Open Science v0.9.1

Reach your workspace from a phone, manage specialist agents in plain conversation, and see exactly when each turn started, finished, and what it cost — while the control plane behind notebook agents, permission lifecycle races, and Claude's MCP server startup get considerably harder.

Open Science is an open-source, model-agnostic AI workbench for scientific discovery — a self-hosted desktop app pairing a plan-and-execute agent with persistent compute, durable project/session storage, and inspectable research artifacts.

v0.9.1 is a patch release on top of v0.9.0. It brings mobile remote access through Remote.It pairing, conversational specialist customization driven by the agent itself through a name-first control-plane SDK, and message timing metadata with elapsed-time and usage popovers in the transcript. Under the hood it hardens the notebook control plane for agent-driven calls, filters incompatible headers from the Responses proxy, surfaces Settings preference write failures instead of silently swallowing them, and closes permission lifecycle races — while a broad ownership refactor extracts narrower, independently testable modules from the main process, ACP runtime, Settings service, and notebook runtime, backed by a new Electron E2E journey suite.

✨ Highlights

• Mobile remote access. The same localhost web UI can now be reached from a phone or tablet through Remote.It pairing. Pair a browser with a six-digit Open Science code, approve it once on the desktop, and the workspace stays reachable without exposing the loopback server directly. Browser trust is revocable, host-management and credential actions remain local-only, and mode changes or service shutdown immediately invalidate active remote sessions. (#545)
• Conversational specialist customization. Specialist agents can now be created, scoped, switched, and deleted entirely in conversation through the agent, powered by a new host.agents control-plane SDK exposed to the trusted notebook REPL. A bundled /customize skill guides the workflow — scope clarification, live read, draft, review, confirm, mutate, read-back — with explicit confirmation boundaries for privileged operations and sanitized errors that never leak credentials or tokens. (#546)
• Message timing metadata. Each user message now shows a stable sent timestamp and each completed agent turn shows a finished timestamp, elapsed runtime, and a usage popover with input, cache, and output breakdowns. The metadata persists independently from mutable record updates, legacy messages are backfilled, and the Codex resume path validates protocol session IDs before replaying the visible transcript. (#559)

🚀 New Features

• Mobile remote access through Remote.It — separate Remote.It App and Browser services keep the Open Science server bound to loopback while routing remote traffic through Remote.It with six-digit Open Science pairing; provider Host/Origin values select an expected route but never authenticate it, pairing is mandatory inside the pairing manager, and Allow once grants workspace-only access without pairing-manager authority. Remote HTTP requests, Task API calls, and WebSockets are bound to a revocable authorization generation invalidated by mode changes, revocation, shutdown, or provider failure. (#545)
• Conversational specialist customization — a name-first host.agents SDK surface (list, get, create, update, switch, delete, attach_skill/detach_skill, attach_connector/detach_connector) exposed to the trusted notebook REPL, a bundled /customize skill, a mutation control plane with atomic multi-field capability edits and a next-message switch lifecycle, an approval surface for privileged operations, and renderer entry points that open the /customize chat from Specialist settings. (#546)
• Message timing metadata — sent timestamps below user bubbles, completed/failed timestamps with elapsed runtime and a usage trigger below agent messages, a compact usage popover with proportional category bar and conditional cache read/write rows, terminal timestamps and turn usage persisted independently from mutable record updates with legacy backfill, and framework-boundary usage normalization across Codex and OpenCode. (#559)

🔧 Improvements

• Settings sidebar tightened to reclaim horizontal space, with detection actions aligned to the far right of their header row instead of wrapping beneath the copy. (#562)
• The Settings → Permissions page no longer triggers a full session-storage load (including startup recovery and file-index reconciliation) solely to resolve session-scoped grant labels, so the page opens quickly regardless of storage work. (#561)
• Settings preference write failures now surface as transient, preference-scoped error state instead of being silently logged to the console while the selection reverts. (#571)
• The general README no longer carries version-specific downgrade guidance; the rollback instructions for older releases live in release-oriented documentation and the existing CLI downgrade guide. (#563)
• The capability status in the README, ROADMAP, and linked PRD is aligned with capabilities already present in the codebase, so shipped foundations are no longer marked incomplete. (#558)

