Goose v1.48.0

✨ Features

Providers

• TrustedRouter declarative provider #11422

• OpenCode Zen gateway as a declarative provider #10939

• Gondola as declarative OpenAI-compatible provider #11421

• SayGM as declarative OpenAI-compatible provider #11267

• Lynkr as a declarative OpenAI-compatible provider #11372

• PleumRouter declarative provider #10479

• Z.ai GLM-5.2 replaced with GLM-5.3 #11226

• Custom provider cost fields drive cost tracking #11220

• Model-native audio transcription provider #10589

• OpenAI GPT-5.6 (sol/terra/luna) routing via AWS Bedrock #10502

• GPT-5.6 follow-up support for Codex and Responses API #10460

Hooks

• on_failure block for PreToolUse hooks #11449

• PreToolUseResult event and stable tool_call_id across tool lifecycle #11120

Desktop & UI

• Select saved recipes when creating a schedule #10892

• Sort configured providers to the top of the provider list #11409

• Collapse scheduled job sessions into accordion in chat history #11265

• Auto-focus chat input when user starts typing #11184

• Interactive git branch indicator in chat bottom bar #11290

• Show recent used models in chat footer model picker #11097

CLI

• --with-extension can now name its extension #11127

• /new command to start a fresh session without restarting #10767

Skills & Extensions

• Web-search and browser-use built-in skills #11233

• Support pre-registered OAuth clients for streamable_http extensions #11182

ACP

• Derive and forward thinking effort from the ACP harness #10949

• Title new sessions from _meta.sessionTitle #10712

• _goose/unstable/session/extensions/apply method #11081

Observability

• OpenTelemetry request params, response metadata, tool call parity, and agent identification #11261

• OpenRouter session_id forwarding and app category header #10868

Other

• Blox run target for the ACP server #11423

• Linux ARM64 desktop release packages #11518

• Roaming as opt-in goose-cli feature #11516

• MCP conformance tests in CI #10940

🐛 Bug Fixes

Security

• Recognize Windows package runners #11466

• Fail closed on malformed tool visibility #11474

• Permission denies take precedence #11477

• Clear custom provider transition secrets #11467

• Require fresh file parameter input #11455

• Escape OAuth callback content #11479

• Sanitize Unicode tags in MCP prompts #11453

• Honor plugin enablement for skills #11439

• Honor MCP tool model visibility in Code Mode #11425

• Suppress sensitive OTLP traces #11381

• Fail closed on invalid default GCP credentials #11363

• Bound call graph traversal #11193

• Fail closed on invalid Codex ACP mode #11362

• Validate memory categories #11191

• Bound recursive mention scans #11228

• Avoid predictable editor symlink #11188

• Fail closed on malformed app visibility #11341

• Encode session navigation parameters #11232

• Redact URLs in provider errors #11230

• Validate recipe parameter values #11234

• Bind Foundry API keys to request origin #11347

Providers

• Stop provider save from overwriting stored config with defaults #11517

• Sanitize hidden Unicode in Bedrock tools #11121

• Bound non-streaming JSON responses #11109