A security and stability release. If you run OpenMAIC 1.0.0, upgrade — and read the two configuration notes below before you do, because this release tightens two defaults.

Security

Four advisories are published with this release. Thank you to the reporters, who found and disclosed all four privately.

• Classroom persistence accepted a stage id that escaped the classrooms directory on write. The read path already validated it; the write path did not. GHSA-p2wh-m28m-c5xw — reported by @skeletonsec
• Stored slide HTML was rendered without sanitization. Content is now restricted to the formatting vocabulary the renderer produces, sanitized once at the persistence boundary rather than at each render sink. KaTeX snapshots keep their own policy, so formulas are unaffected. GHSA-7rhf-2798-mvcj — reported by @skeletonsec
• The outbound URL guard ran only in production builds. It now runs everywhere, and a repository-scanning test fails if a gated call site reappears. GHSA-9m7h-vh2h-rc3w — reported by @uziii2208
• Redirects on provider requests were followed without re-validation. Every hop is now re-checked, and credential headers are dropped on a cross-origin hop. GHSA-725p-44hx-v52c — reported by @skeletonsec

Also in this release: dependency bumps for disclosed advisories, bounded skill-zip inflation, a bounded import_pptx parse, and a development persistence authenticator that now refuses to serve under NODE_ENV=production.

Before you upgrade

• Node 22.19 or newer is now required (was 20.9).
• Pointing at a local model server? A client-supplied provider base URL on a loopback or private address — a local Ollama or Lemonade endpoint entered in Settings — is now rejected outside production builds too. Set ALLOW_LOCAL_NETWORKS=true to keep using it. Production deployments already behaved this way; development builds did not.
• Running the development persistence authenticator in production? It now fails closed. Set PERSISTENCE_ALLOW_INSECURE_DEV_AUTH=true if your deployment is on a trusted network, and plan to replace it — it provides no user isolation.
• Calling POST /api/classroom directly? It now rejects scenes that do not satisfy the slide DSL, and stage ids outside [A-Za-z0-9_-].

Also in 1.0.1

A fact-check skill, asynchronous generate_video, interactive-widget hints for generate_scene, PPT element references in Pro chat, an Exa web-search provider, a POST /preview endpoint and machine-readable admission state on the render service, double-click text insertion on the canvas, and deepseek-v4-flash-vision-exp in the DeepSeek catalog — plus faster classroom loading and around two dozen fixes across the agent runtime, generation, providers, media, and the importer.

See the full CHANGELOG for 1.0.1.

One prompt in, a whole course out — and now you can steer. Released August 27, 2026, OpenMAIC v1.0.0 adds a Pro workbench alongside the classic one-click generator: chat with an agent that plans your curriculum, builds and revises every page, and works straight from your materials.

Highlights

• 🤖 Agent workbench (Pro mode) — a chat-first workspace entered from the home page: the collapsible shell, the agent chat surface, folders, a materials pane, and entry points that preserve classic mode-transition semantics
• 💾 Durable agent runtime — server-backed sessions that survive restarts: cancel, resume, and steer anytime, with replayable transcript event streams and a background session runner
• 🧰 Course tools + skills — validated, provider-neutral tools for planning, building, and editing courses (slides, quizzes, interactives, PBL, images, video, voices, folders, materials, .pptx import, web search), 20 built-in skills, and per-owner skill management in Settings
• 📎 Session materials — upload documents, audio, and video and let the agent build from them; extract, search, and reuse material media, or pull from web search
• 🔌 Neutral by design — provider-neutral server capabilities (media model resolution, capability toggles, startup validation, fail-loud routing) and a pluggable persistence stack (PostgreSQL agent sessions, owner materials, quotas, migrations)

Plus editor and classroom improvements, whiteboard fixes, Qwen TTS voice cloning, narration-script export, document lexical retrieval, German localization, and more.

See the full CHANGELOG for 1.0.0.

