# OpenSquilla 0.4.0 ## Overview OpenSquilla 0.4.0 is the first release with desktop installers for the Vue control console. It keeps the Python wheel and legacy Windows portable paths available, while making the desktop app the clearest install path for macOS and Windows users who want the packaged control UI. The release also updates the daily control surfaces, workflow launch model, coding workflow, search providers, terminal preview path, and runtime hardening. Existing gateway and data locations stay the same, so users can upgrade without migrating their `~/.opensquilla` state. ## ✨ What's New ### Desktop installers for the Control UI The release now includes a macOS Apple Silicon installer and a Windows x64 NSIS installer for the Electron desktop shell. Both packages embed the built Vue control UI and the packaged gateway runtime. ### Coding mode and guarded code-task workflow Coding mode gives source-editing work a clearer product lane. The `opensquilla code-task` workflow routes generated or edited code through isolated run directories, trusted-host confirmation, separated build output, and verification before source persistence. This keeps coding tasks easier to inspect and safer to continue from the Control UI. ### Manual MetaSkills and workflow launch control MetaSkills are manual-only by default. Use `/meta` to list workflows and `/meta ` to run one; set `meta_skill.auto_trigger = true` only when the older automatic behavior is intentional. MetaSkill progress, clarification, run-history reads, and rescue-action surfaces are clearer in the Control UI. ### Control UI, sessions, and daily workflow polish The refreshed browser console centers everyday work around conversation state, session inspection, Settings, artifact previews, share export, deliverables, turn trace, mobile tabs, and clearer Skills, Usage, Cron, Logs, and Approvals surfaces. ### Search, providers, and runtime hardening DuckDuckGo, Bocha, Brave, Tavily, and Exa are now documented as runtime search providers, with `web_search` for source-backed answers and `web_discover` for lightweight discovery. The release also adds the `openai_responses` provider shape and hardens provider stream parsing, Gemini thought-signature replay, SSRF fake-IP DNS guidance, session recovery, artifact handling, and approval event delivery. ## Downloads Recommended desktop downloads: - macOS desktop installer: `OpenSquilla-0.4.0-mac-arm64.dmg` - Windows desktop installer: `OpenSquilla-0.4.0-win-x64.exe` Code signing policy: [`docs/code-signing-policy.md`](https://github.com/opensquilla/opensquilla/blob/7353f2795aa2e77aa408c3e8a9150dd7efbd80d0/docs/code-signing-policy.md). Terminal and automation downloads: - Python wheel: `opensquilla-0.4.0-py3-none-any.whl` - Checksums: `SHA256SUMS` Legacy compatibility downloads: - Legacy Windows portable, versioned: `OpenSquilla-0.4.0-windows-x64-py312-recommended-portable.zip` - Legacy Windows portable, stable alias: `OpenSquilla-windows-x64-portable.zip` The legacy Windows portable assets remain available as legacy compatibility downloads for existing scripts and portable-folder workflows. New Windows desktop users should prefer `OpenSquilla-0.4.0-win-x64.exe`. Privacy and third-party attribution are documented in [`PRIVACY.md`](https://github.com/opensquilla/opensquilla/blob/7353f2795aa2e77aa408c3e8a9150dd7efbd80d0/PRIVACY.md) and [`THIRD_PARTY_NOTICES.md`](https://github.com/opensquilla/opensquilla/blob/v0.4.0/THIRD_PARTY_NOTICES.md). Updater metadata: - `latest-mac.yml` - `latest.yml` - `*.blockmap` ## Upgrading from 0.3.1 If OpenSquilla was installed with `uv tool install`, reinstall 0.4.0 over the existing tool environment: ```sh uv tool install --python 3.12 --force --reinstall-package opensquilla \ "opensquilla[recommended] @ https://github.com/opensquilla/opensquilla/releases/download/v0.4.0/opensquilla-0.4.0-py3-none-any.whl" ``` The release installers use the same forced reinstall path. Close any running OpenSquilla gateway before upgrading, then restart it after the install. Existing `~/.opensquilla/config.toml` and session data are reused. Desktop users should quit the running desktop app before replacing it. macOS users install the `.dmg` by dragging OpenSquilla into Applications. Windows users run the `.exe` installer. Legacy Windows portable users should extract the 0.4.0 portable zip to a fresh folder, or replace the whole extracted 0.3.x folder while the gateway is stopped. Do not copy only individual files from the new zip into an old portable tree. ## Acknowledgements Thanks to the contributors whose pull-request work is present in the current 0.4.0 release surface: - [@ab2ence](https://github.com/ab2ence) for Control UI migration and stabilization, share-image export, Web Chat slash-input handling, bundled AwesomeWebpage MetaSkill work, the Coding mode toggle, and desktop gateway startup plus install telemetry hardening. - [@myz-ah](https://github.com/myz-ah) for the guarded `code-task` workflow and Web UI LaTeX formula rendering. - [@nice-code-la](https://github.com/nice-code-la) for Skills readiness, MetaSkill progress and clarification UX, manual `/meta` behavior, scoped MetaSkill run-history reads, router fallback/default refresh work, image follow-up routing gates, from-scratch `code-task` build support, and MetaSkill clarify resume feedback. - [@openvictory](https://github.com/openvictory) for MetaSkill run-history and rescue-action Control UI work carried through the session-contract Control UI integration, plus Skill API-key fallback behavior. - [@Liu-RK](https://github.com/Liu-RK) for sandbox run-mode and managed access-control work across Windows and Linux. - [@weiconghe](https://github.com/weiconghe) for Gemini thought-signature replay across provider tool-call turns. - [@changquanyou](https://github.com/changquanyou) for no-space SSE `data:` handling and managed-layer MetaSkill inspection. - [@nkgotcode](https://github.com/nkgotcode) for DOCX `skill_exec` export behavior. - [@C1-BA-B1-F3](https://github.com/C1-BA-B1-F3) for actionable SSRF fake-IP DNS failure guidance. - [@BlueOcean223](https://github.com/BlueOcean223) for TUI EOF-state recovery on cached reentry. - [@szdtzpj](https://github.com/szdtzpj) for environment test precedence and the TUI abort hook. - [@lose4578](https://github.com/lose4578) for OpenTUI scrollback-native frontend work carried into the 0.4.0 preview backend. - cwan0785 ([@Anonymous-4427](https://github.com/Anonymous-4427)) for OpenTUI preview backend implementation commits carried into the 0.4.0 preview backend. See [`CONTRIBUTORS.md`](https://github.com/opensquilla/opensquilla/blob/v0.4.0/CONTRIBUTORS.md) for the full 0.4.0 attribution ledger and PR evidence.