AIPOCH Open-Science v0.28.0

AIPOCH Open-Science v0.28.0

A release that closes the loop from evidence to verification: captured artifact versions can now be re-executed from sealed recipes and compared with the original — joined by a categorized global search across the whole workspace, an opt-in WSL2 Bash preview on Windows, tested managed Codex upgrades, and privacy defaults that keep remote media and model traffic explicit.

AIPOCH Open-Science is an open-source, local-first, model-agnostic AI research workbench for scientists and researchers. It enables reproducible, inspectable research across models with scientific AI agents, Python and R execution, scientific data connectors, and cross-platform support for macOS, Windows, and Linux.

v0.28.0 turns provenance from a record into a check. Every captured artifact version can now be re-executed: the app restores the version's sealed recipe — its recorded inputs, file generations, environment lock, lineage, and execution recipe — in an isolated environment, reruns it, and compares the reproduced files with the original through byte-exact checks, bounded image and table comparisons, and optional scientific comparison rules. Outcomes are reported per file, checks run on single versions or in batches across a session, and verification records can be exported with explicit retention and deletion controls. Finding things gets faster too: one global search now reaches projects, sessions, message bodies, uploaded and generated files, and the literature library, with grouped results, filters, and a contextual detail pane that jumps to the matching message. Windows x64 gains an opt-in WSL2 Bash preview with version-matched assets and ownership-tracked cleanup, and the managed Codex runtime moves to a newer tested CLI with explicit tested upgrades from Settings. Privacy tightens by default: remote media in model output loads only after explicit activation, images sent to models are normalized, and remote model endpoints must use HTTPS.

✨ Highlights

• Verify that a result reproduces. Re-execute a captured artifact version from its sealed recipe — recorded inputs, environment lock, and execution evidence — in an isolated environment, and compare the reproduced files with the original through byte-exact checks, bounded image and table comparisons, and optional scientific comparison rules, with exportable verification records. (#2438)
• One search across the whole workspace. Global search reaches projects, sessions, message bodies, uploaded and generated files, and the literature library — grouped, filterable results with a contextual detail pane, file previews, and a jump straight to the matching message. (#2362)
• Remote media and model endpoints are private by default. Images, audio, and video embedded in model output load only after explicit activation, images sent to models are normalized, and remote model endpoints must use HTTPS. (#2420)
• WSL2 Bash preview on Windows x64. An explicit opt-in preview routes shell commands through a readiness-checked WSL2 environment with version-matched assets, command-scoped sandboxing, and ownership-tracked cleanup; PowerShell remains the default. (#2252)
• Tested managed Codex upgrades. The app-managed Codex CLI moves to a newer tested release with the bundled Astra model catalog, Settings shows CLI and adapter versions separately, and older app-owned runtimes get an explicit tested update. (#2429)

🚀 New Features

• Replayable artifact verification — capture version-bound execution evidence, file generations, environment locks, lineage graphs, and replay recipes; inspect the captured inputs, upstream Notebook runs, environment, and lineage a check will use; restore the sealed recipe in an isolated environment; and see per-file comparison outcomes instead of treating execution completion as proof. Checks start from captured inputs or available intermediate-file checkpoints, run on single versions or in batches across a session's versions, apply exact byte checks, bounded image and table comparisons, and optional scientific comparison rules, and export verification records with output retention, size, and deletion controls. Python and R dependency analysis covers cross-cell variables and package setup and stays conservative when an operation or evidence is not supported. (#2438)
• Categorized global search with contextual previews — one entry point for projects, message bodies, sessions, uploaded files, generated files, and Library literature and collections. The default All view groups results with sticky headings and loads more per category in place; scope, date, sender, file-format, and Library-kind filters run before pagination. A compact detail pane opens on selection, is reused when changing results, and collapses without closing search; message search groups linked agent fragments by response turn, highlights rendered text, jumps to the matching message, and hydrates a long message's full body only when selected. Recent sessions, files, and literature preview inline, and a file links back to its source message. (#2362)
• WSL2 Bash preview on Windows x64 — WSL2 Bash ships as an explicit Windows x64 Preview: activation is explicit, PowerShell remains the default, and packaged use requires a version-matched asset manifest plus readiness checks. Commands run inside a command-scoped WSL2 sandbox with durable ownership, cancellation, timeouts, and restart reconciliation; macOS process cleanup is hardened in the same pass so helpers that outlive their parent are still found and cleaned up. (#2252)
• Tested managed Codex upgrades — the managed native Codex CLI is pinned to a newer tested release (0.153.4) with its verified bundled Astra catalog, while the previous release's catalog and delegation certification are preserved. Settings shows CLI and ACP adapter versions separately, offers an explicit update only for an older app-owned pair, and gives external CLI installations manual update guidance; replacement is refused while an app-launched Codex process is still using the target. (#2429)

