This release includes breaking changes for platform teams planning a safe upgrade.
Published 24d
AI Agents & Assistants
✓ No known CVEs patched
✓ No known CVEs patched in this version
Topics
acp
ai
ai-agents
mcp
Summary
AI summaryUpdates 🐛 Bug Fixes, ✨ Features, and 🔧 Improvements across a mixed release.
Full changelog
✨ Features
- iFlytek Spark and Astron MaaS providers (#9837)
--editsession flag to edit conversation before forking (#9799)- Fireworks AI declarative provider (#9990)
- OpenRouter request parameters support (#9276)
- French, German, Italian, Portuguese, Indonesian, Malay, Vietnamese, and Traditional Chinese desktop locales (#10072)
- Spanish (es) locale support (#9833)
- Korean localization for desktop app (#9856)
- Japanese locale support (#9768)
- Hindi desktop locale (#9733)
- Language selection feature in desktop (#9405)
/statusslash command in CLI (#9845)- Streamable HTTP support in deeplink generator (#9954)
- GLM-5.2 model support (#9967)
- Global hints loading from
~/.agents/AGENTS.md(#9736) - Azure Entra ID bearer token auth via
AZURE_OPENAI_AD_TOKEN(#9716) - Together AI declarative provider (#9545)
- OrcaRouter as declarative OpenAI-compatible provider (#9515)
- EmpirioLabs AI declarative provider (#9771)
- MLX model support for local inference provider (#9154)
- Summon peek mode for async background tasks (#9519)
- Summon context parameter for delegate tasks (#9518)
- Summon working_dir override for delegate tasks (#9520)
- Structured metadata for summon task load results (#9521)
- TLS support for ACP serve (#10088)
- OpenAI Responses API store param configurability (#10040)
- Exposed available tools in ACP schema (#10097)
- ACP thinking effort config option (#10711)
- Last message snippets for ACP sessions (#9798)
- OTLP logging schema for cross-tool detection (#9713)
- Option to disable automatic update downloads (#9872)
- Cache token tracking for accurate cost reporting (#9752)
- Session import functionality (#9474)
- xAI SuperGrok OAuth subscription provider (#9420)
- Perplexity as declarative OpenAI-compatible provider (#9324)
- Alibaba (Qwen via DashScope) declarative provider (#9443)
- Configurable tool output size limit via
GOOSE_MAX_TOOL_RESPONSE_SIZE(#9256) /modelslash command for session model switching (#8747)- Databricks AI Gateway provider (#9274)
- Russian language support (#9406)
- Turkish desktop locale (#9392)
- NEAR AI Cloud provider (#9352)
- Scaleway provider (#9254)
- Harbor eval runner (#9138)
/goalcommand for agent self-evaluation before finishing (#9069)- Summon subagent instructions (#9325)
- Open-plugins generalization + skills (#9112)
- PreToolUse denial in hooks (#9304)
- Optional api_key configuration for declarative openai-engine providers (#9202)
goose reviewlocal code review command (#9114)- TUI diff viewer (#9260)
- Paginated session list in ACP (#9199)
- Structured per-provider config block with non-destructive provider switching (#8977)
tuicommand on goose-cli (#9385)- Configurable
MAX_CODE_BLOCK_LINESvia env vars (#9301) goose://resumesession deep link (#9343)GOOSE_FAST_MODELenv var support (#9296)- Vercel AI Gateway provider (#9144)
- Quarterly option for scheduler (#9076)
- Hooks feature (#9093)
- Projects as backend sources with system prompt injection (#8739)
- Worktree-aware directory switcher (#8450)
- Chat history search feature (#8448)
- Optional
--parametersfor scheduled recipes (#8741) - GitHub Copilot
/responsesAPI (#9043) - Unified thinking effort control across all providers (#9242)
- Slash commands (built-in, skill, recipe) in ACP server (#9238)
- Nushell terminal and completion support (#8628)
- Simplified Chinese (zh-CN) translation (#8765)
- Atomic Chat as declarative OpenAI-compatible provider (#9210)
GOOSE_OAUTH_CALLBACK_PORTfor stable OAuth redirect_uri (#9209)- Proactive OAuth token refresh to avoid re-auth on every session (#8386)