🐛 Bug Fixes

• Notebook control-plane hardening — the production Notebook control-plane capability now includes agentsCall, so host.agents.* calls from the real REPL succeed instead of failing with HTTP 403. Request-body session identity is no longer trusted without validation, closing several hardening gaps left by the Specialist customization work. (#581)
• Responses proxy header filtering — the loopback compatibility proxy no longer forwards browser-controlled sec-fetch-mode headers to Electron net.fetch, preventing net::ERR_INVALID_ARGUMENT failures when DeepSeek's flash model targets the native Responses endpoint. (#573)
• Claude MCP server startup race — a new Claude Code session now waits for its configured stdio MCP servers to finish registering before accepting the first user prompt, so otherwise-valid tool calls are no longer rejected because Claude snapshotted the tool set before the servers connected. (#560)
• Permission lifecycle races — hardened against concurrent grant mutations, stale optimistic-concurrency revisions, and interleaved revoke/approve sequences that could leave the grant table in an inconsistent state. (#555)
• Immutable environment manifest migration — only actual immutable Environment manifests are migrated, preventing the migration path from touching non-target records during upgrade. (#554)
• Complete prompt token usage aggregation — the Codex ACP adapter accumulates every model request in the turn so tool-bearing turns are no longer underreported in the usage footer. (#553)

📦 Install

Requirements: macOS 12+ (Apple Silicon or Intel), Linux x64, or Windows 10/11 x64. On first run, the onboarding wizard checks the environment and can install and configure an app-managed agent runtime. Once installed, the app can update itself in place.

Download the appropriate package from the Assets section below:

Platform	Package
macOS (Apple Silicon)	DMG for ARM64
macOS (Intel)	DMG for x64
Linux	AppImage or Debian package for x64
Windows	Installer for x64

macOS — first launch. Official release builds are Developer ID signed and notarized by Apple, so they open like other trusted applications. A locally built copy is not notarized and may require approval through macOS Privacy & Security.

Windows — first launch (unsigned build). No Authenticode certificate yet, so SmartScreen shows a bypassable "unrecognized app" prompt (More info → Run anyway). Verify that the package came from the official release page before continuing.

Build from source instead:

npm install
npm run build:mac   # or: build:linux / build:win

🧭 What's in this release (maturity)

• ✅ Implemented: a local-first desktop, localhost-web, headless, CLI, and task-SDK surface over persistent projects and sessions with selectable message branches; selectable Claude Code, OpenCode, and Codex agent frameworks; multi-provider model configuration with combined model/reasoning selection and native Responses API support for DeepSeek flash; persistent Python/R/REPL kernels and remote SSH execution; immutable artifact versions with inspectable audit evidence; multi-format previews including TIFF; file-based skills; permissioned scientific connectors; opt-in review and bounded correction; personal specialist agent profiles with scoped capabilities and conversational customization; scoped permission management with global, project, and session grants; conversation export as Markdown and PDF; selective session-artifact downloads; per-turn token usage; message timing metadata; collapsible side panels; mobile remote access through Remote.It pairing; configurable storage; and installers for macOS, Windows, and Linux.
• 🚧 Partial: R remains managed-only; provider choice remains constrained by the active framework's endpoint compatibility; remote compute is SSH-only; skills remain local; specialist roles are personal-only (no cross-machine sharing); and review is opt-in and record-scoped.
• 🗺️ Roadmap: a unified model gateway, a public skills commons and cross-machine specialist sharing, Slurm/cloud-GPU execution, stronger sandboxing and credential isolation, and collaborative research workflows.

🐢 Known Limitations

• R is managed-only. A bring-your-own R interpreter path is not built yet.
• Remote compute is SSH-only. Slurm, cloud GPU, and parallel sub-agent fan-out are not built yet.
• Provider choice is per framework, not one unified gateway. The available protocol depends on the selected agent backend.
• Specialist roles are personal-only. There is no shared public commons or cross-machine specialist forking yet.
• The task SDK is a first-generation surface. Task creation, polling, and artifact retrieval work; broader orchestration remains open.
• Switching agent backends cannot transfer in-flight tool state. Existing conversation history can replay, but a running action is not migrated.
• Skills are local only. There is no shared public commons, cross-machine forking, or user-facing version pinning yet.
• The reviewer is opt-in and record-scoped. It does not replace domain-specific validation of citations, units, statistics, or methods.
• Scoped permissions cover allow-grants only. Network sandboxing, directory-level file access control, and a credential vault are not built yet.
• Windows builds are unsigned. SmartScreen may warn on first launch; official macOS builds are notarized.
• No local GPU compute backend.
• No multi-user real-time collaboration.

