AIPOCH Open-Science v1.0.1

AIPOCH Open-Science v1.0.1

The first 1.x patch: import .science research packages straight from your browser, follow and trust in-app updates (especially on Windows), always see when a session is waiting on you, and benefit from security fixes for MCP OAuth credential handling — plus a broad round of PDF, literature, and session reliability fixes.

AIPOCH Open-Science is an open-source, local-first, model-agnostic AI research workbench for scientists and researchers. It enables reproducible, inspectable research across models with scientific AI agents, Python and R execution, scientific data connectors, and cross-platform support for macOS, Windows, and Linux.

v1.0.1 follows v1.0.0 with a focused reliability pass. Download pages can now hand .science packages to the desktop app in one click. The in-app updater keeps download, readiness and installation in one dialog, and the Windows update path is reworked for stable handoff and ownership. Sessions paused for your approval or answer now always present as waiting. Stored MCP OAuth credentials are bound to their authorization server before use, with refreshed third-party security patches. PDF reading, literature state, session packages, skill editing and notebook recovery all receive targeted fixes.

✨ Highlights

• Import .science packages straight from your browser. A download page can now hand a research package to the desktop app in one click — the app receives and validates it automatically, then you pick where it goes and confirm the import. Cold start and an already-running app are both handled, and failed transfers report what happened with structured, actionable errors. (#3493)
• Updates you can follow — and trust, especially on Windows. Downloading, readiness and installation preparation now stay in one dialog with independently scrollable release notes, instead of dialogs swapping underneath you. The Windows update path no longer duplicates the installer with a separate progress process, keeps ownership of Explorer-launched successors, and stops recopying thousands of files on every update; quitting also waits for notebook cleanup, and cold start no longer reports network failure before the app is ready. (#3653, #3633)
• Security fixes for MCP OAuth credential handling. Stored OAuth credentials are now bound to the authorization server they were issued for before use, and refreshed third-party security patches are included. (#3668)
• Sessions waiting on you always show as waiting. A session paused for your approval or answer no longer flashes back to Running — across Home, the sidebar, workspace actions and the conversation header, and it survives app reloads and live runtime updates. (#3574)

🚀 New Features

• The PDC connector retrieves public case-level clinical metadata — demographics, diagnoses, tumor information and sample references — for the latest study version or a specific one. (#3614)
• Skill selection can now take the images attached to your current message into account, not just the text. (#3595)
• MiniMax M3.1 Flash, the released model with a 1M-token context and multimodal input, is available in both MiniMax regions. (#3670)
• Double-click a session in the workspace sidebar to open the session editor, instead of reaching through the action menu. (#3650)

🔧 Improvements

• In the standalone web workspace, Compute is enabled when the notebook and compute APIs it needs are available, instead of staying disabled. (#3638)
• Settings opens on the General section again, and provider selectors disable themselves while a save is in flight. (#3647, #3646)
• Windows startup credential validation surfaces diagnostics instead of failing silently. (#3631)
• Popover surfaces align with the active theme colors. (#3667)

🐛 Bug Fixes

• Quitting the app while a provider-native question was waiting no longer permanently cancels that question — after relaunch it can still be answered. (#3672)
• Stopping a conversation while its new message was being persisted no longer lets that stopped message reach the provider. (#3660)
• Repeated MCP startup activity identifiers no longer block conversation changes from being saved. (#3628)
• Recreating the agent runtime mid-session no longer lets new skill activities collide with historical ones — a collision previously blocked turn settlement and further messages. (#3682)
• Startup recovery keeps its retry authority, recovered library views refresh, and recovery dialogs no longer stack on top of each other. (#3579)
• Memory edits made while a save is pending are preserved instead of discarded, and completed notebook runs are no longer misreported as interrupted after a restart. (#3571, #3683)
• Manual terminal commands stay visible in the Main Agent view even when a subagent is selected. (#3611)
• PDF reading keeps improving: two-column prose stays in the right order, figure and table ownership stays with the right element, translated reader layouts render correctly, and PDF search now tells you when its coverage is incomplete. (#3605, #3622, #3644, #3654, #3603)
• Literature: saved tool cards refresh with the current library state, table fullscreen uses the correct source, and save status updates reliably. (#3645, #3629)
• Session package import: packages can be dropped onto the project home, import checks and progress are clearer, and nested dialogs scroll correctly. (#3649, #3648, #3673)
• Editing a skill's body no longer overwrites separately edited names or descriptions, and antibody searches respect their configured result limits. (#3570)
• Automated review waits for MCP servers to be ready and verifies routed authentication before proceeding. (#3597, #3627)
• Save-as-skill persistence is scoped to the session that created it. (#3594)
• Sessions with many reviews load their review history again — the full history previously exceeded the transport budget and blocked the review panel; individual review logs now open on demand. (#3677)
• The Windows installer completes silent and assisted installs reliably in every language environment. (#3691)
• Mobile session editing keeps its double-click behavior. (#3651)

📦 Install

Desktop client. Requirements: macOS 12+ (Apple Silicon or Intel), Linux x64 or ARM64, or Windows 10/11 x64. On first run, the onboarding wizard checks the environment and can install and configure an app-managed agent runtime. Once installed, the app updates itself in place.