[0.3.2] - 2026-08-14

Features

• Video export hardening — fidelity polish for spotlight geometry, video clips, formulas, and subtitles #952, deterministic Quiz/PBL cover cards #995, self-contained static interactive HTML capture #1086, deterministic Quiz question-list scrolling #1102, a stable RenderExecutor seam #1104, explicit CPU resource profiles #1105, and effective parallel capture in the render service #1042
• Server-backed persistence completion — learner-data cutover: quiz + playback onto RuntimeStore #955; document-persistence cutover: stage/scene/outline onto DocumentStore #965; server-backed documents over an HTTP contract with a Postgres backend and one reference server #979; a one-command server-backed stack (compose profile + embedded API + docs) #982; dirty-set incremental saves with operation-level flush #983; settings/user-profile persistence through KVStore #1001; the KV HTTP contract and clients promoted to main #1020; learner whiteboard RuntimeStore foundation #1075
• Asset registry — allocated asset ids over the content-addressed blob layer #1024, unified media asset reference types #1038, generated assets allocated through the registry #1039, a server asset registry over a pluggable byte layer #1077, and the asset backend wired into the app #1089
• @openmaic/generation package — scaffolding with pipeline types and packaged prompt assets #1063; outline generation #1065 and scene generation + PBL single-call planning #1087 moved into the package; the app consumes the package everywhere and lib/generation is deleted #1090
• SDK contract ownership — interactive and PBL content kinds promoted into @openmaic/dsl #1070, app consumes the contract's interactive/widget types #1073 and PBL project types #1079, and the renderer decouples its editing UI from the app #1072
• Course folder grouping #1005 (by @CXuPercy)
• Local FunASR ASR provider #1044
• Claude (claude search) as a web-search provider #393 (by @joseph-mpo-yeti)
• Per-stage routing for generate-classroom instead of one model #1048; evidence-aware Pi Director context runtime #971; optional playback canvas renderer #958
• Amazon Bedrock LLM provider #538 (by @littlebullGit), Atlas Cloud LLM provider #948 (by @binyangzhu000-sudo), latest Claude/Gemini/Kimi/Grok models #993, and Grok 4.6 #1113
• French (fr-FR) locale #1068 (by @momo2lajoie), Spanish (Mexico) locale #942 (by @davidmedel), Vietnamese (vi-VN) locale #1025 (by @niitbeo), and 432 reviewed zh-TW translations #526 (by @alvinets)

Bug Fixes

• Persistence: stop corrupting binary response bodies in the route adapter #1088; omit undefined object fields at persistence boundaries #992; bind default fetch to globalThis in both HTTP store clients #984
• Chat: harden runtime sync, legacy migration, and record validation #1050; add opt-in streaming chat compatibility #990
• Access code: refetch server providers after the code is accepted #1081
• Render service: make parallel capture effective #1042; keep the entrypoint LF so the image starts on Windows #1027
• i18n: load every Inter subset so non-Latin text keeps the UI font #1026; translate ASR provider names in the generation toolbar #1028; localize Pro mode right rail labels #1023
• Render whiteboard math via KaTeX instead of raw LaTeX text #938; keep arrowheads visible when toggling thumbnails #1045
• AI: omit zero SiliconFlow thinking budget #1035; harden shared Pi transport contracts #1108
• Importer: handle custom shapes without paths #1015
• Vocational mode: keep the toggle thumb within the track #1032
• Editor packages: add npm provenance metadata #1098
• Release: dedupe the published dsl and close two release-path blind spots #1019; hand published versions to the marker job #1076

Other Changes

• PBL: retire the v1 write path and dead UI, converge on v2 #1060; split the planner core from the loop with an injectable LLM call path #1069; pin single-call prompt goldens #1071; route runtime agents through the shared LLM entry point #1006
• Document transform pipeline foundation #920; choreography overlays driven from descriptors #947; single-source the generated agent roster on the stage document #994
• Publish validated package tarballs #1040; publish storage and enforce version bumps #998; publish the OpenMAIC skill to ClawHub #1056
• Docs refresh and synchronization #996; align the environment variable template #1107; stabilize the Hyperframes lint command #1097

