Skip to content

Goose

v1.39.0 Breaking

This release includes breaking changes for platform teams planning a safe upgrade.

✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

acp ai ai-agents mcp

Affected surfaces

auth

Summary

AI summary

Broad release touches ✨ Features, 🐛 Bug Fixes, 🔧 Improvements, and 📚 Documentation.

Full changelog

✨ Features

  • ACP method for managing recipes and UI changes #9951
  • Use ACP to manage global config and session extensions #9948
  • Recipe handling in new_session #9935
  • /status slash command in CLI #9845
  • ACP new session on desktop (non-recipe sessions) #9914
  • Typed request/response for add, get session extensions in ACP #9890
  • Option to disable automatic update downloads #9872
  • Change cwd using ACP and refactor extension in bottom menubar #9887
  • Track cache tokens for accurate cost reporting #9752
  • Load session using ACP #9875
  • View model interactions #9806
  • Support OpenAI GPT models via AWS Bedrock mantle endpoint #9707
  • Peek mode for async background tasks in summon #9519
  • Korean localization for desktop app #9856
  • Chat reply UI with ACP #9857
  • Durable ACP chat session state for desktop UI #9852
  • ACP for desktop chat prompt (feature toggle off) #9802
  • MCP extensions support in open plugins #9471
  • Initial prompt with goose://new-session deep link #9427
  • Configurable Open Model Gym output dir #9789
  • Spanish (es) locale support #9833
  • EmpirioLabs as a declarative OpenAI-compatible provider #9771
  • MLX models support for local inference provider #9154
  • Elicitation method for ACP with improvements #9797
  • View JSON #9678
  • Load global hints from ~/.agents/AGENTS.md #9736
  • Configurable per-agent timeout (GYM_AGENT_TIMEOUT) #9791
  • Azure Entra ID bearer token auth via AZURE_OPENAI_AD_TOKEN #9716
  • _meta.conversationBefore for ACP forking session #9821
  • Quarterly option for scheduler #9076
  • Together AI declarative provider #9545
  • Image read tool #9607
  • Context parameter for summon delegate tasks #9518
  • Structured metadata for summon task load results #9521
  • Working_dir override for summon delegate tasks #9520
  • OrcaRouter as a declarative OpenAI-compatible provider #9515
  • Elicitation decline and cancel actions propagation #9437
  • ACP opt-in last message snippets #9798
  • Japanese locale support #9768
  • Unified OTLP logging schema for cross-tool detection #9713
  • Canonical thinking modes #9743
  • Hindi Desktop locale #9733
  • Custom ACP method to get session info #9729
  • GOOSE_SERVER__SECRET_KEY support at goose serve ACP endpoint #9726
  • Surface Anthropic stream refusals as visible errors #9724
  • ACP search session in Desktop #9717
  • Steering messages with ACP #9560
  • ACP list session with keyword and type filter #9695
  • ACP thinking effort config option #9711
  • Prompt injection mitigation enabled by default for internal users #9612
  • ACP list sessions and manage sessions in Desktop #9687
  • ACP methods for config extensions #9581
  • Custom notifications only when ACP client specifies capability #9596
  • Minimal uniffi setup for cross-language SDK #9593
  • Hugging Face OAuth support with auth tab in settings #9552
  • Import sessions #9474
  • xAI SuperGrok OAuth subscription provider #9420
  • Replay ACP images on session load #9496
  • Raw provider supported models over ACP #9475
  • ACP session system prompt setter #9478
  • Scholar Sidekick MCP extension #9433
  • tui feature flag to gate the tui command #9428
  • CLI to list skills with token counts #9326
  • Perplexity as a declarative OpenAI-compatible provider #9324
  • Alibaba (Qwen via DashScope) declarative provider #9443
  • Configurable tool output size limit via GOOSE_MAX_TOOL_RESPONSE_SIZE #9256
  • /model slash command to CLI for session model switching #8747
  • Databricks AI Gateway provider #9274
  • Russian language support #9406
  • Turkish desktop locale #9392
  • Language selection feature #9405
  • Handle resume deep links #9298

