Remove project relocation announcement from README (#10347)

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

.github/ISSUE_TEMPLATE/bug_report.md

@@ -2,7 +2,7 @@
 name: Bug report
 about: Create a report to help us improve
 title: ''
-labels: bug
+type: bug
 assignees: ''
 ---
 

.github/ISSUE_TEMPLATE/config.yml

@@ -1,8 +1 @@
 blank_issues_enabled: false
-contact_links:
-  - name: goose Discord discussion
-    url: https://discord.gg/goose-oss
-    about: Please ask and answer questions here.
-  - name: Report a security vulnerability
-    url: https://github.com/aaif-goose/goose/security/policy
-    about: Please report security vulnerabilities here.

.github/ISSUE_TEMPLATE/feature_request.md

@@ -2,11 +2,14 @@
 name: Feature request
 about: Suggest an idea for this project
 title: ''
-labels: 'enhancement'
+type: 'feature'
 assignees: ''
 
 ---
 
+**Before opening a feature request**
+Please start a discussion in the [goose-eng Discord channel](https://discord.com/channels/1287729918100246654/1514412780504088677) before creating a feature request or beginning implementation. This helps align on direction before anyone spends time building.
+
 **Please explain the motivation behind the feature request.**
 Does this feature solve a particular problem you have been experiencing? What opportunities or use cases would be unlocked with this feature?
 

.github/ISSUE_TEMPLATE/submit-recipe.yml

@@ -1,99 +0,0 @@
-name: 🧑‍🍳 Submit a recipe to the goose cookbook
-description: Share a reusable goose recipe with the community!
-title: "[Recipe] <your recipe title here>"
-labels: ["recipe submission"]
-body:
-  - type: markdown
-    attributes:
-      value: |
-        Thanks for contributing to the goose cookbook! 🍳  
-        Recipes are reusable sessions created in goose desktop or CLI and shared with the community to help others vibe code faster.
-
-        📌 **How to Submit**
-        - Create your recipe using goose ("Make recipe from this session")
-        - Fill out the YAML below using the format provided
-        - Paste it into the field and submit the issue — we'll review and add it to the cookbook!
-
-        🪄 **What Happens After?**
-        - If accepted, we'll publish your recipe to the [goose recipes cookbook](https://goose-docs.ai/recipes)
-        - Your GitHub handle will be displayed and linked on the recipe card
-        - If the YAML has any issues, goose will comment with validation errors so you can fix and resubmit.
-
-        🧪 **Pro Tip:** You can test your recipe locally in your terminal with:  
-        `goose recipe validate your-recipe.yaml`
-
-  - type: textarea
-    id: recipe-yaml
-    attributes:
-      label: Paste Your Full Recipe YAML Below
-      description: Use the structure below and we'll auto-fill your GitHub handle for `author.contact` after submission.
-      placeholder: |
-        version: "1.0.0"
-        id: clean-up-feature-flag
-        title: Clean Up Feature Flag
-        description: Automatically clean up all references of a fully rolled out feature flag from a codebase and make the new behavior the default.
-        instructions: |
-          Your job is to systematically remove a fully rolled out feature flag and ensure the new behavior is now the default. Use code search tools like ripgrep to identify all references to the flag, clean up definition files, usage sites, tests, and configuration files. Then create a commit and push changes with clear commit messages documenting the flag removal.
-        prompt: |
-          Task: Remove a feature flag that has been fully rolled out, where the feature flag's functionality should become the default behavior.
-
-          Context:
-            Feature flag key: {{ feature_flag_key }}
-            Project: {{ repo_dir }}
-
-          Steps to follow:
-            1. Check out a *new* branch from main or master named using the feature flag key.
-            2. Find the feature flag constant/object that wraps the key.
-            3. Search for all references to the constant/object using ripgrep or equivalent tools.
-            4. Remove all conditional logic and make the new behavior default.
-            5. Remove unused imports, mocks, config, and tests.
-            6. Commit your changes and push the branch.
-            7. Open a GitHub PR.
-
-          Use commit messages like:
-            chore(flag-cleanup): remove <feature_flag_key> flag from codebase
-
-        parameters:
-          - key: feature_flag_key
-            input_type: string
-            requirement: required
-            description: Key of the feature flag
-
-          - key: repo_dir
-            input_type: string
-            requirement: optional
-            default: ./
-            description: Directory of the codebase
-
-        extensions:
-          - type: stdio
-            name: developer
-            cmd: uvx
-            args:
-              - developer-mcp@latest
-            timeout: 300
-            bundled: true
-            description: Access developer tools
-        
-        activities:
-          - Remove feature flag definitions
-          - Clean up feature flag usage sites
-          - Update affected tests
-          - Remove flag configurations
-          - Document flag removal
-    validations:
-      required: true
-
-  - type: markdown
-    attributes:
-      value: |
-        🛠 **Recipe Field Tips**
-        - `version` must be "1.0.0" for now
-        - `id` should be lowercase, hyphenated, and unique (e.g. `my-awesome-recipe`)
-        - `title` is the display name of your recipe
-        - `description` should clearly explain what the recipe does
-        - `instructions` are specific steps goose should follow — supports template variables like `{{ variable_name }}`
-        - `prompt` is the first thing goose sees when the recipe is launched
-        - `parameters` should include required or optional inputs — optional ones must have `default`
-        - `extensions` must follow the full format with `type`, `cmd`, `args`, `timeout`, etc.
-        - `activities` describe the main actions the recipe performs

.github/actions/generate-release-pr-body/pr_body_template.txt

@@ -2,7 +2,7 @@
 
 ## Test before Release
 
-1. Close and reopen this PR to trigger CI and produce the Desktop bundle for testing. Reason: workflows don't run on PRs opened by `GITHUB_TOKEN` ([docs](https://docs.github.com/en/actions/using-workflows/triggering-a-workflow#triggering-a-workflow-from-a-workflow)).
+1. Approve the workflows for this PR (scroll to bottom) to trigger CI and produce the Desktop bundle for testing.
 2. Make sure all check workflows pass.
 3. Install the Desktop bundle from the download links (posted as a comment below when it is ready).
 4. Complete the goose Release Manual Testing Checklist (posted as a comment below).

.github/copilot-instructions.md

@@ -40,7 +40,7 @@
 ## Project-Specific Context
 
 - This is a Rust project using cargo workspaces
-- Core crates: `goose` (agent logic), `goose-cli` (CLI), `goose-server` (backend), `goose-mcp` (MCP servers)
+- Core crates: `goose` (agent logic and ACP server), `goose-cli` (CLI), `goose-mcp` (MCP servers)
 - Error handling: Use `anyhow::Result`, not `unwrap()` in production code
 - Async runtime: tokio
 - MCP protocol implementations require extra scrutiny
@@ -56,7 +56,6 @@
 - `cargo fmt --check` - Code formatting (rustfmt)
 - `cargo test --jobs 2` - All tests
 - `cargo clippy --all-targets -- -D warnings` - Linting (clippy)
-- `just check-openapi-schema` - OpenAPI schema validation
 
 **Desktop app checks:**
 - `pnpm install --frozen-lockfile` - Fresh dependency install (in `ui/desktop/`)

.github/workflows/autoclose

@@ -1,23 +0,0 @@
-name: Close inactive issues
-on:
-  schedule:
-    - cron: "30 1 * * *"
-
-jobs:
-  close-issues:
-    runs-on: ubuntu-latest
-    permissions:
-      issues: write
-      pull-requests: write
-    steps:
-      - uses: actions/stale@v9
-        with:
-          days-before-issue-stale: 60
-          days-before-issue-close: 21
-          stale-issue-label: "stale"
-          stale-issue-message: "This issue is stale because it has been open for 30 days with no activity."
-          close-issue-message: "This issue was closed because it has been inactive for 14 days since being marked as stale."
-          days-before-pr-stale: -1
-          days-before-pr-close: -1
-          any-of-labels: "bug,Bug"
-          repo-token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/build-notify.yml

@@ -7,6 +7,8 @@ on:
       - Release
       - Canary
     types: [completed]
+    branches-ignore:
+      - "release/**"
 
 
 jobs:
@@ -34,4 +36,4 @@ jobs:
                 "color": 15158332
               }]
             }' \
-            "$DISCORD_WEBHOOK_URL"
+            "$DISCORD_WEBHOOK_URL"

.github/workflows/bundle-desktop-intel.yml

@@ -73,11 +73,11 @@ jobs:
           key: intel-macos-deployment-target-12
 
 
-      - name: Build goose-server for Intel macOS (x86_64)
+      - name: Build desktop backend for Intel macOS (x86_64)
         run: |
           source ./bin/activate-hermit
           rustup target add x86_64-apple-darwin
-          cargo build --release -p goose-server --target x86_64-apple-darwin
+          cargo build --release -p goose-cli --bin goose --target x86_64-apple-darwin
 
 
 
@@ -95,12 +95,16 @@ jobs:
           # Check disk space after cleanup
           df -h
 
-      - name: Copy binaries into Electron folder
+      - name: Copy backend binary into Electron folder
         run: |
-          cp target/x86_64-apple-darwin/release/goosed ui/desktop/src/bin/goosed
+          mkdir -p ui/desktop/src/bin
+          rm -f ui/desktop/src/bin/goose
+          cp target/x86_64-apple-darwin/release/goose ui/desktop/src/bin/goose
+          chmod +x ui/desktop/src/bin/goose
+          ls -la ui/desktop/src/bin/
 
       - name: Cache pnpm dependencies
-        uses: actions/cache@8b402f58fbc84540c8b491a91e594a4576fec3d7  # v5.0.2
+        uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8  # v6.0.0
         with:
           path: |
             ui/desktop/node_modules
@@ -152,6 +156,10 @@ jobs:
           fi
         working-directory: ui/desktop
 
+      - name: Verify macOS updater resources
+        run: node scripts/verify-mac-update-resources.js "out/Goose-darwin-x64/Goose.app"
+        working-directory: ui/desktop
+
       - name: Clean up signing keychain
         if: always()
         run: |

.github/workflows/bundle-desktop-linux.yml

@@ -124,7 +124,7 @@ jobs:
         with:
           key: linux-${{ matrix.build-on }}-${{ matrix.variant }}
 
-      - name: Build goosed binary
+      - name: Build desktop backend binary
         env:
           RUST_LOG: debug
           RUST_BACKTRACE: 1
@@ -137,19 +137,25 @@ jobs:
             FEATURE_ARGS=(--features vulkan)
           fi
 
-          cargo build --release --target ${TARGET} -p goose-server "${FEATURE_ARGS[@]}"
+          cargo build --release --target ${TARGET} -p goose-cli --bin goose "${FEATURE_ARGS[@]}"
 
-      - name: Copy binaries into Electron folder
+      - name: Copy backend binary into Electron folder
         run: |
-          echo "Copying binaries to ui/desktop/src/bin/"
+          echo "Copying backend binary to ui/desktop/src/bin/"
           export TARGET="x86_64-unknown-linux-gnu"
           mkdir -p ui/desktop/src/bin
-          cp target/$TARGET/release/goosed ui/desktop/src/bin/
-          chmod +x ui/desktop/src/bin/goosed
+          rm -f ui/desktop/src/bin/goose
+          cp target/$TARGET/release/goose ui/desktop/src/bin/
+          chmod +x ui/desktop/src/bin/goose
           ls -la ui/desktop/src/bin/
 
+      - name: Free Rust build artifacts before packaging
+        run: |
+          source ./bin/activate-hermit
+          cargo clean
+
       - name: Cache pnpm dependencies
-        uses: actions/cache@8b402f58fbc84540c8b491a91e594a4576fec3d7  # v5.0.2
+        uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8  # v6.0.0
         with:
           path: |
             ui/desktop/node_modules

.github/workflows/bundle-desktop-windows.yml

@@ -61,7 +61,7 @@ jobs:
         run: npm install -g pnpm@10.30.3
 
       - name: Cache node_modules
-        uses: actions/cache@8b402f58fbc84540c8b491a91e594a4576fec3d7  # v5.0.2
+        uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8  # v6.0.0
         with:
           path: |
             node_modules
@@ -113,28 +113,33 @@ jobs:
         env:
           CUDA_COMPUTE_CAP: ${{ inputs.windows_variant == 'cuda' && '80' || '' }}
         run: |
-          Write-Output "Building Windows executable..."
-          if ("${{ inputs.windows_variant }}" -eq "cuda") {
-            cargo build --release --target x86_64-pc-windows-msvc -p goose-server --features cuda
+          $isCuda = "${{ inputs.windows_variant }}" -eq "cuda"
+
+          Write-Output "Building Windows ACP backend"
+          if ($isCuda) {
+            cargo build --release --target x86_64-pc-windows-msvc -p goose-cli --bin goose --features cuda
           } else {
-            cargo build --release --target x86_64-pc-windows-msvc -p goose-server
+            cargo build --release --target x86_64-pc-windows-msvc -p goose-cli --bin goose
           }
+          $binaryPath = "./target/x86_64-pc-windows-msvc/release/goose.exe"
 
           # Verify build succeeded
-          if (-not (Test-Path "./target/x86_64-pc-windows-msvc/release/goosed.exe")) {
-            Write-Error "Windows binary not found."
+          if (-not (Test-Path $binaryPath)) {
+            Write-Error "Windows backend binary not found: $binaryPath"
             Get-ChildItem ./target/x86_64-pc-windows-msvc/release/ -ErrorAction SilentlyContinue
             exit 1
           }
 
