v1.46.0

## ✨ Features

- Unrolled agent loop [#9574](https://github.com/aaif-goose/goose/pull/9574)
- Cache-safe request assembly with append-only turn context and declared cache semantics [#11022](https://github.com/aaif-goose/goose/pull/11022)
- Streaming shell output while commands run [#10808](https://github.com/aaif-goose/goose/pull/10808)
- Per-message usage stats UI (tokens, cost, TTFT, tok/s) [#10210](https://github.com/aaif-goose/goose/pull/10210)
- Per-message usage/cost tracking with derived session totals [#10172](https://github.com/aaif-goose/goose/pull/10172)
- Track cache tokens for accurate cost reporting [#9752](https://github.com/aaif-goose/goose/pull/9752)
- Markdown format option to session export [#10703](https://github.com/aaif-goose/goose/pull/10703)
- Resizable sidebar with drag handle and persisted width [#10795](https://github.com/aaif-goose/goose/pull/10795)
- Interactive menu for single select elicitations [#10327](https://github.com/aaif-goose/goose/pull/10327)
- Session metadata on sidebar chat hover [#10663](https://github.com/aaif-goose/goose/pull/10663)
- Configurable LOCAL_WHISPER_LANGUAGE for multilingual local transcription [#10634](https://github.com/aaif-goose/goose/pull/10634)
- Allow disabling built-in skills [#10600](https://github.com/aaif-goose/goose/pull/10600)
- Structured summary output with template rendering for compaction [#10471](https://github.com/aaif-goose/goose/pull/10471)
- Pass working_dir to the Stop hook context [#10296](https://github.com/aaif-goose/goose/pull/10296)
- Surface output-token-limit info [#10831](https://github.com/aaif-goose/goose/pull/10831)
- Tab completion and switch provider for `model` command [#10585](https://github.com/aaif-goose/goose/pull/10585)
- Collapse const-union enums in tool schemas [#10577](https://github.com/aaif-goose/goose/pull/10577)
- GenAI semantic convention attributes for OTEL [#10700](https://github.com/aaif-goose/goose/pull/10700)
- Enrich root span with gen_ai attributes and improve OTEL output format [#10816](https://github.com/aaif-goose/goose/pull/10816)
- Forward images and MCP embedded-resource blobs in Anthropic and Google formats [#10340](https://github.com/aaif-goose/goose/pull/10340)
- ACP session/new supports Hidden session via _meta.hidden [#10811](https://github.com/aaif-goose/goose/pull/10811)
- Stable agent event message identity [#10716](https://github.com/aaif-goose/goose/pull/10716)
- OAuth logo_uri in client ID metadata documents [#10727](https://github.com/aaif-goose/goose/pull/10727)
- Termux detection in installer to select musl portable build [#10568](https://github.com/aaif-goose/goose/pull/10568)
- Hooks feature with PreToolUse denial [#9093](https://github.com/aaif-goose/goose/pull/9093), [#9304](https://github.com/aaif-goose/goose/pull/9304)
- `/goal` command for agent self-evaluation before finishing [#9069](https://github.com/aaif-goose/goose/pull/9069)
- `/status` slash command [#9845](https://github.com/aaif-goose/goose/pull/9845)
- `/model` slash command to switch session model [#8747](https://github.com/aaif-goose/goose/pull/8747)
- `--edit` session flag to edit conversation before forking [#9799](https://github.com/aaif-goose/goose/pull/9799)
- `goose review` local code review command [#9114](https://github.com/aaif-goose/goose/pull/9114)
- Open plugins generalization with skills support [#9112](https://github.com/aaif-goose/goose/pull/9112)
- Summon extension: peek mode for async background tasks [#9519](https://github.com/aaif-goose/goose/pull/9519)
- Summon extension: context and working_dir parameters for delegate tasks [#9518](https://github.com/aaif-goose/goose/pull/9518), [#9520](https://github.com/aaif-goose/goose/pull/9520)
- Load global hints from ~/.agents/AGENTS.md [#9736](https://github.com/aaif-goose/goose/pull/9736)
- Proactive OAuth token refresh to avoid re-auth on every session [#8386](https://github.com/aaif-goose/goose/pull/8386)
- GOOSE_OAUTH_CALLBACK_PORT for stable OAuth redirect_uri [#9209](https://github.com/aaif-goose/goose/pull/9209)
- Unified thinking effort control across all providers [#9242](https://github.com/aaif-goose/goose/pull/9242)
- Projects as backend sources with system prompt injection [#8739](https://github.com/aaif-goose/goose/pull/8739)
- Group chat sessions by project in nav panel [#10212](https://github.com/aaif-goose/goose/pull/10212)
- Collapsible project group headers in nav panel [#10278](https://github.com/aaif-goose/goose/pull/10278)
- Worktree-aware directory switcher [#8450](https://github.com/aaif-goose/goose/pull/8450)
- Chat history search feature in navigation panel [#8448](https://github.com/aaif-goose/goose/pull/8448)
- Search filter to provider grid [#10437](https://github.com/aaif-goose/goose/pull/10437)
- Option to disable automatic update downloads [#9872](https://github.com/aaif-goose/goose/pull/9872)
- TUI diff viewer [#9260](https://github.com/aaif-goose/goose/pull/9260)
- MAX_CODE_BLOCK_LINES configurable via env vars [#9301](https://github.com/aaif-goose/goose/pull/9301)
- GOOSE_MAX_TOOL_RESPONSE_SIZE to configure tool output size limit [#9256](https://github.com/aaif-goose/goose/pull/9256)
- GOOSE_FAST_MODEL env var in ModelConfig::with_fast [#9296](https://github.com/aaif-goose/goose/pull/9296)
- GOOSE_DOCS_ROOT for air-gapped docs access [#10294](https://github.com/aaif-goose/goose/pull/10294)
