ai-space/goose
3
0
Fork 0
mirror of https://github.com/aaif-goose/goose.git synced 2026-07-03 14:10:03 +02:00
Code Issues Packages Projects Releases Wiki Activity
4,812 Commits 603 Branches 222 Tags
86e0ced494720a0cb56389c4dce4fe3014ff7398
Commit Graph

2041 Commits

Author SHA1 Message Date
Michael Neale 86e0ced494 fix(acp): restrict CORS origins on unauthenticated ACP endpoint 
The ACP transport (/acp) is served on loopback and, in CLI mode, is
unauthenticated while being able to spawn shells via the default
`developer` builtin. Its CORS layer used `allow_origin(Any)`, returning
`Access-Control-Allow-Origin: *` to any origin. This let a malicious
website the victim visits drive the agent from the browser
(CSRF -> RCE). See CWE-942.

Replace the wildcard with an origin predicate that only permits origins
legitimate local clients use:
- `null` (Electron file:// renderer)
- loopback origins (localhost, 127.0.0.1, ::1) on any scheme/port

Arbitrary web origins, including look-alikes like localhost.evil.example,
are rejected.

Also gate the test-only `clear_env` builder behind the `aws-providers`
feature (its only call sites), fixing a dead-code clippy warning that
blocked `cargo clippy --all-targets -- -D warnings`.