goose://new-sessiondeep link for fresh chat (#9196)- Routstr as declarative provider (#9175)
- FuturMix provider (#8840)
- oMLX declarative provider (#9177)
- Declarative provider support in goose-providers crate (#9992)
- ACP elicitation improvements (#9797)
- Image read tool (#9607)
gpt-5.5model support for ChatGPT Codex provider (#9292)
🐛 Bug Fixes
- Canonical model output paths (#10196)
- ACP agent cleanup errors propagation on session delete (#10112)
claude-sonnet-5added to canonical model registry (#10183)- MCP-app-guest request body limit increased (#10180)
- Tolerate partial Responses output items (#10108)
- Databricks tool parameters for OpenAI compatibility (#10101)
- Unescape shell-escaped image paths (#10098)
- Desktop Mac auto-update config seeding (#10132)
/editprompts saved to history (#10011)- Schedule sessions listing using
session.message_count(#10026) - Session store sync after provider/model update and thinking effort update (#10060)
- Fallback REST API call removed in ACP mode for edit in place (#10034)
- Don't retry deterministically-permanent 400s (thinking-block immutability) (#10005)
- Async reqwest client for OTLP export in
goose servemode (#10100) - Reject non-object tool-call arguments instead of panicking (#9832)
- Databricks pricing resolution and cost surfacing (#9925)
- Removed unused SubagentStart/SubagentStop hook events (#9960)
- Recipe modal closes when canceling parameter form (#9195)
- Tool request timestamp precedes tool response timestamp (#9462)
- Activate hermit on macOS so STDIO extensions resolve node (#9482)
- Auto-visualiser JSON-encoded string handling (#9838)
- User-Agent sent on URL image fetches (#9927)
- Do not pass temperature to ChatGPT Codex provider (#9931)
- Nostr session deep link import deduplication (#9918)
- Provider refresh when session working directory changes (#9883)
- GCP refreshed gcloud token after reauth (retry Vertex AI on 401/403) (#9849)
- Start a turn when
/goalor/grindis set (#9801) - Handle resume deep links (#9298)
- PATH repair for plugin hook commands (#9615)
- Cmd/Ctrl+T new chat shortcut restored (#9614)
- Mention menu icon opens sidebar (#9643)
- Dedupe React to prevent multiple instances in renderer (#9631)
- Hermit cleanup added to uvx and jbang scripts (#9616)
- Blocking OTLP HTTP exporter (#9599)
- Fall back to default provider when resuming session with unavailable provider (#9547)
- Tokio runtime provided for OTLP HTTP exporter batch thread (#9541)
- OpenAI meta.n_ctx read from
/v1/modelsfor local server context limit (#9530) - Session history scrollbar aligned with window edge (#9601)
- Session name refresh in sidebar after rename (#9543)
- Resolved skill supporting file paths shown (#9584)
- Bedrock real streaming via ConverseStream API (#9579)
- OpenAI-native cached_tokens recorded in usage metering (#9829)
- Moonshot provider API URL override option (#9819)
- Image paths with spaces detected (#9387)
- New chat shortcut navigation restored (#9528)
- Stale completed tasks evicted in summon (#9514)
- OAuth callback timeout in WSL instead of hanging (#9536)
- Unmatched extension names warning in delegate (#9513)
- Elicitation decline and cancel actions propagated end-to-end (#9437)
- Bedrock inference config (max_tokens, temperature) sent on Converse (#9889)
- Optimistic toggle state shown when disabling an extension (#9882)
- Windows backslash paths preserved in custom extension command (#9741)
- ACP cancel race condition fixed (#9804)
- Removed window goosed when closing window (#9818)
- Context exceeded checker made more precise (#9831)
- Login-shell PATH inherited in spawned subagents (#9737)
- String values accepted for
GOOSE_CONTEXT_LIMIT(#9738) - Rejected OAuth credentials cleared after refresh (#9694)