- Quarterly option for scheduler [#9076](https://github.com/aaif-goose/goose/pull/9076)
- Harbor eval runner [#9138](https://github.com/aaif-goose/goose/pull/9138)
- goose://new-session and goose://resume deep links [#9196](https://github.com/aaif-goose/goose/pull/9196), [#9343](https://github.com/aaif-goose/goose/pull/9343)
- Initial prompt with goose://new-session [#9427](https://github.com/aaif-goose/goose/pull/9427)
- Encrypted Nostr session sharing [#8922](https://github.com/aaif-goose/goose/pull/8922)
- Import sessions [#9474](https://github.com/aaif-goose/goose/pull/9474)
- Hugging Face OAuth support with auth tab in settings [#9552](https://github.com/aaif-goose/goose/pull/9552)
- MLX models support in local inference provider [#9154](https://github.com/aaif-goose/goose/pull/9154)
- Linux Vulkan support for local inference [#9038](https://github.com/aaif-goose/goose/pull/9038)
- Reconnect desktop ACP sessions after sleep and connection loss [#10411](https://github.com/aaif-goose/goose/pull/10411)
- TLS support for ACP serve [#10088](https://github.com/aaif-goose/goose/pull/10088)
- Group consecutive tool calls into one summarized chain card [#8995](https://github.com/aaif-goose/goose/pull/8995)
- Bind MCP apps to trusted ownership metadata [#10747](https://github.com/aaif-goose/goose/pull/10747)
- MCP extensions in open plugins [#9471](https://github.com/aaif-goose/goose/pull/9471)
- Skills to the chat composer [#8881](https://github.com/aaif-goose/goose/pull/8881)
- Dynamically refresh skill instructions each turn [#9217](https://github.com/aaif-goose/goose/pull/9217)
- CLI to list skills with token counts [#9326](https://github.com/aaif-goose/goose/pull/9326)
- Image read tool [#9607](https://github.com/aaif-goose/goose/pull/9607)
- View model interactions [#9806](https://github.com/aaif-goose/goose/pull/9806)
- UniFFI SDK for cross-language bindings [#9593](https://github.com/aaif-goose/goose/pull/9593)
- Provider bindings MVP to goose-sdk with Python wheel publishing [#10208](https://github.com/aaif-goose/goose/pull/10208)
- Kotlin FFI with build and Maven publish [#10375](https://github.com/aaif-goose/goose/pull/10375)
- Create source archive as release artifact [#10786](https://github.com/aaif-goose/goose/pull/10786)

### New Providers

- Celeris provider [#10714](https://github.com/aaif-goose/goose/pull/10714)
- Friendli declarative provider [#10762](https://github.com/aaif-goose/goose/pull/10762)
- Azure AI Foundry multi-LLM provider [#10622](https://github.com/aaif-goose/goose/pull/10622)
- OllamaCloud provider with dynamic model discovery [#10264](https://github.com/aaif-goose/goose/pull/10264)
- Sakana AI provider for OpenAI-compatible Fugu API [#10357](https://github.com/aaif-goose/goose/pull/10357)
- iFlytek Spark and Astron MaaS providers [#9837](https://github.com/aaif-goose/goose/pull/9837)
- Fireworks AI declarative provider [#9990](https://github.com/aaif-goose/goose/pull/9990)
- OpenRouter request parameters support [#9276](https://github.com/aaif-goose/goose/pull/9276)
- Together AI declarative provider [#9545](https://github.com/aaif-goose/goose/pull/9545)
- OrcaRouter declarative provider [#9515](https://github.com/aaif-goose/goose/pull/9515)
- Perplexity declarative provider [#9324](https://github.com/aaif-goose/goose/pull/9324)
- Alibaba (Qwen via DashScope) declarative provider [#9443](https://github.com/aaif-goose/goose/pull/9443)
- Databricks AI Gateway provider [#9274](https://github.com/aaif-goose/goose/pull/9274)
- Scaleway provider [#9254](https://github.com/aaif-goose/goose/pull/9254)
- NEAR AI Cloud provider [#9352](https://github.com/aaif-goose/goose/pull/9352)
- EmpirioLabs declarative provider [#9771](https://github.com/aaif-goose/goose/pull/9771)
- xAI SuperGrok OAuth subscription provider [#9420](https://github.com/aaif-goose/goose/pull/9420)
- Vercel AI Gateway [#9144](https://github.com/aaif-goose/goose/pull/9144)
- Routstr declarative provider [#9175](https://github.com/aaif-goose/goose/pull/9175)
- FuturMix provider [#8840](https://github.com/aaif-goose/goose/pull/8840)
- oMLX declarative provider [#9177](https://github.com/aaif-goose/goose/pull/9177)
- Atomic Chat declarative provider [#9210](https://github.com/aaif-goose/goose/pull/9210)
- Muse Spark 1.1 via Meta Models API [#10432](https://github.com/aaif-goose/goose/pull/10432)
- AWS Bedrock support for OpenAI GPT models via mantle endpoint [#9707](https://github.com/aaif-goose/goose/pull/9707)
- Azure AD (Entra ID) bearer token auth via AZURE_OPENAI_AD_TOKEN [#9716](https://github.com/aaif-goose/goose/pull/9716)

### New Models

- GPT-5.6 support [#10384](https://github.com/aaif-goose/goose/pull/10384), [#10349](https://github.com/aaif-goose/goose/pull/10349)
- GPT-5.5 to ChatGPT Codex known models [#9292](https://github.com/aaif-goose/goose/pull/9292)
- GLM-5.2 support [#9967](https://github.com/aaif-goose/goose/pull/9967)
- Opus5 support with adaptive thinking [#10686](https://github.com/aaif-goose/goose/pull/10686)
- Claude-sonnet-5 and claude-fable-5 to known models [#10865](https://github.com/aaif-goose/goose/pull/10865), [#10183](https://github.com/aaif-goose/goose/pull/10183)
- Cursor composer-2.5 models [#10618](https://github.com/aaif-goose/goose/pull/10618)