Fixes project-loupe/audit-goose#2
 2026-06-19 13:09:24 +10:00
Douwe Osinga 09c8d2be5a Update Moim (#9636) 
Signed-off-by: Douwe M Osinga <douwe@sidewalklabs.com>
Co-authored-by: Douwe Osinga <douwe@squareup.com>
Co-authored-by: Douwe M Osinga <douwe@sidewalklabs.com>
 2026-06-18 20:02:40 +00:00
Jack Amadeo b3cf3cbcff delete embeddings support (#9865) 2026-06-18 19:22:32 +00:00
Michael Neale 92644274a2 fix(gcp): use refreshed gcloud token after reauth (retry Vertex AI on 401/403) (#9849) 
Signed-off-by: Michael Neale <michael.neale@gmail.com>
Signed-off-by: Douwe M Osinga <douwe@sidewalklabs.com>
Co-authored-by: Douwe M Osinga <douwe@sidewalklabs.com>
 2026-06-18 19:17:11 +00:00
Jack Amadeo 73fd41d7c5 move the provider trait into goose-providers (#9860) 2026-06-18 18:29:58 +00:00
Jack Amadeo 80eaf8fa44 move global config access out of ModelConfig, and move ModelConfig into goose_providers (#9769) 2026-06-18 16:33:19 +00:00
Hugues Clouâtre d6393d71a5 feat(aws_bedrock): support OpenAI GPT models via Bedrock mantle endpoint (#9707) 
Signed-off-by: Hugues Clouâtre <hugues@linux.com>
Co-authored-by: Douwe M Osinga <douwe@sidewalklabs.com>
 2026-06-18 14:21:00 +00:00
Michael Neale c524c27189 fix(goal): start a turn when /goal or /grind is set (#9801) 
Signed-off-by: Michael Neale <michael.neale@gmail.com>
 2026-06-18 14:13:28 +00:00
jeffa-block 6d3620d66f feat(summon): add peek mode for async background tasks (#9519) 
Signed-off-by: Douwe M Osinga <douwe@sidewalklabs.com>
Co-authored-by: Douwe M Osinga <douwe@sidewalklabs.com>
 2026-06-18 13:46:06 +00:00
Lifei Zhou 7130cbf33e feat (ui): chat reply UI with ACP (last part) (#9857) 2026-06-18 11:13:35 +00:00
Lifei Zhou ddf23a0b64 feat (ui): Add durable ACP chat session state for desktop UI (#9852) 2026-06-18 08:06:14 +00:00
Lifei Zhou 109bda35ac refactor: make session.name the source of truth for displayed session titles (#9841) 2026-06-17 22:18:28 +00:00
Michael Neale bd7f4924bb fix: pass thinking config to Bedrock Anthropic models (#9794) 
Signed-off-by: Michael Neale <michael.neale@gmail.com>
Signed-off-by: Douwe M Osinga <douwe@sidewalklabs.com>
Co-authored-by: Douwe M Osinga <douwe@sidewalklabs.com>
 2026-06-17 20:44:01 +00:00
Jack Amadeo c239ae0042 Split provider inventory out of providers (#9826) 2026-06-17 20:42:38 +00:00
Jack Amadeo b0f5db2a07 Support MCP extensions in open plugins (#9471) 
Signed-off-by: Douwe M Osinga <douwe@sidewalklabs.com>
Co-authored-by: Douwe M Osinga <douwe@sidewalklabs.com>
 2026-06-17 18:52:54 +00:00
Jack Amadeo f0cc765440 check for responses API support in databricks (#9347) 
Signed-off-by: Douwe M Osinga <douwe@sidewalklabs.com>
Co-authored-by: Douwe M Osinga <douwe@sidewalklabs.com>
 2026-06-17 18:00:46 +00:00
jh-block 3d405249a6 fix(local-inference): use media marker parts for vision prompts (#9452) 
Signed-off-by: jh-block <jhugo@block.xyz>
Co-authored-by: Douwe M Osinga <douwe@sidewalklabs.com>
 2026-06-17 18:00:40 +00:00
Seydi Charyyev 1a500d8f48 fix(desktop): keep extensions icon visible after switching sessions (#9787) 
Signed-off-by: Seydi Charyyev <seydi.charyev@gmail.com>
Signed-off-by: Angie Jones <jones.angie@gmail.com>
Signed-off-by: Douwe M Osinga <douwe@sidewalklabs.com>
Co-authored-by: Angie Jones <jones.angie@gmail.com>
Co-authored-by: Douwe M Osinga <douwe@sidewalklabs.com>
 2026-06-17 17:17:24 +00:00
Thump604 80a286da8c fix(summon): skip non-recipe project config files (#9808) 
Signed-off-by: Douwe M Osinga <douwe@sidewalklabs.com>
Co-authored-by: Douwe M Osinga <douwe@sidewalklabs.com>
 2026-06-17 16:23:08 +00:00
Michael Neale e3dbb86742 Dedup duplicate tool-call ids within a turn (#9792) 
Signed-off-by: Michael Neale <michael.neale@gmail.com>
Signed-off-by: Douwe M Osinga <douwe@sidewalklabs.com>
Co-authored-by: Douwe M Osinga <douwe@sidewalklabs.com>
 2026-06-17 16:19:58 +00:00
Darren Xu 9f6eb65ad1 fix: resolve bundled extensions from discovery (#9759) 
Signed-off-by: Douwe M Osinga <douwe@sidewalklabs.com>
Co-authored-by: Douwe M Osinga <douwe@sidewalklabs.com>
 2026-06-17 16:10:35 +00:00
Adam Dalloul 402afa5a8c feat(providers): add EmpirioLabs as a declarative OpenAI-compatible provider (#9771) 
Signed-off-by: Adam Dalloul <47503782+Adam-Dalloul@users.noreply.github.com>
Signed-off-by: Douwe M Osinga <douwe@sidewalklabs.com>
Co-authored-by: Douwe M Osinga <douwe@sidewalklabs.com>
 2026-06-17 14:38:45 +00:00
jh-block 4aa5de150a Add support for MLX models to the local inference provider (#9154) 
Signed-off-by: jh-block <jhugo@block.xyz>
 2026-06-17 13:32:07 +00:00
Roman Ponomarev 86846ec325 fix(acp): include agentInfo in initialize response (#9765) 
Signed-off-by: Roman Ponomarev <maksugr@gmail.com>
 2026-06-17 09:49:52 +00:00
Michael Neale 739d9cb276 Fix custom OpenAI provider dropping port when URL scheme is omitted (#9730) 
Signed-off-by: Michael Neale <michael.neale@gmail.com>
Signed-off-by: Douwe M Osinga <douwe@sidewalklabs.com>
Co-authored-by: Douwe M Osinga <douwe@sidewalklabs.com>
 2026-06-17 08:50:15 +00:00
Lifei Zhou 55dd84775b fixed acp cancel race condition (#9804) 2026-06-17 05:47:50 +00:00