- Extended thinking kept within Anthropic output cap (#9814)
- RPM build-id links disabled (#9671)
- Custom API path preserved in OpenAI base_url derivation (#9649)
- Bedrock ValidationException classified as ExecutionError (#9735)
- Unparseable extension entries preserved during config refresh (#9439)
- Session info ACP method (#9729)
- Anthropic stream refusals surfaced as visible errors (#9724)
- Ollama_cloud correctly mapped to canonical provider (#9639)
- Groq provider max tokens values corrected (#9790)
- Stream decode errors marked retryable (#9723)
- Databricks AI Gateway v2 endpoints pagination (#9753)
- Pattern-based prompt injection detection confidence scores adjusted (#9690)
- ACP compatibility in TUI for config extensions (#9683)
- Thinking content buffered across stream chunks for DeepSeek/Kimi tool calls (#9704)
- Actionable errors surfaced for truncated tool-call arguments (#9946)
- Deleting recently created session and creating new one no longer shows deleted content (#9351)
- Custom OpenAI provider port preserved when URL scheme omitted (#9730)
- ACP agentInfo included in initialize response (#9765)
- Local inference media marker parts used for vision prompts (#9452)
- Extensions icon visible after switching sessions (#9787)
- Non-recipe project config files skipped in summon (#9808)
- Duplicate tool-call ids deduped within a turn (#9792)
- Bundled extensions resolved from discovery (#9759)
- Thinking config passed to Bedrock Anthropic models (#9794)
- LiteLLM context limit from
/model/infofor custom models (#9303) - Thinking content preserved for provider context (#9314)
- Configurable timeout env vars mentioned in Ollama stream stall error (#9246)
- Full recipe parameter details included in load/discovery output (#9233)
- Unused fetch-metadata IPC handler removed (SSRF) (#9340)
- Gateway respects
GOOSE_MAX_TURNS(#9354) - Anthropic empty object sent instead of null for tool_use input (#9355)
- Selected branch preserved across project chats (#9010)
- Tolerate missing responses output (#9449)
- Azure api-version query param made optional (#9221)
- Pending env vars preserved in Add Extension form (#9285)
- Linux x86_64 built inside manylinux_2_28 for glibc 2.28+ compat (#9415)
- Main window stops growing taller on every launch (#9409)
- Desktop chat search session limiting (#9366)
- Per-session agent creation serialized to stop duplicate MCP init (#9357)
- OTLP signals skipped when protocol=grpc to avoid background-thread panic (#9512)
- Stop hook decisions honored when blocking (#9468)
- ACP server context window size forwarded to clients (#9455)
- Provider list refresh in Switch Models picker (#9408)
- New chat started in current window from recipe param modal (#9422)
- Trace_output emitted as span attribute instead of event (#9255)
- File fallback checked when keyring has no entry (#9279)
- ScheduleModal error message styling (#9278)
- Sidebar hamburger aligned in macOS fullscreen (#9257)
current_exe()used instead of PATH lookup when spawning goose (#9236)- TCP_USER_TIMEOUT set on streamable HTTP clients (#9207)
- Custom provider activated after adding via configure (#9213)
- OTLP traces flushed reliably on exit with configurable timeout (#9228)
- Excessive MISSING_TRANSLATION warnings reduced for fallback locales (#9294)
- Cross-window deep link contamination eliminated (#9273)
- Telegram gateway error reporting and connection reliability improved (#9223)
- VT processing enabled on Windows Console Host (#9248)
- Cost zeroed for local providers (ollama, local) (#9222)
- Tool-use marker leakage prevented in toolshim output (#8310)
- Summon canonical limits re-applied when delegate overrides model (#9183)
- CLI cumulative total_tokens reported in stream-json/json output (#8910)
- GCP metadata server token refreshed on expiration (#8929)