- Cursor-agent models from CLI [#10367](https://github.com/aaif-goose/goose/pull/10367)
- Latest Gemini models [#10630](https://github.com/aaif-goose/goose/pull/10630)
- Gemini 3.x known locations and KNOWN_MODELS entries [#9142](https://github.com/aaif-goose/goose/pull/9142)
- MiniMax-M3 and M2.7 variants [#10431](https://github.com/aaif-goose/goose/pull/10431)
- OVHcloud Qwen3.6-27B model [#10339](https://github.com/aaif-goose/goose/pull/10339)

### Internationalization

- French, German, Italian, Portuguese, Indonesian, Malay, Vietnamese, zh-TW desktop locales [#10072](https://github.com/aaif-goose/goose/pull/10072)
- Korean localization [#9856](https://github.com/aaif-goose/goose/pull/9856), [#10667](https://github.com/aaif-goose/goose/pull/10667)
- Spanish (es) locale [#9833](https://github.com/aaif-goose/goose/pull/9833)
- Japanese locale [#9768](https://github.com/aaif-goose/goose/pull/9768)
- Hindi Desktop locale [#9733](https://github.com/aaif-goose/goose/pull/9733)
- Russian language support [#9406](https://github.com/aaif-goose/goose/pull/9406)
- Turkish desktop locale [#9392](https://github.com/aaif-goose/goose/pull/9392)
- Simplified Chinese (zh-CN) translation [#8765](https://github.com/aaif-goose/goose/pull/8765)
- Language selection feature [#9405](https://github.com/aaif-goose/goose/pull/9405)

## 🐛 Bug Fixes

- Reject invalid subrecipe content [#10994](https://github.com/aaif-goose/goose/pull/10994)
- Keep turn-context in place for OpenAI Responses-stack models for prompt caching [#10993](https://github.com/aaif-goose/goose/pull/10993)
- Byte-bound the shell truncation preview [#10992](https://github.com/aaif-goose/goose/pull/10992)
- Stop silently ignoring thinking effort off for OpenRouter [#10991](https://github.com/aaif-goose/goose/pull/10991)
- Dispatch edited queued messages [#10933](https://github.com/aaif-goose/goose/pull/10933)
- Contain recipe template paths [#10930](https://github.com/aaif-goose/goose/pull/10930)
- Make shell approval titles faithful [#10986](https://github.com/aaif-goose/goose/pull/10986)
- Block MCP app form submissions [#10985](https://github.com/aaif-goose/goose/pull/10985)
- Sanitize Bedrock tool errors [#10934](https://github.com/aaif-goose/goose/pull/10934)
- Implicit OAuth during model discovery [#10929](https://github.com/aaif-goose/goose/pull/10929)
- Keep ACP session naming out of live conversations [#10963](https://github.com/aaif-goose/goose/pull/10963)
- Sanitize Unicode tags in MCP resources [#10746](https://github.com/aaif-goose/goose/pull/10746)
- Preserve RFC 9207 iss from MCP OAuth callback [#10678](https://github.com/aaif-goose/goose/pull/10678)
- Shell ACP providers on desktop [#10907](https://github.com/aaif-goose/goose/pull/10907)
- Stop killing streaming responses at the total request timeout [#10620](https://github.com/aaif-goose/goose/pull/10620)
- Restore final_output_tool when agent is recreated after LRU eviction [#10793](https://github.com/aaif-goose/goose/pull/10793)
- Avoid O(n²) cloning during session load [#10665](https://github.com/aaif-goose/goose/pull/10665)
- Prefix child stderr log target so it passes the default goose=info filter [#10901](https://github.com/aaif-goose/goose/pull/10901)
- Fall back to static model list only for non-models payloads [#10189](https://github.com/aaif-goose/goose/pull/10189)
- Stdio extensions silently skipped when name missing or env: used in config [#10773](https://github.com/aaif-goose/goose/pull/10773)
- Start scheduler at startup instead of first ACP connection [#10766](https://github.com/aaif-goose/goose/pull/10766)
- Respect disabled builtin extensions (developer) at session start [#10223](https://github.com/aaif-goose/goose/pull/10223)
- Parse PyPI requirements for OSV checks [#10510](https://github.com/aaif-goose/goose/pull/10510)
- Contain voice file extensions in telegram [#10456](https://github.com/aaif-goose/goose/pull/10456)
- Preserve denied tool request precedence [#10612](https://github.com/aaif-goose/goose/pull/10612)
- Contain subdirectory hint discovery [#10545](https://github.com/aaif-goose/goose/pull/10545)
- Clear stale validation error when reopening the schedule modal [#10627](https://github.com/aaif-goose/goose/pull/10627)
- Sanitize shell/subprocess call in linux.rs [#10748](https://github.com/aaif-goose/goose/pull/10748)
- Unlink destination before copying binaries [#10705](https://github.com/aaif-goose/goose/pull/10705)
- Honor timeout_seconds on the Anthropic declarative provider [#10440](https://github.com/aaif-goose/goose/pull/10440)
- Allow removing images when editing user messages [#9979](https://github.com/aaif-goose/goose/pull/9979)
- Preserve thinking inline for Cerebras models that reject reasoning_content [#10774](https://github.com/aaif-goose/goose/pull/10774)
- Make CLI streaming render incremental instead of O(n^2) [#10487](https://github.com/aaif-goose/goose/pull/10487)
- Together provider: parse model list response [#10576](https://github.com/aaif-goose/goose/pull/10576)
- DeepSeek model names to v4 API [#10729](https://github.com/aaif-goose/goose/pull/10729)
- Forward Claude Code and Pi model picker selection to the adapter [#10675](https://github.com/aaif-goose/goose/pull/10675), [#10707](https://github.com/aaif-goose/goose/pull/10707)
- Preserve enabled flag when migrating platform extensions [#10690](https://github.com/aaif-goose/goose/pull/10690)
