v1.43.0

## ✨ Features

- Reconnect desktop ACP sessions after sleep and connection loss [#10411](https://github.com/aaif-goose/goose/pull/10411)
- Per-message usage stats UI (tokens, cost, TTFT, tok/s) [#10210](https://github.com/aaif-goose/goose/pull/10210)
- Per-message usage/cost tracking with derived session totals [#10172](https://github.com/aaif-goose/goose/pull/10172)
- Group chat sessions by project in nav panel [#10212](https://github.com/aaif-goose/goose/pull/10212)
- Show project names in directory switcher dropdown [#10207](https://github.com/aaif-goose/goose/pull/10207)
- OllamaCloudProvider with dynamic model discovery and context limits [#10264](https://github.com/aaif-goose/goose/pull/10264)
- Delete support for custom apps from Apps UI [#10127](https://github.com/aaif-goose/goose/pull/10127)
- `--edit` session flag to edit conversation before forking [#9799](https://github.com/aaif-goose/goose/pull/9799)
- iFlytek Spark and Astron MaaS providers [#9837](https://github.com/aaif-goose/goose/pull/9837)
- Fireworks AI declarative provider [#9990](https://github.com/aaif-goose/goose/pull/9990)
- OpenRouter request parameters support [#9276](https://github.com/aaif-goose/goose/pull/9276)
- OVHcloud Qwen3.6-27B model (262K context) [#10339](https://github.com/aaif-goose/goose/pull/10339)
- GPT-5.6 family support [#10349](https://github.com/aaif-goose/goose/pull/10349)
- GLM-5.2 support [#9967](https://github.com/aaif-goose/goose/pull/9967)
- French, German, Italian, Portuguese, Indonesian, Malay, Vietnamese, and Traditional Chinese desktop locales [#10072](https://github.com/aaif-goose/goose/pull/10072)
- Provider bindings MVP to goose-sdk with Python wheel publishing [#10208](https://github.com/aaif-goose/goose/pull/10208)
- TLS support for ACP serve [#10088](https://github.com/aaif-goose/goose/pull/10088)
- Streamable HTTP support in deeplink generator [#9954](https://github.com/aaif-goose/goose/pull/9954)