Features

• Video export (MP4) — Export a lesson as a rendered video: a VideoTimeline IR with a pure compile pipeline #913, an L1 Hyperframes emitter with in-browser frame collection and ZIP export #931, and a service-backed MP4 render with in-app one-click export #937 (by @cosarah) — built on a shared orchestration spec in lib/choreography #890 (by @cosarah) and persisted TTS audio durations #862 (by @cosarah)
• Server-backed runtime storage — A pluggable storage seam for classroom runtime state: @openmaic/storage KV + asset primitives #858, a normalized DocumentStore #860, RuntimeStore sessions with append-only records #880, a DSL runtime envelope #870, device-anonymous learner identity #885, a runtime-event outbox with dual-write #893, cutovers for PBL learner state #902 #922 and chat sessions #926, and an HTTP backend contract with a Postgres backend and reference server #946
• Editor: direct manipulation — Select and drag slide elements #859, 8-point resize + rotate handles #881, marquee multi-select with multi-element drag #888, and a draggable insert toolbar #912, scaffolded as the @openmaic/renderer v2 editing surface behind a machine-enforced import boundary #853 #855
• Edit with AI upgrades — Natural-language element edits through a typed EditIntent pipeline #896, validated JSON Patch element edits #927, and multi-session conversation history for the AI editor #801
• DSL self-ownership — @openmaic/dsl now owns the Action playback verbs #787, ships JSON Schema artifacts with pure validators #817, activates the migration registry and runner #825, and owns element-level normalization and defaults wired into the generator #832 and the importer output boundary #845
• Document Parsing expansion — Multi-format course-material upload #741 and document bundles #844 (by @jackefn), audio/video media extraction with an AliDocMind provider #887 (by @yanpgwang), and a renamed Document Parsing surface with visible supported formats and extended MinerU support (by @yanpgwang)
• Add Azure OpenAI as an LLM provider #916 (by @hydraxman), SearXNG as a web-search provider #842 (by @PineSongCN), ComfyUI as an image provider #850 (by @PhillLittlewood), the GPT-5.6 model family #907, and an updated Doubao Seed model catalog #827
• Add one-click token-plan setup and a deployment usage dashboard #784 (by @yanpgwang)
• Add action-level playback navigation #843 (by @danishsshaikh)
• Redesign the narration timeline (action picker + inline insert) and enable it for interactive/PBL scenes #834
• Add in-editor authoring of classroom agents with a Stage-level roster #816
• Parallelize within-scene TTS generation #696 (by @ly-wang19)
• Feed the real HTML element inventory into interactive-action prompts #829 and add a postMessage listener contract to diagram/game/code widgets #872 (by @yanpgwang)
• Add an experimental Pi classroom runtime behind a flag #914

Bug Fixes

• Security: disable redirects in media connectivity probes #930 and harden provider redirect handling with ISATAP address detection #928 against SSRF (by @YizukiAme)
• Generation: strip reasoning blocks before JSON parsing #750 (by @yipwingtim), localize scene-generation errors #894 (by @wsun1), tolerate malformed generated slide data (by @yipwingtim), and honor outline node constraints in diagrams #911
• Editor: keep emptied or zero-action scenes playable, bind the outline by stable id, and surface incomplete content #814; show per-line loading while the batch "regenerate all TTS" runs #830
• Export: fix the unresponsive resource pack for interactive-only decks #933 (by @2046731121CC), compute SVG path bounding boxes via getBounds() #656, keep sibling attributes when style is empty #683, and convert PPTX shadow offsets from px to pt #679 (by @ly-wang19)
• Quiz: render formulas in quiz text #833 (by @dpersek); stop leaking questions on entry and pass results to the chat agent #823 (by @yanpgwang)
• Storage: store image files as array buffers #923 (by @YizukiAme) and accept image storage IDs containing underscores #918
• Chat: preserve message line breaks #908, and cap the roundtable non-presentation input height #917 (by @YizukiAme)
• TTS: respect string context when splitting the Doubao stream #677; web search: match Brave's current result-title markup #688 (by @ly-wang19)
• Stage: centralize the deck completion predicate #883 (by @dpersek)
• AI: close PROVIDERS/THINKING_CAPABILITIES metadata drift with a guard #809 (by @mvanhorn)
• Home: clarify the Interactive Mode selected state #901; lecture notes: render interactive-webpage widget actions #810
• Docker: fix the postinstall script failure in Docker builds #835 (by @Lee-Flier)
• mathml2omml: call includes() instead of indexing it #681 (by @ly-wang19)

