v1.35.0

## ✨ Features

- Hooks system for extensible pre/post tool execution [#9093](https://github.com/aaif-goose/goose/pull/9093)
- PreToolUse denial hook support [#9304](https://github.com/aaif-goose/goose/pull/9304)
- `/goal` command for agent self-evaluation before finishing [#9069](https://github.com/aaif-goose/goose/pull/9069)
- `goose review` local code review command [#9114](https://github.com/aaif-goose/goose/pull/9114)
- Diff viewer in TUI [#9260](https://github.com/aaif-goose/goose/pull/9260)
- Slash commands (built-in, skill, recipe) in ACP server [#9238](https://github.com/aaif-goose/goose/pull/9238)
- Unified thinking effort control across all providers [#9242](https://github.com/aaif-goose/goose/pull/9242)
- Open-plugins generalization + skills [#9112](https://github.com/aaif-goose/goose/pull/9112)
- Summon subagent instructions [#9325](https://github.com/aaif-goose/goose/pull/9325)
- Proactive OAuth token refresh to avoid re-auth on every session [#8386](https://github.com/aaif-goose/goose/pull/8386)
- `goose://new-session` deep link to open fresh chat [#9196](https://github.com/aaif-goose/goose/pull/9196)
- GOOSE_OAUTH_CALLBACK_PORT for stable OAuth redirect_uri [#9209](https://github.com/aaif-goose/goose/pull/9209)
- Paginated session list in ACP [#9199](https://github.com/aaif-goose/goose/pull/9199)
- Pass session cwd param to ACP providers [#9229](https://github.com/aaif-goose/goose/pull/9229)
- Opt-in to Vercel AI Gateway leaderboard [#9259](https://github.com/aaif-goose/goose/pull/9259)
- Optional `--parameters` for scheduled recipes [#8741](https://github.com/aaif-goose/goose/pull/8741)
- Quarterly scheduling option [#9076](https://github.com/aaif-goose/goose/pull/9076)
- Recipe discovery/execution in ACP server [#8925](https://github.com/aaif-goose/goose/pull/8925)
- Projects as backend sources with system prompt injection [#8739](https://github.com/aaif-goose/goose/pull/8739)
- Worktree-aware directory switcher [#8450](https://github.com/aaif-goose/goose/pull/8450)
- Chat history search in navigation panel [#8448](https://github.com/aaif-goose/goose/pull/8448)
- Encrypted Nostr session sharing [#8922](https://github.com/aaif-goose/goose/pull/8922)
- Nushell terminal and completion support [#8628](https://github.com/aaif-goose/goose/pull/8628)
- Simplified Chinese (zh-CN) translation [#8765](https://github.com/aaif-goose/goose/pull/8765)
- Strip chain-of-thought markers from custom provider output [#8635](https://github.com/aaif-goose/goose/pull/8635)
- GOOSE_DISABLE_TOOL_CALL_SUMMARY to opt out of per-tool-call summaries [#8947](https://github.com/aaif-goose/goose/pull/8947)
- Group consecutive tool calls into one summarized chain card [#8995](https://github.com/aaif-goose/goose/pull/8995)
- Vercel AI Gateway provider [#9144](https://github.com/aaif-goose/goose/pull/9144)
- GitHub Copilot /responses API [#9043](https://github.com/aaif-goose/goose/pull/9043)
- Agents CRUD operations [#9084](https://github.com/aaif-goose/goose/pull/9084)
- ACP streamable HTTP spec compliance [#9034](https://github.com/aaif-goose/goose/pull/9034)
- GPT-5.5 added to known models [#9292](https://github.com/aaif-goose/goose/pull/9292)
- Linux musl CLI builds [#9240](https://github.com/aaif-goose/goose/pull/9240)
- Linux Vulkan support for local inference [#9038](https://github.com/aaif-goose/goose/pull/9038)
- Windows CUDA release artifacts [#8750](https://github.com/aaif-goose/goose/pull/8750)

### New Providers
- Atomic Chat [#9210](https://github.com/aaif-goose/goose/pull/9210)
- Routstr [#9175](https://github.com/aaif-goose/goose/pull/9175)
- FuturMix [#8840](https://github.com/aaif-goose/goose/pull/8840)
- oMLX [#9177](https://github.com/aaif-goose/goose/pull/9177)
- SaladCloud AI Gateway [#9253](https://github.com/aaif-goose/goose/pull/9253)