## 🐛 Bug Fixes

- Exclude MCP App tools from Code Mode callbacks [#10290](https://github.com/aaif-goose/goose/pull/10290)
- Preserve reasoning_content for DeepSeek thinking mode on multi-turn tool calls [#10366](https://github.com/aaif-goose/goose/pull/10366)
- Compaction disabled during approval [#10089](https://github.com/aaif-goose/goose/pull/10089)
- Treat empty-string finish_reason as non-terminal in streaming [#10258](https://github.com/aaif-goose/goose/pull/10258)
- Gemini OAuth onboarding failure [#10363](https://github.com/aaif-goose/goose/pull/10363)
- Retry empty provider turns instead of stopping silently [#10360](https://github.com/aaif-goose/goose/pull/10360)
- Guard llama.cpp backend init against SIGILL on x86_64 CPUs without FMA/AVX2 [#10105](https://github.com/aaif-goose/goose/pull/10105)
- Sanitize responses function call names [#10344](https://github.com/aaif-goose/goose/pull/10344)
- Pick session mode from the IDs the agent actually offers [#10320](https://github.com/aaif-goose/goose/pull/10320)
- Desktop ACP shell PATH [#10336](https://github.com/aaif-goose/goose/pull/10336)
- Dedupe duplicate signed thinking blocks to fix Anthropic 400 [#10083](https://github.com/aaif-goose/goose/pull/10083)
- Resolve provider default model instead of leaking sentinel "current" [#10305](https://github.com/aaif-goose/goose/pull/10305)
- Return effective context limit from /model-info [#10165](https://github.com/aaif-goose/goose/pull/10165)
- Gate rcgen aws_lc_rs feature behind rustls-tls [#10116](https://github.com/aaif-goose/goose/pull/10116)
- Recover malformed tool calls from GLM/Minimax models instead of rejecting them [#10230](https://github.com/aaif-goose/goose/pull/10230)
- Restore cursor when configure exits [#10222](https://github.com/aaif-goose/goose/pull/10222)
- Skip scheduled sessions for implicit resume [#10178](https://github.com/aaif-goose/goose/pull/10178)
- Sync slash help with builtins [#10173](https://github.com/aaif-goose/goose/pull/10173)
- Treat unicode punctuation as image path terminators [#10106](https://github.com/aaif-goose/goose/pull/10106)
- Don't bleed provider-specific request_params into delegate() sessions [#9906](https://github.com/aaif-goose/goose/pull/9906)
- Purge empty phantom sessions on startup [#9651](https://github.com/aaif-goose/goose/pull/9651)
- Include structuredContent from MCP tool response [#10128](https://github.com/aaif-goose/goose/pull/10128)
- Propagate agent cleanup errors on session delete [#10112](https://github.com/aaif-goose/goose/pull/10112)
- Tolerate partial Responses output items [#10108](https://github.com/aaif-goose/goose/pull/10108)
- Always use OpenAI-compatible "parameters" for Databricks tools [#10101](https://github.com/aaif-goose/goose/pull/10101)
- Unescape shell-escaped image paths [#10098](https://github.com/aaif-goose/goose/pull/10098)
- Send inference config (max_tokens, temperature) on Bedrock Converse [#9889](https://github.com/aaif-goose/goose/pull/9889)
- Dedupe Nostr session deep link imports [#9918](https://github.com/aaif-goose/goose/pull/9918)
- Don't retry deterministically-permanent 400s (thinking-block immutability) [#10005](https://github.com/aaif-goose/goose/pull/10005)
- Use async reqwest client so OTLP export works in `goose serve` mode [#10100](https://github.com/aaif-goose/goose/pull/10100)
- Reject non-object tool-call arguments instead of panicking [#9832](https://github.com/aaif-goose/goose/pull/9832)
- Save /edit prompts to history [#10011](https://github.com/aaif-goose/goose/pull/10011)
- Buffer thinking across stream chunks for DeepSeek/Kimi tool calls [#9704](https://github.com/aaif-goose/goose/pull/9704)
- Surface actionable errors for truncated tool-call arguments [#9946](https://github.com/aaif-goose/goose/pull/9946)
- Show optimistic toggle state when disabling an extension [#9882](https://github.com/aaif-goose/goose/pull/9882)
- Resolve databricks_v2 pricing and surface cost in standard usage update [#9925](https://github.com/aaif-goose/goose/pull/9925)
- Activate hermit on macOS so STDIO extensions resolve node [#9482](https://github.com/aaif-goose/goose/pull/9482)
- Prompt timestamps are now timezone-explicit [#10209](https://github.com/aaif-goose/goose/pull/10209)

## 🔧 Improvements

- Apply the default extension timeout to developer shell tool calls [#10348](https://github.com/aaif-goose/goose/pull/10348)
- Disable thinking preservation for Groq [#10284](https://github.com/aaif-goose/goose/pull/10284)
- Bound code-mode execution with timeout and cancellation [#10214](https://github.com/aaif-goose/goose/pull/10214)
- Keep turn-context out of the Anthropic prefix cache [#10030](https://github.com/aaif-goose/goose/pull/10030)
- Disable extended thinking for fast-model operations [#9815](https://github.com/aaif-goose/goose/pull/9815)
- Switch the local inference provider MLX backend to use the safemlx crate [#10304](https://github.com/aaif-goose/goose/pull/10304)
- OpenAI Responses API store param configurable [#10040](https://github.com/aaif-goose/goose/pull/10040)
- Support streamed tool calls without indexes [#10023](https://github.com/aaif-goose/goose/pull/10023)
- Fail closed on unverifiable update provenance [#10168](https://github.com/aaif-goose/goose/pull/10168)
- Migrate diagnostics to JSON report [#9964](https://github.com/aaif-goose/goose/pull/9964)
- Route MCP elicitations through tool streams [#9943](https://github.com/aaif-goose/goose/pull/9943)
- ACP migration for desktop UI [#10081](https://github.com/aaif-goose/goose/pull/10081)
- Relabel settings 'Session' tab to 'External Backend' [#10318](https://github.com/aaif-goose/goose/pull/10318)
- Show manual-setup indicator for extensions without an install link [#10321](https://github.com/aaif-goose/goose/pull/10321)

## 📚 Documentation

- Clarify session --edit context retention [#10257](https://github.com/aaif-goose/goose/pull/10257)
- Name the message field in the hooks payload guide [#9913](https://github.com/aaif-goose/goose/pull/9913)
- Custom agents guide [#9293](https://github.com/aaif-goose/goose/pull/9293)
- Correct custom agents guide [#9947](https://github.com/aaif-goose/goose/pull/9947)