Other Changes

• Performance: dedupe editor alignment snap-lines in O(n) #692, diff code lines in O(n) via a prev-line map #706, and index assigned images by id in fixElementDefaults #701 (by @ly-wang19)
• Tests: cover splitLongSpeechText / splitLongSpeechActions #694 (by @ly-wang19); settle dynamic imports #899 and drain debounced saves #897 before store-test teardown
• Media providers: share the submit-poll task driver #900 and the auth probe across matching adapters #903, and remove the dead legacy pipeline chain #905 (by @YizukiAme)
• Packages: add repository metadata #813 and set @openmaic/* package versions to 0.0.2 #812 (by @xuyuanwei678)
• Docs: document the dev-server OOM workaround for large generations #808 (by @mvanhorn)
• Tighten GitHub issue intake #921

License

• Relicense the project from AGPL-3.0 to MIT

Breaking Changes

• Remove allow-same-origin from the interactive srcDoc iframe sandbox for tighter isolation; interactive widgets that relied on same-origin access may need updates #726 (by @sebastiondev)
• Restructure the slide DSL and renderer into standalone @openmaic/* packages consumed by the app; the inline DSL shim is removed #707 #738

Features

• Project-Based Learning (PBL) v2 — Add the PBL v2 core schema and generation path #795 (by @cosarah), runtime APIs with classroom UI #799 (by @cosarah), in-timeline discussion authoring #798, auto-retry for transient scene-generation failures #788 (by @YizukiAme), and a planner eval harness #803 #805 (by @cosarah)
• Edit with AI — Add a Pro-mode editor agent that edits generated slides from a chat prompt #777
• @openmaic/* SDK on npm — Publish the DSL, renderer, and importer SDK family to npm #778 #780, introduce the maic-import/maic-renderer workspace packages #668 (by @xuyuanwei678), and promote the Stage/Scene lesson skeleton into @maic/dsl #740
• Add optional per-stage LLM model routing #745
• Add GLM-5.2 and Kimi K2.7 Code #774, and Qwen3.7 Plus and Qwen3.7 Max #753, to the model registry
• Add a vocational-learning task engine with procedural skill widgets #685 (by @jackefn)
• Add Korean (ko-KR) translation #733 (by @moduvoice)
• Improve TTS with per-agent auto-voice quality and stable timbre registration #670, and unify the provider-enablement model with browser-native TTS off by default #665
• Add opt-in parallel scene-content generation #660 (by @ly-wang19)
• Add a document extractor provider foundation #704 (by @jackefn)
• Infer concise course titles from outlines for more readable course names #756
• Refactor widget actions into the unified scene action pipeline #796

Bug Fixes

• Importer: port PPTX shape-restoration hotfixes #789 (by @xuyuanwei678), fix hanging-indent bullet rendering #727 (by @xuyuanwei678), and guard SVG export against arc-first paths #638 (by @ly-wang19)
• Generation: make outline type changes take effect so interactive/PBL outlines are no longer downgraded to slides #772, stop regenerating deleted slides on finished decks #769, show full key-point text in the outline editor #782, and linearize outline streaming and interactive post-processing for better performance #732
• Agent: respond to the user's turn before lecturing #699, and constrain action narration to a single teacher voice #671
• Editor: stop dumping the raw tool-failure blob in AI edit tool cards #785, persist AgentBar voice and mode selections across reloads #723, and keep the edit runtime alive across read-only scenes #802 (by @cosarah)
• Audio: gate the speech button on ASR availability #711, revoke blob URLs when playback is rejected #652 (by @ly-wang19), and surface TTS provider rate limits as HTTP 429 #644 (by @ly-wang19)
• Renderer: make the code entrance animation play line by line #724 (by @tongshu2023)
• Security: point the SSRF local-network rejection at the ALLOW_LOCAL_NETWORKS escape hatch #667 (by @mvanhorn)
• Networking: bypass the proxy for loopback hosts and honor NO_PROXY #718 (by @tongshu2023)
• Fix overlay layout shift on the home and classroom pages #690 (by @cosarah)