-          Write-Output "Windows binary found."
-          Get-Item ./target/x86_64-pc-windows-msvc/release/goosed.exe
+          Write-Output "Windows backend binary found."
+          Get-Item $binaryPath
 
       - name: Prepare Windows binary
         shell: bash
         run: |
-          if [ ! -f "./target/x86_64-pc-windows-msvc/release/goosed.exe" ]; then
-            echo "Windows binary not found."
+          BACKEND_BINARY="./target/x86_64-pc-windows-msvc/release/goose.exe"
+
+          if [ ! -f "$BACKEND_BINARY" ]; then
+            echo "Windows backend binary not found: $BACKEND_BINARY"
             exit 1
           fi
 
@@ -142,13 +147,14 @@ jobs:
           rm -rf ./ui/desktop/src/bin
           mkdir -p ./ui/desktop/src/bin
 
-          echo "Copying Windows binary..."
-          cp -f ./target/x86_64-pc-windows-msvc/release/goosed.exe ./ui/desktop/src/bin/
+          echo "Copying Windows backend binary..."
+          cp -f "$BACKEND_BINARY" ./ui/desktop/src/bin/
 
           if [ -d "./ui/desktop/src/platform/windows/bin" ]; then
             echo "Copying Windows platform files..."
             for file in ./ui/desktop/src/platform/windows/bin/*.{exe,dll,cmd}; do
-              if [ -f "$file" ] && [ "$(basename "$file")" != "goosed.exe" ]; then
+              filename="$(basename "$file")"
+              if [ -f "$file" ] && [ "$filename" != "goose.exe" ]; then
                 cp -f "$file" ./ui/desktop/src/bin/
               fi
             done
@@ -229,14 +235,14 @@ jobs:
           certificate-profile-name: ${{ secrets.AZURE_CERTIFICATE_PROFILE_NAME }}
           files: |
             ${{ github.workspace }}/dist-windows/Goose.exe
-            ${{ github.workspace }}/dist-windows/resources/bin/goosed.exe
+            ${{ github.workspace }}/dist-windows/resources/bin/goose.exe
 
       - name: Verify signed executables
         shell: pwsh
         run: |
           $files = @(
             "dist-windows/Goose.exe",
-            "dist-windows/resources/bin/goosed.exe"
+            "dist-windows/resources/bin/goose.exe"
           )
           foreach ($file in $files) {
             Write-Output "Verifying signature: $file"

.github/workflows/bundle-desktop.yml

@@ -118,8 +118,10 @@ jobs:
           key: macos-deployment-target-12
 
       # Build the project
-      - name: Build goosed
-        run: source ./bin/activate-hermit && cargo build --release -p goose-server
+      - name: Build desktop backend
+        run: |
+          source ./bin/activate-hermit
+          cargo build --release -p goose-cli --bin goose
 
       # Post-build cleanup to free space
       - name: Post-build cleanup
@@ -134,12 +136,16 @@ jobs:
           # Check disk space after cleanup
           df -h
 
-      - name: Copy binaries into Electron folder
+      - name: Copy backend binary into Electron folder
         run: |
-          cp target/release/goosed ui/desktop/src/bin/goosed
+          mkdir -p ui/desktop/src/bin
+          rm -f ui/desktop/src/bin/goose
+          cp target/release/goose ui/desktop/src/bin/goose
+          chmod +x ui/desktop/src/bin/goose
+          ls -la ui/desktop/src/bin/
 
       - name: Cache pnpm dependencies
-        uses: actions/cache@8b402f58fbc84540c8b491a91e594a4576fec3d7  # v5.0.2
+        uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8  # v6.0.0
         with:
           path: |
             ui/desktop/node_modules
@@ -184,6 +190,10 @@ jobs:
           fi
         working-directory: ui/desktop
 
+      - name: Verify macOS updater resources
+        run: node scripts/verify-mac-update-resources.js "out/Goose-darwin-arm64/Goose.app"
+        working-directory: ui/desktop
+
       - name: Clean up signing keychain
         if: always()
         run: |

.github/workflows/canary.yml

@@ -67,7 +67,7 @@ jobs:
           path: download_cli.sh
 
   # ------------------------------------------------------------
-  # 4) Bundle Desktop App (macOS only) - builds goosed and Electron app
+  # 4) Bundle Desktop App (macOS only)
   # ------------------------------------------------------------
   bundle-desktop:
     needs: [prepare-version]
@@ -80,7 +80,7 @@ jobs:
       signing: false
 
   # ------------------------------------------------------------
-  # 5) Bundle Desktop App (macOS Intel) - builds goosed and Electron app
+  # 5) Bundle Desktop App (macOS Intel)
   # ------------------------------------------------------------
   bundle-desktop-intel:
     needs: [prepare-version]
@@ -93,7 +93,7 @@ jobs:
       signing: false
 
   # ------------------------------------------------------------
-  # 6) Bundle Desktop App (Linux) - builds goosed and Electron app
+  # 6) Bundle Desktop App (Linux)
   # ------------------------------------------------------------
   bundle-desktop-linux:
     needs: [prepare-version]
@@ -102,7 +102,7 @@ jobs:
       version: ${{ needs.prepare-version.outputs.version }}
 
   # ------------------------------------------------------------
-  # 6) Bundle Desktop App (Windows) - builds goosed and Electron app
+  # 6) Bundle Desktop App (Windows)
   # ------------------------------------------------------------
   bundle-desktop-windows:
     needs: [prepare-version]
@@ -138,7 +138,7 @@ jobs:
           merge-multiple: true
 
       - name: Attest build provenance
-        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32  # v4.1.0
+        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373  # v4.1.1
         with:
           subject-path: |
             goose-*.tar.bz2

.github/workflows/cargo-deny.yml

@@ -22,7 +22,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.0
       # https://github.com/EmbarkStudios/cargo-deny-action v2.0.15
       - uses: EmbarkStudios/cargo-deny-action@bb137d7af7e4fb67e5f82a49c4fce4fad40782fe
         with:

.github/workflows/ci.yml

@@ -41,7 +41,7 @@ jobs:
       - name: Checkout Code
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
-      - uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 # v1.16.1
+      - uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
 
       - name: Run cargo fmt
         run: cargo fmt --check
@@ -55,7 +55,7 @@ jobs:
       - name: Checkout Code
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
-      - uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 # v1.16.1
+      - uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
 
       - name: Install Dependencies
         run: |
@@ -119,7 +119,7 @@ jobs:
           echo "msrv=$msrv" >> "$GITHUB_OUTPUT"
           echo "MSRV: $msrv"
 
-      - uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6  # v1
+      - uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659  # v1
         with:
           toolchain: ${{ steps.msrv.outputs.msrv }}
 
@@ -145,7 +145,7 @@ jobs:
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
-      - uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 # v1.16.1
+      - uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
 
       - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4  # v2.9.1
 
@@ -167,7 +167,7 @@ jobs:
       - name: Checkout Code
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
-      - uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 # v1.16.1
+      - uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
 
       - name: Install Dependencies
         run: |
@@ -183,12 +183,6 @@ jobs:
           cd ui/desktop && pnpm install --frozen-lockfile
           cd ../sdk && pnpm install --frozen-lockfile
 
-      - name: Check OpenAPI Schema is Up-to-Date
-        run: |
-          source ./bin/activate-hermit
-          hermit uninstall rustup
-          just check-openapi-schema
-
       - name: Check ACP Schema is Up-to-Date
         run: |
           source ./bin/activate-hermit

.github/workflows/create-release-branch.yaml

@@ -23,7 +23,7 @@ jobs:
         ref: ${{ github.event.pull_request.merge_commit_sha }}
         fetch-depth: 0
 
-    - uses: cashapp/activate-hermit@e49f5cb4dd64ff0b0b659d1d8df499595451155a # v1
+    - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1
     - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39  # v8.2.0
 
     - name: Extract version and base branch

.github/workflows/create-version-bump-pr.yaml

@@ -30,7 +30,7 @@ jobs:
           ref: main
           fetch-depth: 0
 
-      - uses: cashapp/activate-hermit@e49f5cb4dd64ff0b0b659d1d8df499595451155a # v1
+      - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1
       - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
 
       - name: install dependencies
@@ -85,7 +85,7 @@ jobs:
 
           **Please follow these steps:**
 
-          1. Close and reopen this PR to trigger CI checks. Reason: workflows don't run on PRs opened by `GITHUB_TOKEN` ([docs](https://docs.github.com/en/actions/using-workflows/triggering-a-workflow#triggering-a-workflow-from-a-workflow)).
+          1. Approve workflows for this PR to trigger CI checks.
           2. Review and resolve any merge conflicts.
           3. Approve and merge this PR.
           4. The `release/${{ env.version }}` PR will be created automatically.

.github/workflows/deploy-docs-and-extensions.yml

@@ -32,7 +32,7 @@ jobs:
           node-version: 20
 
       - name: Cache Node.js modules (documentation)
-        uses: actions/cache@8b402f58fbc84540c8b491a91e594a4576fec3d7  # v5.0.2
+        uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8  # v6.0.0
         with:
           path: ./documentation/node_modules
           key: ${{ runner.os }}-documentation-${{ hashFiles('./documentation/package-lock.json') }}

.github/workflows/docs-update-cli-ref.yml

@@ -63,7 +63,7 @@ jobs:
           sudo apt-get install -y jq ripgrep
       
       - name: Set up Rust
-        uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 # v1.16.1
+        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
         with:
           toolchain: stable
       