Download the appropriate package from the Assets section below, or from the official download page. On macOS, the desktop app is also installable via Homebrew: brew install --cask open-science.

Platform	Package
macOS (Apple Silicon)	DMG for ARM64
macOS (Intel)	DMG for x64
Linux	AppImage or Debian package for x64 / ARM64
Windows	Code-signed installer for x64

Command line via Homebrew (macOS and Linux). The standalone CLI and local Web UI live in the official tap — bundled Node runtime, no separate Node.js needed, and upgrades through the normal brew flow:

brew install aipoch/tap/open-science
open-science start --no-open
open-science url

Command line via npm. With Node.js 22.13+, install the CLI (and Task SDK) globally; updates then follow your normal npm upgrade flow:

npm install --global @aipoch/open-science
open-science --help

Command line standalone (all platforms, no toolchain). The Assets below also include standalone CLI archives — macOS and Linux arm64/x64 tarballs and a Windows x64 zip — with a bundled Node runtime, so they install and run without Homebrew, npm, or a local Node.js. Linux packages additionally arrive as standalone .deb and .rpm installers.

macOS — first launch. Official release builds are Developer ID signed and notarized by Apple, so they open like other trusted applications. A locally built copy is notarized differently and may require approval through macOS Privacy & Security.

Windows — first launch. Official release builds are code-signed; Windows recognizes the publisher and no SmartScreen warning appears. Verify that the package came from the official release page before continuing.

Build from source instead:

npm install
npm run build:mac   # or: build:linux / build:win

🧭 What's in this release (maturity)

• ✅ Implemented: everything shipping in v1.0.0, plus the browser .science import, updater redesign, visible session wait states, PDC clinical metadata, image-aware skill selection and the fixes described above.
• 🚧 Partial: provider choice remains constrained by the active framework's endpoint compatibility; remote compute covers direct SSH and Slurm (cloud-GPU submission is not built yet); WSL2 Bash remains an opt-in Windows x64 preview; the skills commons ships marketplace discovery but not cross-machine forking or user-facing version pinning; reproducibility ships replayable per-version verification, session replay, and RO-Crate packaging, while solver-exact equivalence remains open; review is opt-in and record-scoped.
• 🗺️ Roadmap: a unified model gateway, cross-machine skill forking and version pinning, cloud-GPU execution, stronger sandboxing and credential isolation, and collaborative research workflows.

🐢 Known Limitations

• Replay reproduces recorded steps, it does not re-execute them. Solver-exact equivalence guarantees remain open; replayable verification remains the deterministic check, and starting a check from the web client currently requires the desktop app.
• Imported .science sessions are read-only. They stay inspectable and referenceable, and forking them into a writable continuation remains available; execution and continuation remain disabled on the import itself.
• PDF annotations are bound to the file version they annotate. Notes follow the file across projects and sessions where that version is shared, but they do not sync across machines.
• Bookmarks belong to a single session. They do not follow branch switches, join .science package exports, or sync across machines — forking copies them into the new session with fresh identities.
• WSL2 Bash is a preview. It is opt-in on Windows x64 only; PowerShell remains the default shell runtime.
• Remote compute covers direct SSH and Slurm. Cloud-GPU submission is not built yet.
• Editable artifacts cover text formats. Binary formats stay read-only, and editing always publishes new versions.
• Network sandboxing covers the app's notebook and compute runtimes, not the whole system. On Windows, the boundary applies only after the sandbox's one-time administrator setup.
• Provider choice is per framework, not one unified gateway. The available protocol depends on the selected agent backend, and remote endpoints must use HTTPS.
• Code reconstruction is LLM-generated. It does not replace deterministic reproduction; replayable verification is the deterministic check.
• The reviewer is opt-in and record-scoped. It does not replace domain-specific validation of citations, units, statistics, or methods.
• No local GPU compute backend.
• No multi-user real-time collaboration.

🙏 Acknowledgements

Thanks to @ewen-poch, @nasus2002, @daanveer-tech, @wen2zhou, @thxuan, @roxi3906, @LiuZhaoyan, @Korrz777 and everyone in Discord, X, and Discussions.

---

Full Changelog: https://github.com/aipoch/open-science/commits/v1.0.1