Release Notes

A Studio to build, deploy, and ask questions about IIoT field apps via chat — the latest version is 2026.08.

Version notation

Versions use YYYY.MM format (for example 2026.08). Updates within the same month keep the same version number, listed below in order of release date. For installation and upgrade instructions, see Installation.

---

🚚 Download location changed — product.kopens.io

Installation scripts and air-gapped bundles have moved from download.kopens.io to product.kopens.io. Folder structure and file names remain the same. If you have installation commands in a script, just update the URL.

…-latest.tar.gz is gone

It was a copy of the latest bundle, and downloading during publication caused checksums to mismatch, marking good files as "corrupted." Now read latest.txt which contains only the latest version name, then download from the version-specific URL.

BASE=https://product.kopens.io/plantpulse-studio
VER=$(curl -fsSL $BASE/latest.txt)
curl -fLO -C - --retry 5 $BASE/plantpulse-studio-images-$VER.tar.gz

Published versions are never deleted. Even after 2026.09 comes out, the …-2026.08.tar.gz URL for …-2026.08.tar.gz stays live and can be retrieved or rolled back at any time. If you have installation procedures in a script, it's safer to pin the version explicitly rather than use latest.txt.

🗓 Monthly regular release — 2026.08

A new version releases on the 1st of each month. 2026.08 is a deployment automation release with no product feature changes — if you're using 2026.07, there's no urgent need to upgrade.

---

Check first — actions needed for upgrade

If applicable	Action
Running in a non-air-gapped environment	Apply this update immediately (builder sidecar exposure blocked)
API keys in config files	Move keys to .env → Secret Management
Serving via domain or reverse proxy	One user re-login required → Domain and Reverse Proxy
Have backups but never tested recovery	Run a recovery drill → Backup and Recovery

---

🛡 Complete data integrity audit

Audited the entire codebase and fixed 3 critical and 15 high severity issues. Most were the "invisible until you need it" type, so we created reproduction tests first, then fixed them.

Backup and recovery

Run a recovery drill

Recovery was not actually restoring anything. Backups were being taken daily without issues, but executing recovery left the database unchanged and showed "recovery complete." In previous versions, DRYRUN=1 drills passed even though actual recovery failed. After this update, test actual recovery at least once → Backup and Recovery

• A failed evacuation copy immediately proceeded, and there was no way to restore from that copy. Now we use the same format as formal backups and halt recovery if evacuation fails.
• Backup was missing .env. Without this after moving keys to environment variables, you cannot restore the system from backup alone → Secret Management
• Fixed an issue where a postgres folder inside the workspace was silently omitted from backups.
• Scheduled backups were failing completely from the first run (log file path missing). If you have auto-backups enabled, no backups may have accumulated — check dist/.

Data loss

• Deleting a chat room could erase other users' query history as well.
• Projects in trash that should stay for 7 days would immediately clear on next restart.
• If storage read failed once, creating any watcher or skill afterward would delete all existing ones.
• If config or history save was interrupted, the project or history could disappear.
• Promoting a lightweight (file-based) installation to PostgreSQL would not migrate accounts and chat history → Installation

Operational stability

• Opening an app twice in quick succession would leak internal ports, eventually failing all app opens.
• As builder chats grew longer, requests kept expanding, increasing token usage until chat blocked.
• Undo could race with builder work, mixing or losing results → Building Apps with Builder
• Reinstall would delete TLS certificates, downgrading HTTPS to plain text → Domain and Reverse Proxy
• Equipment control commands could be sent up to 4 times on response delay.

Screen

• Questions sent right after entering chat would disappear once the list finished loading → Chat Query on Data
• Notifications appeared twice on mobile, and logging out would re-login after refresh → Field Mobile
• Writing requirements, then switching modes would erase them.
• Expired sessions showed a blank screen with no warning.

📖 User manual built in

• The manual is now in the product — the document you're reading now. Click Manual ↗ (fa-book-open) in the left navigation to open it in a new window.
• Works without internet: the manual is bundled with the product image, so you can view it offline in air-gapped sites. Full-text search runs locally too.
• Left navigation icons are slightly enlarged for better readability.

🔒 Security and supply chain

• Chat-pasted keys don't appear in history: app changes are auto-logged (→ Building Apps with Builder), and API keys pasted into chat were recorded as-is. Now we auto-mask known key and token patterns.

  Still, don't paste them

  We cannot catch every secret format. Put keys in Secret Management environment variables, not chat.