.github/workflows/docs-update-recipe-ref.yml

@@ -1,292 +0,0 @@
-# Automatically updates the Recipe Reference Guide when recipe struct fields,
-# validation rules, or schema constraints change between releases.
-#
-# Triggers: Manual (for testing) or on release (production)
-# Testing: Use dry_run mode to review outputs without creating PRs
-# See: documentation/automation/recipe-schema-tracking/TESTING.md
-
-name: Update Recipe Documentation
-
-on:
-  workflow_dispatch:  # Manual trigger for testing
-    inputs:
-      old_version:
-        description: 'Previous version (e.g., v1.14.0). Leave empty to auto-detect.'
-        required: false
-        type: string
-      new_version:
-        description: 'New version (e.g., v1.15.0). Leave empty to use HEAD.'
-        required: false
-        type: string
-      dry_run:
-        description: 'Dry run mode - generate files but do not create PR'
-        required: false
-        type: boolean
-        default: true
-      
-  release:
-    types: [published]
-
-permissions:
-  contents: write       # Create branches and commit files
-  pull-requests: write  # Create PRs
-
-jobs:
-  update-docs:
-    name: Update Recipe Documentation
-    runs-on: ubuntu-latest
-    
-    env:
-      OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
-    
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
-        with:
-          fetch-depth: 0  # Fetch all history for version comparison
-          fetch-tags: true  # Fetch all tags so we can checkout version tags
-      
-      - name: Fetch upstream tags (for forks)
-        if: github.repository != 'aaif-goose/goose'
-        run: |
-          # Add upstream remote and fetch tags (only needed when testing in forks)
-          git remote add upstream https://github.com/aaif-goose/goose.git || git remote set-url upstream https://github.com/aaif-goose/goose.git
-          git fetch upstream --tags --force
-          echo "✅ Fetched tags from upstream (fork mode)"
-          echo "Total tags available: $(git tag | wc -l)"
-      
-      - name: Install system dependencies
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y jq ripgrep
-      
-      - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
-        with:
-          node-version: '20'
-      
-      - name: Install goose CLI
-        run: |
-          mkdir -p /home/runner/.local/bin
-          curl -fsSL https://github.com/aaif-goose/goose/releases/download/stable/download_cli.sh \
-            | CONFIGURE=false GOOSE_BIN_DIR=/home/runner/.local/bin bash
-          echo "/home/runner/.local/bin" >> $GITHUB_PATH
-          goose --version
-      
-      - name: Configure goose for CI
-        env:
-          GOOSE_PROVIDER: ${{ vars.GOOSE_PROVIDER || 'openai' }}
-          GOOSE_MODEL: ${{ vars.GOOSE_MODEL || 'gpt-4o' }}
-        run: |
-          mkdir -p ~/.config/goose
-          cat <<EOF > ~/.config/goose/config.yaml
-          GOOSE_PROVIDER: $GOOSE_PROVIDER
-          GOOSE_MODEL: $GOOSE_MODEL
-          keyring: false
-          EOF
-          echo "✅ Created goose config:"
-          cat ~/.config/goose/config.yaml
-      
-      - name: Determine versions to compare
-        id: versions
-        env:
-          GH_TOKEN: ${{ github.token }}
-          INPUT_OLD_VERSION: ${{ github.event.inputs.old_version }}
-          INPUT_NEW_VERSION: ${{ github.event.inputs.new_version }}
-          EVENT_NAME: ${{ github.event_name }}
-          RELEASE_TAG: ${{ github.event.release.tag_name }}
-        run: |
-          get_previous_release() {
-            gh release list --limit 2 --json tagName --jq '.[].tagName' | sed -n '2p'
-          }
-          
-          if [ -n "$INPUT_OLD_VERSION" ]; then
-            OLD_VERSION="$INPUT_OLD_VERSION"
-          else
-            OLD_VERSION=$(get_previous_release)
-          fi
-          
-          if [ -n "$INPUT_NEW_VERSION" ]; then
-            NEW_VERSION="$INPUT_NEW_VERSION"
-          elif [ "$EVENT_NAME" = "release" ]; then
-            NEW_VERSION="$RELEASE_TAG"
-          else
-            NEW_VERSION="HEAD"  # For testing unreleased changes
-          fi
-          
-          if [ -z "$OLD_VERSION" ] || [ -z "$NEW_VERSION" ]; then
-            echo "Error: Could not determine versions to compare"
-            exit 1
-          fi
-          
-          echo "old_version=$OLD_VERSION" >> $GITHUB_OUTPUT
-          echo "new_version=$NEW_VERSION" >> $GITHUB_OUTPUT
-          echo "OLD_VERSION=$OLD_VERSION" >> $GITHUB_ENV
-          echo "NEW_VERSION=$NEW_VERSION" >> $GITHUB_ENV
-          
-          echo "✅ Comparing $OLD_VERSION → $NEW_VERSION"
-      
-      - name: Extract and compare schemas
-        id: extract
-        timeout-minutes: 15
-        working-directory: documentation/automation/recipe-schema-tracking
-        env:
-          GOOSE_REPO: ${{ github.workspace }}
-        run: |
-          set -o pipefail  # Ensure pipeline failures are caught
-          
-          mkdir -p output
-          ./scripts/run-pipeline.sh "$OLD_VERSION" "$NEW_VERSION" 2>&1 | tee output/pipeline.log
-          
-          HAS_CHANGES=$(jq -r '.has_changes' output/validation-changes.json)
-          echo "has_changes=$HAS_CHANGES" >> $GITHUB_OUTPUT
-          
-          if [ "$HAS_CHANGES" = "false" ]; then
-            echo "✅ No changes detected"
-          else
-            echo "✅ Changes detected"
-          fi
-      
-      - name: Update recipe-reference.md (AI synthesis)
-        if: steps.extract.outputs.has_changes == 'true'
-        timeout-minutes: 10
-        working-directory: documentation/automation/recipe-schema-tracking/output
-        env:
-          RECIPE_REF_PATH: ${{ github.workspace }}/documentation/docs/guides/recipes/recipe-reference.md
-        run: |
-          echo "🔍 Environment diagnostics:"
-          echo "  GOOSE_PROVIDER: $GOOSE_PROVIDER"
-          echo "  GOOSE_MODEL: $GOOSE_MODEL"
-          echo "  OPENAI_API_KEY: ${OPENAI_API_KEY:0:8}..." # Show first 8 chars only
-          echo "  RECIPE_REF_PATH: $RECIPE_REF_PATH"
-          echo "  HOME: $HOME"
-          echo "  PATH: $PATH"
-          echo ""
-          echo "📁 Goose config file:"
-          cat ~/.config/goose/config.yaml || echo "Config file not found!"
-          echo ""
-          echo "📁 Current directory:"
-          pwd
-          ls -la
-          echo ""
-          echo "🤖 Step 1: Running validation changes synthesis..."
-          goose run --recipe ../recipes/synthesize-validation-changes.yaml
-          
-          echo ""
-          echo "🤖 Step 2: Applying changes to recipe-reference.md..."
-          goose run --recipe ../recipes/update-recipe-reference.yaml
-      
-      - name: Upload automation outputs
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
-        with:
-          name: recipe-docs-update-${{ steps.versions.outputs.old_version }}-to-${{ steps.versions.outputs.new_version }}
-          path: |
-            documentation/automation/recipe-schema-tracking/output/*.json
-            documentation/automation/recipe-schema-tracking/output/*.md
-            documentation/automation/recipe-schema-tracking/output/*.log
-          retention-days: 30
-      
-      - name: Create Pull Request
-        if: |
-          steps.extract.outputs.has_changes == 'true' && 
-          (github.event.inputs.dry_run != 'true' || github.event_name == 'release')
-        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1  # v8.1.1
-        with:
-          branch: docs/auto-recipe-reference-${{ steps.versions.outputs.new_version }}
-          delete-branch: true
-          
-          commit-message: |
-            docs: Update recipe reference for ${{ steps.versions.outputs.new_version }}
-            
-            Automated update based on schema changes between ${{ steps.versions.outputs.old_version }} and ${{ steps.versions.outputs.new_version }}.
-          
-          title: "docs: Update Recipe Reference Guide for ${{ steps.versions.outputs.new_version }}"
-          body: |
-            ## Summary
-
-            This PR updates the Recipe Reference Guide based on schema and validation changes detected between **${{ steps.versions.outputs.old_version }}** and **${{ steps.versions.outputs.new_version }}**.
-
-            ### Type of Change
-            - [x] Documentation
-
-            ### AI Assistance
-            - [x] This PR was created or reviewed with AI assistance
-
-            #### 🤖 Automation Details
-            
-            - **Workflow**: `docs-update-recipe-ref.yml`
-            - **Triggered by**: ${{ github.event_name }}
-            - **Previous version**: ${{ steps.versions.outputs.old_version }}
-            - **New version**: ${{ steps.versions.outputs.new_version }}
-            
-            #### 📋 Changes Detected
-            
-            Review the workflow artifacts for detailed change analysis:
-            - `validation-changes.json` - Structured diff of changes
-            - `validation-changes.md` - Human-readable change documentation
-            - `update-summary.md` - Summary of documentation updates applied
-            
-            Download artifacts from the [workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}).
-            
-            ### ✅ Review Checklist
-            
-            - [ ] Verify all schema changes are accurately documented
-            - [ ] Check that examples are updated correctly
-            - [ ] Ensure validation rules are clearly explained
-            - [ ] Confirm no unintended changes were made
-            - [ ] Do changes require additional updates in this or other recipe topics?
-            
-            ### 🔗 Related
-            
-            - Release: ${{ github.event.release.html_url || 'N/A' }}
-            
-            ---
-            
-            *This PR was automatically generated by the Recipe Documentation Automation workflow.*
-          
-          labels: |
-            documentation
-            automated
-            recipe-reference
-      
-      - name: Workflow summary
-        if: always()
-        env:
-          OLD_VERSION: ${{ steps.versions.outputs.old_version }}
-          NEW_VERSION: ${{ steps.versions.outputs.new_version }}
-          HAS_CHANGES: ${{ steps.extract.outputs.has_changes }}
-          DRY_RUN: ${{ github.event.inputs.dry_run || 'false' }}
-        run: |
-          echo "## 📊 Recipe Documentation Update Summary" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "**Version Comparison**: $OLD_VERSION → $NEW_VERSION" >> $GITHUB_STEP_SUMMARY
-          echo "**Changes Detected**: $HAS_CHANGES" >> $GITHUB_STEP_SUMMARY
-          echo "**Dry Run Mode**: $DRY_RUN" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          
-          if [ "$HAS_CHANGES" = "true" ]; then
-            echo "### ✅ Documentation Updated" >> $GITHUB_STEP_SUMMARY
-            echo "" >> $GITHUB_STEP_SUMMARY
-            echo "The Recipe Reference Guide has been updated to reflect changes in $NEW_VERSION." >> $GITHUB_STEP_SUMMARY
-            echo "" >> $GITHUB_STEP_SUMMARY
-            
-            if [ "$DRY_RUN" = "true" ]; then
-              echo "**Note**: Running in dry-run mode - no PR was created. Review the artifacts to see the generated changes." >> $GITHUB_STEP_SUMMARY
-            else
-              echo "A pull request has been created with the documentation updates." >> $GITHUB_STEP_SUMMARY
-            fi
-          else
-            echo "### ℹ️ No Changes Needed" >> $GITHUB_STEP_SUMMARY
-            echo "" >> $GITHUB_STEP_SUMMARY
-            echo "No recipe schema or validation changes were detected between $OLD_VERSION and $NEW_VERSION." >> $GITHUB_STEP_SUMMARY
-          fi
-          
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "### 📦 Artifacts" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "Download the workflow artifacts to review:" >> $GITHUB_STEP_SUMMARY
-          echo "- Extracted schemas and validation structures" >> $GITHUB_STEP_SUMMARY
-          echo "- Change detection results" >> $GITHUB_STEP_SUMMARY
-          echo "- Human-readable change documentation" >> $GITHUB_STEP_SUMMARY
-          echo "- Documentation update summary" >> $GITHUB_STEP_SUMMARY

.github/workflows/goose-issue-solver.yml

@@ -30,7 +30,7 @@ env:
       - Deletion is a feature: ask "can I delete code instead of adding?"
       - Complete changes: update ALL usages when changing a type. No exceptions.
       - When changing message types, update ALL provider format functions.
-      - When changing server routes, run `just generate-openapi`.
+      - When changing ACP request/response types, run `just generate-acp-types`.
       - Your context degrades. The TODO is your memory. Update it after each step.
 
       Types:

.github/workflows/goose-release-notes.yml

@@ -15,6 +15,8 @@ on:
       - Release
     types:
       - completed
+    branches-ignore:
+      - "release/**"
 
   # Allow manual trigger for testing
   workflow_dispatch:
@@ -76,7 +78,7 @@ jobs:
   generate-release-notes:
     name: Generate Release Notes
     runs-on: ubuntu-latest
-    # For workflow_run: only run if Release succeeded and tag is not 'stable'
+    # For workflow_run: release branch preflight builds are ignored by the trigger.
     # For workflow_dispatch: only run if tag is not 'stable'
     if: |
       (github.event_name == 'workflow_dispatch' && inputs.tag != 'stable') ||

.github/workflows/patch-release.yaml

@@ -24,7 +24,7 @@ jobs:
         ref: ${{ inputs.target_branch }}
         fetch-depth: 0
 
-    - uses: cashapp/activate-hermit@e49f5cb4dd64ff0b0b659d1d8df499595451155a # v1
+    - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1
     - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39  # v8.2.0
 
     - name: install dependencies

.github/workflows/pr-smoke-test.yml

@@ -55,7 +55,7 @@ jobs:
         with:
           ref: ${{ github.event.inputs.branch || github.ref }}
 
-      - uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 # v1.16.1
+      - uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
 
       - name: Install Dependencies
         run: |
@@ -67,7 +67,7 @@ jobs:
 
       - name: Build Binary for Smoke Tests
         run: |
-          cargo build --bin goose --bin goosed
+          cargo build --bin goose
 
       - name: Upload goose binary
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
@@ -76,13 +76,6 @@ jobs:
           path: target/debug/goose
           retention-days: 1
 
-      - name: Upload goosed binary
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
-        with:
-          name: goosed-binary
-          path: target/debug/goosed
-          retention-days: 1
-
   smoke-tests:
     name: Smoke Tests
     runs-on: ubuntu-latest
@@ -253,39 +246,3 @@ jobs:
           mkdir -p $HOME/.local/share/goose/sessions
           mkdir -p $HOME/.config/goose
           bash scripts/test_compaction.sh
-
-  goosed-integration-tests:
-    name: goose server HTTP integration tests
-    runs-on: ubuntu-latest
-    needs: build-binary
-    steps:
-      - name: Checkout Code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
-        with:
-          ref: ${{ github.event.inputs.branch || github.ref }}
-
-      - name: Download Binary
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
-        with:
-          name: goosed-binary
-          path: target/debug
-
-      - name: Make Binary Executable
-        run: chmod +x target/debug/goosed
-
-      - name: Install Node.js Dependencies
-        run: source ../../bin/activate-hermit && pnpm install --frozen-lockfile
-        working-directory: ui/desktop
-
-      - name: Run Integration Tests
-        env:
-          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
-          GOOSED_BINARY: ../../target/debug/goosed
-          GOOSE_PROVIDER: anthropic
-          GOOSE_MODEL: claude-sonnet-4-5-20250929
-          SHELL: /bin/bash
-          SKIP_BUILD: 1
-        run: |
-            echo 'export PATH=/some/fake/path:$PATH' >> $HOME/.bash_profile
-            source ../../bin/activate-hermit && pnpm run test:integration:goosed
-        working-directory: ui/desktop

.github/workflows/pr-website-preview.yml

@@ -20,6 +20,10 @@ jobs:
     permissions:
       contents: read
       pull-requests: write
+    env:
+      CLOUDFLARE_ACCOUNT_ID: ${{ secrets.PAGES_PR_PREVIEW_CF_ACCOUNT_ID }}
+      CLOUDFLARE_API_TOKEN: ${{ secrets.PAGES_PR_PREVIEW_CF_API_TOKEN }}
+      CLOUDFLARE_PAGES_PROJECT_NAME: ${{ secrets.PAGES_PR_PREVIEW_CF_PAGES_PROJECT_NAME }}
     steps:
       - name: Checkout the branch
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
@@ -47,17 +51,16 @@ jobs:
         run: ./scripts/verify-build.sh
 
       - name: Setup Node.js for Wrangler
+        if: env.CLOUDFLARE_API_TOKEN != ''
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
         with:
           node-version: 22
 
       - name: Deploy preview to Cloudflare Pages
+        if: env.CLOUDFLARE_API_TOKEN != ''
         id: cloudflare-pages
         working-directory: ./documentation
         env:
-          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.PAGES_PR_PREVIEW_CF_ACCOUNT_ID }}
-          CLOUDFLARE_API_TOKEN: ${{ secrets.PAGES_PR_PREVIEW_CF_API_TOKEN }}
-          CLOUDFLARE_PAGES_PROJECT_NAME: ${{ secrets.PAGES_PR_PREVIEW_CF_PAGES_PROJECT_NAME }}
           PR_NUMBER: ${{ github.event.number }}
         run: |
           set -euo pipefail
@@ -76,6 +79,7 @@ jobs:
           echo "preview-url=$preview_url" >> "$GITHUB_OUTPUT"
 
