ai-space/goose
3
0
Fork 0
mirror of https://github.com/aaif-goose/goose.git synced 2026-07-03 14:10:03 +02:00
Code Issues Packages Projects Releases Wiki Activity
4,812 Commits 603 Branches 222 Tags
86e0ced494720a0cb56389c4dce4fe3014ff7398
Commit Graph

4812 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Michael Neale 86e0ced494 fix(acp): restrict CORS origins on unauthenticated ACP endpoint 
The ACP transport (/acp) is served on loopback and, in CLI mode, is
unauthenticated while being able to spawn shells via the default
`developer` builtin. Its CORS layer used `allow_origin(Any)`, returning
`Access-Control-Allow-Origin: *` to any origin. This let a malicious
website the victim visits drive the agent from the browser
(CSRF -> RCE). See CWE-942.

Replace the wildcard with an origin predicate that only permits origins
legitimate local clients use:
- `null` (Electron file:// renderer)
- loopback origins (localhost, 127.0.0.1, ::1) on any scheme/port

Arbitrary web origins, including look-alikes like localhost.evil.example,
are rejected.

Also gate the test-only `clear_env` builder behind the `aws-providers`
feature (its only call sites), fixing a dead-code clippy warning that
blocked `cargo clippy --all-targets -- -D warnings`.