🔧 Improvements

• Updates and downloads keep their integrity: cancelled downloads no longer reappear as ready while a retry drains, manually downloaded installers are re-verified (file type, size, streaming SHA-256) before opening, a refused install gate leaves a direct installation retry, Linux download estimates derive from the actual updater package format, and published update channels advance monotonically so a channel never moves backwards. (#2408, #2412)
• Remote image, audio, and video sources and posters in rendered messages stay deferred until you activate a control that shows the destination hosts, approval is scoped to the rendered element and its complete URL set, and diagram blocks with embedded images are blocked before any request can leave the machine. Images sent to models are normalized — ancillary metadata is stripped from model-input derivatives while original files are preserved. (#2420)
• Configured conda, PyPI, and CRAN package mirrors are authorized automatically during package management — for the duration of that operation only — instead of being blocked by the network policy until separately approved; unsafe mirror URLs (embedded credentials, localhost, or raw IP literals) are rejected. (#2399)
• Windows keeps installer elevation across the update preflight (#2433), and R runtimes request access during first execution with a kernel startup retry. (#2431)
• Declining a connector credential prompt settles every queued request for the same credential at once, instead of surfacing the next identical prompt immediately. (#2447)
• The provenance panel orders the Reproducibility entry directly before Review, next to the evidence it verifies. (#2442)
• Long sessions stay responsive: queued work and retained history are bounded. (#2414)
• Keyboard and assistive-technology interactions are consistent again across the workspace. (#2417)

🐛 Bug Fixes

• Literature — PubMed publication dates and journal abbreviations are preserved on import (#2437), and terminal PDF metadata identifiers are verified before use. (#2425)
• Sessions and persistence — optional session fields are compared by value so harmless formatting no longer discards changes (#2432); authoritative renderer updates are preserved during sync (#2403); startup and renderer failures recover (#2415); asynchronous cleanup completes after failures (#2404); interrupted data cleanup recovers independently (#2398); and diagnostic logging stays bounded and recoverable. (#2406)
• Agents, skills, and composer — scoped Codex document loading is restored (#2418), the Claude skill loader honors conversation grants, and pasted file references open before a new session is created. (#2409)
• Notebook and compute — compute dispatch survives session-catalog failures so a catalog error no longer blocks queued work (#2434); Windows R access and kernel startup retry are restored; and Windows R startup is repaired for product-named temporary directories, with bounded permission preparation, quieter startup, and reliable directory cleanup. (#2446)
• Verification and provenance — reproducibility recipes stay consistent when captured execution evidence is trimmed to its size limit. (#2440)
• Workspace, export, and web — the web UI no longer touches desktop-only lifecycle APIs (#2424); conversation export ignores runtime timestamps in integrity checks (#2430); annotation text selections trigger reliably during active sessions (#2426); and sticky CSV row numbers stay opaque while scrolling. (#2411)
• Platform and dependencies — vulnerable image and tooling dependencies are updated (#2407), and source installs automatically recover stale bundled patches during npm install. (#2439)

⚠️ Breaking Changes

• Remote model endpoints must use HTTPS. Endpoint validation, request sending, and runtime configuration reject plain-HTTP remote model URLs; localhost and IPv4/IPv6 loopback addresses remain allowed. Previously stored HTTP configurations stay visible and editable but cannot run until switched to HTTPS. (#2420)
• Model output media requires activation, and model-input images are normalized. Remote images, audio, and video in rendered messages load only after you explicitly activate them, and images sent to models are normalized derivatives (originals are untouched). Because vision caches key on the emitted image bytes, normalization can cause a one-time cache miss and recomputation for previously seen images. (#2420)

📦 Install

Requirements: macOS 12+ (Apple Silicon or Intel), Linux x64, or Windows 10/11 x64. On first run, the onboarding wizard checks the environment and can install and configure an app-managed agent runtime. Once installed, the app can update itself in place.

