Goose v1.48.0

✨ Features

Providers

• TrustedRouter declarative provider #11422
• OpenCode Zen gateway as a declarative provider #10939
• Gondola as declarative OpenAI-compatible provider #11421
• SayGM as declarative OpenAI-compatible provider #11267
• Lynkr as a declarative OpenAI-compatible provider #11372
• PleumRouter declarative provider #10479
• Z.ai GLM-5.2 replaced with GLM-5.3 #11226
• Custom provider cost fields drive cost tracking #11220
• Model-native audio transcription provider #10589
• OpenAI GPT-5.6 (sol/terra/luna) routing via AWS Bedrock #10502
• GPT-5.6 follow-up support for Codex and Responses API #10460

Hooks

• on_failure block for PreToolUse hooks #11449
• PreToolUseResult event and stable tool_call_id across tool lifecycle #11120

Desktop & UI

• Select saved recipes when creating a schedule #10892
• Sort configured providers to the top of the provider list #11409
• Collapse scheduled job sessions into accordion in chat history #11265
• Auto-focus chat input when user starts typing #11184
• Interactive git branch indicator in chat bottom bar #11290
• Show recent used models in chat footer model picker #11097

CLI

• --with-extension can now name its extension #11127
• /new command to start a fresh session without restarting #10767

Skills & Extensions

• Web-search and browser-use built-in skills #11233
• Support pre-registered OAuth clients for streamable_http extensions #11182

ACP

• Derive and forward thinking effort from the ACP harness #10949
• Title new sessions from _meta.sessionTitle #10712
• _goose/unstable/session/extensions/apply method #11081

Observability

• OpenTelemetry request params, response metadata, tool call parity, and agent identification #11261
• OpenRouter session_id forwarding and app category header #10868

Other

• Blox run target for the ACP server #11423
• Linux ARM64 desktop release packages #11518
• Roaming as opt-in goose-cli feature #11516
• MCP conformance tests in CI #10940

🐛 Bug Fixes

Security

• Recognize Windows package runners #11466
• Fail closed on malformed tool visibility #11474
• Permission denies take precedence #11477
• Clear custom provider transition secrets #11467
• Require fresh file parameter input #11455
• Escape OAuth callback content #11479
• Sanitize Unicode tags in MCP prompts #11453
• Honor plugin enablement for skills #11439
• Honor MCP tool model visibility in Code Mode #11425
• Suppress sensitive OTLP traces #11381
• Fail closed on invalid default GCP credentials #11363
• Bound call graph traversal #11193
• Fail closed on invalid Codex ACP mode #11362
• Validate memory categories #11191
• Bound recursive mention scans #11228
• Avoid predictable editor symlink #11188
• Fail closed on malformed app visibility #11341
• Encode session navigation parameters #11232
• Redact URLs in provider errors #11230
• Validate recipe parameter values #11234
• Bind Foundry API keys to request origin #11347

Providers

• Stop provider save from overwriting stored config with defaults #11517
• Sanitize hidden Unicode in Bedrock tools #11121
• Bound non-streaming JSON responses #11109
• Inform user of clipboard copy and remove copilot auth retry on timeout #11160
• Escape Gemini tool response ref keys in OpenRouter #11276
• Estimate cost for Azure Foundry models via inferred catalog pricing #11264
• Coalesce consecutive Thinking blocks in collect_stream #11317
• Replace flat model list with routing table, add Gemma 4 Mantle support #10297
• Include thinking tokens in Google usage output_tokens #10354
• Send explicit thinking disabled to adaptive Claude models #11177
• Include required annotations field on replayed output_text items #11263
• Deprecated Gemini OAuth provider #11223
• Stop paying the prompt-cache write premium on one-shot fast-model calls #11179
• Classify byte-size request limit errors as context-length-exceeded #11173
• Bound local image reads #11114
• Map kimi_code provider name and pass correct provider to create_request #11130

…