Merge remote-tracking branch 'origin/main' into lifei/agent-browser

* origin/main: (32 commits)
  docs: rework homepage and add aaif migration blog post (#8356)
  chore(aaif): rename a bunch of repository references (#8152)
  fix: use OPENAI_API_KEY secret for recipe security scanner (#8358)
  feat: configurable extension timeouts via ACP _meta and global default (#8295)
  fix: hide hidden extensions in UI (#8346)
  refactor: skills as its own platform ext (#8244)
  fix baseUrl (#8347)
  Fix desktop slash commands (#8341)
  fix(cli): display platform-correct secrets path in keyring config dialog (#8328)
  feat(acp): add reusable ACP provider controls (#8314)
  fix: resolve MDX compilation error in using-goosehints.md (#8332)
  fix: use v1beta1 API version for Google/MaaS models on GCP Vertex AI (#8278)
  docs: add MCP Roots guide (#8252)
  rust acp client for extension methods (#8227)
  fix: reconsolidate split tool-call messages to follow OpenAI format (#7921)
  fix: clean up MCP subprocesses after abrupt parent exit (#8242)
  build: raise default stack reserve to 8 MB (#8234)
  fix(config): honour GOOSE_DISABLE_KEYRING from config.yaml at startup (#8219)
  feat: add configurable fast_model for declarative providers (#8194)
  fix(authentication): Allow connecting to Oauth servers that use protected-resource fallback instead of the WWW-authenticate header (#8148)
  ...

.github/workflows/cargo-deny.yml

@@ -18,7 +18,7 @@ on:
 jobs:
   deny:
     runs-on: ubuntu-latest
-    if: github.repository == 'block/goose'
+    if: github.repository == 'aaif-goose/goose'
     permissions:
       contents: read
     steps:

.github/workflows/cargo-machete.yml

@@ -16,7 +16,7 @@ on:
 jobs:
   machete:
     runs-on: ubuntu-latest
-    if: github.repository == 'block/goose'
+    if: github.repository == 'aaif-goose/goose'
     permissions:
       contents: read
     steps:

.github/workflows/code-review.yml

@@ -77,7 +77,7 @@ jobs:
     timeout-minutes: 15
 
     container:
-      image: ghcr.io/block/goose:latest
+      image: ghcr.io/aaif-goose/goose:latest
       options: --user root
       env:
         HOME: /tmp/goose-home

.github/workflows/docs-update-cli-ref.yml

@@ -49,10 +49,10 @@ jobs:
           fetch-tags: true  # Fetch all tags so we can checkout version tags
       
       - name: Fetch upstream tags (for forks)
-        if: github.repository != 'block/goose'
+        if: github.repository != 'aaif-goose/goose'
         run: |
           # Add upstream remote and fetch tags (only needed when testing in forks)
-          git remote add upstream https://github.com/block/goose.git || git remote set-url upstream https://github.com/block/goose.git
+          git remote add upstream https://github.com/aaif-goose/goose.git || git remote set-url upstream https://github.com/aaif-goose/goose.git
           git fetch upstream --tags --force
           echo "✅ Fetched tags from upstream (fork mode)"
           echo "Total tags available: $(git tag | wc -l)"
@@ -80,7 +80,7 @@ jobs:
       - name: Install goose CLI
         run: |
           mkdir -p /home/runner/.local/bin
-          curl -fsSL https://github.com/block/goose/releases/download/stable/download_cli.sh \
+          curl -fsSL https://github.com/aaif-goose/goose/releases/download/stable/download_cli.sh \
             | CONFIGURE=false GOOSE_BIN_DIR=/home/runner/.local/bin bash
           echo "/home/runner/.local/bin" >> $GITHUB_PATH
           goose --version

.github/workflows/docs-update-recipe-ref.yml

@@ -47,10 +47,10 @@ jobs:
           fetch-tags: true  # Fetch all tags so we can checkout version tags
       
       - name: Fetch upstream tags (for forks)
-        if: github.repository != 'block/goose'
+        if: github.repository != 'aaif-goose/goose'
         run: |
           # Add upstream remote and fetch tags (only needed when testing in forks)
-          git remote add upstream https://github.com/block/goose.git || git remote set-url upstream https://github.com/block/goose.git
+          git remote add upstream https://github.com/aaif-goose/goose.git || git remote set-url upstream https://github.com/aaif-goose/goose.git
           git fetch upstream --tags --force
           echo "✅ Fetched tags from upstream (fork mode)"
           echo "Total tags available: $(git tag | wc -l)"
@@ -68,7 +68,7 @@ jobs:
       - name: Install goose CLI
         run: |
           mkdir -p /home/runner/.local/bin
-          curl -fsSL https://github.com/block/goose/releases/download/stable/download_cli.sh \
+          curl -fsSL https://github.com/aaif-goose/goose/releases/download/stable/download_cli.sh \
             | CONFIGURE=false GOOSE_BIN_DIR=/home/runner/.local/bin bash
           echo "/home/runner/.local/bin" >> $GITHUB_PATH
           goose --version