- Pass session working_dir to on_call_tool [#10689](https://github.com/aaif-goose/goose/pull/10689)
- Preserve adversary tool arguments [#10529](https://github.com/aaif-goose/goose/pull/10529)
- Keep XML snippets inside JSON as data for local-inference [#10606](https://github.com/aaif-goose/goose/pull/10606)
- Sync generated chat title in header [#10578](https://github.com/aaif-goose/goose/pull/10578)
- Prompt for tool approval in Telegram gateway sessions [#10613](https://github.com/aaif-goose/goose/pull/10613)
- Keep CLI provider prompts out of process arguments [#10547](https://github.com/aaif-goose/goose/pull/10547)
- Ignore stale inventory for static model lists [#10591](https://github.com/aaif-goose/goose/pull/10591)
- Preserve featured model size on delete and backfill missing sizes [#10422](https://github.com/aaif-goose/goose/pull/10422)
- Create inventory tables atomically with schema version [#10586](https://github.com/aaif-goose/goose/pull/10586)
- Rewrite oneOf to anyOf in tool schemas for OpenAI-compatible backends [#10571](https://github.com/aaif-goose/goose/pull/10571)
- Allow custom model as default for non-local providers [#10438](https://github.com/aaif-goose/goose/pull/10438)
- Require absolute goose path roots [#10454](https://github.com/aaif-goose/goose/pull/10454)
- Scope smart approval by request [#10457](https://github.com/aaif-goose/goose/pull/10457)
- Preserve fixed subrecipe values [#10452](https://github.com/aaif-goose/goose/pull/10452)
- Bundle git so hermit can clone its package registry in Flatpak [#10511](https://github.com/aaif-goose/goose/pull/10511)
- Forward image content chunks to client during live ACP session [#10485](https://github.com/aaif-goose/goose/pull/10485)
- Dispatch Code Mode callbacks on main runtime to prevent hangs [#10484](https://github.com/aaif-goose/goose/pull/10484)
- Protect OAuth token caches [#10516](https://github.com/aaif-goose/goose/pull/10516)
- Preserve content audience boundaries [#10493](https://github.com/aaif-goose/goose/pull/10493)
- Bound scheduled recipe validation [#10509](https://github.com/aaif-goose/goose/pull/10509)
- Return JSON-RPC errors from dispatch handlers instead of killing the connection [#10499](https://github.com/aaif-goose/goose/pull/10499)
- Avoid local inference Metal teardown crash [#10508](https://github.com/aaif-goose/goose/pull/10508)
- Enable indexmap serde support for musl builds [#10507](https://github.com/aaif-goose/goose/pull/10507)
- Scroll chat to the latest reply on session resume [#10501](https://github.com/aaif-goose/goose/pull/10501)
- Secure large response spill files [#10482](https://github.com/aaif-goose/goose/pull/10482)
- Register LiteLLM with refresh_only inventory so model picker lists models [#10489](https://github.com/aaif-goose/goose/pull/10489)
- Limit provider selector height in CLI [#10420](https://github.com/aaif-goose/goose/pull/10420)
- Tighten existing secrets file permissions [#10453](https://github.com/aaif-goose/goose/pull/10453)
- Classify image access capabilities in developer extension [#10451](https://github.com/aaif-goose/goose/pull/10451)
- Preserve one-time permission scope [#10450](https://github.com/aaif-goose/goose/pull/10450)
- Register goose:// scheme handler in Flatpak desktop entry [#10461](https://github.com/aaif-goose/goose/pull/10461)
- Reject duplicate recipe parameter keys [#10448](https://github.com/aaif-goose/goose/pull/10448)
- Synchronously kill orphaned goose serve backends on GUI close [#10292](https://github.com/aaif-goose/goose/pull/10292)
- Break self-referential $ref cycles before Code Mode schema [#10469](https://github.com/aaif-goose/goose/pull/10469)
- Stop multiline paste auto-submitting line-by-line on Windows [#10326](https://github.com/aaif-goose/goose/pull/10326)
- Hide nested config values in Configuration Editor [#10390](https://github.com/aaif-goose/goose/pull/10390)
- Stop resolving TUI scripts from cwd [#10449](https://github.com/aaif-goose/goose/pull/10449)
- Exclude MCP App tools from Code Mode callbacks [#10290](https://github.com/aaif-goose/goose/pull/10290)
- Apply the default extension timeout to developer shell tool calls [#10348](https://github.com/aaif-goose/goose/pull/10348)
- Preserve reasoning_content for DeepSeek thinking mode on multi-turn tool calls [#10366](https://github.com/aaif-goose/goose/pull/10366)
- Make prompt timestamps timezone-explicit [#10209](https://github.com/aaif-goose/goose/pull/10209)
- Compact disabled during approval [#10089](https://github.com/aaif-goose/goose/pull/10089)
- Treat empty-string finish_reason as non-terminal in streaming [#10258](https://github.com/aaif-goose/goose/pull/10258)
- Gemini OAuth onboarding [#10363](https://github.com/aaif-goose/goose/pull/10363), [#8905](https://github.com/aaif-goose/goose/pull/8905)
- Retry empty provider turns instead of stopping silently [#10360](https://github.com/aaif-goose/goose/pull/10360)
- Guard llama.cpp backend init against SIGILL on x86_64 CPUs without FMA/AVX2 [#10105](https://github.com/aaif-goose/goose/pull/10105)
- Sanitize responses function call names [#10344](https://github.com/aaif-goose/goose/pull/10344)
- Pick session mode from the ids the agent actually offers [#10320](https://github.com/aaif-goose/goose/pull/10320)