• Builder engine image included in signature: the builder sidecar image was missing from signature validation on offline bundles. Now bin/verify-images.sh verifies all 4 image types.

• Config file permissions no longer reset on save: added login token files and config backups to protected objects.

• Builder engine updated: OpenHands sidecar bumped to SDK v1.37.1 (no usage change).

📌 Version pinning

• All images specified with fixed versions (latest removed). Different versions won't be installed depending on reinstall timing. You can pin a specific version via .env in TAG → Installation.

🔑 Secret management and connection stability

• API keys managed via environment variables only — platform, AI, Git, and registry keys that were stored plain-text in config files now go to environment variables only. Even if the config leaks, keys are safe. Existing installations work as-is; boot logs guide you to what to migrate (values are not logged). The settings screen shows such keys as "managed via environment variable" and blocks editing.
• File permissions auto-hardened — the server forces config files and .env to owner-only (0600) on every boot.
• Config change tracking — what changed is logged in audit (secrets show a fingerprint, not the value). You can trace "when it stopped working."
• Long build disconnects resolved — when agents go silent during tool runs, proxies would close the stream causing "connection error." Fixed with server heartbeats (works regardless of proxy settings).
• Better error messages — unclear messages like "sidecar status: error" now show actual reasons and fixes (e.g., "AI provider URL unreachable → check settings").
• Reasoning model compatibility — auto-corrects gateway config conflicts that caused queries to fail in tool-using models.
• Operations documentation now includes full proxy config examples and a "symptom → cause" lookup table.

🔒 Security and stability hardening

A comprehensive audit (security, code health, frontend, operations) found and fixed all issues:

• Builder sidecar exposure blocked — the builder engine sidecar was exposed by default, accessible without auth across the entire intranet. Now bound to loopback only with memory, CPU, and log caps applied. If you run in a non-air-gapped environment, apply this update immediately.
• Preview access control — knowing just the preview URL let you read non-public project source and chat attachments. Now limited to owner, admin, and shared recipients (including real-time update WebSockets).
• App origin proxy limits — generated app data proxy accepted all methods and paths. Now restricted to a read allowlist + write requires app's own auth (UI behavior unchanged).
• Watcher cost safeguard — update API didn't validate input; bad values could halt watchers or trigger AI calls every minute.
• Recovery script provided — backups existed but recovery tooling didn't. New recovery script (with non-destructive drill mode) and owner-only backup file perms.
• Reinstall safety — re-running one-line install on an existing server would delete .env and local backups, preventing stack startup. Fixed to preserve them.
• Performance — 66% reduction in initial bundle (chart engine, lazy-loaded screens), eliminated input lag during answer streaming, stopped polling in background tabs.
• Accessibility and i18n — added Esc and focus handling to 11 modals and drawers; translated 83 error messages that leaked Korean in English mode.

🌐 Custom domain deployment

• App origin setting — Settings → Runtime tab sets public URLs for preview and deployed apps. Changes apply instantly without restart when behind a reverse proxy or HTTPS domain.
• Login cookie auto-domain — if Studio and app origin are sibling subdomains, the cookie gets the common parent domain automatically, so deployed apps can query live data and access non-public apps even after domain split. ⚠ One re-login required after domain change.
• Mixed content warning — HTTPS Studio to HTTP app origin now shows root cause and fix in preview and settings screens instead of a blank page.
• Deployment guide — documented two-origin setup, Host preservation, WebSocket, Cloudflare cautions → Domain and Reverse Proxy
• UI polish: removed horizontal scrollbar in English builder, adjusted context rail toggle position.

🏗 3D digital twin + extended stack

• 3D digital twin — generate factory 3D screens via chat. Includes a standard 3D kit with status colors, alarm pulses, value billboards, and a new "3D Digital Twin" template.
• Blueprint → floor texture — attach a blueprint image to chat, auto-save it, and it becomes the 3D scene floor.
• 12 extended stacks pre-included — process flowchart, animation, forms, drag-and-drop, virtual scroll, QR scan, maps, etc., ready to use without extra setup.
• Raised default app session container memory to 2 GB (for 3D builds).

🧩 MCP registry

• Settings MCP tab — add/remove external MCP servers, auto-discover tools (10-minute cache + manual refresh), toggle tools per chat/builder, new and conflict badges.
• Platform tools auto-reflect — when Platform adds tools, Studio chat and builder expose them automatically.