- WSL2 OS detection corrected by removing PWD-based Windows override (#8869)
- Bedrock ReasoningContent blocks handled gracefully (#8843)
- Tool pair summaries inserted at chronological position in conversation (#9087)
- SQLite foreign key enforcement enabled in session pool (#9121)
- Deleted chat session still appearing in sidebar list (#8674)
- Extension_name required on read_resource (#8989)
- SACP notifies clients of generated session names (#8983)
- Quoted numeric config values converted to numbers if needed (#8844)
- SSE reconnect loop kept alive on long disconnects (#8717)
- OpenAI request_params applied to outgoing API payload (#9151)
- Gemini 3.x known_location Global routing and KNOWN_MODELS entries (#9142)
- Anthropic Retry-After honored on 429 responses (#9161)
- Streaming Thinking deltas coalesced + available tools listed on not-found (#9162)
- User-set session name preserved for recipe-based chats (#9079)
- OIDC-proxy exp enforcement independent of MAX_TOKEN_AGE_SECONDS (#8832)
- Inline code contrast improved in light theme (#9058)
- Max_tokens omitted for OpenAI-compatible requests when unset (#9123)
- MCP-app host capabilities set correctly (#9116)
- Nullable schemas normalized for Vertex Gemini compatibility (#8930)
- GitHub recipe temp paths isolated (#8878)
- X-Initiator header set on GitHub Copilot requests (#8809)
- Dynamic_models: false honored in declarative provider configs (#8795)
- Frontend extension session state and tool routes (#8464)
- Bedrock trailing message cached for stable prefix across agent turns (#8916)
- Case-insensitive model name lookup for context_limit (#8906)
- Cumulative token usage emitted in stream-json/json complete event (#8870)
- 400 returned instead of panicking on invalid CSP header value (#8810)
- ACP streaming chunks coalesced under one message id (#8788)
- Goose2 vite server reused on port conflict (#8722)
- Python3 used in developer extension instructions for macOS/Linux compatibility (#8784)
- ACP child synchronously reaped to avoid SIGCHLD race (#9023)
- Goose2 small-window chat and settings layouts (#9019)
- Elicitation fixes (#8999)
- OpenAI null tool_call arguments accepted in streaming chunks (#9035)
- Plain '> ' prompt used instead of goose emoji in CLI (#9305)
- Goosed not killed when a window closes (#9302)
- Databricks parallel tool image responses don't interleave tool results (#9241)
- Accumulated cost persisted in session DB to survive reload (#9191)
- Publish-npm binary built from current SHA + compat check (#9212)
- Preprompt excluded from session title generation (#8793)
- Login-shell PATH probe prevented from suspending goose on startup (#8804)
- Venice replaced with declarative config (#9234)
- MOIM allowlist widened for expected fix_conversation warnings (#9226)
- mkdir -p used for self-test workspace initialization (#9247)
- Tool name shown in approval prompt (#9216)
- ACP images replayed on session load (#9496)
- Azure CLI resolved on Windows using az.cmd (#9215)
- Non-interactive terminal handled in goose configure on Windows (#9214)
- ACP recipe state applied during session load and fork (#9998)
- Local inference GGUF requirements stricter, auto detection of tool calling support, thinking output parsing fixed (#9442)
- Goose alias preferred for Databricks v2 inventory (#9430)
- Streamed tool calls without indexes supported (#10023)
- Allow local file ACP origins (#10194)
- MCP app sandbox bridge lifecycle fixed (#10064)
🔧 Improvements
- Refactored local inference provider crates (#10169)
- ACP auth and origin defaults improved (#9886)
- UI connected to ACP directly instead of goosed (#10081)
- Turn-context kept out of Anthropic prefix cache (#10030)
- Extended thinking disabled for fast-model operations (#9815)
- Diagnostics migrated to JSON report (#9964)
- MCP elicitations routed through tool streams (#9943)