- Dedupe duplicate signed thinking blocks to fix Anthropic 400 [#10083](https://github.com/aaif-goose/goose/pull/10083)
- Resolve provider default model instead of leaking sentinel "current" [#10305](https://github.com/aaif-goose/goose/pull/10305)
- Return effective context limit from /model-info [#10165](https://github.com/aaif-goose/goose/pull/10165)
- Gate rcgen aws_lc_rs feature behind rustls-tls [#10116](https://github.com/aaif-goose/goose/pull/10116)
- Tolerate partial Responses output items [#10108](https://github.com/aaif-goose/goose/pull/10108)
- Always use OpenAI-compatible "parameters" for tools in Databricks [#10101](https://github.com/aaif-goose/goose/pull/10101)
- Unescape shell-escaped image paths [#10098](https://github.com/aaif-goose/goose/pull/10098)
- Seed mac auto-update config [#10132](https://github.com/aaif-goose/goose/pull/10132)
- Send inference config (max_tokens, temperature) on Bedrock Converse [#9889](https://github.com/aaif-goose/goose/pull/9889)
- Dedupe Nostr session deep link imports [#9918](https://github.com/aaif-goose/goose/pull/9918)
- Don't retry deterministically-permanent 400s (thinking-block immutability) [#10005](https://github.com/aaif-goose/goose/pull/10005)
- Use async reqwest client so OTLP export works in `goose serve` mode [#10100](https://github.com/aaif-goose/goose/pull/10100)
- Reject non-object tool-call arguments instead of panicking [#9832](https://github.com/aaif-goose/goose/pull/9832)
- Save /edit prompts to history [#10011](https://github.com/aaif-goose/goose/pull/10011)
- Use session.message_count for schedule sessions listing [#10026](https://github.com/aaif-goose/goose/pull/10026)
- Support streamed tool calls without indexes [#10023](https://github.com/aaif-goose/goose/pull/10023)
- Disable extended thinking for fast-model operations [#9815](https://github.com/aaif-goose/goose/pull/9815)
- Buffer thinking across stream chunks for DeepSeek/Kimi tool calls [#9704](https://github.com/aaif-goose/goose/pull/9704)
- Surface actionable errors for truncated tool-call arguments [#9946](https://github.com/aaif-goose/goose/pull/9946)
- Show optimistic toggle state when disabling an extension [#9882](https://github.com/aaif-goose/goose/pull/9882)
- Resolve databricks_v2 pricing and surface cost in standard usage update [#9925](https://github.com/aaif-goose/goose/pull/9925)
- Publish mac updater metadata [#9945](https://github.com/aaif-goose/goose/pull/9945)
- Activate hermit on macOS so STDIO extensions resolve node [#9482](https://github.com/aaif-goose/goose/pull/9482)
- Accept JSON-encoded string for autovisualiser data parameter [#9838](https://github.com/aaif-goose/goose/pull/9838)
- Send User-Agent on URL image fetches in developer/read_image [#9927](https://github.com/aaif-goose/goose/pull/9927)
- Do not pass temperature to ChatGPT Codex provider [#9931](https://github.com/aaif-goose/goose/pull/9931)
- Sanitize extension environment maps [#9884](https://github.com/aaif-goose/goose/pull/9884)
- GCP: use refreshed gcloud token after reauth (retry Vertex AI on 401/403) [#9849](https://github.com/aaif-goose/goose/pull/9849)
- Start a turn when /goal or /grind is set [#9801](https://github.com/aaif-goose/goose/pull/9801)
- Pass thinking config to Bedrock Anthropic models [#9794](https://github.com/aaif-goose/goose/pull/9794)
- Keep extensions icon visible after switching sessions [#9787](https://github.com/aaif-goose/goose/pull/9787)
- Skip non-recipe project config files in summon [#9808](https://github.com/aaif-goose/goose/pull/9808)
- Dedup duplicate tool-call ids within a turn [#9792](https://github.com/aaif-goose/goose/pull/9792)
- Resolve bundled extensions from discovery [#9759](https://github.com/aaif-goose/goose/pull/9759)
- Custom OpenAI provider dropping port when URL scheme is omitted [#9730](https://github.com/aaif-goose/goose/pull/9730)
- Preserve Windows backslash paths in custom extension command [#9741](https://github.com/aaif-goose/goose/pull/9741)
- Include agentInfo in ACP initialize response [#9765](https://github.com/aaif-goose/goose/pull/9765)
- ACP cancel race condition [#9804](https://github.com/aaif-goose/goose/pull/9804)
- Inherit login-shell PATH in spawned subagents [#9737](https://github.com/aaif-goose/goose/pull/9737)
- Accept string values for GOOSE_CONTEXT_LIMIT [#9738](https://github.com/aaif-goose/goose/pull/9738)
- Clear rejected OAuth credentials after refresh [#9694](https://github.com/aaif-goose/goose/pull/9694)
- Keep extended thinking within the Anthropic output cap [#9814](https://github.com/aaif-goose/goose/pull/9814)
- Disable RPM build-id links [#9671](https://github.com/aaif-goose/goose/pull/9671)
- Preserve custom API path in base_url derivation for OpenAI [#9649](https://github.com/aaif-goose/goose/pull/9649)
- Handle resume deep links [#9298](https://github.com/aaif-goose/goose/pull/9298)
- Repair PATH for plugin hook commands [#9615](https://github.com/aaif-goose/goose/pull/9615)
- Restore Cmd/Ctrl+T new chat shortcut [#9614](https://github.com/aaif-goose/goose/pull/9614)
- Lead with extension description, shorten HTTP/SSE transport label [#9653](https://github.com/aaif-goose/goose/pull/9653)
- Mention menu icon to open the sidebar [#9643](https://github.com/aaif-goose/goose/pull/9643)
- Dedupe React to prevent multiple instances in renderer [#9631](https://github.com/aaif-goose/goose/pull/9631)