Other Changes

• Drop the dead ThumbnailSlide path and fix @maic/dsl Node ESM resolution #736
• Docs: correct the stale i18n location and supported-language list #640 (by @ly-wang19)

Full Changelog: v0.2.2...v0.3.0

Features

• MAIC Editor (v0) — slide editing surface — A new Pro Mode toggle turns any generated slide into an editable canvas: select and edit text, insert text boxes and images, navigate and reorder slides from a thumbnail rail, with history-aware undo/redo. This is the first surface of the broader MAIC Editor framework (gated behind NEXT_PUBLIC_MAIC_EDITOR_ENABLED) #615
• Editable outline before generation — The streaming course outline now morphs into an inline editor: review, edit, reorder, and add or delete scenes and bullet points, then confirm to generate the full course — so you catch structure problems before spending a full generation #558
• Offline-ready classroom export — Exported teaching resource packs and classroom ZIPs now inline external assets so interactive pages open fully offline, even when copied to another machine #613
• Add Claude Opus 4.8 and MiniMax M3 to the default model registry #635
• Add Gemini 3.5 Flash #584
• Add Xiaomi MiMo Token Plan support #578 (by @xuruiray)
• Add web search providers: Brave and Baidu #42 (by @YizukiAme), Bocha #524, and MiniMax #634
• Add Azure STT (Fast Transcription) as a speech-to-text provider #175 (by @ismailariyan)
• Add HappyHorse video adapter #509 (by @xuruiray) and Lemonade as an LLM provider #508
• Add OpenAI image generation environment-variable fallback #510 (by @xuruiray)
• Add generated-video manifest references so produced videos survive export/import #540
• Add Traditional Chinese (zh-TW) #517 (by @alvinets) and Brazilian Portuguese (pt-BR) #602 (by @hemanz) interface languages

Bug Fixes

• Server-configured providers are now admin-managed — providers set via server environment can no longer be overridden by client settings, preventing base-URL/key tampering on shared deployments #624; fixes server API-key fallback when the client echoes the provider base URL #533 (by @LooThao); auto-selects the server LLM model #577 (by @xuruiray); and enforces a "usable provider ⇒ concrete model" invariant #581
• Keep interactive scenes alive across remounts with an iframe keep-alive pool, so interactive content no longer reloads when navigating #629
• Restore the orchestration director's ability to answer the user's question and stop runaway turns (removed maxTurns) #599; restore agent attribution in the director summary #554 (by @ashutoshrana)
• Skip shapes with malformed SVG paths instead of aborting the whole PPTX export #505; prevent memory leaks and silent export failures #552 (by @arnow117)
• Add defensive checks in ChartElement to prevent crashes on malformed chart data #588 (by @tongshu2023)
• Let whiteboard code elements capture internal scroll/drag instead of the canvas #544 (by @cosarah)
• Preserve discussion triggers when importing classroom ZIPs #557 (by @cosarah)
• Fix generated video thumbnails #546
• Gate media snippets in the interactive-outlines prompt template #628
• Hide the unsupported MiniMax Hailuo fast text-to-video model #632; remove weak Lemonade recommended models #567 (by @cosarah)
• Fix Haiku 4.5 thinking controls #501
• Use an ESM import for TypeScript in the pptxgenjs rollup config #616
• Align zh-TW provider names with the rest of the locale set

Other Changes

• Add a Fumadocs-based documentation site #622
• Add a VoxCPM2 setup guide and tighten the README section #500 #502
• Fix the commercial licensing contact email #604 (by @DHQ1204)