Lifei Zhou 72da97204e feat: implement acp method for elicitation and elicitation improvement (#9797) 2026-06-17 03:40:10 +00:00
Douwe Osinga 5adaebb867 Make the context exceeded checker more precise (#9831) 
Signed-off-by: Douwe M Osinga <douwe@sidewalklabs.com>
Co-authored-by: Douwe M Osinga <douwe@sidewalklabs.com>
 2026-06-17 02:25:29 +00:00
Michael Neale b0d8ea055c feat: load global hints from ~/.agents/AGENTS.md (#9736) 
Signed-off-by: Michael Neale <michael.neale@gmail.com>
Signed-off-by: Douwe M Osinga <douwe@sidewalklabs.com>
Co-authored-by: Douwe M Osinga <douwe@sidewalklabs.com>
 2026-06-17 02:25:27 +00:00
Michael Neale 0b95199896 fix: inherit login-shell PATH in spawned subagents (#9737) 
Signed-off-by: Michael Neale <michael.neale@gmail.com>
 2026-06-17 02:24:51 +00:00
Michael Neale 7f02c1e539 fix: accept string values for GOOSE_CONTEXT_LIMIT (#9738) 
Signed-off-by: Michael Neale <michael.neale@gmail.com>
 2026-06-17 02:12:50 +00:00
Hammad Khan b3d3a8b29e feat(azure): support Entra ID bearer token auth via AZURE_OPENAI_AD_TOKEN (#9716) 
Signed-off-by: hammadxcm <hammadkhanxcm@gmail.com>
Signed-off-by: Douwe M Osinga <douwe@sidewalklabs.com>
Co-authored-by: Douwe M Osinga <douwe@sidewalklabs.com>
 2026-06-17 02:09:05 +00:00
qybaihe 9ca81e78d7 fix: clear rejected OAuth credentials after refresh (#9694) 
Signed-off-by: qybaihe <qybaihe@gmail.com>
 2026-06-17 02:01:47 +00:00
filip 75f7d08254 fix: keep extended thinking within the Anthropic output cap (#9814) 
Signed-off-by: Filip Kujawa <filip.j.kujawa@gmail.com>
 2026-06-17 00:40:45 +00:00
Steve Beaulac 34b20e3083 fix(providers/openai): preserve custom API path in base_url derivation (#9649) 
Signed-off-by: Douwe M Osinga <douwe@sidewalklabs.com>
Co-authored-by: Douwe M Osinga <douwe@sidewalklabs.com>
 2026-06-17 00:40:40 +00:00
Lifei Zhou e783d2a512 feat: added _meta.conversationBefore for ACP forking session (#9821) 2026-06-17 00:33:55 +00:00
dependabot[bot] b3d64bb848 chore(deps): bump shlex from 1.3.0 to 2.0.1 (#9505) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-16 22:12:21 +00:00
John Matthew Tennant 81a8b87a60 bug(hooks): repair PATH for plugin hook commands (#9615) 
Signed-off-by: John Tennant <jtennant@squareup.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Douwe M Osinga <douwe@sidewalklabs.com>
 2026-06-16 19:01:17 +00:00
nuthalapativarun 764a33fb0b feat: add Together AI declarative provider (#9545) 
Signed-off-by: Varun Nuthalapati <nuthalapativarun@gmail.com>
Signed-off-by: Douwe M Osinga <douwe@sidewalklabs.com>
Co-authored-by: Douwe M Osinga <douwe@sidewalklabs.com>
 2026-06-16 19:00:13 +00:00
Yufeng He 9278953c0a fix: use blocking OTLP HTTP exporter (#9599) 
Signed-off-by: Douwe M Osinga <douwe@sidewalklabs.com>
Co-authored-by: Douwe M Osinga <douwe@sidewalklabs.com>
 2026-06-16 18:48:45 +00:00
nuthalapativarun 1512934138 fix: fall back to default provider when resuming session with unavailable provider (#9547) 
Signed-off-by: Varun Nuthalapati <nuthalapativarun@gmail.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-06-16 18:48:08 +00:00
nuthalapativarun 3ee795a652 fix(otel): provide Tokio runtime for OTLP HTTP exporter batch thread (#9541) 
Signed-off-by: Varun Nuthalapati <nuthalapativarun@gmail.com>
Signed-off-by: Douwe M Osinga <douwe@sidewalklabs.com>
Co-authored-by: Douwe M Osinga <douwe@sidewalklabs.com>
 2026-06-16 18:46:41 +00:00
Lance Colton 11c607c476 openai: read meta.n_ctx from /v1/models to fix context limit for local servers (#9530) 
Signed-off-by: Douwe M Osinga <douwe@sidewalklabs.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Co-authored-by: Douwe M Osinga <douwe@sidewalklabs.com>
 2026-06-16 18:45:41 +00:00
Yufeng He e56c7496b2 fix: show resolved skill supporting file paths (#9584) 2026-06-16 18:32:04 +00:00
Simon Ho 76c8028c26 fix(bedrock): implement real streaming via ConverseStream API (#9579) 
Signed-off-by: Simon Ho <simon@holabs.dev>
 2026-06-16 18:20:05 +00:00
Yi Liu 4327dee7a3 fix: record OpenAI-native cached_tokens in usage metering (#9829) 
Signed-off-by: Yi LIU <yi@quantstamp.com>
Signed-off-by: Douwe M Osinga <douwe@sidewalklabs.com>
Co-authored-by: Douwe M Osinga <douwe@sidewalklabs.com>
 2026-06-16 18:15:13 +00:00
Trang Le 02f27b97d5 fix: add option for overriding API Url for Moonshot provider (#9819) 2026-06-16 18:08:20 +00:00
jeffa-block 8659c14021 feat(summon): add context parameter for delegate tasks (#9518) 
Signed-off-by: Douwe M Osinga <douwe@sidewalklabs.com>
Co-authored-by: Douwe M Osinga <douwe@sidewalklabs.com>
 2026-06-16 15:21:29 +00:00
jeffa-block 4602a88446 feat(summon): add structured metadata to task load results (#9521) 
Signed-off-by: Douwe M Osinga <douwe@sidewalklabs.com>
Co-authored-by: Douwe M Osinga <douwe@sidewalklabs.com>
 2026-06-16 14:48:37 +00:00
jlmalone 93285db7c9 fix(providers): detect image paths with spaces (#9387) 
Signed-off-by: Joseph Malone <jlmalone@users.noreply.github.com>
Signed-off-by: Douwe M Osinga <douwe@sidewalklabs.com>
Co-authored-by: Douwe M Osinga <douwe@sidewalklabs.com>
 2026-06-16 14:31:26 +00:00