       - name: Comment preview URL
+        if: env.CLOUDFLARE_API_TOKEN != ''
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9.0.0
         env:
           PREVIEW_URL: ${{ steps.cloudflare-pages.outputs.preview-url }}

.github/workflows/publish-ask-ai-bot.yml

@@ -22,7 +22,7 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
       - name: Log in to GitHub Container Registry
         uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
@@ -33,7 +33,7 @@ jobs:
 
       - name: Extract metadata
         id: meta
-        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         with:
           images: ghcr.io/${{ github.repository_owner }}/ask-ai-bot
           tags: |
@@ -42,7 +42,7 @@ jobs:
             type=raw,value=latest,enable={{is_default_branch}}
 
       - name: Build and push Docker image
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # pin@v7.2.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # pin@v7.3.0
         with:
           context: .
           file: services/ask-ai-bot/Dockerfile

.github/workflows/publish-docker.yml

@@ -26,7 +26,7 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
       
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f  # v3.12.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c  # v4.2.0
       
       - name: Log in to GitHub Container Registry
         uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee  # v4.2.0
@@ -37,7 +37,7 @@ jobs:
       
       - name: Extract metadata
         id: meta
-        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9  # v6.1.0
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302  # v6.2.0
         with:
           images: ghcr.io/${{ github.repository_owner }}/goose
           tags: |
@@ -54,7 +54,7 @@ jobs:
       
       - name: Build and push Docker image
         id: docker-push
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # pin@v7.2.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # pin@v7.3.0
         with:
           context: .
           push: true
@@ -65,7 +65,7 @@ jobs:
           platforms: linux/amd64,linux/arm64
 
       - name: Attest Docker image
-        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32  # v4.1.0
+        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373  # v4.1.1
         with:
           subject-name: ghcr.io/${{ github.repository_owner }}/goose
           subject-digest: ${{ steps.docker-push.outputs.digest }}

.github/workflows/publish-npm.yml

@@ -32,7 +32,7 @@ jobs:
           always-auth: true
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
         with:
           version: 10.30.3
 
@@ -164,7 +164,7 @@ jobs:
           always-auth: true
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
         with:
           version: 10.30.3
 

.github/workflows/python-sdk-wheels.yml

@@ -0,0 +1,118 @@
+name: Python SDK Wheels
+
+on:
+  workflow_dispatch:
+    inputs:
+      publish:
+        description: "Publish wheels to PyPI after building"
+        required: true
+        default: false
+        type: boolean
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  build-wheels:
+    name: Build wheel (${{ matrix.name }})
+    runs-on: ${{ matrix.os }}
+    container: ${{ matrix.container || null }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: macos-arm64
+            os: macos-14
+          - name: macos-x86_64
+            os: macos-13
+          - name: linux-x86_64
+            os: ubuntu-latest
+            container: quay.io/pypa/manylinux_2_28_x86_64@sha256:441c35fdc6ee809ff9260894f8468ab4fea8c15dc880f8700a3f81b7922c1cda
+          - name: windows-x86_64
+            os: windows-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Set up Rust
+        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
+
+      - name: Set up Python
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        with:
+          python-version: "3.12"
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        with:
+          enable-cache: true
+
+      - name: Install Linux tools
+        if: runner.os == 'Linux'
+        shell: bash
+        run: |
+          python3 -m pip install --upgrade pip
+          python3 -m pip install uv
+          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+          curl --proto '=https' --tlsv1.2 -sSf https://just.systems/install.sh | bash -s -- --to /usr/local/bin
+
+      - name: Install just
+        if: runner.os != 'Linux'
+        uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4
+
+      - name: Cache Cargo artifacts
+        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+
+      - name: Build wheel
+        shell: bash
+        run: just --justfile crates/goose-sdk/justfile python-wheel
+
+      - name: Repair Linux wheel
+        if: runner.os == 'Linux'
+        shell: bash
+        run: |
+          python3 -m pip install auditwheel
+          mkdir -p crates/goose-sdk/python/wheelhouse
+          auditwheel repair --plat manylinux_2_28_x86_64 -w crates/goose-sdk/python/wheelhouse crates/goose-sdk/python/dist/*.whl
+          rm crates/goose-sdk/python/dist/*.whl
+          mv crates/goose-sdk/python/wheelhouse/*.whl crates/goose-sdk/python/dist/
+
+      - name: Smoke test wheel
+        shell: bash
+        run: |
+          python -m venv .venv-wheel-test
+          if [ "${{ runner.os }}" = "Windows" ]; then
+            python_bin=".venv-wheel-test/Scripts/python.exe"
+          else
+            python_bin=".venv-wheel-test/bin/python"
+          fi
+          UV_NO_CONFIG=1 uv pip install --default-index https://pypi.org/simple --python "$python_bin" crates/goose-sdk/python/dist/*.whl
+          "$python_bin" -c 'import goose; print(goose.__name__)'
+
+      - name: Upload wheel artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: goose-sdk-wheel-${{ matrix.name }}
+          path: crates/goose-sdk/python/dist/*.whl
+          if-no-files-found: error
+
+  publish:
+    name: Publish wheels to PyPI
+    needs: build-wheels
+    runs-on: ubuntu-latest
+    if: github.event_name == 'workflow_dispatch' && inputs.publish
+    environment: pypi
+    steps:
+      - name: Download wheel artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          pattern: goose-sdk-wheel-*
+          path: dist
+          merge-multiple: true
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
+        with:
+          packages-dir: dist

.github/workflows/rebuild-skills-marketplace.yml

@@ -53,7 +53,7 @@ jobs:
           node-version: 20
 
       - name: Cache Node.js modules (documentation)
-        uses: actions/cache@8b402f58fbc84540c8b491a91e594a4576fec3d7  # v5.0.2
+        uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8  # v6.0.0
         with:
           path: ./documentation/node_modules
           key: ${{ runner.os }}-documentation-${{ hashFiles('./documentation/package-lock.json') }}

.github/workflows/recipe-security-scanner.yml

@@ -119,7 +119,7 @@ jobs:
 
       - name: Set up Docker Buildx
         if: steps.find_recipes.outputs.has_recipes == 'true' && steps.recipe_changes.outputs.recipe_files_changed == 'true'
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f  # v3.12.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c  # v4.2.0
 
       - name: Prune Docker caches
         if: steps.find_recipes.outputs.has_recipes == 'true' && steps.recipe_changes.outputs.recipe_files_changed == 'true'

.github/workflows/release.yml

@@ -1,8 +1,10 @@
-# This workflow is main release, needs to be manually tagged & pushed.
+# This workflow builds release artifacts for release branches and publishes tagged releases.
 on:
   push:
     paths-ignore:
       - "documentation/**"
+    branches:
+      - "release/*"
     tags:
       - "v1.*"
 
@@ -15,6 +17,11 @@ permissions:
   pull-requests: write  # Required for npm publish workflow
   attestations: write  # Required for SLSA build provenance attestations
 
+env:
+  # Set this repository Actions variable to "true" in GitHub Settings > Secrets and variables
+  # > Actions > Variables after a release containing desktop app-update.yml has shipped.
+  ENABLE_MAC_NATIVE_AUTO_UPDATE: ${{ vars.ENABLE_MAC_NATIVE_AUTO_UPDATE || 'false' }}
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
@@ -49,8 +56,8 @@ jobs:
       id-token: write
       contents: read
     with:
-      signing: true
-      environment: signing
+      signing: ${{ startsWith(github.ref, 'refs/tags/') }}
+      environment: ${{ startsWith(github.ref, 'refs/tags/') && 'signing' || '' }}
     secrets: inherit
 
   # ------------------------------------------------------------
@@ -62,8 +69,8 @@ jobs:
       id-token: write
       contents: read
     with:
-      signing: true
-      environment: signing
+      signing: ${{ startsWith(github.ref, 'refs/tags/') }}
+      environment: ${{ startsWith(github.ref, 'refs/tags/') && 'signing' || '' }}
     secrets: inherit
 
   # ------------------------------------------------------------
@@ -82,7 +89,7 @@ jobs:
       contents: read
       actions: read
     with:
-      signing: true
+      signing: ${{ startsWith(github.ref, 'refs/tags/') }}
     secrets: inherit
 
   bundle-desktop-windows-cuda:
@@ -92,7 +99,7 @@ jobs:
       contents: read
       actions: read
     with:
-      signing: true
+      signing: ${{ startsWith(github.ref, 'refs/tags/') }}
       windows_variant: cuda
     secrets: inherit
 
@@ -101,6 +108,7 @@ jobs:
   # ------------------------------------
   release:
     name: Release
+    if: startsWith(github.ref, 'refs/tags/')
     runs-on: ubuntu-latest
     needs: [build-cli, install-script, bundle-desktop, bundle-desktop-intel, bundle-desktop-linux, bundle-desktop-windows, bundle-desktop-windows-cuda]
     permissions:
@@ -108,7 +116,7 @@ jobs:
       id-token: write      # Required for Sigstore OIDC signing
       attestations: write  # Required for SLSA build provenance attestations
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
       - name: Download all artifacts
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
@@ -116,10 +124,17 @@ jobs:
           merge-multiple: true
 
       - name: Generate macOS update manifest
+        if: ${{ env.ENABLE_MAC_NATIVE_AUTO_UPDATE == 'true' }}
         run: node ui/desktop/scripts/generate-mac-update-manifest.js --version "${GITHUB_REF_NAME}" --directory .
 
+      - name: Attest macOS update manifest
+        if: ${{ env.ENABLE_MAC_NATIVE_AUTO_UPDATE == 'true' }}
+        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373  # v4.1.1
+        with:
+          subject-path: latest-mac.yml
+
       - name: Attest build provenance
-        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32  # v4.1.0
+        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373  # v4.1.1
         with:
           subject-path: |
             goose-*.tar.bz2
@@ -129,7 +144,6 @@ jobs:
             *.deb
             *.rpm
             *.flatpak
-            latest-mac.yml
             download_cli.sh
 
       # Create/update the versioned release
@@ -145,7 +159,6 @@ jobs:
             *.deb
             *.rpm
             *.flatpak
-            latest-mac.yml
             download_cli.sh
           allowUpdates: true
           omitBody: true
@@ -166,8 +179,15 @@ jobs:
             *.deb
             *.rpm
             *.flatpak
-            latest-mac.yml
             download_cli.sh
           allowUpdates: true
           omitBody: true
           omitPrereleaseDuringUpdate: true
+
+      - name: Upload macOS update manifest
+        if: ${{ env.ENABLE_MAC_NATIVE_AUTO_UPDATE == 'true' }}
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh release upload "${GITHUB_REF_NAME}" latest-mac.yml --clobber
+          gh release upload stable latest-mac.yml --clobber

.github/workflows/stale.yml

@@ -29,7 +29,7 @@ jobs:
     steps:
       # Use the official stale action from GitHub
       - name: 'Close Stale PRs'
-        uses: actions/stale@997185467fa4f803885201cee163a9f38240193d  # v10.1.1
+        uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899  # v10.3.0
         with:
           # Authentication token with required permissions
           repo-token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/update-release-pr.yaml

@@ -21,7 +21,7 @@ jobs:
       with:
         fetch-depth: 0
 
-    - uses: cashapp/activate-hermit@e49f5cb4dd64ff0b0b659d1d8df499595451155a # v1
+    - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1
     - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39  # v8.2.0
 
     - name: Extract version from branch name

.gitignore

@@ -6,6 +6,7 @@ tokenizer_files/
 .DS_Store
 .idea
 .vscode
+.zed/
 *.log
 tmp/
 

AGENTS.md

@@ -14,7 +14,7 @@ cargo build
 ```bash
 cargo build                   # debug
 cargo build --release         # release  
-just release-binary           # release + openapi
+just release-binary           # release binary
 ```
 
 ### Test
@@ -33,8 +33,8 @@ cargo clippy --all-targets -- -D warnings
 
 ### UI
 ```bash
-just generate-openapi        # after server changes
 just run-ui                  # start desktop
+cd ui/desktop && pnpm run typecheck
 cd ui/desktop && pnpm test   # test UI
 ```
 
@@ -44,12 +44,10 @@ crates/
 ├── goose              # core logic
 ├── goose-acp-macros   # ACP proc macros
 ├── goose-cli          # CLI entry
-├── goose-server       # backend (binary: goosed)
 ├── goose-mcp          # MCP extensions
 ├── goose-test         # test utilities
 └── goose-test-support # test helpers
 
-evals/open-model-gym/  # benchmarking / evals
 ui/desktop/            # Electron app
 ```
 
@@ -65,7 +63,6 @@ ui/desktop/            # Electron app
 # 1. cargo build
 # 2. cargo test -p <crate>
 # 3. cargo clippy --all-targets -- -D warnings
-# 4. [if server] just generate-openapi
 ```
 
 ## Rules
@@ -75,7 +72,7 @@ ui/desktop/            # Electron app
 - Error: Use anyhow::Result
 - Provider: Implement Provider trait see providers/base.rs
 - MCP: Extensions in crates/goose-mcp/
-- Server: Changes need just generate-openapi
+- UI Desktop: Use ACP SDK types or local `src/types/*` types. Do not import generated OpenAPI types/client code from `ui/desktop/src/api`
 
 ## Code Quality
 
@@ -107,7 +104,7 @@ remaining space for dynamic text.
 