Full Changelog: v0.2.1...v0.2.2

Features

• VoxCPM2 TTS provider with voice cloning — OpenMAIC adapts to user-managed VoxCPM backends (vLLM-Omni, Nano-VLLM, official Python API). Clone any voice from a reference audio clip you upload or record in the browser, or let Auto Voice generate a fitting voice from each agent's persona at synthesis time. Voice profiles are stored locally to keep the serverless setup model. The Agent Bar exposes a searchable, previewable voice picker that draws from the global VoxCPM voice pool #496
• Per-model thinking configuration — First-class metadata for each model's reasoning capability (effort levels, on/off toggle, adjustable budget, or fixed thinking) flows through chat and all generation paths and is mapped to the right provider-specific request fields (Anthropic thinking, OpenAI reasoning, etc.). The model selector becomes a unified provider/model/thinking popover with compact search and a much smaller toolbar footprint #494
• End-of-course completion page with persistent quiz state — When the outline is fully materialized, students see a course-complete view with quiz score card, scene-type stat cards, and a (motion-respecting) confetti celebration. Quiz answers persist on submit and grading results persist on completion, so navigating away and back restores the reviewing state with AI feedback intact instead of resetting #484
• Add latest released models including GPT-5.5, DeepSeek-V4 (-pro, -flash), Xiaomi MiMo (mimo-v2.5-pro, mimo-v2.5), Tencent Hy3, and OpenRouter as a multi-provider gateway #481 #487
• Add OpenAI image generation (GPT-Image-2) as a media provider #481
• Refresh built-in model registries across Anthropic, DeepSeek, Kimi, Qwen, MiniMax, Grok, OpenAI, GLM, SiliconFlow, and Ollama; persisted local settings now rehydrate in registry order so newly curated lists appear consistent without clearing state #481
• Add inline search for recent classrooms on the home page with deferred filtering by name and description, keyboard-driven open/clear/collapse #476
• Add Deep-Interactive badge on classroom thumbnails for sessions generated with Interactive Mode #478
• Replace always-included media instruction blocks in generation prompts with conditional snippet includes gated on imageEnabled / videoEnabled — disabled capabilities are removed from the prompt entirely instead of relying on negative-override directives the model often ignored #490 (by @YizukiAme)

Bug Fixes

• Fix language drift between outline and scene generation by unifying the languageDirective across the pipeline so the same target language flows from outline planning through every per-scene call #474

Other Changes

• Refactor whiteboard role prompts to file-based markdown templates and add a geometry-conflict detector (overlap, line-through-bbox, canvas clipping) that surfaces problems back to the model. Eval (flash, repeat 3, gemini-3.1-pro scorer) shows overall quality 5.4 → 6.1 and overlap 6.3 → 8.1 from prompt + detector alone #485
• Migrate orchestration prompt builders (buildStructuredPrompt, buildDirectorPrompt, buildPBLSystemPrompt) from inline TS template literals to file-based markdown templates under lib/prompts/, sharing the loader infrastructure with the generation pipeline. prompt-builder.ts 890 → 314 lines; future content tweaks land as markdown edits #459

Full Changelog: v0.2.0...v0.2.1

[0.2.0] - 2026-04-20

Features

• Deep Interactive Mode — Generate hands-on interactive scenes (3D visualization, simulation, game, mind map/diagram, online programming) with an AI teacher who operates the UI to guide students. Fully responsive across desktop, tablet, and mobile #461
• Add code element support on the whiteboard — AI agents can write, display, and reference runnable code during lessons #385 (by @cosarah)
• Add Arabic (ar-SA) interface language #431 (by @YizukiAme)
• Add MinerU Cloud API as a PDF parsing provider, with a dedicated settings UI #438
• Add latest OpenAI models to the default config #416 (by @donghch)
• Add GLM-5.1 and GLM-5V-Turbo to GLM preset models #437
• Add international base URL shortcuts for GLM, Kimi, and MiniMax in provider settings #449
• Add anti-framing security headers (X-Frame-Options + CSP frame-ancestors) with an optional ALLOWED_FRAME_ANCESTORS override #430 (by @YizukiAme)
• Add i18n key alignment check to CI so missing or extra translation keys fail the build #447 (by @KanameMadoka520)
• Add whiteboard layout quality eval harness and unify it with the outline-language harness #425 #453

Bug Fixes

• Fix classroom ZIP export to use the latest classroom name from IndexedDB #435
• Fix spotlight cutout for text elements and add element-content variant for image/video #457

Other Changes

• Renew the README with Deep Interactive Mode showcase and visual assets #463 (by @Shirokumaaaa)
• Update Discord invite links across README, CONTRIBUTING, and issue templates

