* origin/main: (32 commits)
docs: rework homepage and add aaif migration blog post (#8356)
chore(aaif): rename a bunch of repository references (#8152)
fix: use OPENAI_API_KEY secret for recipe security scanner (#8358)
feat: configurable extension timeouts via ACP _meta and global default (#8295)
fix: hide hidden extensions in UI (#8346)
refactor: skills as its own platform ext (#8244)
fix baseUrl (#8347)
Fix desktop slash commands (#8341)
fix(cli): display platform-correct secrets path in keyring config dialog (#8328)
feat(acp): add reusable ACP provider controls (#8314)
fix: resolve MDX compilation error in using-goosehints.md (#8332)
fix: use v1beta1 API version for Google/MaaS models on GCP Vertex AI (#8278)
docs: add MCP Roots guide (#8252)
rust acp client for extension methods (#8227)
fix: reconsolidate split tool-call messages to follow OpenAI format (#7921)
fix: clean up MCP subprocesses after abrupt parent exit (#8242)
build: raise default stack reserve to 8 MB (#8234)
fix(config): honour GOOSE_DISABLE_KEYRING from config.yaml at startup (#8219)
feat: add configurable fast_model for declarative providers (#8194)
fix(authentication): Allow connecting to Oauth servers that use protected-resource fallback instead of the WWW-authenticate header (#8148)
...
* origin/main: (85 commits)
docs: standardize on ~/.agents/skills/ as canonical skill path (#8239)
feat: bump versions (already published) (#8240)
Revert "fix: rename bin for the tui (#8231)" (#8238)
docs: update reusable recipes docs (#8232)
docs: add GOOSE_SHELL env var (#8233)
feat(security): add egress logging inspector (#8149)
blog: Adversary Mode — A Second Pair of Eyes on Every Tool Call (#8220)
fix: rename bin for the tui (#8231)
feat: goose serve (#8209)
refactor: make --text mode independent of the normal TUI (#8210)
refactor: handle complex streaming/scrolling with better rendering (#8214)
Add Inference Mesh settings tab (#8094)
only run windows compile on main branch (#8216)
used simplified privacy info modal and removed unnecessary components (#8200)
removed unused welcome route (#8196)
fix: use build_host_url for GCP Vertex AI location fallback (#8185)
fix: remove ui/acp/.npmrc to allow auth token inheritance
fix(openai): use safely_parse_json for streaming tool arguments (#8208)
feat: add copilot-acp provider (#8154)
chore(deps): bump path-to-regexp from 8.3.0 to 8.4.0 in /evals/open-model-gym/mcp-harness (#8178)
...
# Conflicts:
# ui/desktop/.gitignore
# ui/desktop/src/components/Layout/CondensedRenderer.tsx
# ui/desktop/src/components/Layout/navigation/ChatSessionsDropdown.tsx
# ui/desktop/src/components/Layout/navigation/SessionsList.tsx
# ui/desktop/src/components/ParameterInputModal.tsx
# ui/desktop/src/components/parameter/ParameterInput.tsx
# ui/desktop/src/components/recipes/RecipeActivityEditor.tsx
# ui/desktop/src/components/recipes/shared/CreateSubRecipeInline.tsx
# ui/desktop/src/main.ts
* main:
Fix user message text silently dropped when message contains both text and image (#8071)
fix: use pnpm when publishing (#8092)
Alexhancock/publish npm file format fix (#8091)
fix: iteration on the publish-npm workflow (#8087)
chore: ignore unmaintained warning for proc-macro-error (#8084)
chore: clean up stray recipe.yaml (#8086)
chore(release): bump version to 1.29.0 (minor) (#8088)
Update lockfile references (#8085)
Fix version bump (#8083)
Add a code review step which uses a short-lived provider token (#7932)
* main: (37 commits)
fix: handle reasoning content blocks in OpenAI-compat streaming parser (#8078)
chore(acp): build native packages on latest mac (#8075)
Display delegate sub agents logs in UI (#7519)
Update tar version to avoid CVE-2026-33056 (#8073)
refactor: consolidate duplicated dependencies into workspace (#8041)
tui: set up for publishing via github actions (#8020)
feat: feature-gate local inference dependencies (#7976)
feat: ability to manage sub recipes in desktop ui (#6360)
Tweak the release process: no more merge to main (#7994)
fix: gemini models via databricks (#8042)
feat(apps): Pass toolInfo to MCP Apps via hostContext (#7506)
fix: remove configured marker when deleting oauth provider configuration (#7887)
docs: add vmware-aiops MCP extension documentation (#8055)
Show setup instructions for ACP providers in settings modal (#8065)
deps: replace sigstore-verification with sigstore-verify to kill vulns (#8064)
feat(acp): add session/set_config and stabilize list, delete and close (#7984)
docs: Correct `gosoe` typo to `goose` (#8062)
fix: use default provider and model when provider in session no longer exists (#8035)
feat: add GOOSE_SHELL env var to configure preferred shell (#7909)
fix(desktop): fullscreen header bar + always-visible close controls (#8033)
...
Lifei Zhou