.github/workflows/goose-issue-solver.yml

@@ -131,7 +131,7 @@ jobs:
     timeout-minutes: 30
 
     container:
-      image: ghcr.io/block/goose:latest
+      image: ghcr.io/aaif-goose/goose:latest
       options: --user root
       env:
         GOOSE_PROVIDER: ${{ vars.GOOSE_PROVIDER || 'anthropic' }}

.github/workflows/goose-pr-reviewer.yml

@@ -223,7 +223,7 @@ jobs:
     timeout-minutes: 15
 
     container:
-      image: ghcr.io/block/goose:latest
+      image: ghcr.io/aaif-goose/goose:latest
       options: --user root
       env:
         GOOSE_PROVIDER: ${{ vars.GOOSE_PROVIDER || 'anthropic' }}

.github/workflows/goose-release-notes.yml

@@ -51,7 +51,7 @@ env:
       - 📚 **Documentation** - Documentation updates
 
       Format each item as:
-      - Concise description [#XXXX](https://github.com/block/goose/pull/XXXX)
+      - Concise description [#XXXX](https://github.com/aaif-goose/goose/pull/XXXX)
 
       Rules:
       - Extract PR numbers from commit messages (look for (#XXXX) pattern)
@@ -85,7 +85,7 @@ jobs:
        github.event.workflow_run.head_branch != 'stable')
 
     container:
-      image: ghcr.io/block/goose:latest
+      image: ghcr.io/aaif-goose/goose:latest
       options: --user root
       env:
         GOOSE_PROVIDER: ${{ vars.GOOSE_PROVIDER || 'anthropic' }}
@@ -190,7 +190,7 @@ jobs:
           DISCORD_BOT_TOKEN: ${{ secrets.DISCORD_RELEASE_BOT_TOKEN }}
           DISCORD_CHANNEL_ID: ${{ secrets.DISCORD_RELEASE_BOT_CHANNEL_ID }}
           RELEASE_TAG: ${{ needs.generate-release-notes.outputs.release_tag }}
-          RELEASE_URL: https://github.com/block/goose/releases/tag/${{ needs.generate-release-notes.outputs.release_tag }}
+          RELEASE_URL: https://github.com/aaif-goose/goose/releases/tag/${{ needs.generate-release-notes.outputs.release_tag }}
           RELEASE_NOTES: ${{ needs.generate-release-notes.outputs.release_notes }}
           NOTES_LENGTH: ${{ needs.generate-release-notes.outputs.notes_length }}
         shell: bash

.github/workflows/minor-release.yaml

@@ -11,7 +11,7 @@ on:
 
 jobs:
   release:
-    if: github.repository == 'block/goose'
+    if: github.repository == 'aaif-goose/goose'
     uses: ./.github/workflows/create-version-bump-pr.yaml
     secrets:
       ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}

.github/workflows/pr-website-preview.yml

@@ -17,6 +17,9 @@ concurrency:
 jobs:
   deploy:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
     steps:
       - name: Checkout the branch
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
@@ -34,14 +37,14 @@ jobs:
           INKEEP_API_KEY: ${{ secrets.INKEEP_API_KEY }}
           INKEEP_INTEGRATION_ID: ${{ secrets.INKEEP_INTEGRATION_ID }}
           INKEEP_ORG_ID: ${{ secrets.INKEEP_ORG_ID }}
-          TARGET_PATH: "/goose/pr-preview/pr-${{ github.event.number }}/"
+          TARGET_PATH: "/pr-preview/pr-${{ github.event.number }}/"
         run: |
           npm install
           npm run build
 
       - name: Deploy preview
         uses: rossjrw/pr-preview-action@ffa7509e91a3ec8dfc2e5536c4d5c1acdf7a6de9  # v1.8.1
-        if: ${{ github.event.pull_request.head.repo.full_name == 'block/goose' }}
+        if: ${{ github.event.pull_request.head.repo.full_name == 'aaif-goose/goose' }}
         with:
           source-dir: documentation/build
 

.github/workflows/rebuild-skills-marketplace.yml

@@ -23,7 +23,7 @@ concurrency:
 jobs:
   rebuild-docs:
     runs-on: ubuntu-latest
-    if: github.repository == 'block/goose'
+    if: github.repository == 'aaif-goose/goose'
     permissions:
       contents: write
 