[0.1.1] - 2026-04-14

Features

• Add inline language inference for outline and PBL generation, replacing manual language selector #412 (by @cosarah)
• Add ACCESS_CODE site-level authentication for shared deployments #411
• Add classroom export and import as ZIP #418
• Add custom OpenAI-compatible TTS/ASR provider support #409
• Add Ollama as built-in provider with keyless activation #94 (by @f1rep0wr)
• Add Japanese (ja-JP) locale #365 (by @YizukiAme)
• Add Russian (ru-RU) locale #261 (by @maximvalerevich)
• Migrate i18n infrastructure to i18next framework #331 (by @cosarah)
• Add MiniMax provider support #182 (by @Hi-Jiajun)
• Add Doubao TTS 2.0 (Volcengine) provider #283
• Add configurable model selection for TTS and ASR #108 (by @ShaojieLiu)
• Add context-aware Tavily web search when PDF is uploaded #258 (by @nkmohit)
• Add course rename #58 (by @YizukiAme)
• Add end-to-end generation happy path test #405

Bug Fixes

• Fix DNS rebinding bypass in SSRF validation #386 (by @YizukiAme)
• Add ALLOW_LOCAL_NETWORKS env var for self-hosted deployments #366
• Fix custom provider baseUrl not persisting on creation #417 (by @YizukiAme)
• Hide Ollama from model selector when not configured #420 (by @cosarah)
• Fix agent configs not persisting in server-generated classrooms #336 (by @YizukiAme)
• Fix action filtering logic and add safety improvements #163 (by @zky001)
• Fix modifier-key combos triggering single-key shortcuts #359 (by @YizukiAme)
• Fix agent mode selection for conditionally set generatedAgentConfigs #373 (by @YizukiAme)
• Unify TTS model selection to per-provider and fix ElevenLabs model_id #326
• Allow model-level test connection without client-side API key #309 (by @cosarah)
• Add structured request context to all API error logs #337 (by @YizukiAme)
• Fix breathing bar background color in roundtable #307

Other Changes

• Add missing Ollama and Doubao provider names for ru-RU #389 (by @cosarah)
• Update Ollama logo to official version #400 (by @cosarah)
• Remove deprecated Gemini 3 Pro Preview model #142 (by @Orinameh)
• Update expired Discord invite link
• Create SECURITY.md #281 (by @fai1424)

New Contributors

@f1rep0wr, @maximvalerevich, @Hi-Jiajun, @cosarah, @zky001, @Orinameh, @fai1424

The first tagged release of OpenMAIC, including all improvements since the initial open-source launch.

Highlights

• Discussion TTS — Voice playback during discussion phase with per-agent voice assignment, supporting all TTS providers including browser-native #211
• Immersive Mode — Full-screen view with speech bubbles, auto-hide controls, and keyboard navigation #195 (by @YizukiAme)
• Discussion buffer-level pause — Freeze text reveal without aborting the AI stream #129 (by @YizukiAme)
• Keyboard shortcuts — Comprehensive roundtable controls: T/V/Esc/Space/M/S/C #256 (by @YizukiAme)
• Whiteboard enhancements — Pan, zoom, auto-fit #31, history and auto-save #40 (by @YizukiAme)
• New providers — ElevenLabs TTS #134 (by @nkmohit), Grok/xAI for LLM, image, and video #113 (by @KanameMadoka520)
• Server-side generation — Media and TTS generation on the server #75 (by @cosarah)
• 1.25x playback speed #131 (by @YizukiAme)
• OpenClaw integration — Generate classrooms from Feishu, Slack, Telegram, and 20+ messaging apps #4 (by @cosarah)
• Vercel one-click deploy #2 (by @cosarah)

Security

• Fix SSRF and credential forwarding via client-supplied baseUrl #30 (by @Wing900)
• Use resolved API key in chat route instead of client-sent key #221

Testing

• Add Vitest unit testing infrastructure #144
• Add Playwright e2e testing framework #229

New Contributors

@YizukiAme, @nkmohit, @KanameMadoka520, @Wing900, @Bortlesboat, @JokerQianwei, @humingfeng, @tsinglua, @mehulmpt, @ShaojieLiu, @Rowtion