 ## Never
 
-- Never: Edit ui/desktop/openapi.json manually
+- Never: Recreate `ui/desktop/src/api` or add `@hey-api/openapi-ts` to `ui/desktop`
 - Cargo.toml: For human-authored dependency changes, use `cargo add` instead of manually editing dependency entries unless there is a specific reason not to.
 - Cargo.toml: Automated dependency bump PRs are exempt; when manual edits are necessary, keep `Cargo.lock` consistent.
 - Never: Skip cargo fmt
@@ -116,6 +113,5 @@ remaining space for dynamic text.
 
 ## Entry Points
 - CLI: crates/goose-cli/src/main.rs
-- Server: crates/goose-server/src/main.rs
 - UI: ui/desktop/src/main.ts
 - Agent: crates/goose/src/agents/agent.rs

BUILDING_LINUX.md

@@ -59,13 +59,7 @@ cd goose
 Build Goose CLI:
 
 ```bash
-cargo build --release -p goose-cli
-```
-
-Build Goose Server:
-
-```bash
-cargo build --release -p goose-server
+cargo build --release -p goose-cli --bin goose
 ```
 
 This command should give you a list of possible packages in the
@@ -80,9 +74,9 @@ cargo test -p
 cd ui/desktop
 pnpm install
 
-# Copy the server binary to the expected location
+# Copy the goose binary to the expected location
 mkdir -p src/bin
-cp ../../target/release/goosed src/bin/
+cp ../../target/release/goose src/bin/
 ```
 
 ### 4. Build the Application
@@ -143,10 +137,10 @@ cd /path/to/goose/ui/desktop/out/goose-linux-x64
 ./goose 2>&1 | grep -v "GLib-GObject" | grep -v "browser_main_loop"
 ```
 
-#### Server Binary Not Found
-If you see "Could not find goosed binary", ensure you've:
-1. Built the Rust backend: `cargo build --release -p goose-server`
-2. Copied it to the right location: `cp ../../target/release/goosed src/bin/`
+#### Goose Binary Not Found
+If you see "Goose binary not found", ensure you've:
+1. Built the Rust binary: `cargo build --release -p goose-cli --bin goose`
+2. Copied it to the right location: `cp ../../target/release/goose src/bin/`
 3. Rebuilt the application: `pnpm run make`
 
 ### Distribution-Specific Notes
@@ -177,7 +171,7 @@ Building as Snap packages is not currently supported but may be added in the fut
 
 For active development:
 
-1. **Backend changes**: Rebuild with `cargo build --release -p goose-server` and copy the binary
+1. **Backend changes**: Rebuild with `cargo build --release -p goose-cli --bin goose` and copy the binary
 2. **Frontend changes**: Use `pnpm run start` for hot reload during development
 3. **Full rebuild**: Run the complete build process above
 

CONTRIBUTING.md

@@ -29,16 +29,17 @@ It just means the change was too large for a first contribution. Start with some
 
 ### Issues
 
-If you spot a bug or have a concrete proposal for a feature, please open an issue. This shows the community and
-the maintainers the direction of your thinking.
+If you spot a bug, please open an issue. This shows the community and the maintainers the direction of your
+thinking.
 
 For bugs, describe how to reproduce the problem as clearly as possible. If the issue involves an interaction
 with an LLM, include a diagnostics report if possible.
 
 ### Discussions
 
-If you have an idea but are not yet sure how it should work, open a discussion instead. Discussions are a good
-place to explore design questions, alternatives, and whether something fits the goals of the project.
+Before opening a feature request or beginning implementation, please start with a discussion in the
+[goose-eng Discord channel](https://discord.com/channels/1287729918100246654/1514412780504088677). Discussions
+are a good place to explore design questions, alternatives, and whether something fits the goals of the project.
 
 If a change is large or touches multiple parts of the codebase, please start with a discussion before opening a PR.
 This helps us align on direction before you spend time implementing something.
@@ -184,41 +185,27 @@ cd ui && pnpm install
 
 See #8757.
 
-### Regenerating the OpenAPI schema
-
-The file `ui/desktop/openapi.json` is automatically generated during the build.
-It is written by the `generate_schema` binary in `crates/goose-server`.
-To update the spec without starting the UI, run:
-
-```
-just generate-openapi
-```
-
-This command regenerates `ui/desktop/openapi.json` and then runs the UI's
-`generate-api` script to rebuild the TypeScript client from that spec.
-
-API changes should be made in the Rust source under `crates/goose-server/src/`.
-
 ### Debugging
 
-To debug the Goose server, run it from an IDE. The configuration will depend on the IDE. The command to run is:
+To debug the external ACP backend, run it from an IDE. The configuration will depend on the IDE. The command to run is:
 
 ```
 export GOOSE_SERVER__SECRET_KEY=test
-cargo run --package goose-server --bin goosed -- agent   # or: `just run-server`
+cargo run --package goose-cli --bin goose -- serve --platform desktop --host 127.0.0.1 --port 3000
 ```
 
-The server listens on port `3000` by default; this can be changed by setting the
-`GOOSE_PORT` environment variable.
+The `debug-ui` recipe connects to `http://127.0.0.1:3000` by default. If the
+backend uses another port, set `GOOSE_PORT` when starting the UI, or set
+`GOOSE_EXTERNAL_BACKEND_URL` to the backend's HTTP base URL.
 
-Once the server is running, start a UI and connect it to the server by running:
+Once the backend is running, start a UI and connect it to the backend by running:
 
 ```
 just debug-ui
 ```
 
-The UI connects to the server started in the IDE, allowing breakpoints
-and stepping through the server code while interacting with the UI.
+The UI connects to the backend started in the IDE, allowing breakpoints
+and stepping through the backend code while interacting with the UI.
 
 ## Creating a fork
 

CUSTOM_DISTROS.md

@@ -26,8 +26,8 @@ goose's architecture is designed for extensibility. Organizations can create "re
           │                │                      │
           ▼                ▼                      ▼
 ┌─────────────────────────────────────────────────────────────────┐
-│                    goose-server (goosed)                        │
-│         REST API for all goose functionality                    │
+│                    goose serve (ACP)                            │
+│         ACP HTTP/WebSocket server for custom clients            │
 └─────────────────────────────────────────────────────────────────┘
           │
           ▼
@@ -49,7 +49,7 @@ goose's architecture is designed for extensibility. Organizations can create "re
 | Bundle custom MCP extensions | `config.yaml` extensions section, `ui/desktop/src/built-in-extensions.json`, `ui/desktop/src/components/settings/extensions/bundled-extensions.json` | Medium |
 | Modify system prompts | `crates/goose/src/prompts/` | Low |
 | Customize desktop branding | `ui/desktop/` (icons, names, colors) | Medium |
-| Build a new UI (web, mobile) | Integrate with `goose-server` REST API | High |
+| Build a new UI (web, mobile) | Integrate with `goose serve` over ACP | High |
 | Create guided workflows | Recipes (YAML-based task definitions) | Low |
 | Build complex multi-step workflows | Recipes with sub-recipes and subagents | Medium |
 
@@ -304,40 +304,32 @@ export GOOSE_BUNDLE_NAME="InsightStream-goose"
 
 **Goal**: Create an entirely new frontend while leveraging goose's backend.
 
-goose provides two integration options for building custom UIs:
+goose provides two ACP transport options for building custom clients:
 
-### Option 1: REST API (goose-server)
+### Option 1: ACP HTTP/WebSocket (`goose serve`)
 
-Use goose-server for HTTP-based integrations (web apps, simple clients):
+Use `goose serve` for process-separated integrations such as web apps, desktop shells, and other clients:
 
 ```bash
 # Start the server
-./target/release/goosed
+GOOSE_SERVER__SECRET_KEY='a-long-random-secret' goose serve
 
-# API available at http://localhost:3000
+# ACP endpoint available at http://localhost:3284/acp
 ```
 
-**Reference the OpenAPI spec** at `ui/desktop/openapi.json` for available endpoints:
-- Session management
-- Message streaming  
-- Extension control
-- Configuration
+HTTP clients authenticate with the `X-Secret-Key` header. Browser WebSocket clients use the same secret as a `?token=` query parameter because the browser WebSocket API cannot set custom headers:
 
-**Key endpoints** for a minimal integration:
-
-```
-POST /sessions              # Create a new session
-POST /sessions/{id}/messages # Send a message (streaming response)
-GET  /sessions/{id}         # Get session state
-GET  /extensions            # List available extensions
-POST /extensions/{name}/enable  # Enable an extension
+```text
+ws://localhost:3284/acp?token=a-long-random-secret
 ```
 
-**Handle streaming responses** - goose uses Server-Sent Events (SSE) for real-time responses.
+For browser clients served from a non-loopback origin, pass the exact UI origin with `--allowed-origin`. When you pass `--allowed-origin`, it replaces the default loopback origin allowlist, so include every origin the client needs.
 
-### Option 2: Agent Client Protocol (ACP)
+For the ACP protocol and client flow, see [Agent Client Protocol clients](documentation/docs/guides/acp-clients.md).
 
-For richer integrations (IDEs, desktop apps, embedded agents), use the **Agent Client Protocol (ACP)**—a standardized JSON-RPC protocol for AI agent communication over stdio or other transports.
+### Option 2: Agent Client Protocol (ACP) over stdio
+
+For richer local integrations (IDEs and embedded agents), run goose as an ACP agent over stdio.
 
 ACP provides:
 - **Bidirectional communication**: Agents can request permissions, stream updates, and receive cancellations
@@ -410,11 +402,6 @@ For the full ACP specification, see the [Agent Client Protocol documentation](ht
 
 ### Technical Details
 
-**REST API (goose-server)**:
-- Server implementation: `crates/goose-server/src/routes/`
-- OpenAPI generation: `just generate-openapi`
-- API client example: `ui/desktop/src/api/` (generated TypeScript client)
-
 **ACP**:
 - ACP server implementation: `crates/goose/src/acp/server.rs`
 - CLI integration: `crates/goose-cli/src/cli.rs` (Command::Acp)
@@ -655,10 +642,10 @@ prompt: |
   - find_patterns: Find similar features to model after
 ```
 
-The AI can then invoke these sub-recipes using the `subagent` tool:
+Recipes that define `sub_recipes` get the Summon extension automatically. The AI can invoke sub-recipes through Summon's `delegate` tool:
 
 ```
-subagent(subrecipe: "find_files", parameters: {"search_term": "authentication"})
+delegate(source: "find_files", parameters: {"search_term": "authentication"})
 ```
 
 ### Subagents: Dynamic Task Delegation
@@ -678,28 +665,27 @@ prompt: |
   To complete this task:
   
   1. Spawn a subagent to analyze the frontend code:
-     subagent(instructions: "Analyze all React components in src/components/ 
-              and list their props and state management patterns")
+     delegate(instructions: "Analyze all React components in src/components/ and list their props and state management patterns")
   
   2. Spawn another subagent for the backend:
-     subagent(instructions: "Document all API endpoints in src/api/ 
-              including their request/response schemas")
+     delegate(instructions: "Document all API endpoints in src/api/ including their request/response schemas")
   
   3. Synthesize findings from both subagents into a unified report.
 ```
 
 #### Parallel Subagent Execution
 
-Multiple subagent calls in the same message execute in parallel:
+Use `async: true` to run delegates in parallel, then collect each result with `load(source: "<task_id>")`:
 
 ```yaml
 prompt: |
-  Run these analyses in parallel by making all subagent calls at once:
+  Run these analyses in parallel:
   
-  subagent(instructions: "Count lines of code by language")
-  subagent(instructions: "Find all TODO comments") 
-  subagent(instructions: "List external dependencies")
+  delegate(instructions: "Count lines of code by language", async: true)
+  delegate(instructions: "Find all TODO comments", async: true)
+  delegate(instructions: "List external dependencies", async: true)
   
+  Use load(source: "<task_id>") for each returned task id.
   Then combine the results into a codebase health report.
 ```
 
@@ -711,22 +697,18 @@ Customize model, provider, or behavior per subagent:
 prompt: |
   Use a faster model for simple tasks:
   
-  subagent(
+  delegate(
     instructions: "List all files modified in the last week",
-    settings: {
-      model: "gpt-4o-mini",
-      max_turns: 3
-    }
+    model: "gpt-4o-mini",
+    max_turns: 3
   )
   
   Use the full model for complex analysis:
   
-  subagent(
+  delegate(
     instructions: "Review this code for security vulnerabilities",
-    settings: {
-      model: "claude-sonnet-4-20250514",
-      temperature: 0.1
-    }
+    model: "claude-sonnet-4-20250514",
+    temperature: 0.1
   )
 ```
 
@@ -738,7 +720,7 @@ Limit which extensions a subagent can access:
 prompt: |
   Create a sandboxed subagent with only file reading capabilities:
   
-  subagent(
+  delegate(
     instructions: "Analyze the README files in this project",
     extensions: ["developer"]  # Only developer extension, no network access
   )
@@ -819,7 +801,7 @@ prompt: |
 2. **Parallelize independent tasks** - Multiple subagent calls in one message run concurrently
 3. **Use `sequential_when_repeated: true`** - For tasks that shouldn't run in parallel (e.g., database migrations)
 4. **Scope extensions appropriately** - Give subagents only the tools they need
-5. **Use summary mode (default)** - Subagents return concise summaries; use `summary: false` only when you need full conversation history
+5. **Use background delegation for independent work** - Pass `async: true` to `delegate`, then collect results with `load(source: "<task_id>")`
 6. **Handle failures gracefully** - Design workflows to continue even if one subagent fails
 
 ### Technical Details

Cargo.toml

@@ -8,8 +8,8 @@ resolver = "2"
 