.github/workflows/recipe-security-scanner.yml

@@ -146,7 +146,7 @@ jobs:
       - name: Scan all recipe files
         if: steps.find_recipes.outputs.has_recipes == 'true' && steps.recipe_changes.outputs.recipe_files_changed == 'true'
         env:
-          SECURITY_SCANNER_ANTHROPIC_API_KEY: ${{ secrets.SECURITY_SCANNER_ANTHROPIC_API_KEY }}
+          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
           TRAINING_DATA_LOW: ${{ secrets.TRAINING_DATA_LOW }}
           TRAINING_DATA_MEDIUM: ${{ secrets.TRAINING_DATA_MEDIUM }}
           TRAINING_DATA_EXTREME: ${{ secrets.TRAINING_DATA_EXTREME }}
@@ -159,7 +159,7 @@ jobs:
           sudo chmod -R 777 "$OUT" || true
           
           # Verify secrets are available (without logging details)
-          if [ -z "$SECURITY_SCANNER_ANTHROPIC_API_KEY" ] || [ -z "$TRAINING_DATA_LOW" ] || [ -z "$TRAINING_DATA_MEDIUM" ] || [ -z "$TRAINING_DATA_EXTREME" ]; then
+          if [ -z "$OPENAI_API_KEY" ] || [ -z "$TRAINING_DATA_LOW" ] || [ -z "$TRAINING_DATA_MEDIUM" ] || [ -z "$TRAINING_DATA_EXTREME" ]; then
             echo "❌ One or more required secrets are missing or inaccessible"
             exit 1
           fi
@@ -183,7 +183,7 @@ jobs:
               
               # Run scanner on this recipe with training data
               if docker run --rm \
-                -e SECURITY_SCANNER_ANTHROPIC_API_KEY="$SECURITY_SCANNER_ANTHROPIC_API_KEY" \
+                -e OPENAI_API_KEY="$OPENAI_API_KEY" \
                 -e TRAINING_DATA_LOW="$TRAINING_DATA_LOW" \
                 -e TRAINING_DATA_MEDIUM="$TRAINING_DATA_MEDIUM" \
                 -e TRAINING_DATA_EXTREME="$TRAINING_DATA_EXTREME" \

.github/workflows/scorecard.yml

@@ -22,7 +22,7 @@ jobs:
     name: Scorecard analysis
     runs-on: ubuntu-latest
     # `publish_results: true` only works when run from the default branch. conditional can be removed if disabled.
-    if: github.repository == 'block/goose' && (github.event.repository.default_branch == github.ref_name || github.event_name == 'pull_request')
+    if: github.repository == 'aaif-goose/goose' && (github.event.repository.default_branch == github.ref_name || github.event_name == 'pull_request')
     permissions:
       # Needed to upload the results to code-scanning dashboard.
       security-events: write

.github/workflows/stale.yml

@@ -24,7 +24,7 @@ jobs:
   stale:
     name: 'Mark and Close Stale PRs'
     runs-on: ubuntu-latest
-    if: github.repository == 'block/goose'
+    if: github.repository == 'aaif-goose/goose'
     
     steps:
       # Use the official stale action from GitHub

.github/workflows/test-finder.yml

@@ -20,7 +20,7 @@ jobs:
   find-untested-code:
     runs-on: ubuntu-latest
     container:
-      image: ghcr.io/block/goose:latest
+      image: ghcr.io/aaif-goose/goose:latest
       options: --user root
       env:
         GOOSE_PROVIDER: ${{ vars.GOOSE_PROVIDER || 'openai' }}

.github/workflows/update-hacktoberfest-leaderboard.yml

@@ -9,7 +9,7 @@ on:
 jobs:
   update-leaderboard:
     runs-on: ubuntu-latest
-    if: github.repository == 'block/goose'
+    if: github.repository == 'aaif-goose/goose'
     permissions:
       contents: read
       pull-requests: read
@@ -29,7 +29,7 @@ jobs:
 
             // Track the Goose repo only
             const REPOS = [
-              'block/goose'
+              'aaif-goose/goose'
             ];
 
             const POINT_VALUES = { small: 5, medium: 10, large: 15 };

.github/workflows/update-health-dashboard.yml

@@ -23,7 +23,7 @@ jobs:
   update-dashboard:
     name: 'Update Health Dashboard'
     runs-on: ubuntu-latest
-    if: github.repository == 'block/goose'
+    if: github.repository == 'aaif-goose/goose'
     
     steps:
       - name: 'Download previous metrics'