- Add hermit cleanup to uvx and jbang scripts [#9616](https://github.com/aaif-goose/goose/pull/9616)
- Use blocking OTLP HTTP exporter [#9599](https://github.com/aaif-goose/goose/pull/9599)
- Fall back to default provider when resuming session with unavailable provider [#9547](https://github.com/aaif-goose/goose/pull/9547)
- Provide Tokio runtime for OTLP HTTP exporter batch thread [#9541](https://github.com/aaif-goose/goose/pull/9541)
- Read meta.n_ctx from /v1/models to fix context limit for local servers [#9530](https://github.com/aaif-goose/goose/pull/9530)
- Align session history scrollbar with window edge [#9601](https://github.com/aaif-goose/goose/pull/9601)
- Refresh session name in sidebar after rename [#9543](https://github.com/aaif-goose/goose/pull/9543)
- Show resolved skill supporting file paths [#9584](https://github.com/aaif-goose/goose/pull/9584)
- Implement real Bedrock streaming via ConverseStream API [#9579](https://github.com/aaif-goose/goose/pull/9579)
- Record OpenAI-native cached_tokens in usage metering [#9829](https://github.com/aaif-goose/goose/pull/9829)
- Add option for overriding API URL for Moonshot provider [#9819](https://github.com/aaif-goose/goose/pull/9819)
- Detect image paths with spaces [#9387](https://github.com/aaif-goose/goose/pull/9387)
- Restore new chat shortcut navigation [#9528](https://github.com/aaif-goose/goose/pull/9528)
- Evict stale completed tasks to prevent unbounded memory growth in summon [#9514](https://github.com/aaif-goose/goose/pull/9514)
- OAuth: time out the MCP callback wait instead of hanging in WSL [#9536](https://github.com/aaif-goose/goose/pull/9536)
- Warn on unmatched extension names in summon delegate [#9513](https://github.com/aaif-goose/goose/pull/9513)
- Deleting a recently created session and then creating a new shows the deleted session's content [#9351](https://github.com/aaif-goose/goose/pull/9351)
- Propagate elicitation decline and cancel actions end-to-end [#9437](https://github.com/aaif-goose/goose/pull/9437)
- Close modal when canceling recipe parameter form [#9195](https://github.com/aaif-goose/goose/pull/9195)
- Ensure tool request timestamp precedes tool response timestamp [#9462](https://github.com/aaif-goose/goose/pull/9462)
- Correctly map ollama_cloud to canonical provider [#9639](https://github.com/aaif-goose/goose/pull/9639)
- Incorrect max tokens values for groq provider [#9790](https://github.com/aaif-goose/goose/pull/9790)
- Mark stream decode errors retryable [#9723](https://github.com/aaif-goose/goose/pull/9723)
- Classify Bedrock ValidationException as ExecutionError [#9735](https://github.com/aaif-goose/goose/pull/9735)
- Page through all Databricks AI Gateway v2 endpoints when listing models [#9753](https://github.com/aaif-goose/goose/pull/9753)
- Preserve unparseable extension entries during config refresh [#9439](https://github.com/aaif-goose/goose/pull/9439)
- Sync slash help with builtins in CLI [#10173](https://github.com/aaif-goose/goose/pull/10173)
- Treat unicode punctuation as image path terminators [#10106](https://github.com/aaif-goose/goose/pull/10106)
- Don't bleed provider-specific request_params into delegate() sessions [#9906](https://github.com/aaif-goose/goose/pull/9906)
- Purge empty phantom sessions on startup [#9651](https://github.com/aaif-goose/goose/pull/9651)
- Include structuredContent from MCP tool response [#10128](https://github.com/aaif-goose/goose/pull/10128)
- Propagate agent cleanup errors on session delete [#10112](https://github.com/aaif-goose/goose/pull/10112)
- Prevent login-shell PATH probe from suspending goose on startup [#8804](https://github.com/aaif-goose/goose/pull/8804)
- Exclude preprompt from session title generation [#8793](https://github.com/aaif-goose/goose/pull/8793)
- Unscheduling a recipe should not delete them [#8978](https://github.com/aaif-goose/goose/pull/8978)
- Seed provider handoff history in ACP [#8941](https://github.com/aaif-goose/goose/pull/8941)
- Respect goose2 interface density settings [#8953](https://github.com/aaif-goose/goose/pull/8953)
- Make goose2 respect accent color [#8952](https://github.com/aaif-goose/goose/pull/8952)
- Preserve replay message timestamps [#8942](https://github.com/aaif-goose/goose/pull/8942)
- Goose2 window minimum sizing [#8946](https://github.com/aaif-goose/goose/pull/8946)
- Avoid transform-rasterized dialog text in goose2 [#8937](https://github.com/aaif-goose/goose/pull/8937)
- Keep renamed skills open in detail view [#8935](https://github.com/aaif-goose/goose/pull/8935)
- Model picker stays usable during provider loading [#8900](https://github.com/aaif-goose/goose/pull/8900)
- Handle ACP requests concurrently [#8781](https://github.com/aaif-goose/goose/pull/8781)
- Apply hermit env directly in node shims so a fish login shell doesn't break MCP startup [#10028](https://github.com/aaif-goose/goose/pull/10028)
- Preserve command arguments through extension forms [#10527](https://github.com/aaif-goose/goose/pull/10527)
- Enforce manual approval for code mode [#10528](https://github.com/aaif-goose/goose/pull/10528)
- Confine app file operations [#10481](https://github.com/aaif-goose/goose/pull/10481)
- Preserve recursive schema types with pctx 0.4.1 in code-mode [#10572](https://github.com/aaif-goose/goose/pull/10572)