🙏 Acknowledgements

Thanks to @ewen-poch, @GiaoLee, @wen2zhou, @roxi3906, @LJLJ111, @EuanTop, @daanveer-tech, and everyone in Discord, X, and Discussions.

---

What's Changed

• feat(remote-access): add mobile remote access with Remote.It by @GiaoLee in https://github.com/aipoch/open-science/pull/545
• feat(agents): add conversational specialist customization via host.agents SDK by @wen2zhou in https://github.com/aipoch/open-science/pull/546
• fix(permission-management): harden permission lifecycle races by @ewen-poch in https://github.com/aipoch/open-science/pull/555
• fix(storage): migrate immutable Environment manifests only by @ewen-poch in https://github.com/aipoch/open-science/pull/554
• fix(agent-usage): aggregate complete prompt token usage by @ewen-poch in https://github.com/aipoch/open-science/pull/553
• docs(roadmap): align capability status with shipped features by @ewen-poch in https://github.com/aipoch/open-science/pull/558
• fix(acp): wait for Claude MCP servers before session start by @ewen-poch in https://github.com/aipoch/open-science/pull/560
• perf(permissions): avoid full session reconciliation by @ewen-poch in https://github.com/aipoch/open-science/pull/561
• style(settings): tighten sidebar and align detection actions by @ewen-poch in https://github.com/aipoch/open-science/pull/562
• docs(readme): remove version-specific downgrade guidance by @ewen-poch in https://github.com/aipoch/open-science/pull/563
• feat(conversation): show message timing metadata by @ewen-poch in https://github.com/aipoch/open-science/pull/559
• test(acp): use platform-native resume cwd assertion by @ewen-poch in https://github.com/aipoch/open-science/pull/564
• test(runtime): pin multi-surface compatibility contracts by @ewen-poch in https://github.com/aipoch/open-science/pull/565
• test(electron-e2e): add real desktop journey by @ewen-poch in https://github.com/aipoch/open-science/pull/566
• refactor(notebook): extract environment lease manager by @ewen-poch in https://github.com/aipoch/open-science/pull/567
• refactor(settings): introduce capability foundations by @ewen-poch in https://github.com/aipoch/open-science/pull/568
• refactor(acp): extract snapshot and context owners by @ewen-poch in https://github.com/aipoch/open-science/pull/569
• refactor(main): separate application runtime composition by @ewen-poch in https://github.com/aipoch/open-science/pull/570
• fix(settings): surface preference write failures by @ewen-poch in https://github.com/aipoch/open-science/pull/571
• refactor(main): introduce caller context and client leases by @ewen-poch in https://github.com/aipoch/open-science/pull/572
• fix(settings): filter Fetch Metadata headers from Responses proxy by @ewen-poch in https://github.com/aipoch/open-science/pull/573
• test(electron-e2e): add journey axe and visual coverage by @ewen-poch in https://github.com/aipoch/open-science/pull/574
• refactor(settings): extract skill catalog ownership by @ewen-poch in https://github.com/aipoch/open-science/pull/575
• test(electron-e2e): add Windows window coverage by @ewen-poch in https://github.com/aipoch/open-science/pull/576
• refactor(notebook): extract recovery coordination by @ewen-poch in https://github.com/aipoch/open-science/pull/577
• refactor(acp): extract permission context ownership by @ewen-poch in https://github.com/aipoch/open-science/pull/578
• test(electron-e2e): add workspace agent journeys by @ewen-poch in https://github.com/aipoch/open-science/pull/579
• refactor(settings): extract connector settings ownership by @ewen-poch in https://github.com/aipoch/open-science/pull/580
• fix(agents): harden notebook control-plane operations by @ewen-poch in https://github.com/aipoch/open-science/pull/581

Full Changelog: https://github.com/aipoch/open-science/compare/v0.9.0...v0.9.1