Fixes project-loupe/audit-goose#2
 2026-06-19 13:09:24 +10:00
Douwe Osinga 08fb6d45f3 View model interactions (#9806) 
Signed-off-by: Douwe M Osinga <douwe@sidewalklabs.com>
Co-authored-by: Douwe M Osinga <douwe@sidewalklabs.com>
Co-authored-by: Michael Neale <michael.neale@gmail.com>
 2026-06-19 00:28:03 +00:00
Douwe Osinga 09c8d2be5a Update Moim (#9636) 
Signed-off-by: Douwe M Osinga <douwe@sidewalklabs.com>
Co-authored-by: Douwe Osinga <douwe@squareup.com>
Co-authored-by: Douwe M Osinga <douwe@sidewalklabs.com>
 2026-06-18 20:02:40 +00:00
Jack Amadeo b3cf3cbcff delete embeddings support (#9865) 2026-06-18 19:22:32 +00:00
Nicholas-Westby a8b11e39b7 docs(installation): correct whitespace in fenced code block (#9867) 2026-06-18 19:18:32 +00:00
Michael Neale 92644274a2 fix(gcp): use refreshed gcloud token after reauth (retry Vertex AI on 401/403) (#9849) 
Signed-off-by: Michael Neale <michael.neale@gmail.com>
Signed-off-by: Douwe M Osinga <douwe@sidewalklabs.com>
Co-authored-by: Douwe M Osinga <douwe@sidewalklabs.com>
 2026-06-18 19:17:11 +00:00
Douwe Osinga fb59045408 Feature AAIF migration blog post (#9866) 
Signed-off-by: Douwe M Osinga <douwe@sidewalklabs.com>
Co-authored-by: Douwe M Osinga <douwe@sidewalklabs.com>
 2026-06-18 18:40:43 +00:00
Jack Amadeo 73fd41d7c5 move the provider trait into goose-providers (#9860) 2026-06-18 18:29:58 +00:00
Douwe Osinga c72c6531aa docs: remove DCO references (#9864) 
Co-authored-by: Douwe M Osinga <douwe@sidewalklabs.com>
 2026-06-18 17:54:45 +00:00
Jack Amadeo 80eaf8fa44 move global config access out of ModelConfig, and move ModelConfig into goose_providers (#9769) 2026-06-18 16:33:19 +00:00
San Clemente 4c64375de7 Add Ophis MCP server to the extensions registry (#9861) 2026-06-18 16:17:52 +00:00
Hugues Clouâtre d6393d71a5 feat(aws_bedrock): support OpenAI GPT models via Bedrock mantle endpoint (#9707) 
Signed-off-by: Hugues Clouâtre <hugues@linux.com>
Co-authored-by: Douwe M Osinga <douwe@sidewalklabs.com>
 2026-06-18 14:21:00 +00:00
Michael Neale c524c27189 fix(goal): start a turn when /goal or /grind is set (#9801) 
Signed-off-by: Michael Neale <michael.neale@gmail.com>
 2026-06-18 14:13:28 +00:00
jeffa-block 6d3620d66f feat(summon): add peek mode for async background tasks (#9519) 
Signed-off-by: Douwe M Osinga <douwe@sidewalklabs.com>
Co-authored-by: Douwe M Osinga <douwe@sidewalklabs.com>
 2026-06-18 13:46:06 +00:00
Hosoeng Lee f108282f03 Add Korean localization to desktop app (#9856) 
Signed-off-by: lhs <lhs@lhsui-Macmini.local>
Signed-off-by: soolmuk <72430756+soolmuk@users.noreply.github.com>
Co-authored-by: lhs <lhs@lhsui-Macmini.local>
 2026-06-18 13:43:00 +00:00
Lifei Zhou 7130cbf33e feat (ui): chat reply UI with ACP (last part) (#9857) 2026-06-18 11:13:35 +00:00
Lifei Zhou ddf23a0b64 feat (ui): Add durable ACP chat session state for desktop UI (#9852) 2026-06-18 08:06:14 +00:00
Lifei Zhou 802dd39165 feat: use acp for desktop chat prompt (feature toggle off) (#9802) 
Signed-off-by: Douwe M Osinga <douwe@sidewalklabs.com>
Co-authored-by: Douwe M Osinga <douwe@sidewalklabs.com>
 2026-06-18 00:13:08 +00:00
Lifei Zhou 109bda35ac refactor: make session.name the source of truth for displayed session titles (#9841) 2026-06-17 22:18:28 +00:00
Lifei Zhou 69b4d3686c fix: remove hard-coded React alias that points to the wrong location and break the dev render (#9842) 2026-06-17 21:28:24 +00:00
Michael Neale bd7f4924bb fix: pass thinking config to Bedrock Anthropic models (#9794) 
Signed-off-by: Michael Neale <michael.neale@gmail.com>
Signed-off-by: Douwe M Osinga <douwe@sidewalklabs.com>
Co-authored-by: Douwe M Osinga <douwe@sidewalklabs.com>
 2026-06-17 20:44:01 +00:00
Jack Amadeo c239ae0042 Split provider inventory out of providers (#9826) 2026-06-17 20:42:38 +00:00
Jack Amadeo b0f5db2a07 Support MCP extensions in open plugins (#9471) 
Signed-off-by: Douwe M Osinga <douwe@sidewalklabs.com>
Co-authored-by: Douwe M Osinga <douwe@sidewalklabs.com>
 2026-06-17 18:52:54 +00:00
Douwe Osinga 1701f5279a Add self-improving agents blog post (#9846) 
Signed-off-by: Douwe M Osinga <douwe@sidewalklabs.com>
Co-authored-by: Douwe M Osinga <douwe@sidewalklabs.com>
 2026-06-17 18:51:23 +00:00
jlmalone 633df013ca perf(build): drop debug info for dependencies in the dev profile (#9843) 
Signed-off-by: Joseph Malone <jlmalone@users.noreply.github.com>
 2026-06-17 18:11:53 +00:00
Jack Amadeo f0cc765440 check for responses API support in databricks (#9347) 
Signed-off-by: Douwe M Osinga <douwe@sidewalklabs.com>
Co-authored-by: Douwe M Osinga <douwe@sidewalklabs.com>
 2026-06-17 18:00:46 +00:00
Jack Amadeo 177cf3d4b8 Initial prompt with goose://new-session (#9427) 
Signed-off-by: Douwe M Osinga <douwe@sidewalklabs.com>
Co-authored-by: Douwe M Osinga <douwe@sidewalklabs.com>
 2026-06-17 18:00:44 +00:00