## 🐛 Bug Fixes

- Databricks parallel tool image responses don't interleave tool results [#9241](https://github.com/aaif-goose/goose/pull/9241)
- Stop killing goosed when a window closes [#9302](https://github.com/aaif-goose/goose/pull/9302)
- Eliminate cross-window deep link contamination [#9273](https://github.com/aaif-goose/goose/pull/9273)
- Check file fallback when keyring has no entry [#9279](https://github.com/aaif-goose/goose/pull/9279)
- Activate custom provider after adding via configure [#9213](https://github.com/aaif-goose/goose/pull/9213)
- Use current_exe() instead of PATH lookup when spawning goose [#9236](https://github.com/aaif-goose/goose/pull/9236)
- Set TCP_USER_TIMEOUT on streamable HTTP clients [#9207](https://github.com/aaif-goose/goose/pull/9207)
- Reduce excessive MISSING_TRANSLATION warnings for fallback locales [#9294](https://github.com/aaif-goose/goose/pull/9294)
- Zero out cost for local providers (ollama, local) [#9219](https://github.com/aaif-goose/goose/pull/9219)
- Persist accumulated cost in session DB to survive reload [#9191](https://github.com/aaif-goose/goose/pull/9191)
- Prevent tool-use marker leakage in toolshim output [#8310](https://github.com/aaif-goose/goose/pull/8310)
- Re-apply canonical limits when delegate overrides model [#9183](https://github.com/aaif-goose/goose/pull/9183)
- Use plain '> ' prompt instead of goose emoji in CLI [#9305](https://github.com/aaif-goose/goose/pull/9305)
- Flag for login shell PATH [#9313](https://github.com/aaif-goose/goose/pull/9313)
- Enable VT processing on Windows Console Host [#9248](https://github.com/aaif-goose/goose/pull/9248)
- Resolve Azure CLI on Windows by using az.cmd [#9215](https://github.com/aaif-goose/goose/pull/9215)
- Handle non-interactive terminal in goose configure on Windows [#9214](https://github.com/aaif-goose/goose/pull/9214)
- Emit trace_output as span attribute instead of event [#9255](https://github.com/aaif-goose/goose/pull/9255)
- Flush OTLP traces reliably on exit with configurable timeout [#9228](https://github.com/aaif-goose/goose/pull/9228)
- Telegram gateway error reporting and connection reliability [#9223](https://github.com/aaif-goose/goose/pull/9223)
- ScheduleModal error message styling [#9278](https://github.com/aaif-goose/goose/pull/9278)
- Align sidebar hamburger in macOS fullscreen [#9257](https://github.com/aaif-goose/goose/pull/9257)
- Coalesce streaming Thinking deltas + list available tools on not-found [#9162](https://github.com/aaif-goose/goose/pull/9162)
- Honor Retry-After on 429 responses [#9161](https://github.com/aaif-goose/goose/pull/9161)
- Replace Venice custom provider with declarative config [#9234](https://github.com/aaif-goose/goose/pull/9234)
- Use mkdir -p for self-test workspace initialization [#9247](https://github.com/aaif-goose/goose/pull/9247)
- Preserve user-set session name for recipe-based chats [#9079](https://github.com/aaif-goose/goose/pull/9079)
- Enforce exp independently of MAX_TOKEN_AGE_SECONDS in OIDC proxy [#8839](https://github.com/aaif-goose/goose/pull/8839)
- Improve inline code contrast in light theme [#9058](https://github.com/aaif-goose/goose/pull/9058)
- Omit max_tokens for OpenAI-compatible requests when unset [#9123](https://github.com/aaif-goose/goose/pull/9123)
- Set correct mcp-app host capabilities [#9116](https://github.com/aaif-goose/goose/pull/9116)
- Normalize nullable schemas for Vertex Gemini compatibility [#8930](https://github.com/aaif-goose/goose/pull/8930)
- Isolate GitHub recipe temp paths [#8878](https://github.com/aaif-goose/goose/pull/8878)
- Set X-Initiator header on GitHub Copilot requests [#8809](https://github.com/aaif-goose/goose/pull/8809)
- Honor dynamic_models: false in declarative provider configs [#8795](https://github.com/aaif-goose/goose/pull/8795)