🔒 Builder build standards

• Dependency locking (on by default) — blocks arbitrary package installs and config changes in generated apps to keep the standard stack fixed. Admin allowlist lets you add exceptions.
• Layout enforcement (on by default) — verifies all screens use the standard shell; agents self-correct violations.
• App default layout — set product name, accent color, max width, and footer in Settings once and inject them into new apps.

📦 Offline reflection bundles

• Click [Bundle] in a deployed version's sidebar to download a compressed file with app images and launch script. Start it in an air-gapped site with bash run.sh one-liner.

🐳 Docker — run apps anywhere

• App image push — package a deployed version to a Docker image and push to registry with one click. Run the app in containers anywhere outside Studio.
• Runtime panel — see session container status (CPU/memory) live in the status bar at the bottom; click to view logs and restart.
• App catalog — click thumbnail to launch deployed apps in a new tab.

🗣 Chat for direct data questions

• Natural language queries — ask "show tag count by equipment on line 3" and get instant answers from live Platform data.
• Rich answers — visualized as tables (CSV copy supported), charts, and process flowchart diagrams.
• Chat room management — separate conversations, rename, search, show answer time, attach photos.
• Chat → app conversion — turn a good answer into a dashboard app draft in one click.

🛰 Watchers — natural language monitoring rules

• Write "alert me if line pressure exceeds 8bar" and you're done. Periodic runs and condition checks are AI-driven.
• Real-time screen alerts (toast) + unread badge (synced across devices) on trigger.
• Alert list screen (search, show more), Slack/Teams-compatible webhook dispatch.
• Create a watcher mid-chat with "watch this."

🏭 Semantic layer — AI that understands the factory

• Studio learns site, line, equipment, and tag structure from a snapshot.
• Agents resolve equipment names, aliases, and time expressions ("yesterday", "last week") to precise data addresses.
• ISA-95 hierarchy picker lets people explore the same structure.

📊 Operations visibility

• Statistics dashboard (admin) — usage, activity, apps, queries, deployment success/failure logs, audit search in one tab.
• Deployment has a step-by-step dialog (build → switch) and QR code for field tablet access.
• Audit log full-text search, deployment history and rollback tracing.

🤖 Coding agent maturity

• OpenHands engine — choose industry-standard open-source coding agent engine for app builds (Settings → Agent → Builder Engine). Fine edits and conversation summary compression keep long sessions stable. Chat (queries) unaffected; switch back to built-in anytime.
• Builder 3 modes — Plan (approve sketch then build) · Auto (default) · Accept (preview edits then accept/undo — chat history preserved).
• Slash commands — type / in chat input to see /plan /build /review /fix /test /loop /deploy. /loop auto-corrects until type checks pass (max 3 retries).

📱 Field mobile

• Phone-only UI — auto-switch to mobile view on phones (not tablets or desktop).
• Four bottom tabs — Home · Chat · Watchers · Apps.
• Home summary — unread alerts, active watchers, deployed apps, conversation count as cards, recent alerts at a glance.
• Real-time alerts — watcher triggers on other devices notify you instantly with toast and unread badge.
• Mobile watcher management — list, toggle on/off, run now, delete, create new watchers in natural language.
• Deployed app access — view deployed apps as live mini-preview cards and open in one tap.
• Theme and language — toggle light/dark, Korean/English.

App list and design refresh

• App list 2 tabs — [Deployed] and [Shared with me] separate your deployed apps from shared ones.
• Premium dashboard design — soft aurora background, glass cards, status LED pulse for a sharper field phone screen (industrial dark tone preserved).

🔒 Security and operations hardening

• Isolated generated app origin (separate listener from Studio) — clear trust boundary.
• Platform API keys kept server-only, acted on behalf of authenticated users only (anonymous blocked).
• Rate-limit login and AI paths, audit logging, role-based access (admin/builder/viewer).
• All critical data (conversations, watchers, alert reads, skills, deployment history) persisted in PostgreSQL — no browser storage dependency.
• Non-public deployed apps accessible to owner, admin, and shared recipients only (tighter than previous "all logged-in users"). Sharing is set via the app card's "share with users."
• Bundled air-gapped (closed network) installation and backup/recovery scripts.

---

Installation and upgrade

Situation	Document
Fresh install	Installation
Air-gapped install	Air-gapped Installation
Serve via domain and HTTPS	Domain and Reverse Proxy
Backup before upgrade	Backup and Recovery
Migrate keys to environment variables	Secret Management
Troubleshooting	Troubleshooting

New to the product? Start with Getting Started.