jh-block 3d405249a6 fix(local-inference): use media marker parts for vision prompts (#9452) 
Signed-off-by: jh-block <jhugo@block.xyz>
Co-authored-by: Douwe M Osinga <douwe@sidewalklabs.com>
 2026-06-17 18:00:40 +00:00
Kyle E DeFreitas d2090b1de5 feat(gym): make Open Model Gym output dir configurable (#9789) 
Signed-off-by: Kyle De Freitas <kdefreitas@squareup.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Douwe M Osinga <douwe@sidewalklabs.com>
 2026-06-17 17:20:56 +00:00
Seydi Charyyev 1a500d8f48 fix(desktop): keep extensions icon visible after switching sessions (#9787) 
Signed-off-by: Seydi Charyyev <seydi.charyev@gmail.com>
Signed-off-by: Angie Jones <jones.angie@gmail.com>
Signed-off-by: Douwe M Osinga <douwe@sidewalklabs.com>
Co-authored-by: Angie Jones <jones.angie@gmail.com>
Co-authored-by: Douwe M Osinga <douwe@sidewalklabs.com>
 2026-06-17 17:17:24 +00:00
Jose Manuel Perez 56812f4617 i18n: add Spanish (es) locale support (#9833) 
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-17 16:39:22 +00:00
Thump604 80a286da8c fix(summon): skip non-recipe project config files (#9808) 
Signed-off-by: Douwe M Osinga <douwe@sidewalklabs.com>
Co-authored-by: Douwe M Osinga <douwe@sidewalklabs.com>
 2026-06-17 16:23:08 +00:00
Michael Neale e3dbb86742 Dedup duplicate tool-call ids within a turn (#9792) 
Signed-off-by: Michael Neale <michael.neale@gmail.com>
Signed-off-by: Douwe M Osinga <douwe@sidewalklabs.com>
Co-authored-by: Douwe M Osinga <douwe@sidewalklabs.com>
 2026-06-17 16:19:58 +00:00
Darren Xu 9f6eb65ad1 fix: resolve bundled extensions from discovery (#9759) 
Signed-off-by: Douwe M Osinga <douwe@sidewalklabs.com>
Co-authored-by: Douwe M Osinga <douwe@sidewalklabs.com>
 2026-06-17 16:10:35 +00:00
Jack Amadeo 184f9efda2 Keep the version-bump PR up to date by re-running on merge conflicts (#9761) 2026-06-17 15:43:23 +00:00
Adam Dalloul 402afa5a8c feat(providers): add EmpirioLabs as a declarative OpenAI-compatible provider (#9771) 
Signed-off-by: Adam Dalloul <47503782+Adam-Dalloul@users.noreply.github.com>
Signed-off-by: Douwe M Osinga <douwe@sidewalklabs.com>
Co-authored-by: Douwe M Osinga <douwe@sidewalklabs.com>
 2026-06-17 14:38:45 +00:00
jh-block 4aa5de150a Add support for MLX models to the local inference provider (#9154) 
Signed-off-by: jh-block <jhugo@block.xyz>
 2026-06-17 13:32:07 +00:00
Roman Ponomarev 86846ec325 fix(acp): include agentInfo in initialize response (#9765) 
Signed-off-by: Roman Ponomarev <maksugr@gmail.com>
 2026-06-17 09:49:52 +00:00
Michael Neale 739d9cb276 Fix custom OpenAI provider dropping port when URL scheme is omitted (#9730) 
Signed-off-by: Michael Neale <michael.neale@gmail.com>
Signed-off-by: Douwe M Osinga <douwe@sidewalklabs.com>
Co-authored-by: Douwe M Osinga <douwe@sidewalklabs.com>
 2026-06-17 08:50:15 +00:00
Michael Neale f7b32dab32 fix(desktop): preserve Windows backslash paths in custom extension command (#9741) 
Signed-off-by: Michael Neale <michael.neale@gmail.com>
 2026-06-17 08:47:44 +00:00
Lifei Zhou 55dd84775b fixed acp cancel race condition (#9804) 2026-06-17 05:47:50 +00:00
Lifei Zhou 72da97204e feat: implement acp method for elicitation and elicitation improvement (#9797) 2026-06-17 03:40:10 +00:00
Lifei Zhou 1f0f5d90cb fix: removed window goosed when closing window (#9818) 2026-06-17 03:39:25 +00:00
Douwe Osinga 9804a8c782 View json (#9678) 
Signed-off-by: Douwe M Osinga <douwe@sidewalklabs.com>
Co-authored-by: Douwe M Osinga <douwe@sidewalklabs.com>
 2026-06-17 02:30:09 +00:00
Douwe Osinga 5adaebb867 Make the context exceeded checker more precise (#9831) 
Signed-off-by: Douwe M Osinga <douwe@sidewalklabs.com>
Co-authored-by: Douwe M Osinga <douwe@sidewalklabs.com>
 2026-06-17 02:25:29 +00:00
Michael Neale b0d8ea055c feat: load global hints from ~/.agents/AGENTS.md (#9736) 
Signed-off-by: Michael Neale <michael.neale@gmail.com>
Signed-off-by: Douwe M Osinga <douwe@sidewalklabs.com>
Co-authored-by: Douwe M Osinga <douwe@sidewalklabs.com>
 2026-06-17 02:25:27 +00:00
Michael Neale 0b95199896 fix: inherit login-shell PATH in spawned subagents (#9737) 
Signed-off-by: Michael Neale <michael.neale@gmail.com>
 2026-06-17 02:24:51 +00:00
Kyle E DeFreitas d95df17615 feat(gym): make per-agent timeout configurable (GYM_AGENT_TIMEOUT) (#9791) 
Signed-off-by: Kyle De Freitas <kdefreitas@squareup.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-06-17 02:24:29 +00:00
Michael Neale 7f02c1e539 fix: accept string values for GOOSE_CONTEXT_LIMIT (#9738) 
Signed-off-by: Michael Neale <michael.neale@gmail.com>
 2026-06-17 02:12:50 +00:00
Hammad Khan b3d3a8b29e feat(azure): support Entra ID bearer token auth via AZURE_OPENAI_AD_TOKEN (#9716) 
Signed-off-by: hammadxcm <hammadkhanxcm@gmail.com>
Signed-off-by: Douwe M Osinga <douwe@sidewalklabs.com>
Co-authored-by: Douwe M Osinga <douwe@sidewalklabs.com>
 2026-06-17 02:09:05 +00:00