:mac   # or: build:linux / build:win

🧭 What's in this release (maturity)

• ✅ Implemented: a local-first desktop, localhost-web, headless, CLI, and task-SDK surface over persistent projects and sessions with selectable message branches, branching into a new session from user messages or completed agent messages with persisted source lineage, composer session references (#) with turn-scoped read access, reversible archiving with keyboard undo, project pinning, a project quick switcher listing other active projects with title and description previews and fuzzy search once the list grows, collapsed long user messages, persistent side conversations with advisories injected into running main turns, generated and editable session details, session hover previews in the sidebar, and SQLite-indexed summary-first session startup; in-app sandboxed previews for source links in agent responses; selectable Claude Code, OpenCode, Codex, and CodeBuddy agent frameworks (CodeBuddy app-managed and login-free) behind a shared provider turn-adapter interface, with agent shell commands routed through the app's own execution path on every framework; text, image, and PDF annotations that send selected context into conversations with click-to-reveal evidence in the source document, a session reading context that links up to three PDFs the agent can read, page through, and search, with agent configuration change markers in the timeline; opt-in persistent agent memory with project-scoped categories recalled across sessions and managed from Settings; production subagent delegation with durable messaging, restart recovery, structured output, artifact and review evidence, camelCase delegation APIs, and a per-session delegation switch in the composer's agent controls; review-gated session plans with CLI plan controls; a unified composer lane with a session-scoped message queue, unified draft undo and redo history, active-specialist emphasis, and mid-turn Send now through native follow-up steering; hot-switching of compatible models and providers; multi-provider model configuration including NVIDIA Build with a curated agent-capable catalog, Tencent Coding Plan and Token Plan subscription providers, an xAI OAuth subscription, a dedicated Vision model selector with persistent evidence relay, custom token limits, and a consolidated Scenario models card; per-model-call usage details with a per-call context-window chart; a token usage dashboard with persisted per-run attribution that includes auxiliary model calls outside the main conversation; centralized credential management for GitHub tokens, connector keys, and connector sign-ins with guided recovery, plus device-wide shared credentials (API keys, access tokens, and OAuth sign-ins) that custom connectors bind to as environment variables, headers, or sign-ins; a configurable reviewer model policy with an isolated review runtime, durable assessment snapshots, and empty initial checks, with bounded evidence reads and correction round-trips that preserve your responses and the reviewer model identity; context-window composition insights with compaction boundaries; persistent Python/R/REPL kernels with bounded run-history payloads, a read-only live variable browser for running kernels, live variable-name suggestions in the shared terminal, a docked Variables pane in wide notebook previews, notebook and compute network access limited to Open Science defaults and user-approved domains with in-conversation approvals for blocked destinations (enforced out of the box on macOS and Linux; on Windows after the sandbox's administrator setup), a status-aware Notebook network protection panel in Settings → Runtimes, safe managed-runtime reinstall from Settings, and a global toggle for agent-created runtime environments, immutable generations for files created or modified by notebook and compute runs, separated approval and execution state, cross-run dependency tracking, package-installation progress, progressive history loading, terminated read-only previews, session-scoped remote SSH execution with key or password authentication (including Windows), harvest ceasing, and remote file-staging cleanup, with remote compute jobs that survive restarts and crashes through durable operation receipts and automatic recovery; a user terminal shared with the agent; app-managed and bring-your-own environments for Python and R with notebook workload caches under the configured data-storage location, and data-location migration that shows the target drive's capacity and estimated copy size; immutable, session-scoped artifact versions with checksummed content, producer code, execution history, exact input references, environment inventory, producing message-branch context, version-scoped reviewer evidence, and on-demand LLM-driven code reconstruction, with allowlisted text artifacts and uploads editable as raw text where every save publishes a new comparable version; rich in-app previews for scientific data, documents, images, source code, molecular structures, and notebook history with right-click tab actions and full-screen mode; file attachments up to 10 GB with streaming upload; skills with conversational creation, import, marketplace browsing, and explicit / selection, plus provenance-aware figure workflows for styling, composition, and paper narratives; 24 built-in research connectors plus custom MCP servers with import/export of standard MCP client configurations; durable scoped permissions with allow grants, safe seeded defaults, and a restore-defaults action for the baseline; remote-access pairing; interface localization in German, Spanish, French, Chinese (Simplified and Traditional), Japanese, Korean, and Russian; and auto-update with prominent update reminders and localized release notes.
• 🚧 Partial: R remains managed-only; provider choice remains constrained by the active framework's endpoint compatibility; remote compute is SSH-only; skills remain local (no hosted public discovery commons); reproducibility stops at preserved evidence — captured file generations are groundwork, not yet automated reruns; and review is opt-in and record-scoped.
• 🗺️ Roadmap: a unified model gateway, a hosted public skills and specialist discovery commons, Slurm/cloud-GPU execution, stronger sandboxing and credential isolation, and collaborative research workflows.

🐢 Known Limitations

• Editable artifacts cover text formats. Markdown, plain text, scripts, and source code are editable as raw text; binary formats such as documents, images, and notebooks stay read-only, and editing always publishes new versions rather than rewriting history.
• Network sandboxing covers the app's notebook and compute runtimes, not the whole system. Processes you launch outside these runtimes are not subject to the domain allowlist. On Windows, the boundary applies only after the sandbox's one-time administrator setup; until then, notebook and compute code runs without it.
• Immutable file generations preserve earlier results, but deterministic reruns are still ahead. Captured generations are the groundwork; portable environment locks and full-fidelity session replay remain open.
• R is managed-only. A bring-your-own R interpreter path is not built yet.
• Remote compute is SSH-only. Slurm and cloud GPU submission are not built yet.
• Provider choice is per framework, not one unified gateway. The available protocol depends on the selected agent backend.
• Hot-switching applies only to registered compatible targets. Framework, auth-lane, wire-route, or unsafe capability changes still require a reconnect.
• Code reconstruction is LLM-generated. It does not replace deterministic reproduction.
• No hosted public specialist discovery commons. Specialist packages are portable across machines via import/export and the signed marketplace; what is not built yet is a hosted public discovery and forking hub.
• The task SDK is a first-generation surface. Task creation, polling, artifact retrieval, run progress, and cancellation work; broader orchestration remains open.
• Switching agent backends cannot transfer in-flight tool state. Existing conversation history can replay, but a running action is not migrated.
• Skills are local only. There is no shared public commons, cross-machine forking, or user-facing version pinning yet.
• The reviewer is opt-in and record-scoped. It does not replace domain-specific validation of citations, units, statistics, or methods.
• Scoped permissions cover allow-grants only. Directory-level file access control is not built yet; notebook network sandboxing is the first enforced network boundary.
• Windows builds are unsigned. SmartScreen may warn on first launch; official macOS builds are notarized.
• No local GPU compute backend.
• No multi-user real-time collaboration.

🙏 Acknowledgements

Thanks to @ewen-poch, @wen2zhou, @daanveer-tech, @justemu, and everyone in Discord, X, and Discussions.

---

Full Changelog: https://github.com/aipoch/open-science/commits/v0.25.0