🐛 Bug Fixes

  • Publish mac updater metadata #9945
  • Activate hermit on macOS so STDIO extensions resolve node #9482
  • Accept JSON-encoded string for autovisualiser data parameter #9838
  • Send User-Agent on URL image fetches in developer/read_image #9927
  • Allow unlisted models in search #9933
  • Do not pass temperature to ChatGPT Codex provider #9931
  • Sanitize extension environment maps #9884
  • Desktop updater to target aaif-goose releases #9868
  • Refresh provider when session working directory changes #9883
  • Use refreshed gcloud token after reauth (retry Vertex AI on 401/403) #9849
  • Start a turn when /goal or /grind is set #9801
  • Remove hard-coded React alias that breaks dev render #9842
  • Pass thinking config to Bedrock Anthropic models #9794
  • Check for responses API support in Databricks #9347
  • Use media marker parts for vision prompts in local-inference #9452
  • Keep extensions icon visible after switching sessions #9787
  • Skip non-recipe project config files in summon #9808
  • Dedupe duplicate tool-call ids within a turn #9792
  • Resolve bundled extensions from discovery #9759
  • Include agentInfo in ACP initialize response #9765
  • Custom OpenAI provider dropping port when URL scheme is omitted #9730
  • Preserve Windows backslash paths in custom extension command #9741
  • ACP cancel race condition #9804
  • Removed window goosed when closing window #9818
  • Inherit login-shell PATH in spawned subagents #9737
  • Accept string values for GOOSE_CONTEXT_LIMIT #9738
  • Clear rejected OAuth credentials after refresh #9694
  • Keep extended thinking within the Anthropic output cap #9814
  • Disable RPM build-id links #9671
  • Preserve custom API path in OpenAI base_url derivation #9649
  • Repair PATH for plugin hook commands #9615
  • Restore Cmd/Ctrl+T new chat shortcut #9614
  • Lead with extension description, shorten HTTP/SSE transport label #9653
  • Mention menu icon to open the sidebar #9643
  • Dedupe React to prevent multiple instances in renderer #9631
  • Add hermit cleanup to uvx and jbang scripts #9616
  • Use blocking OTLP HTTP exporter #9599
  • Fall back to default provider when resuming session with unavailable provider #9547
  • Provide Tokio runtime for OTLP HTTP exporter batch thread #9541
  • Read meta.n_ctx from /v1/models to fix context limit for local OpenAI servers #9530
  • Align session history scrollbar with window edge #9601
  • Refresh session name in sidebar after rename #9543
  • Show resolved skill supporting file paths #9584
  • Implement real streaming via ConverseStream API for Bedrock #9579
  • Record OpenAI-native cached_tokens in usage metering #9829
  • Add option for overriding API URL for Moonshot provider #9819
  • Detect image paths with spaces #9387
  • Restore new chat shortcut navigation #9528
  • Evict stale completed tasks to prevent unbounded memory growth in summon #9514
  • OAuth timeout instead of hanging in WSL #9536
  • Warn on unmatched extension names in summon delegate #9513
  • Deleting a recently created session then creating new session shows deleted session's content #9351
  • Close modal when canceling recipe parameter form #9195
  • Ensure tool request timestamp precedes tool response timestamp #9462
  • Correctly map ollama_cloud to canonical provider and update max tokens #9639
  • Incorrect max tokens values for groq provider #9790
  • Mark stream decode errors retryable #9723
  • Classify Bedrock ValidationException as ExecutionError #9735
  • Page through all Databricks AI Gateway v2 endpoints when listing models #9753
  • Preserve unparseable extension entries during config refresh #9439
  • Goose-sdk release compat check with new schema #9697
  • Compatibility of config extension ACP call in TUI #9683

🔧 Improvements

  • Move OpenAI provider into goose-providers #9880
  • Move ApiClient to goose-providers, lifting out TlsConfig #9869
  • Refactor request logger out of providers #9847
  • Delete embeddings support #9865
  • Move provider trait into goose-providers #9860
  • Move global config access out of ModelConfig, move ModelConfig into goose_providers #9769
  • Add Ophis MCP server to the extensions registry #9861
  • Make session.name the source of truth for displayed session titles #9841
  • Split provider inventory out of providers #9826
  • Drop debug info for dependencies in dev profile #9843
  • Make context exceeded checker more precise #9831
  • Update analyze extension instructions #9585
  • Validate desktop i18n catalogs #9776
  • Refresh canonical model registry #9709
  • Move formats/openai.rs into goose-providers crate #9633
  • Create goose-providers crate with canonical models, conversation and other types #9588
  • Remove dead component and useNavigationSessions cleanup #9603
  • ACP session setup refactor #9488
  • Use LRU cache for token counting #9586
  • Replace review subprocess timeout with turn limits #9571
  • Improve benchmarking #9637
  • Pattern-based detection adjustments for prompt injection confidence scores #9690
  • Removed create recipe from session modal and REST API #9916

📚 Documentation

  • Correct custom agents guide #9947
  • Custom agents documentation #9293
  • AAIF migration blog post #9866
  • Remove DCO references #9864
  • Self-improving agents blog post #9846
  • Correct whitespace in installation fenced code block #9867
  • Update docs for ACP clients #9772
  • Fix stale session navigation/delete docs #9727
  • Fix typo in MCP blog post #9641
  • Add Scaleway provider docs #9423
  • Scholar Sidekick tutorial page #9477

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track Goose

Get notified when new releases ship.

Sign up free

About Goose

an open source, extensible AI agent that goes beyond code suggestions - install, execute, edit, and test with any LLM

All releases →

Related context

Beta — feedback welcome: [email protected]