- Cache trailing message for stable prefix across Bedrock agent turns [#8916](https://github.com/aaif-goose/goose/pull/8916)
- Case-insensitive model name lookup for context_limit [#8906](https://github.com/aaif-goose/goose/pull/8906)
- Return 400 instead of panicking on invalid CSP header value [#8810](https://github.com/aaif-goose/goose/pull/8810)
- Coalesce streaming chunks under one message id in ACP [#8788](https://github.com/aaif-goose/goose/pull/8788)
- Handle Bedrock ReasoningContent blocks gracefully [#8843](https://github.com/aaif-goose/goose/pull/8843)
- Correct WSL2 OS detection by removing PWD-based Windows override [#8869](https://github.com/aaif-goose/goose/pull/8869)
- Insert tool pair summaries at chronological position in conversation [#9087](https://github.com/aaif-goose/goose/pull/9087)
- Enable SQLite foreign key enforcement in session pool [#9121](https://github.com/aaif-goose/goose/pull/9121)
- Deleted chat session still appears in sidebar list [#8674](https://github.com/aaif-goose/goose/pull/8674)
- Require extension_name on read_resource [#8989](https://github.com/aaif-goose/goose/pull/8989)
- Queued message lost when clicking send now [#9074](https://github.com/aaif-goose/goose/pull/9074)
- Keep model picker and session config in sync [#9048](https://github.com/aaif-goose/goose/pull/9048)
- Read prompted file parameters in recipes [#8504](https://github.com/aaif-goose/goose/pull/8504)
- Accept null tool_call arguments in OpenAI streaming chunks [#9035](https://github.com/aaif-goose/goose/pull/9035)
- Synchronously reap ACP child to avoid SIGCHLD race [#9023](https://github.com/aaif-goose/goose/pull/9023)
- Elicitation fixes [#8999](https://github.com/aaif-goose/goose/pull/8999)
- SACP notifies clients of generated session names [#8983](https://github.com/aaif-goose/goose/pull/8983)
- Unscheduling a recipe should not delete them [#8978](https://github.com/aaif-goose/goose/pull/8978)
- Seed provider handoff history in ACP [#8941](https://github.com/aaif-goose/goose/pull/8941)
- Respect goose2 interface density settings [#8953](https://github.com/aaif-goose/goose/pull/8953)
- Make goose2 respect accent color [#8952](https://github.com/aaif-goose/goose/pull/8952)
- Preserve replay message timestamps [#8942](https://github.com/aaif-goose/goose/pull/8942)
- Avoid transform-rasterized dialog text in goose2 [#8937](https://github.com/aaif-goose/goose/pull/8937)
- Keep renamed skills open in detail view [#8935](https://github.com/aaif-goose/goose/pull/8935)
- Gemini OAuth onboarding failure [#8905](https://github.com/aaif-goose/goose/pull/8905)
- Convert quoted numeric config values to numbers if needed [#8844](https://github.com/aaif-goose/goose/pull/8844)
- Keep SSE reconnect loop alive on long disconnects [#8846](https://github.com/aaif-goose/goose/pull/8846)
- Apply request_params to outgoing OpenAI API payload [#9151](https://github.com/aaif-goose/goose/pull/9151)
- Gemini 3.x known_location Global routing and KNOWN_MODELS entries [#9142](https://github.com/aaif-goose/goose/pull/9142)
- Refresh GCP metadata server token on expiration [#8929](https://github.com/aaif-goose/goose/pull/8929)
- Report cumulative total_tokens in stream-json/json output [#8910](https://github.com/aaif-goose/goose/pull/8910)
- Emit cumulative token usage in stream-json/json complete event [#8870](https://github.com/aaif-goose/goose/pull/8870)
- Model picker stays usable during provider loading [#8900](https://github.com/aaif-goose/goose/pull/8900)
- Handle ACP requests concurrently [#8781](https://github.com/aaif-goose/goose/pull/8781)
- Reuse goose2 vite server on port conflict [#8722](https://github.com/aaif-goose/goose/pull/8722)
- Exclude preprompt from session title generation [#8793](https://github.com/aaif-goose/goose/pull/8793)
- Prevent login-shell PATH probe from suspending goose on startup [#8804](https://github.com/aaif-goose/goose/pull/8804)