- Provider refactored: model config not required to create provider (#9953)
- Session name as source of truth for displayed session titles (#9841)
- Provider inventory split out of providers (#9826)
- MCP extensions supported in open plugins (#9471)
- Databricks Responses API support check (#9347)
- Initial prompt with
goose://new-session(#9427) - View model interactions (#9806)
- API Client moved to goose-providers (#9869)
- Request logger refactored out of providers (#9847)
- Provider trait moved into goose-providers (#9860)
- Global config access moved out of ModelConfig (#9769)
- Debug info dropped for dependencies in dev profile (#9843)
- Formats/openai.rs moved into goose-providers crate (#9633)
- Goose-providers crate created with canonical models, conversation and other types (#9588)
- Generic validator for declarative providers (#10010)
- UI types decoupled from generated OpenAPI types (#10149, #10109)
- ACP SDK upgraded to new HTTP/WS crate (#10082)
- MCP sampling support removed (#10087)
- Legacy MCP-UI proxy support removed (#10086)
- Session_id removed from provider streaming trait methods (#9984)
- Ollama provider moved into goose-providers (#9986)
- Anthropic provider moved into goose-providers (#9985)
- OpenAI provider moved into goose-providers (#9880)
- LRU cache used for token counting (#9586)
- Hugging Face OAuth support added with auth tab in settings (#9552)
- Review subprocess timeout replaced with turn limits (#9571)
- Benchmarking improved (#9465, #9637)
- Canonical thinking modes added (#9743)
- Skill instructions dynamically refreshed each turn (#9217)
- Pasted HTML parsed better as markdown (#9190)
- Dependency hygiene improved (#9360)
- Summon instructions built per turn (#9329)
- Protocol cleanup (#9147)
- Settings moved into app shell (#9047)
- Extension page redesigned (#8940)
- Provider catalog moved behind ACP layer in goose2 (#9030)
- Skills library redesigned (#8868)
- Sidebar navigation and project icons polished (#8896)
- Provider resolution parallelized and SQLite pool eagerly initialized (#8899)
- Skill categories removed (#9008)
- Consecutive tool calls grouped into summarized chain card (#8995)
- Artifact heuristics/regexes replaced with protocol messages (#8996)
- CLI help text updated for
--session-id(#10077) - Canonical model registry refreshed (#10709, #9551, #9331)
- EmpirioLabs provider display name updated (#10126)
📚 Documentation
- Custom agents guide (#9293)
- Custom agents guide correction (#9947)
- Message field named in hooks payload guide (#9913)
- Release testing instructions updated (#10122)
- ACP clients documentation updated (#9772)
- Session History navigation/delete docs fixed (#9727)
- Remote goosed server connection guide (#9275)
- SaladCloud AI Gateway documentation (#9253)
- Summon extension requirement documented for delegate and load tools (#9231)
- Hooks guide (#9288)
- Hooks feature blog post (#9227)
- Documentation reorganized (#9310)
- Scaleway provider documentation (#9423)
- Self-improving agents blog post (#9846)
- AAIF migration blog post (#9866)
- Orchestrating with goose blog post (#9104)
- Minimax and office QA benchmark findings blog post (#8984)
- Goose with peekaboo blog post (#8884)
- Built-in Local Inference blog post (#8808)
- DCO references removed (#9864)
- Internal documentation anchors fixed (#9094)
- Ophis MCP server added to extensions registry (#9861)
- Scholar Sidekick tutorial page (#9477)
- Installation whitespace fix (#9867)
- Stats update (#9410)
- MCP blog post typo fix (#9641)
- Analyze extension instructions updated (#9585)
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Goose
an open source, extensible AI agent that goes beyond code suggestions - install, execute, edit, and test with any LLM
Related context
Related tools
Beta — feedback welcome: [email protected]