 [workspace.package]
 edition = "2021"
-version = "1.39.0"
-rust-version = "1.91.1"
+version = "1.42.0"
+rust-version = "1.94.1"
 authors = ["AAIF <ai-oss-tools@block.xyz>"]
 license = "Apache-2.0"
 repository = "https://github.com/aaif-goose/goose"
@@ -21,8 +21,9 @@ string_slice = "warn"
 
 [workspace.dependencies]
 rmcp = { version = "1.4", default-features = false, features = ["schemars", "auth"] }
-agent-client-protocol-schema = { version = "0.12", default-features = false, features = ["unstable"] }
-agent-client-protocol = { version = "0.11", default-features = false }
+agent-client-protocol-schema = { version = "1.1", default-features = false, features = ["unstable"] }
+agent-client-protocol = { version = "1.0", default-features = false }
+agent-client-protocol-http = { version = "1.0", default-features = false, features = ["server", "unstable_cancel_request"] }
 arboard = { version = "3", default-features = false }
 anyhow = { version = "1.0.102", default-features = false, features = ["std"] }
 async-stream = { version = "0.3.6", default-features = false }
@@ -30,8 +31,8 @@ async-trait = { version = "0.1.89", default-features = false }
 axum = { version = "0.8", default-features = false, features = ["http1", "http2", "json", "tokio", "query"] }
 base64 = { version = "0.22.1", default-features = false, features = ["std"] }
 bytes = { version = "1.10.1", default-features = false, features = ["std"] }
-candle-core = { version = "0.10", default-features = false }
-candle-nn = { version = "0.10", default-features = false }
+candle-core = { version = "0.11", default-features = false }
+candle-nn = { version = "0.11", default-features = false }
 chrono = { version = "0.4.44", default-features = false, features = ["serde", "std"] }
 clap = { version = "4.1.14", default-features = false, features = ["derive", "std", "help", "suggestions", "usage", "color", "error-context"] }
 dirs = { version = "6", default-features = false }
@@ -83,7 +84,7 @@ url = { version = "2.5.4", default-features = false, features = ["std"] }
 opentelemetry = { version = "0.32", default-features = false }
 opentelemetry_sdk = { version = "0.32", default-features = false, features = ["metrics"] }
 opentelemetry-http = { version = "0.32", default-features = false, features = ["internal-logs", "reqwest"] }
-opentelemetry-otlp = { version = "0.32", default-features = false, features = ["http-proto", "internal-logs", "logs", "metrics", "reqwest-blocking-client", "trace"] }
+opentelemetry-otlp = { version = "0.32", default-features = false, features = ["http-proto", "internal-logs", "logs", "metrics", "reqwest-client", "trace"] }
 opentelemetry-appender-tracing = { version = "0.32", default-features = false, features = ["experimental_span_attributes"] }
 opentelemetry-stdout = { version = "0.32", default-features = false, features = ["trace", "metrics", "logs"] }
 tracing-opentelemetry = { version = "0.33", default-features = false, features = ["metrics"] }

Justfile

@@ -13,18 +13,14 @@ check-everything:
     cargo clippy --all-targets -- -D warnings
     @echo "  → Checking UI code formatting..."
     cd ui/desktop && pnpm run lint:check
-    @echo "  → Validating OpenAPI schema..."
-    ./scripts/check-openapi-schema.sh
     @echo ""
     @echo "✅ All style checks passed!"
 
 # Default release command
 release-binary:
     @echo "Building release version..."
-    cargo build --release
+    cargo build --release -p goose-cli --bin goose
     @just copy-binary
-    @echo "Generating OpenAPI schema..."
-    cargo run -p goose-server --bin generate_schema
 
 # Build Windows executable on a Windows host
 [unix]
@@ -34,7 +30,7 @@ release-windows:
 
 [windows]
 release-windows:
-    @powershell.exe -NoProfile -ExecutionPolicy Bypass -Command 'rustup target add x86_64-pc-windows-msvc; if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }; cargo build --release --target x86_64-pc-windows-msvc -p goose-server; if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }; Write-Host "Windows executable created at ./target/x86_64-pc-windows-msvc/release/goosed.exe"'
+    @powershell.exe -NoProfile -ExecutionPolicy Bypass -Command 'rustup target add x86_64-pc-windows-msvc; if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }; cargo build --release --target x86_64-pc-windows-msvc -p goose-cli --bin goose; if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }; Write-Host "Windows executable created at ./target/x86_64-pc-windows-msvc/release/goose.exe"'
 
 # Build for Intel Mac
 release-intel:
@@ -43,14 +39,7 @@ release-intel:
     @just copy-binary-intel
 
 copy-binary BUILD_MODE="release":
-    @if [ -f ./target/{{BUILD_MODE}}/goosed ]; then \
-        echo "Copying goosed binary from target/{{BUILD_MODE}}..."; \
-        rm -f ./ui/desktop/src/bin/goosed; \
-        cp -p ./target/{{BUILD_MODE}}/goosed ./ui/desktop/src/bin/; \
-    else \
-        echo "Binary not found in target/{{BUILD_MODE}}"; \
-        exit 1; \
-    fi
+    @rm -f ./ui/desktop/src/bin/goosed
     @if [ -f ./target/{{BUILD_MODE}}/goose ]; then \
         echo "Copying goose CLI binary from target/{{BUILD_MODE}}..."; \
         rm -f ./ui/desktop/src/bin/goose; \
@@ -62,14 +51,7 @@ copy-binary BUILD_MODE="release":
 
 # Copy binary command for Intel build
 copy-binary-intel:
-    @if [ -f ./target/x86_64-apple-darwin/release/goosed ]; then \
-        echo "Copying Intel goosed binary to ui/desktop/src/bin with permissions preserved..."; \
-        rm -f ./ui/desktop/src/bin/goosed; \
-        cp -p ./target/x86_64-apple-darwin/release/goosed ./ui/desktop/src/bin/; \
-    else \
-        echo "Intel release binary not found."; \
-        exit 1; \
-    fi
+    @rm -f ./ui/desktop/src/bin/goosed
     @if [ -f ./target/x86_64-apple-darwin/release/goose ]; then \
         echo "Copying Intel goose CLI binary to ui/desktop/src/bin..."; \
         rm -f ./ui/desktop/src/bin/goose; \
@@ -87,10 +69,11 @@ copy-binary-windows:
 
 [windows]
 copy-binary-windows:
-    @powershell.exe -NoProfile -ExecutionPolicy Bypass -Command 'if (Test-Path ./target/x86_64-pc-windows-msvc/release/goosed.exe) { \
+    @powershell.exe -NoProfile -ExecutionPolicy Bypass -Command 'if (Test-Path ./target/x86_64-pc-windows-msvc/release/goose.exe) { \
         Write-Host "Copying Windows binary to ui/desktop/src/bin..."; \
         New-Item -ItemType Directory -Force "./ui/desktop/src/bin" | Out-Null; \
-        Copy-Item -Path "./target/x86_64-pc-windows-msvc/release/goosed.exe" -Destination "./ui/desktop/src/bin/" -Force; \
+        Remove-Item -Path "./ui/desktop/src/bin/goosed.exe" -Force -ErrorAction SilentlyContinue; \
+        Copy-Item -Path "./target/x86_64-pc-windows-msvc/release/goose.exe" -Destination "./ui/desktop/src/bin/" -Force; \
     } else { \
         Write-Host "Windows binary not found." -ForegroundColor Red; \
         exit 1; \
@@ -116,7 +99,7 @@ run-ui-only:
     cd ui/desktop && pnpm install && pnpm run start-gui
 
 debug-ui:
-    @echo "🚀 Starting goose frontend in external backend mode"
+    @echo "🚀 Starting goose frontend in external ACP backend mode"
     cd ui/desktop && \
     export GOOSE_EXTERNAL_BACKEND=true && \
     export GOOSE_SERVER__SECRET_KEY="${GOOSE_SERVER__SECRET_KEY:-test}" && \
@@ -161,19 +144,8 @@ run-docs:
 
 # Run server
 run-server:
-    @echo "Running server..."
-    cargo run -p goose-server --bin goosed agent
-
-# Check if OpenAPI schema is up-to-date
-check-openapi-schema: generate-openapi
-    ./scripts/check-openapi-schema.sh
-
-# Generate OpenAPI specification without starting the UI
-generate-openapi:
-    @echo "Generating OpenAPI schema..."
-    cargo run -p goose-server --bin generate_schema
-    @echo "Generating frontend API..."
-    cd ui/desktop && npx @hey-api/openapi-ts
+    @echo "Running external ACP backend..."
+    GOOSE_SERVER__SECRET_KEY="${GOOSE_SERVER__SECRET_KEY:-test}" cargo run -p goose-cli --bin goose -- serve --platform desktop --host 127.0.0.1 --port 3000
 
 # Check if generated ACP schema and TypeScript types are up-to-date
 check-acp-schema: generate-acp-types
@@ -318,7 +290,6 @@ bump-version version:
     @cd ui/desktop && npm pkg set "version={{ version }}"
     # update Cargo.lock after bumping versions in Cargo.toml
     @cargo update --workspace
-    @just set-openapi-version {{ version }}
 
 # rebuild canonical model registry and mapping report from models.dev
 build-canonical-models:
@@ -333,14 +304,10 @@ prepare-release version:
         Cargo.lock \
         ui/desktop/package.json \
         ui/pnpm-lock.yaml \
-        ui/desktop/openapi.json \
-        crates/goose-providers/src/canonical/data/canonical_models.json \
-        crates/goose-providers/src/canonical/data/provider_metadata.json
+        crates/goose-provider-types/src/canonical/data/canonical_models.json \
+        crates/goose-provider-types/src/canonical/data/provider_metadata.json
     @git commit --message "chore(release): release version {{ version }}"
 
-set-openapi-version version:
-    @jq '.info.version |= "{{ version }}"' ui/desktop/openapi.json > ui/desktop/openapi.json.tmp && mv ui/desktop/openapi.json.tmp ui/desktop/openapi.json
-
 # extract version from Cargo.toml
 get-tag-version:
     @uvx --from=toml-cli toml get --toml-path=Cargo.toml "workspace.package.version"
@@ -375,7 +342,6 @@ set windows-shell := ["powershell.exe", "-NoLogo", "-Command"]
 ### profile = --release or "" for debug
 ### allparam = OR/AND/ANY/NONE --workspace --all-features --all-targets
 win-bld profile allparam:
-  cargo run {{profile}} -p goose-server --bin  generate_schema
   cargo build {{profile}} {{allparam}}
 
 ### Build just debug
@@ -404,6 +370,7 @@ win-app-deps:
 win-copy-win profile:
   copy target{{s}}{{profile}}{{s}}*.exe ui{{s}}desktop{{s}}src{{s}}bin
   copy target{{s}}{{profile}}{{s}}*.dll ui{{s}}desktop{{s}}src{{s}}bin
+  if exist ui{{s}}desktop{{s}}src{{s}}bin{{s}}goosed.exe del /f /q ui{{s}}desktop{{s}}src{{s}}bin{{s}}goosed.exe
 
 ### "Other" copy {release|debug} files to ui/desktop/src/bin
 ### s = os dependent file separator

README.md

@@ -1,5 +1,3 @@
-> **🦆 goose has moved!** This project has moved from `block/goose` to the [Agentic AI Foundation (AAIF)](https://aaif.io/) at the Linux Foundation. Some links and references are still being updated — please bear with us during the transition.
-
 <div align="center">
 
 # goose
@@ -16,8 +14,12 @@ _your native open source AI agent — desktop app, CLI, and API — for code, wo
   <a href="https://insights.linuxfoundation.org/project/goose"><img src="https://insights.linuxfoundation.org/api/badge/health-score?project=goose"></a>
   <a href="https://repology.org/project/goose-cli/versions"><img src="https://repology.org/badge/tiny-repos/goose-cli.svg" alt="Packaging status"></a>
 </p>
+
+<a href="https://trendshift.io/repositories/25298?utm_source=repository-badge&amp;utm_medium=badge&amp;utm_campaign=badge-repository-25298" target="_blank" rel="noopener noreferrer"><img src="https://trendshift.io/api/badge/repositories/25298" alt="aaif-goose%2Fgoose | Trendshift" width="250" height="55"/></a>
+
 </div>
 
+
 goose is a general-purpose AI agent that runs on your machine. Not just for code — use it for research, writing, automation, data analysis, or anything you need to get done.
 
 A native desktop app for macOS, Linux, and Windows. A full CLI for terminal workflows. An API to embed it anywhere. Built in Rust for performance and portability.

RELEASE_CHECKLIST.md

@@ -1,134 +1,23 @@
 # goose Release Manual Testing Checklist
 
-## Version: {{VERSION}}
-
-### Identify the high risk changes in this Release
+Download the release builds from this PR. Once a build is ready, the actions bot will post a comment on this PR
+with instructions on how to download and sign.
 
+## Use the following script to create a risk assessment and testing plan:
 ```
 ./workflow_recipes/release_risk_check/run.sh {{VERSION}}
 ```
 
-It will generate an analysis report in `/tmp/release_report_final.md` and perform testing is necessary for high risk pr changes. 
+It will generate an analysis report in `/tmp/release_report_final.md` and perform testing is necessary for high risk pr changes.
 
