Roadmap: What's coming in v0.1.1

[wyuc]

Thanks to everyone who contributed to v0.1.0 — we have been reading through every issue, PR, and discussion over the past few weeks. Here is what is next.

---

1. Internationalization

We are merging community-contributed locale PRs. The i18n infrastructure migrated to i18next in #331 — if you have an open language PR, please rebase onto main (one JSON file + one registry line, no code changes needed). See the Translation Guide.

Tracking: #280 (es-MX), #215 (de-DE), #403 (ca)

Already merged: ja-JP (#365), ru-RU UI (#389)

2. Smarter Course Language

Currently users must manually select the generation language. We are replacing the manual selector with automatic language inference — the LLM infers the appropriate teaching language, content language, and terminology strategy directly from the source material, user input, and browser locale. Users only intervene when there is genuine ambiguity (e.g., English PDF + Chinese browser).

This is an architectural change that eliminates 15+ hardcoded language branches and unlocks true multi-language support without per-language code changes.

Status: Implementation ready, under final review.

Related: #344, #381, Discussion #333

3. ACCESS_CODE

A simple ACCESS_CODE environment variable for self-hosted and shared deployments. When set, users see a password overlay before the app is usable.

How it works:

• A Next.js middleware checks all incoming requests for a valid session cookie
• First-time visitors see a full-screen modal prompting for the access code
• The code is verified server-side; on success, a session cookie is set
• All subsequent requests (including API calls) are authenticated via the cookie automatically
• If ACCESS_CODE is not set, the app behaves exactly as it does today — zero impact

This is a lightweight site-level gate for protecting API keys in shared deployments. It is not a user account system.

Note for Discussion #293 participants: We appreciate the thorough RFC! We are going with a simpler middleware + cookie approach instead of the proxy.ts + HMAC architecture. The core goal is the same — prevent unauthorized access to shared deployments. The middleware approach gives us server-side API protection with minimal complexity. Contributions welcome.

Related: #287, Discussion #293

4. Classroom Export and Import (ZIP)

Full classroom export as a .zip — course structure (outlines, scenes, actions, agents) as JSON, plus generated media (TTS audio, images). Import on another device or share with others — a lightweight sharing mechanism without server-side storage.

Status: Design phase.

Related: #321, #291, #237, #290, #219, #234, #225

5. Local Deployment

Improving the self-hosted experience for users running local LLMs and services.

Done:

• ALLOW_LOCAL_NETWORKS env var: allows SSRF guard to pass through local network requests (PR fix(ssrf): add ALLOW_LOCAL_NETWORKS env var for self-hosted deployments #366) ✅
• SSRF guard DNS rebinding fix (PR fix: resolve DNS before SSRF validation to prevent rebinding bypass #386) ✅
• Ollama local LLM support with keyless bypass (feat: Ollama local LLM support #94, fix: use resolved API key in chat route instead of client-sent key #221) ✅

Planned:

• OpenAI-compatible custom TTS/ASR endpoints ([Feature]: ASR和TTS支持openAI 兼容协议 #292)
• Local deployment documentation improvements ([Feature]: 对使用私有模型部署的，需跳过安全机制可在readme中添加简要说明 #311)

Related: #357, #310, #311, #292, #271, PR #366, PR #386

---

What is NOT in this release

To keep scope focused, these are explicitly deferred:

• User accounts / role-based access
• MySQL / server-side database
• Video export
• SCORM export (PR Feat/export scorm12 #370 under review, may land separately)

---

If you are working on something related, please comment below so we can coordinate and avoid duplicate effort.

[wyuc]

v0.1.1 is now released! https://github.com/THU-MAIC/OpenMAIC/releases/tag/v0.1.1

All planned items have shipped:

• ✅ Smarter Course Language (inline inference, feat: inline language inference for outline and PBL generation #412)
• ✅ ACCESS_CODE (feat: ACCESS_CODE site-level authentication (#407) #411)
• ✅ Classroom Export/Import ZIP (feat: classroom export and import (ZIP) (#408) #418)
• ✅ Local Deployment improvements (Ollama feat: Ollama local LLM support #94, custom TTS/ASR feat(audio): add custom OpenAI-compatible TTS/ASR provider support (#357) #409, ALLOW_LOCAL_NETWORKS fix(ssrf): add ALLOW_LOCAL_NETWORKS env var for self-hosted deployments #366, SSRF fix fix: resolve DNS before SSRF validation to prevent rebinding bypass #386)
• ✅ i18n: ja-JP (feat(i18n): add Japanese (ja-JP) locale #365), ru-RU (feat: add Russian language (ru-RU) support for interface and AI agents #261)

We ran a full round of manual testing on the release candidate before tagging. Community i18n PRs (es-MX, de-DE, ca, zh-TW) are in review and will land in a patch release.

Thanks to all contributors!