v1.28.0

## ✨ Features

- Adversarial agent for preventing leaking of info and more [#7948](https://github.com/block/goose/pull/7948)
- Claude adaptive thinking support [#7944](https://github.com/block/goose/pull/7944)
- New onboarding flow [#7266](https://github.com/block/goose/pull/7266)
- Persist GooseMode per-session via session DB [#7854](https://github.com/block/goose/pull/7854)
- Propagate session.id to OpenTelemetry spans and log records [#7490](https://github.com/block/goose/pull/7490)
- Migrate autovisualiser extension to MCP Apps [#7852](https://github.com/block/goose/pull/7852)
- ACP session/set_mode handler [#7801](https://github.com/block/goose/pull/7801)
- MCP Roots support [#7790](https://github.com/block/goose/pull/7790)
- Load hints in nested subdirectories [#7772](https://github.com/block/goose/pull/7772)
- ACP read tool for delegating filesystem I/O to ACP clients [#7668](https://github.com/block/goose/pull/7668)
- Summarize tool for deterministic reads [#7054](https://github.com/block/goose/pull/7054)
- ACP providers for Claude Code and Codex [#6605](https://github.com/block/goose/pull/6605)
- Capture reasoning summaries from OpenAI Responses API [#7375](https://github.com/block/goose/pull/7375)
- MiniMax provider with Anthropic-compatible API [#7640](https://github.com/block/goose/pull/7640)
- Tensorix as a declarative provider [#7712](https://github.com/block/goose/pull/7712)
- Skill supporting files individually loadable via load() in summon [#7583](https://github.com/block/goose/pull/7583)
- Avian as an LLM provider [#7561](https://github.com/block/goose/pull/7561)
- Combine TUI UX with publishing config [#7683](https://github.com/block/goose/pull/7683)
- Base path field for custom provider configuration [#7614](https://github.com/block/goose/pull/7614)
- Better private channel detection for Slack bot [#7680](https://github.com/block/goose/pull/7680)
- Preferred microphone selection [#7805](https://github.com/block/goose/pull/7805)
- Secret interpolation in streamable HTTP extension URLs [#7782](https://github.com/block/goose/pull/7782)

## 🐛 Bug Fixes

- Remove incorrect agent_visible filter on user message in claude-code [#7931](https://github.com/block/goose/pull/7931)
- Retry on authentication failure with credential refresh [#7812](https://github.com/block/goose/pull/7812)
- Bump pctx_code_mode to 0.3.0 for iterator type checking fix [#7892](https://github.com/block/goose/pull/7892)
- Pass session_id when loading extensions so skills are discovered [#7868](https://github.com/block/goose/pull/7868)
- Tool choice and parallel_tool_calls support for chatgpt_codex provider [#7867](https://github.com/block/goose/pull/7867)
- Tool confirmation handling for multiple requests [#7856](https://github.com/block/goose/pull/7856)
- Resolve tokio::sync::Mutex deadlock in recipe retry path [#7832](https://github.com/block/goose/pull/7832)
- Stop writing without error when hitting broken pipe for goose session list [#7858](https://github.com/block/goose/pull/7858)
- Skip upgrade-insecure-requests CSP for external HTTP backends [#7714](https://github.com/block/goose/pull/7714)
- Prevent hang when command backgrounds a child process [#7689](https://github.com/block/goose/pull/7689)
- Exit agent loop when tool call JSON fails to parse [#7840](https://github.com/block/goose/pull/7840)
- Prevent SSE connection drops from silently truncating responses [#7831](https://github.com/block/goose/pull/7831)
- Prevent SageMaker TGI from being marked configured when only Bedrock keys are set [#7284](https://github.com/block/goose/pull/7284)
- Disable computercontroller functionality when no $DISPLAY detected [#7824](https://github.com/block/goose/pull/7824)
- Register MCP extensions when resuming a session [#7806](https://github.com/block/goose/pull/7806)
- Load .gitignore in prompt_manager for hint file filtering [#7795](https://github.com/block/goose/pull/7795)
- Remap max_completion_tokens to max_tokens for OpenAI-compatible providers [#7765](https://github.com/block/goose/pull/7765)
- Preserve OpenAI Responses API tool call/output linkage [#7759](https://github.com/block/goose/pull/7759)
- Return ContextLengthExceeded when prompt exceeds effective KV cache size [#7815](https://github.com/block/goose/pull/7815)
- Use `includeThoughts/part.thought` for Google thinking handling [#7593](https://github.com/block/goose/pull/7593)
- Model selector showing wrong model in tabs [#7784](https://github.com/block/goose/pull/7784)
- Avoid word splitting by space for Windows shell commands [#7810](https://github.com/block/goose/pull/7810)
- Unify path resolution around GOOSE_PATH_ROOT [#7335](https://github.com/block/goose/pull/7335)
- Pass OAuth scopes to DCR and extract granted_scopes from token response [#7571](https://github.com/block/goose/pull/7571)
- Write to real file if config.yaml is symlink [#7669](https://github.com/block/goose/pull/7669)
- Preserve pairings when stopping gateway [#7733](https://github.com/block/goose/pull/7733)
- Sanitize streamable HTTP extension names derived from URLs [#7740](https://github.com/block/goose/pull/7740)
- Improve keyring availability error detection [#7766](https://github.com/block/goose/pull/7766)
- Remove insecure default secret from GOOSE_EXTERNAL_BACKEND [#7783](https://github.com/block/goose/pull/7783)
- Add #[serde(default)] to description field on ExtensionConfig variants [#7708](https://github.com/block/goose/pull/7708)
- Restore smart-approve mode [#7690](https://github.com/block/goose/pull/7690)
- Make TLS configurable in goosed agent via GOOSE_TLS env var [#7686](https://github.com/block/goose/pull/7686)
- Max turns configuration [#7612](https://github.com/block/goose/pull/7612)
- Compare extension configs before skipping add_extension [#7650](https://github.com/block/goose/pull/7650)
- Only add viewable channels to Slack bot context [#7678](https://github.com/block/goose/pull/7678)
- Make sure platform binary exists [#7676](https://github.com/block/goose/pull/7676)
- Replace global static output buffer with per-instance TempDir [#7632](https://github.com/block/goose/pull/7632)
- Resolve parameters in initial message with autosubmit [#7659](https://github.com/block/goose/pull/7659)
- Add analyzer extension in recipe to maintain backwards compatibility [#7652](https://github.com/block/goose/pull/7652)
- Scope empty session reuse to current window to prevent session mixing [#7602](https://github.com/block/goose/pull/7602)
- Prevent abort in local inference [#7633](https://github.com/block/goose/pull/7633)
- Restore provider and extensions for LRU-evicted sessions [#7616](https://github.com/block/goose/pull/7616)
- Removed double dash in pnpm command [#7951](https://github.com/block/goose/pull/7951)