+## Run the goose self-test recipe
 
-## Regression Testing
+goose run --recipe goose-self-test.yaml
 
-Make a copy of this document for each version and check off as steps are verified.
+## Have goose produce a test plan
 
-### Provider Testing
+Open the release candidate desktop app and have goose produce a test plan by pointing it at this PR. Use a prompt like
 
-- [ ] Run `cd ui/desktop && pnpm run test:integration:providers` locally from the release branch and verify all providers/models work
-- [ ] Launch goose, click reset providers, choose databricks and a model
+> Look at the notes in PR <release PR> and the report at `/tmp/release_report_final.md` and investigate potential risks in this release. After familiarizing yourself with the scope of each change, produce a suggested test plan that I should follow before publishing the release.
 
-### Starting Conversations
-
-Test various ways to start a conversation:
-
-- [ ] Open home and start a new conversation with "Hello"
-  - [ ] Agent responds
-  - [ ] Token count is updated after agent finishes
-  - [ ] Go to history and see there is a new entry
-- [ ] Go back to the main screen, start a new conversation from the hub and see that it opens a new conversation
-- [ ] Open history and click the Hello conversation - verify it loads
-- [ ] Add a new message to this conversation and see that it is added
-- [ ] Change the working directory of an existing conversation
-  - [ ] Ask "what is your working directory?"
-  - [ ] Response should match the new directory
-- [ ] Open a new window, click chat in left side for new chat
-- [ ] Type "create a tamagotchi game" in the chat input to test developer extension
-
-### Recipes
-
-#### Create Recipe from Session
-
-- [ ] Start a simple chat conversation like "hi"
-- [ ] Click "create a recipe from this session" in the bottom chat bar
-  - [ ] Recipe title, description and instructions should be filled in with details from the chat
-  - [ ] Add a few activities and params (params unused indicator should update if added to instructions/prompts or activities)
-  - [ ] Can launch create and run recipe - launches in a new window showing as a recipe agent chat with parameters filled in and interact with it
-  - [ ] Recipe should be saved in recipe library
-
-#### Use Existing Recipe
-
-- [ ] Pick trip planner from recipe hub (go/gooserecipes)
-  - [ ] See the warning whether to trust this recipe (only on fresh install)
-  - [ ] See the form pop up
-  - [ ] Fill in the form with "Africa" and "14 days"
-  - [ ] Check results are reasonable
-  - [ ] Ask how many days the trip is for - should say 14
-
-#### Recipe Management
-
-- [ ] Go to recipe manager and enter a new recipe to generate a joke
-  - [ ] See that it works if you run it
-  - [ ] Edit the recipe by bottom bar and click "View/Edit Recipe"
-  - [ ] Make it generate a limerick instead
-  - [ ] Check that the updated recipe works
-  - [ ] Delete the recipe from the recipe manager
-  - [ ] Verify recipe is actually deleted
-
-#### Recipe from File
-
-- [ ] Create a file `~/.config/goose/recipes/test-recipe.yaml` with the following content:
-
-```yaml
-recipe:
-  title: test recipe again
-  description: testing recipe again
-  instructions: The value of test_param is {{test_param}}
-  prompt: What is the value of test_param?
-  parameters:
-    - key: test_param
-      input_type: string
-      requirement: required
-      description: Enter value for test_param
-```
-
-- [ ] See that it shows up in the list of installed recipes
-- [ ] Launch the recipe, see that it asks for test_param
-- [ ] Enter a number, see that it pre-fills the prompt and tells you the value after you hit submit
-- [ ] Go to hub and enter "what is the value of test_param"
-- [ ] See a new chat that says it has no idea (recipe is no longer active)
-
-### Extensions
-
-#### Manual Extension Addition
-
-- [ ] Can manually add an extension using random quotes from project
-  - [ ] Add new custom stdio extension with the following command and save:
-    - [ ] `node /ABSOLUTE/PATH/TO/goose/ui/desktop/tests/e2e/basic-mcp.ts` (use your actual project path)
-    - [ ] Should add and can chat to ask for a random quote
-
-#### Playwright Extension
-
-- [ ] Install the playwright extension from the extensions hub
-  - [ ] Tell it to open a browser and search on Google for cats
-  - [ ] Verify that the browser opens and navigates
-
-#### Extension with Environment Variables
-
-- [ ] Install an extension from deeplink that needs env variables:
-  - [ ] Use: `goose://extension?cmd=npx&arg=-y&arg=%40upstash%2Fcontext7-mcp&id=context7&name=Context7&description=Use%20up-to-date%20code%20and%20docs&env=TEST_ACCESS_TOKEN`
-  - [ ] Extension page should load with env variables modal showing
-  - [ ] Allow form input and saving extension
-
-### Speech-to-Text (Local Model)
-
-- [ ] Go to Settings > Chat > Voice dictation provider and select the small model
-- [ ] Run a quick test that speech-to-text is working (click the mic button, speak, verify transcription)
-- [ ] Also try OpenAI using your OpenAI key
-
-### Settings
-
-- [ ] Settings page loads and all tabs load
-- [ ] Can change dark mode setting
-
-### Follow-up Issues
-
-Link any GitHub issues filed during testing:
-
----
-
-**Tested by:** _____
-**Date:** _____
-**Notes:** _____
+goose will produce a plan. Follow this plan to finish testing.

crates/goose-cli/Cargo.toml

@@ -62,8 +62,9 @@ urlencoding = { workspace = true }
 clap_complete = { version = "4", default-features = false }
 comfy-table = { version = "7", default-features = false }
 sha2 = { workspace = true }
-sigstore-verify = { version = "0.9", default-features = false, optional = true }
+sigstore-verify = { version = "0.10", default-features = false, optional = true }
 axum.workspace = true
+axum-server = { version = "0.8", default-features = false, optional = true }
 clap_complete_nushell = { version = "4", default-features = false }
 
 [target.'cfg(target_os = "windows")'.dependencies]
@@ -99,14 +100,18 @@ portable-default = ["rustls-tls", "aws-providers", "telemetry", "otel", "tui"]
 # disables the update command
 disable-update = []
 rustls-tls = [
+    "dep:axum-server",
     "reqwest/rustls",
+    "axum-server/tls-rustls",
     "sigstore-verify?/rustls",
     "goose/rustls-tls",
     "goose-mcp/rustls-tls",
     "goose-providers/rustls-tls",
 ]
 native-tls = [
+    "dep:axum-server",
     "reqwest/native-tls",
+    "axum-server/tls-openssl",
     "sigstore-verify?/native-tls",
     "goose/native-tls",
     "goose-mcp/native-tls",

crates/goose-cli/src/cli.rs

@@ -51,6 +51,22 @@ fn generate_serve_secret_key() -> String {
     )
 }
 
+#[derive(clap::ValueEnum, Clone, Copy, Debug, Default, PartialEq, Eq)]
+enum ServePlatform {
+    #[default]
+    Cli,
+    Desktop,
+}
+
+impl From<ServePlatform> for GoosePlatform {
+    fn from(platform: ServePlatform) -> Self {
+        match platform {
+            ServePlatform::Cli => GoosePlatform::GooseCli,
+            ServePlatform::Desktop => GoosePlatform::GooseDesktop,
+        }
+    }
+}
+
 #[derive(Parser)]
 #[command(name = "goose", author, version, display_name = "", about, long_about = None)]
 pub struct Cli {
@@ -75,7 +91,7 @@ pub struct Identifier {
         alias = "id",
         value_name = "SESSION_ID",
         help = "Session ID (e.g., '20250921_143022')",
-        long_help = "Specify a session ID directly. When used with --resume, will resume this specific session if it exists."
+        long_help = "Specify a session ID to resume. Requires --resume."
     )]
     pub session_id: Option<String>,
 
@@ -392,7 +408,9 @@ async fn get_or_create_session_id(
 
     let resolved_id = if resume {
         let Some(id) = identifier else {
-            let sessions = session_manager.list_sessions().await?;
+            let sessions = session_manager
+                .list_sessions_by_types(&[SessionType::User])
+                .await?;
             let session_id = sessions
                 .first()
                 .map(|s| s.id.clone())
@@ -580,11 +598,9 @@ enum SessionCommand {
     },
     #[command(name = "diagnostics")]
     Diagnostics {
-        /// Session identifier for generating diagnostics
         #[command(flatten)]
         identifier: Option<Identifier>,
 
-        /// Output path for the diagnostics zip file (optional, defaults to current directory)
         #[arg(short = 'o', long)]
         output: Option<PathBuf>,
     },
@@ -833,6 +849,18 @@ enum Command {
         #[arg(long, default_value = "3284")]
         port: u16,
 
+        #[arg(long, help = "Serve ACP over TLS")]
+        tls: bool,
+
+        #[arg(long = "tls-cert-path", value_name = "PATH")]
+        tls_cert_path: Option<String>,
+
+        #[arg(long = "tls-key-path", value_name = "PATH")]
+        tls_key_path: Option<String>,
+
+        #[arg(long, value_enum, default_value_t = ServePlatform::Cli)]
+        platform: ServePlatform,
+
         #[arg(
             long = "with-builtin",
             value_name = "NAME",
@@ -842,6 +870,20 @@ enum Command {
             action = clap::ArgAction::Append
         )]
         builtins: Vec<String>,
+
+        #[arg(
+            long = "dangerously-unauthenticated",
+            help = "Start the ACP endpoint without requiring GOOSE_SERVER__SECRET_KEY"
+        )]
+        dangerously_unauthenticated: bool,
+
+        #[arg(
+            long = "allowed-origin",
+            value_name = "ORIGIN",
+            action = clap::ArgAction::Append,
+            help = "Allow an exact Origin value for ACP CORS; may be specified multiple times and replaces the default loopback origins"
+        )]
+        allowed_origins: Vec<String>,
     },
 
     /// Start or resume interactive chat sessions
@@ -874,6 +916,15 @@ enum Command {
         )]
         fork: bool,
 
+        /// Open the session's conversation in $EDITOR before starting
+        #[arg(
+            long,
+            requires = "resume",
+            help = "Edit the session conversation in $EDITOR before starting",
+            long_help = "Open the session's conversation in your editor ($VISUAL / $EDITOR / vi) for modification before resuming. When combined with --fork, creates a new session from the edited result."
+        )]
+        edit: bool,
+
         /// Show message history when resuming
         #[arg(
             long,
@@ -1326,7 +1377,21 @@ async fn handle_mcp_command(server: McpCommand) -> Result<()> {
     Ok(())
 }
 
-async fn handle_serve_command(host: String, port: u16, builtins: Vec<String>) -> Result<()> {
+struct ServeCommandArgs {
+    host: String,
+
+    port: u16,
+    tls: bool,
+    tls_cert_path: Option<String>,
+    tls_key_path: Option<String>,
+    platform: ServePlatform,
+    builtins: Vec<String>,
+    dangerously_unauthenticated: bool,
+    allowed_origins: Vec<String>,
+}
+
+async fn handle_serve_command(args: ServeCommandArgs) -> Result<()> {
+    use axum::http::HeaderValue;
     use goose::acp::server_factory::{AcpServer, AcpServerFactoryConfig};
     use goose::acp::transport::create_router;
     use goose::config::paths::Paths;
@@ -1334,6 +1399,18 @@ async fn handle_serve_command(host: String, port: u16, builtins: Vec<String>) ->
     use std::sync::Arc;
     use tracing::{info, warn};
 
+    let ServeCommandArgs {
+        host,
+        port,
+        tls,
+        tls_cert_path,
+        tls_key_path,
+        platform,
+        builtins,
+        dangerously_unauthenticated,
+        allowed_origins,
+    } = args;
+
     let builtins = if builtins.is_empty() {
         vec!["developer".to_string()]
     } else {
@@ -1356,32 +1433,93 @@ async fn handle_serve_command(host: String, port: u16, builtins: Vec<String>) ->
         builtins,
         data_dir: Paths::data_dir(),
         config_dir: Paths::config_dir(),
-        goose_platform: GoosePlatform::GooseCli,
+        goose_platform: platform.into(),
         additional_source_roots,
-        scheduler: None,
     }));
     let env_secret = std::env::var(GOOSE_SERVER_SECRET_KEY_ENV)
         .ok()
         .map(|secret| secret.trim().to_string())
         .filter(|secret| !secret.is_empty());
     let require_token = env_secret.is_some();
-    if !require_token {
-        warn!(
-            "{GOOSE_SERVER_SECRET_KEY_ENV} is not set; the ACP endpoint will accept unauthenticated connections"
+    if !require_token && !dangerously_unauthenticated {
+        anyhow::bail!(
+            "{GOOSE_SERVER_SECRET_KEY_ENV} must be set to start `goose serve`; pass --dangerously-unauthenticated to run without ACP authentication"
         );
     }
+    if dangerously_unauthenticated && !require_token {
+        warn!(
+            "{GOOSE_SERVER_SECRET_KEY_ENV} is not set and --dangerously-unauthenticated was passed; the ACP endpoint will accept unauthenticated connections"
+        );
+    }
+    let additional_allowed_origins = allowed_origins
+        .into_iter()
+        .map(|origin| {
+            let origin = origin.trim();
+            if origin.is_empty() || origin == "*" {
+                anyhow::bail!("--allowed-origin must be a non-wildcard Origin value");
+            }
+            HeaderValue::from_str(origin).map_err(|error| {
+                anyhow::anyhow!("invalid --allowed-origin value `{origin}`: {error}")
+            })
+        })
+        .collect::<Result<Vec<_>>>()?;
     let secret_key = env_secret.unwrap_or_else(generate_serve_secret_key);
-    let router = create_router(server, secret_key, require_token);
+    let router = create_router(
+        server,
+        secret_key,
+        require_token,
+        additional_allowed_origins,
+    );
+
+    let config = Config::global();
+    let tls_cert_path =
+        tls_cert_path.or_else(|| config.get_param::<String>("GOOSE_TLS_CERT_PATH").ok());
+    let tls_key_path =
+        tls_key_path.or_else(|| config.get_param::<String>("GOOSE_TLS_KEY_PATH").ok());
+    let tls = tls
+        || config.get_param::<bool>("GOOSE_TLS").unwrap_or(false)
+        || tls_cert_path.is_some()
+        || tls_key_path.is_some();
 
     let addr: SocketAddr = format!("{}:{}", host, port).parse()?;
-    info!("Starting ACP server on {}", addr);
+    if tls {
+        #[cfg(any(feature = "rustls-tls", feature = "native-tls"))]
+        {
+            let tls_setup = goose::acp::transport::tls::setup_tls(
+                tls_cert_path.as_deref(),
+                tls_key_path.as_deref(),
+            )
+            .await?;
+            info!("Starting ACP server on https://{}", addr);
 