Download the appropriate package from the Assets section below:

Platform	Package
macOS (Apple Silicon)	DMG for ARM64
macOS (Intel)	DMG for x64
Linux	AppImage or Debian package for x64
Windows	Installer for x64

macOS — first launch. Official release builds are Developer ID signed and notarized by Apple, so they open like other trusted applications. A locally built copy is not notarized and may require approval through macOS Privacy & Security.

Windows — first launch (unsigned build). No Authenticode certificate yet, so SmartScreen shows a bypassable "unrecognized app" prompt (More info → Run anyway). Verify that the package came from the official release page before continuing.

Build from source instead:

npm install
npm run build:mac   # or: build:linux / build:win

🧭 What's in this release (maturity)

• ✅ Implemented: a local-first desktop, localhost-web, headless, CLI, and task-SDK surface over persistent projects and sessions with selectable message branches, durable background execution for Notebook, REPL, and shell work with automatic result delivery across local runs and remote compute jobs, a categorized global search across projects, sessions, message bodies, uploaded and generated files, and the literature library with contextual detail previews, CLI and SDK connector management, branching into a new session from user messages or completed agent messages with persisted source lineage, composer session references (#) with turn-scoped read access, reversible archiving with keyboard undo, project pinning, a project quick switcher with fuzzy search, persistent side conversations with advisories injected into running main turns, generated and editable session details, session hover previews in the sidebar, and SQLite-indexed summary-first session startup; in-app sandboxed previews for source links in agent responses; selectable Claude Code, OpenCode, Codex, and CodeBuddy agent frameworks (CodeBuddy app-managed and login-free) behind a shared provider turn-adapter interface, with tested in-place upgrades for the managed Codex runtime; text, image, and PDF annotations that send selected context into conversations with click-to-reveal evidence, a session reading context that links up to three PDFs the agent can read, page through, and search, with agent configuration change markers in the timeline; opt-in persistent agent memory with project-scoped categories recalled across sessions and managed from Settings; production subagent delegation with durable messaging, restart recovery, structured output, and a per-session delegation switch; review-gated session plans with CLI plan controls; compact summary cards for artifact writes and notebook controls in messages and approvals; a unified composer lane with a session-scoped message queue, unified draft undo and redo history, and mid-turn Send now through native follow-up steering; hot-switching of compatible models and providers; multi-provider model configuration including Apodex, NVIDIA Build with a curated agent-capable catalog, the latest OpenAI and Anthropic model catalogs, Tencent Coding Plan and Token Plan subscription providers, an xAI OAuth subscription, a dedicated Vision model selector, custom token limits, and a consolidated Scenario models card; per-model-call usage details with a per-call context-window chart; a token usage dashboard with persisted per-run attribution; centralized credential management with guided recovery, device-wide shared credentials, and an explicit file-storage mode for headless Linux; a configurable reviewer model policy with an isolated review runtime and durable assessment snapshots; context-window composition insights with compaction boundaries; persistent Python/R/REPL kernels with bounded run-history payloads, live variable browsing, notebook and compute network access limited to user-approved domains with in-conversation approvals and automatically authorized configured package mirrors, safe managed-runtime reinstall, a global toggle for agent-created runtime environments, and an opt-in WSL2 Bash preview on Windows x64; session-scoped remote compute execution with a per-host execution mode (direct SSH or Slurm) with durable submission, polling, recovery, cancellation, and cleanup plus a guided Compute Environment Setup skill, with remote compute jobs that survive restarts and crashes through durable operation receipts and automatic recovery; a user terminal shared with the agent; app-managed and bring-your-own environments for Python and R; immutable, session-scoped artifact versions with checksummed content, producer code, execution history, exact input references, environment inventory, version-scoped reviewer evidence, artifact lineage, and on-demand code reconstruction, replayable verification that restores a version's sealed recipe in an isolated environment and compares reproduced files with the original through byte-exact and scientific comparison rules with exportable verification records, and allowlisted text artifacts and uploads editable as raw text; a literature reference library with collections, project links, batch and identifier-aware imports, duplicate comparison and bulk merge, open-access full-text PDF attachment through Europe PMC, PMC, OpenAlex, arXiv, and Unpaywall with parallel multi-source lookup, citation formatting with artifact provenance, and relocation-safe storage; rich in-app previews for scientific data, documents, images, source code, molecular structures, and notebook history with right-click tab and content actions and full-screen mode; file attachments up to 10 GB with streaming upload; skills with conversational creation, import, marketplace browsing, explicit / selection, and always-on application skills; 24 built-in research connectors plus custom MCP servers; durable scoped permissions with allow grants, safe seeded defaults, a restore-defaults action, explicit activation for remote media in model output, and HTTPS-only remote model endpoints; remote-access pairing; interface localization in German, Spanish, French, Chinese (Simplified and Traditional), Japanese, Korean, and Russian; and auto-update with prominent update reminders and localized release notes.
• 🚧 Partial: R remains managed-only; provider choice remains constrained by the active framework's endpoint compatibility; remote compute covers direct SSH and Slurm (cloud-GPU submission is not built yet); WSL2 Bash is an opt-in Windows x64 preview rather than a default; skills remain local (no hosted public discovery commons); reproducibility ships replayable per-version verification, while full-session replay and solver-exact equivalence remain open; and review is opt-in and record-scoped.
• 🗺️ Roadmap: a unified model gateway, a hosted public skills and specialist discovery commons, cloud-GPU execution, stronger sandboxing and credential isolation, and collaborative research workflows.

