●Change8

v1.48.0

Goose
View on GitHubDocumentation
26 features42 fixes14 improvementsclideveloperextensionsmcpshell

Summary

This release introduces a wide array of new declarative providers, enhancing flexibility in connecting to various AI models. Key features include improved hook capabilities with `on_failure` and stable tool IDs, alongside significant UI enhancements for a smoother user experience. Several bug fixes, particularly in security and provider handling, have been implemented to improve stability and safety.

New Features

  • Added TrustedRouter, OpenCode Zen gateway, Gondola, SayGM, Lynkr, and PleumRouter as declarative providers.
  • Introduced custom provider cost fields to drive cost tracking.
  • Enabled model-native audio transcription provider.
  • Added support for OpenAI GPT-5.6 (sol/terra/luna) routing via AWS Bedrock.
  • Added follow-up support for GPT-5.6 with Codex and Responses API.
  • Introduced an `on_failure` block for PreToolUse hooks.
  • Enabled PreToolUseResult event and stable tool_call_id across the tool lifecycle.
  • Added the ability to select saved recipes when creating a schedule.
  • Configured providers are now sorted to the top of the provider list.
  • Scheduled job sessions are now collapsed into an accordion in chat history.
  • The chat input now auto-focuses when a user starts typing.
  • Added an interactive git branch indicator in the chat bottom bar.
  • Recent used models are now shown in the chat footer model picker.
  • The `--with-extension` CLI command can now name its extension.
  • Introduced a `/new` command to start a fresh session without restarting.
  • Added built-in web-search and browser-use skills.
  • Enabled support for pre-registered OAuth clients for streamable_http extensions.
  • Added derivation and forwarding of thinking effort from the ACP harness.
  • New sessions are now titled from `_meta.sessionTitle`.
  • Added the `_goose/unstable/session/extensions/apply` method.
  • Enhanced OpenTelemetry with request params, response metadata, tool call parity, and agent identification.
  • Enabled OpenRouter session_id forwarding and app category header.
  • Added Blox run target for the ACP server.
  • Released Linux ARM64 desktop packages.
  • Introduced Roaming as an opt-in goose-cli feature.
  • Added MCP conformance tests in CI.

Bug Fixes

  • Fixed security issue where Windows package runners were not recognized.
  • Ensured the system fails closed on malformed tool visibility.
  • Ensured permission denies take precedence over other settings.
  • Cleared custom provider transition secrets to prevent potential leaks.
  • Required fresh file parameter input to prevent unexpected behavior.
  • Escaped OAuth callback content to prevent injection vulnerabilities.
  • Sanitized Unicode tags in MCP prompts to avoid rendering issues.
  • Ensured plugin enablement is honored for skills.
  • Ensured MCP tool model visibility is honored in Code Mode.
  • Suppressed sensitive OTLP traces to protect user data.
  • Ensured the system fails closed on invalid default GCP credentials.
  • Bound call graph traversal to prevent excessive resource consumption.
  • Ensured the system fails closed on invalid Codex ACP mode.
  • Validated memory categories to ensure data integrity.
  • Bound recursive mention scans to prevent infinite loops.
  • Avoided predictable editor symlink creation to enhance security.
  • Ensured the system fails closed on malformed app visibility.
  • Encoded session navigation parameters to prevent issues with special characters.
  • Redacted URLs in provider errors to avoid exposing sensitive information.
  • Validated recipe parameter values to ensure correct operation.
  • Bound Foundry API keys to request origin to prevent misuse.
  • Fixed provider save from overwriting stored config with defaults.
  • Sanitized hidden Unicode characters in Bedrock tools.
  • Bound non-streaming JSON responses to prevent excessive memory usage.
  • Informed the user of clipboard copy status and removed copilot auth retry on timeout.
  • Escaped Gemini tool response ref keys in OpenRouter.
  • Fixed cost estimation for Azure Foundry models via inferred catalog pricing.
  • Coalesced consecutive Thinking blocks in collect_stream.
  • Replaced flat model list with routing table and added Gemma 4 Mantle support.
  • Included thinking tokens in Google usage output_tokens.
  • Sent explicit thinking disabled to adaptive Claude models.
  • Included required annotations field on replayed output_text items.
  • Deprecated the Gemini OAuth provider.
  • Stopped paying the prompt-cache write premium on one-shot fast-model calls.
  • Classified byte-size request limit errors as context-length-exceeded.
  • Bound local image reads to prevent excessive resource usage.
  • Mapped kimi_code provider name and passed the correct provider to create_request.
  • Handled error code for context length exceeded.
  • Ensured DeepSeek and Alibaba compatibility with OpenAI responses API.
  • Ensured remote working directory is honored for new chats and allowed typed paths.
  • Scoped app events by extension to improve isolation.
  • Pinned renderer ACP certificates.

Improvements

  • Updated Z.ai GLM-5.2 to GLM-5.3.
  • Improved model routing by replacing the flat model list with a routing table.
  • Added Gemma 4 Mantle support.
  • Included thinking tokens in Google usage output_tokens.
  • Sent explicit 'thinking disabled' to adaptive Claude models.
  • Included required annotations field on replayed output_text items.
  • Classified byte-size request limit errors as context-length-exceeded.
  • Bound local image reads.
  • Mapped kimi_code provider name and passed the correct provider to create_request.
  • Handled error code for context length exceeded.
  • Ensured DeepSeek and Alibaba compatibility with OpenAI responses API.
  • Ensured remote working directory is honored for new chats and allowed typed paths.
  • Scoped app events by extension.
  • Pinned renderer ACP certificates.

Related Documentation

Goose Documentation

mcpextensionsgetting started