- Use shell working directory on initial launch [#10655](https://github.com/aaif-goose/goose/pull/10655)
- Enable inventory refresh for OpenRouter model picker [#10641](https://github.com/aaif-goose/goose/pull/10641)
- Preserve read lines and reload tool output in ACP [#10662](https://github.com/aaif-goose/goose/pull/10662)
- Surface tool call output in CLI and Desktop [#10654](https://github.com/aaif-goose/goose/pull/10654)
- Overlong function names in provider requests [#10659](https://github.com/aaif-goose/goose/pull/10659)
- Preserve ACP tool call update fields [#10653](https://github.com/aaif-goose/goose/pull/10653)
- Omit disabled OpenRouter reasoning [#10517](https://github.com/aaif-goose/goose/pull/10517)
- Clear stale pending ACP connection after terminal recovery failure [#10552](https://github.com/aaif-goose/goose/pull/10552)
- Confirm pending steer message on queuedSteer notification [#10532](https://github.com/aaif-goose/goose/pull/10532)
- Restore dynamic model discovery and current Grok support [#10756](https://github.com/aaif-goose/goose/pull/10756)
- Reuse parent provider for summon delegates [#10754](https://github.com/aaif-goose/goose/pull/10754)
- Skip permission mode negotiation for Pi [#10701](https://github.com/aaif-goose/goose/pull/10701)
- Freeze turn-context timestamp at turn start to preserve prefix cache [#10734](https://github.com/aaif-goose/goose/pull/10734)
- Refresh Moonshot model list with current Kimi lineup [#10696](https://github.com/aaif-goose/goose/pull/10696)
- Update Kimi-code known models metadata with current platform lineup [#10713](https://github.com/aaif-goose/goose/pull/10713)
- Avoid double loading full conversation on session open [#10794](https://github.com/aaif-goose/goose/pull/10794)
- Recover malformed tool calls from GLM/Minimax models instead of rejecting them [#10230](https://github.com/aaif-goose/goose/pull/10230)
- Restore cursor when configure exits [#4889](https://github.com/aaif-goose/goose/pull/4889)

## 🔧 Improvements

- Keep turn-context out of the OpenAI-compatible prefix cache [#10937](https://github.com/aaif-goose/goose/pull/10937)
- Keep turn-context out of the Anthropic prefix cache [#10030](https://github.com/aaif-goose/goose/pull/10030)
- Parallelize provider resolution and eagerly init SQLite pool [#8899](https://github.com/aaif-goose/goose/pull/8899)
- Deduplicate _goose/providers/list RPC call at startup [#8873](https://github.com/aaif-goose/goose/pull/8873)
- Compact tool schema JSON [#10409](https://github.com/aaif-goose/goose/pull/10409)
- Drop debug info for dependencies in the dev profile [#9843](https://github.com/aaif-goose/goose/pull/9843)
- Use LRU cache for token counting [#9586](https://github.com/aaif-goose/goose/pull/9586)
- Mergeable configs with cleanup [#8378](https://github.com/aaif-goose/goose/pull/8378)
- Structured per-provider config block with non-destructive provider switching [#8977](https://github.com/aaif-goose/goose/pull/8977)
- Linux musl CLI builds [#9240](https://github.com/aaif-goose/goose/pull/9240)
- Windows CUDA release artifacts [#8750](https://github.com/aaif-goose/goose/pull/8750)
- Linux desktop Vulkan packages [#9323](https://github.com/aaif-goose/goose/pull/9323)
- Migrate desktop routing to React Router 8.3.0 [#10971](https://github.com/aaif-goose/goose/pull/10971)
- Upgrade to rmcp 3.0 [#10789](https://github.com/aaif-goose/goose/pull/10789)
- Handle MCP tool list change notifications [#e7088ee](https://github.com/aaif-goose/goose/commit/e7088ee)
- Redesign Extensions page [#8940](https://github.com/aaif-goose/goose/pull/8940)
- Redesign skills library [#8868](https://github.com/aaif-goose/goose/pull/8868)
- Dark mode inline code styling for message bubbles [#10861](https://github.com/aaif-goose/goose/pull/10861)
- Refine dark theme message surfaces [#10693](https://github.com/aaif-goose/goose/pull/10693)
- Inline code contrast improvement in light theme [#9058](https://github.com/aaif-goose/goose/pull/9058)
- Polish sidebar navigation and project icons [#8896](https://github.com/aaif-goose/goose/pull/8896)
- Simplify UI customization [#9353](https://github.com/aaif-goose/goose/pull/9353)
- Better parsing of pasted HTML as markdown so agents understand [#9190](https://github.com/aaif-goose/goose/pull/9190)
- Remove CLI project support [#10838](https://github.com/aaif-goose/goose/pull/10838)
- Deprecate and remove ui/text TUI [#10799](https://github.com/aaif-goose/goose/pull/10799)
- Remove MCP sampling support [#10087](https://github.com/aaif-goose/goose/pull/10087)
- Make context exceeded checker more precise [#9831](https://github.com/aaif-goose/goose/pull/9831)
- Update canonical model inventory [#10352](https://github.com/aaif-goose/goose/pull/10352), [#9709](https://github.com/aaif-goose/goose/pull/9709), [#9551](https://github.com/aaif-goose/goose/pull/9551), [#9331](https://github.com/aaif-goose/goose/pull/9331)
- Add canonical thinking modes [#9743](https://github.com/aaif-goose/goose/pull/9743)
- Nushell terminal and completion support [#8628](https://github.com/aaif-goose/goose/pull/8628)
- Migrate diagnostics to JSON report [#9964](https://github.com/aaif-goose/goose/pull/9964)
- Route MCP elicitations through tool streams [#9943](https://github.com/aaif-goose/goose/pull/9943)
- Allow unlisted models in search [#9933](https://github.com/aaif-goose/goose/pull/9933)