🐢 Known Limitations

• Verification checks a captured version, not a whole session. Replayable verification restores that version's sealed recipe and compares reproduced files with the original; full-fidelity session replay and solver-exact equivalence guarantees remain open. Large binary scientific files (such as RDS and H5AD) are not loaded for content comparison, and starting a check from the web client currently requires the desktop app.
• WSL2 Bash is a preview. It is opt-in on Windows x64 only, requires version-matched assets and readiness checks, and is not yet declared generally available; PowerShell remains the default shell runtime.
• Remote compute covers direct SSH and Slurm. Cloud-GPU submission is not built yet.
• The literature library keeps maturing. Batch import, collections, duplicate merging, open-access PDF attachment, and citation formatting ship today; deeper reference-aware research workflows continue to evolve.
• Editable artifacts cover text formats. Markdown, plain text, scripts, and source code are editable as raw text; binary formats such as documents, images, and notebooks stay read-only, and editing always publishes new versions rather than rewriting history.
• Network sandboxing covers the app's notebook and compute runtimes, not the whole system. Processes you launch outside these runtimes are not subject to the domain allowlist. On Windows, the boundary applies only after the sandbox's one-time administrator setup; until then, notebook and compute code runs without it.
• R is managed-only. A bring-your-own R interpreter path is not built yet.
• Provider choice is per framework, not one unified gateway. The available protocol depends on the selected agent backend, and remote endpoints must use HTTPS.
• Hot-switching applies only to registered compatible targets. Framework, auth-lane, wire-route, or unsafe capability changes still require a reconnect.
• Code reconstruction is LLM-generated. It does not replace deterministic reproduction; replayable verification is the deterministic check.
• No hosted public specialist discovery commons. Specialist packages are portable across machines via import/export and the signed marketplace; what is not built yet is a hosted public discovery and forking hub.
• The task SDK is a first-generation surface. Task creation, polling, artifact retrieval, run progress, cancellation, session configuration, and connector management work; broader orchestration remains open.
• Switching agent backends cannot transfer in-flight tool state. Existing conversation history can replay, but a running action is not migrated.
• Skills are local only. There is no shared public commons, cross-machine forking, or user-facing version pinning yet.
• The reviewer is opt-in and record-scoped. It does not replace domain-specific validation of citations, units, statistics, or methods.
• Scoped permissions cover allow-grants only. Directory-level file access control is not built yet; notebook network sandboxing is the first enforced network boundary.
• Windows builds are unsigned. SmartScreen may warn on first launch; official macOS builds are notarized.
• No local GPU compute backend.
• No multi-user real-time collaboration.

🙏 Acknowledgements

Thanks to @ewen-poch, @wen2zhou, @roxi3906, @nasus2002, @justemu, and everyone in Discord, X, and Discussions.

---

Full Changelog: https://github.com/aipoch/open-science/commits/v0.28.0