## 🔧 Improvements

- Upgrade Electron 40.6.0 → 41.0.0 [#7851](https://github.com/block/goose/pull/7851)
- Only show up to 50 lines of source code [#7578](https://github.com/block/goose/pull/7578)
- Keep messages in sync [#7850](https://github.com/block/goose/pull/7850)
- More ACP tools [#7843](https://github.com/block/goose/pull/7843)
- Use pnpm for Desktop Electron App [#7679](https://github.com/block/goose/pull/7679)
- Use constant-time comparison for auth token validation [#7730](https://github.com/block/goose/pull/7730)
- Use camelCase in CallToolResponse and add type discriminators to ContentBlock [#7487](https://github.com/block/goose/pull/7487)
- Convert Tanzu provider to declarative JSON config [#7124](https://github.com/block/goose/pull/7124)
- Simplify tokenizer initialization — remove unnecessary Result wrapper [#7744](https://github.com/block/goose/pull/7744)
- Reduce server log verbosity [#7729](https://github.com/block/goose/pull/7729)
- Derive GooseMode string conversions with strum [#7706](https://github.com/block/goose/pull/7706)
- Update to rmcp 1.1.0 [#7619](https://github.com/block/goose/pull/7619)
- Merge platform/builtin extensions [#7630](https://github.com/block/goose/pull/7630)
- Updated canonical models [#7920](https://github.com/block/goose/pull/7920)
- Keep toast open on failed extension [#7771](https://github.com/block/goose/pull/7771)
- Stop collecting goosed stderr after startup [#7814](https://github.com/block/goose/pull/7814)
- Remove dependency on posthog-rs [#7811](https://github.com/block/goose/pull/7811)
- Add prefer-offline to pnpm config to skip unnecessary registry lookups [#7828](https://github.com/block/goose/pull/7828)
- Restore goosed logging [#7622](https://github.com/block/goose/pull/7622)
- Log 500 errors and show error for direct download [#7936](https://github.com/block/goose/pull/7936)
- Add `linux-mcp-server` to the goose registry [#6979](https://github.com/block/goose/pull/6979)
- Remove dead OllamaSetup onboarding flow [#7861](https://github.com/block/goose/pull/7861)
- Delete goose web [#7696](https://github.com/block/goose/pull/7696)

## 📚 Documentation

- Credit balance monitoring section [#7952](https://github.com/block/goose/pull/7952)
- Cerebras provider to supported providers list [#7953](https://github.com/block/goose/pull/7953)
- TUI client documentation in ACP clients guide [#7950](https://github.com/block/goose/pull/7950)
- Polish ACP docs [#7946](https://github.com/block/goose/pull/7946)
- ACP providers guide for claude-acp and codex-acp [#7800](https://github.com/block/goose/pull/7800)
- Spraay Batch Payments MCP Extension Tutorial [#7525](https://github.com/block/goose/pull/7525)
- MLflow integration guide [#7563](https://github.com/block/goose/pull/7563)
- LM Studio availability [#7698](https://github.com/block/goose/pull/7698)
- GOOSE_INPUT_LIMIT environment variable documentation [#7299](https://github.com/block/goose/pull/7299)
- Update recipe usage step to reflect auto-submit behavior [#7639](https://github.com/block/goose/pull/7639)
- Guide for customizing the sidebar [#7638](https://github.com/block/goose/pull/7638)
- Update Claude Code approve behavior and model list in cli-providers guide [#7448](https://github.com/block/goose/pull/7448)
- Update contributing.md [#7927](https://github.com/block/goose/pull/7927)
- Notes in contribution guide for pnpm [#7833](https://github.com/block/goose/pull/7833)