## 🔧 Improvements

- Surface resolved Databricks model metadata [#9206](https://github.com/aaif-goose/goose/pull/9206)
- Include request URL in provider error messages [#9232](https://github.com/aaif-goose/goose/pull/9232)
- Structured per-provider config block, non-destructive provider switching [#8977](https://github.com/aaif-goose/goose/pull/8977)
- Optional api_key configuration for declarative openai-engine providers [#9202](https://github.com/aaif-goose/goose/pull/9202)
- Remove popular chat topics from new chat screen [#9307](https://github.com/aaif-goose/goose/pull/9307)
- Remove vendored Windows binaries [#9318](https://github.com/aaif-goose/goose/pull/9318)
- Linux desktop Vulkan packages [#9323](https://github.com/aaif-goose/goose/pull/9323)
- Better parsing of pasted HTML as markdown [#9190](https://github.com/aaif-goose/goose/pull/9190)
- Prompt injection mitigation: updated pattern-based detection [#9198](https://github.com/aaif-goose/goose/pull/9198)
- Consolidate logging setup into shared helper [#8817](https://github.com/aaif-goose/goose/pull/8817)
- Localize hardcoded strings in provider settings UI [#8931](https://github.com/aaif-goose/goose/pull/8931)
- Move settings into app shell [#9047](https://github.com/aaif-goose/goose/pull/9047)
- Location column in CLI skills table [#8785](https://github.com/aaif-goose/goose/pull/8785)
- Preserve thinking content for providers that require it [#8857](https://github.com/aaif-goose/goose/pull/8857)
- Dynamically refresh skill instructions each turn [#9217](https://github.com/aaif-goose/goose/pull/9217)
- Build non-vulkan Linux variants using ubuntu 22.04 [#9211](https://github.com/aaif-goose/goose/pull/9211)
- Show tool name in approval prompt [#9216](https://github.com/aaif-goose/goose/pull/9216)
- Remove Filesystem MCP extension from catalog [#9225](https://github.com/aaif-goose/goose/pull/9225)
- Mount ACP in goosed server for iterative migration [#9097](https://github.com/aaif-goose/goose/pull/9097)
- Frontend extension session state and tool routes [#8464](https://github.com/aaif-goose/goose/pull/8464)
- TUI spacing/layout improvements [#9243](https://github.com/aaif-goose/goose/pull/9243)
- Polish sidebar and context panel [#9059](https://github.com/aaif-goose/goose/pull/9059)
- Polish inline code snippet styling [#9011](https://github.com/aaif-goose/goose/pull/9011)
- Refresh onboarding when provider catalog loads [#9051](https://github.com/aaif-goose/goose/pull/9051)
- Replace lazy_static with std::sync::LazyLock [#8815](https://github.com/aaif-goose/goose/pull/8815)
- Introduce DEFAULT_PROVIDER_TIMEOUT_SECS constant [#8816](https://github.com/aaif-goose/goose/pull/8816)
- Provider-first onboarding [#9039](https://github.com/aaif-goose/goose/pull/9039)
- Redesign Skills library [#8868](https://github.com/aaif-goose/goose/pull/8868)
- Redesign Extensions page [#8940](https://github.com/aaif-goose/goose/pull/8940)
- Improvements to LM Studio declarative provider [#8973](https://github.com/aaif-goose/goose/pull/8973)
- Mergeable configs + cleanup [#8378](https://github.com/aaif-goose/goose/pull/8378)
- MCP Apps: hydrate and replay app payloads in Goose2 [#8632](https://github.com/aaif-goose/goose/pull/8632)
- MCP Apps: translate ACP host capabilities into MCP initialization [#8623](https://github.com/aaif-goose/goose/pull/8623)
- Render MCP apps inline in goose2 [#8877](https://github.com/aaif-goose/goose/pull/8877)
- Plugin installation and auto-updating [#8949](https://github.com/aaif-goose/goose/pull/8949) [#9061](https://github.com/aaif-goose/goose/pull/9061)
- Skills in chat composer [#8881](https://github.com/aaif-goose/goose/pull/8881)
- Custom providers support in goose2 UI & ACP [#8924](https://github.com/aaif-goose/goose/pull/8924)
- Make ollama host configurable in goose2 [#8912](https://github.com/aaif-goose/goose/pull/8912)
- Support Google model inventory refresh [#8913](https://github.com/aaif-goose/goose/pull/8913)
- Update provider row after saving credentials [#8914](https://github.com/aaif-goose/goose/pull/8914)
- Parallelize provider resolution and eagerly init SQLite pool [#8899](https://github.com/aaif-goose/goose/pull/8899)
- Deduplicate _goose/providers/list RPC call at startup [#8873](https://github.com/aaif-goose/goose/pull/8873)
- Refactor local inference around backends [#9137](https://github.com/aaif-goose/goose/pull/9137)
- Native arm64 runners for Linux artifact builds [#9075](https://github.com/aaif-goose/goose/pull/9075)
- Update canonical model registry [#9331](https://github.com/aaif-goose/goose/pull/9331)
- Update patterns for pattern-based command injection [#8546](https://github.com/aaif-goose/goose/pull/8546)

## 📚 Documentation

- Documentation reorganization [#9310](https://github.com/aaif-goose/goose/pull/9310)
- Hooks guide [#9288](https://github.com/aaif-goose/goose/pull/9288)
- Hooks feature blog post [#9227](https://github.com/aaif-goose/goose/pull/9227)
- Guide for connecting goose Desktop to a remote goosed server [#9275](https://github.com/aaif-goose/goose/pull/9275)
- Document summon extension requirement for delegate and load tools [#9231](https://github.com/aaif-goose/goose/pull/9231)
- Updated tunnel remote access documentation [#9077](https://github.com/aaif-goose/goose/pull/9077)
- Orchestrating with goose blog post [#9104](https://github.com/aaif-goose/goose/pull/9104)
- Goose with Peekaboo blog post [#8884](https://github.com/aaif-goose/goose/pull/8884)
- Built-in Local Inference blog post [#8808](https://github.com/aaif-goose/goose/pull/8808)
- MiniMax and Office QA benchmark findings blog post [#8984](https://github.com/aaif-goose/goose/pull/8984)
- Fix internal documentation anchors [#9094](https://github.com/aaif-goose/goose/pull/9094)