- ACP paginate session list [#9199](https://github.com/aaif-goose/goose/pull/9199)
- Flush OTLP traces reliably on exit with configurable timeout [#9228](https://github.com/aaif-goose/goose/pull/9228)
- Increase /mcp-app-guest body limit for larger single-file MCP apps [#10324](https://github.com/aaif-goose/goose/pull/10324)
- Use current_exe() instead of PATH lookup when spawning goose [#9236](https://github.com/aaif-goose/goose/pull/9236)
- Set TCP_USER_TIMEOUT on streamable HTTP clients in extension_manager [#9207](https://github.com/aaif-goose/goose/pull/9207)
- Fail closed on unverifiable update provenance [#10168](https://github.com/aaif-goose/goose/pull/10168)
- Trim macOS desktop entitlements [#10490](https://github.com/aaif-goose/goose/pull/10490)
- Consolidate and harden release workflows [#10447](https://github.com/aaif-goose/goose/pull/10447)
- Update Rust toolchain and raise recursion limit [#10303](https://github.com/aaif-goose/goose/pull/10303)
- Enhance the uniffi API layer [#10427](https://github.com/aaif-goose/goose/pull/10427)
- Bound code-mode execution with timeout and cancellation [#10214](https://github.com/aaif-goose/goose/pull/10214)
- Switch local inference MLX backend to use safemlx crate [#10304](https://github.com/aaif-goose/goose/pull/10304)
- Preserve thinking content for providers that require it [#8857](https://github.com/aaif-goose/goose/pull/8857), [#9314](https://github.com/aaif-goose/goose/pull/9314)
- Build summon instructions per turn [#9329](https://github.com/aaif-goose/goose/pull/9329)
- Refactor local inference around backends [#9137](https://github.com/aaif-goose/goose/pull/9137)
- Stricter GGUF requirements with auto detection of tool calling support and fixed thinking output parsing [#9442](https://github.com/aaif-goose/goose/pull/9442)
- Prefer goose aliases for Databricks v2 inventory [#9430](https://github.com/aaif-goose/goose/pull/9430)
- ACP migration: UI connect to ACP directly instead of goosed [#10081](https://github.com/aaif-goose/goose/pull/10081)
- Unified OTLP logging schema for cross-tool detection [#9713](https://github.com/aaif-goose/goose/pull/9713)
- Pattern-based detection updates for prompt injection [#9350](https://github.com/aaif-goose/goose/pull/9350), [#9198](https://github.com/aaif-goose/goose/pull/9198), [#9690](https://github.com/aaif-goose/goose/pull/9690), [#8546](https://github.com/aaif-goose/goose/pull/8546)
- Enable prompt injection mitigation by default for internal users [#9612](https://github.com/aaif-goose/goose/pull/9612)
- OpenAI Responses API store param configurable [#10040](https://github.com/aaif-goose/goose/pull/10040)
- GitHub Copilot /responses API [#9043](https://github.com/aaif-goose/goose/pull/9043)
- Check for responses API support in Databricks [#9347](https://github.com/aaif-goose/goose/pull/9347)
- Honor Retry-After on 429 responses [#9161](https://github.com/aaif-goose/goose/pull/9161)
- Coalesce streaming Thinking deltas and list available tools on not-found [#9162](https://github.com/aaif-goose/goose/pull/9162)
- Strip chain-of-thought markers from custom provider output [#8635](https://github.com/aaif-goose/goose/pull/8635)
- Coalesce streaming chunks under one message id in ACP [#8788](https://github.com/aaif-goose/goose/pull/8788)

## 📚 Documentation

- Document auto-injected GOOSE_SHELL flags [#10759](https://github.com/aaif-goose/goose/pull/10759)
- Clarify macOS sandbox feature was removed in post-v1.25.0 cleanup [#10900](https://github.com/aaif-goose/goose/pull/10900)
- Update Discord invite [#10863](https://github.com/aaif-goose/goose/pull/10863)
- Update environment and config references [#10203](https://github.com/aaif-goose/goose/pull/10203)
- Document hook deny contract, matcher regex, tool_input keys, and provider config [#10467](https://github.com/aaif-goose/goose/pull/10467)
- Add Code of Conduct [#10424](https://github.com/aaif-goose/goose/pull/10424)
- Adopt issue-first contribution workflow [#10819](https://github.com/aaif-goose/goose/pull/10819)
- Update docs for ACP clients [#9772](https://github.com/aaif-goose/goose/pull/9772)
- Hooks guide [#9288](https://github.com/aaif-goose/goose/pull/9288)
- Custom agents guide [#9293](https://github.com/aaif-goose/goose/pull/9293)
- Guide for connecting goose Desktop to a remote goosed server [#9275](https://github.com/aaif-goose/goose/pull/9275)
- Document summon extension requirement for delegate and load tools [#9231](https://github.com/aaif-goose/goose/pull/9231)
- Refresh Ophis extension page (tool list, chains, skills link) [#10681](https://github.com/aaif-goose/goose/pull/10681)
- Clean up stale documentation audit findings [#10114](https://github.com/aaif-goose/goose/pull/10114)
- Reorganize docs [#9310](https://github.com/aaif-goose/goose/pull/9310)
- Blog: Goose with Peekaboo [#8884](https://github.com/aaif-goose/goose/pull/8884)
- Blog: Built-in Local Inference [#8808](https://github.com/aaif-goose/goose/pull/8808)
- Blog: Orchestrating with Goose [#9104](https://github.com/aaif-goose/goose/pull/9104)
- Blog: Self-improving agents [#9846](https://github.com/aaif-goose/goose/pull/9846)
- Blog: AAIF migration [#9866](https://github.com/aaif-goose/goose/pull/9866)
- Blog: MiniMax and Office QA benchmark findings [#8984](https://github.com/aaif-goose/goose/pull/8984)