-    let listener = tokio::net::TcpListener::bind(addr).await?;
-    axum::serve(
-        listener,
-        router.into_make_service_with_connect_info::<SocketAddr>(),
-    )
-    .await?;
+            #[cfg(feature = "rustls-tls")]
+            axum_server::bind_rustls(addr, tls_setup.config)
+                .serve(router.into_make_service_with_connect_info::<SocketAddr>())
+                .await?;
+
+            #[cfg(feature = "native-tls")]
+            axum_server::bind_openssl(addr, tls_setup.config)
+                .serve(router.into_make_service_with_connect_info::<SocketAddr>())
+                .await?;
+        }
+
+        #[cfg(not(any(feature = "rustls-tls", feature = "native-tls")))]
+        {
+            let _ = (tls_cert_path, tls_key_path);
+            anyhow::bail!(
+                "TLS was requested but no TLS backend is enabled. \
+                 Enable the `rustls-tls` or `native-tls` feature."
+            );
+        }
+    } else {
+        info!("Starting ACP server on http://{}", addr);
+        let listener = tokio::net::TcpListener::bind(addr).await?;
+        axum::serve(
+            listener,
+            router.into_make_service_with_connect_info::<SocketAddr>(),
+        )
+        .await?;
+    }
 
     Ok(())
 }
@@ -1466,6 +1604,7 @@ async fn handle_interactive_session(
     identifier: Option<Identifier>,
     resume: bool,
     fork: bool,
+    edit: bool,
     history: bool,
     session_opts: SessionOptions,
     extension_opts: ExtensionOptions,
@@ -1505,12 +1644,31 @@ async fn handle_interactive_session(
     let goose_mode = Config::global().get_goose_mode().unwrap_or_default();
     let mut session_id = get_or_create_session_id(identifier, resume, false, goose_mode).await?;
 
-    if fork {
-        if let Some(id) = session_id {
+    if edit || fork {
+        if let Some(ref id) = session_id {
             let session_manager = SessionManager::instance();
-            let original = session_manager.get_session(&id, false).await?;
-            let copied = session_manager.copy_session(&id, original.name).await?;
-            session_id = Some(copied.id);
+            let original = session_manager.get_session(id, true).await?;
+
+            let target_id = if fork {
+                let copied = session_manager
+                    .copy_session(id, original.name.clone())
+                    .await?;
+                let copied_id = copied.id.clone();
+                session_id = Some(copied.id);
+                copied_id
+            } else {
+                id.clone()
+            };
+
+            if edit {
+                let conversation = original
+                    .conversation
+                    .ok_or_else(|| anyhow::anyhow!("session has no messages to edit"))?;
+                let edited = crate::session::editor::edit_conversation(&conversation)?;
+                session_manager
+                    .replace_conversation(&target_id, &edited)
+                    .await?;
+            }
         }
     }
 
@@ -1881,6 +2039,8 @@ async fn handle_local_models_command(command: LocalModelsCommand) -> Result<()>
     use goose::providers::local_inference::hf_models;
     use goose::providers::local_inference::local_model_registry::get_registry;
 
+    goose::providers::local_inference::configure_huggingface_auth();
+
     match command {
         LocalModelsCommand::Search { query, limit } => {
             println!("Searching HuggingFace for '{}'...", query);
@@ -2072,8 +2232,27 @@ pub async fn cli() -> anyhow::Result<()> {
         Some(Command::Serve {
             host,
             port,
+            tls,
+            tls_cert_path,
+            tls_key_path,
+            platform,
             builtins,
-        }) => handle_serve_command(host, port, builtins).await,
+            dangerously_unauthenticated,
+            allowed_origins,
+        }) => {
+            handle_serve_command(ServeCommandArgs {
+                host,
+                port,
+                tls,
+                tls_cert_path,
+                tls_key_path,
+                platform,
+                builtins,
+                dangerously_unauthenticated,
+                allowed_origins,
+            })
+            .await
+        }
         Some(Command::Session {
             command: Some(cmd), ..
         }) => handle_session_subcommand(cmd).await,
@@ -2082,6 +2261,7 @@ pub async fn cli() -> anyhow::Result<()> {
             identifier,
             resume,
             fork,
+            edit,
             history,
             session_opts,
             extension_opts,
@@ -2090,6 +2270,7 @@ pub async fn cli() -> anyhow::Result<()> {
                 identifier,
                 resume,
                 fork,
+                edit,
                 history,
                 session_opts,
                 extension_opts,
@@ -2268,6 +2449,35 @@ mod tests {
         }
     }
 
+    #[test]
+    fn serve_command_accepts_dangerously_unauthenticated_flag() {
+        let cli = Cli::try_parse_from([
+            "goose",
+            "serve",
+            "--dangerously-unauthenticated",
+            "--allowed-origin",
+            "app://localhost",
+            "--allowed-origin",
+            "https://app.example",
+        ])
+        .expect("parse failed");
+
+        match cli.command {
+            Some(Command::Serve {
+                dangerously_unauthenticated,
+                allowed_origins,
+                ..
+            }) => {
+                assert!(dangerously_unauthenticated);
+                assert_eq!(
+                    allowed_origins,
+                    vec!["app://localhost", "https://app.example"]
+                );
+            }
+            _ => panic!("expected serve command"),
+        }
+    }
+
     #[test]
     fn review_command_accepts_options() {
         let cli = Cli::try_parse_from([

crates/goose-cli/src/commands/configure.rs

@@ -28,11 +28,22 @@ use goose::session::SessionType;
 use goose_providers::thinking::ThinkingEffort;
 use serde_json::Value;
 use std::collections::HashMap;
-use std::io::IsTerminal;
+use std::io::{IsTerminal, Write};
 
 // useful for light themes where there is no discernible colour contrast between
 // cursor-selected and cursor-unselected items.
 const MULTISELECT_VISIBILITY_HINT: &str = "<";
+const SHOW_CURSOR: &[u8] = b"\x1b[?25h";
+
+struct CursorRestoreGuard;
+
+impl Drop for CursorRestoreGuard {
+    fn drop(&mut self) {
+        let mut stdout = std::io::stdout().lock();
+        let _ = stdout.write_all(SHOW_CURSOR);
+        let _ = stdout.flush();
+    }
+}
 
 pub async fn handle_configure() -> anyhow::Result<()> {
     if !std::io::stdin().is_terminal() {
@@ -42,6 +53,7 @@ pub async fn handle_configure() -> anyhow::Result<()> {
         );
     }
 
+    let _cursor_restore = CursorRestoreGuard;
     let config = Config::global();
 
     if !config.exists() {
@@ -339,8 +351,7 @@ async fn handle_oauth_configuration(provider_name: &str, key_name: &str) -> anyh
     ));
 
     // Create a temporary provider instance to handle OAuth
-    let temp_model = goose::model_config::model_config_from_user_config(provider_name, "temp")?;
-    match create(provider_name, temp_model, Vec::new()).await {
+    match create(provider_name, Vec::new()).await {
         Ok(provider) => match provider.configure_oauth().await {
             Ok(_) => {
                 let _ = cliclack::log::success("OAuth authentication completed successfully!");
@@ -761,13 +772,11 @@ pub async fn configure_provider_dialog() -> anyhow::Result<bool> {
 
     let spin = spinner();
     spin.start("Attempting to fetch supported models...");
-    let temp_model_config = goose::model_config::model_config_from_user_config(
-        provider_name,
-        &provider_meta.default_model,
-    )?;
-    let temp_provider = create(provider_name, temp_model_config, Vec::new()).await?;
+    let temp_provider = create(provider_name, Vec::new()).await?;
     let models_res = retry_operation(&RetryConfig::default(), || async {
-        temp_provider.fetch_recommended_models().await
+        temp_provider
+            .fetch_recommended_models(goose::model_config::global_toolshim())
+            .await
     })
     .await;
     spin.stop(style("Model fetch complete").green());
@@ -792,9 +801,7 @@ pub async fn configure_provider_dialog() -> anyhow::Result<bool> {
     {
         let supports_thinking = match temp_provider.fetch_model_info(&model).await {
             Ok(model_info) => model_info.reasoning,
-            Err(_) => goose_providers::model::ModelConfig::new(&model)
-                .map(|c| c.is_reasoning_model())
-                .unwrap_or(false),
+            Err(_) => goose_providers::model::ModelConfig::new(&model).is_reasoning_model(),
         };
 
         if supports_thinking {
@@ -1618,8 +1625,10 @@ pub async fn configure_tool_permissions_dialog() -> anyhow::Result<()> {
     }
 
     let extensions = extension_config.into_iter().collect::<Vec<_>>();
-    let new_provider = create(&provider_name, model_config, extensions).await?;
-    agent.update_provider(new_provider, &session.id).await?;
+    let new_provider = create(&provider_name, extensions).await?;
+    agent
+        .update_provider(new_provider, model_config, &session.id)
+        .await?;
 
     let permission_manager = PermissionManager::instance();
     let selected_tools = agent
@@ -1811,13 +1820,11 @@ pub async fn handle_openrouter_auth() -> anyhow::Result<()> {
             }
         };
 
-    match create("openrouter", model_config, Vec::new()).await {
+    match create("openrouter", Vec::new()).await {
         Ok(provider) => {
-            let provider_model_config = provider.get_model_config();
             let test_result = provider
                 .complete(
-                    &provider_model_config,
-                    "",
+                    &model_config,
                     "You are goose, an AI assistant.",
                     &[Message::user().with_text("Say 'Configuration test successful!'")],
                     &[],
@@ -1883,17 +1890,14 @@ pub async fn handle_tetrate_auth() -> anyhow::Result<()> {
     // Test configuration
     println!("\nTesting configuration...");
     let configured_model: String = config.get_goose_model()?;
-    let model_config =
-        match goose::model_config::model_config_from_user_config("tetrate", &configured_model) {
-            Ok(config) => config,
-            Err(e) => {
-                eprintln!("⚠️  Invalid model configuration: {}", e);
-                eprintln!("Your settings have been saved. Please check your model configuration.");
-                return Ok(());
-            }
-        };
+    if let Err(e) = goose::model_config::model_config_from_user_config("tetrate", &configured_model)
+    {
+        eprintln!("⚠️  Invalid model configuration: {}", e);
+        eprintln!("Your settings have been saved. Please check your model configuration.");
+        return Ok(());
+    }
 
-    match create("tetrate", model_config, Vec::new()).await {
+    match create("tetrate", Vec::new()).await {
         Ok(provider) => {
             let test_result = provider.fetch_supported_models().await;
 

crates/goose-cli/src/commands/info.rs

@@ -76,7 +76,7 @@ async fn check_provider(
     let model_config = goose::model_config::model_config_from_user_config(&provider, &model)
         .map_err(|e| ProviderCheckError::InvalidModel(e.to_string()))?;
 
-    let provider_client = goose::providers::create(&provider, model_config, Vec::new())
+    let provider_client = goose::providers::create(&provider, Vec::new())
         .await
         .map_err(|e| {
             let error = e.to_string();
@@ -87,12 +87,13 @@ async fn check_provider(
         })?;
 
     let test_msg = Message::user().with_text("Say 'ok'");
-    let model_config = provider_client.get_model_config();
     let start = std::time::Instant::now();
-    provider_client
-        .complete(&model_config, "check", "", &[test_msg], &[])
-        .await
-        .map_err(ProviderCheckError::ProviderRequest)?;
+    goose::session_context::with_session_id(
+        Some("check".to_string()),
+        provider_client.complete(&model_config, "", &[test_msg], &[]),
+    )
+    .await
+    .map_err(ProviderCheckError::ProviderRequest)?;
 
     Ok(ProviderCheckSuccess {
         provider,

crates/goose-cli/src/commands/project.rs

@@ -36,7 +36,7 @@ pub fn handle_project_default() -> Result<()> {
     }
 
     // Sort projects by last_accessed (newest first)
-    projects.sort_by(|a, b| b.last_accessed.cmp(&a.last_accessed));
+    projects.sort_by_key(|project| std::cmp::Reverse(project.last_accessed));
 
     // Get the most recent project
     let project = &projects[0];
@@ -178,7 +178,7 @@ pub fn handle_projects_interactive() -> Result<()> {
     }
 
     // Sort projects by last_accessed (newest first)
-    projects.sort_by(|a, b| b.last_accessed.cmp(&a.last_accessed));
+    projects.sort_by_key(|project| std::cmp::Reverse(project.last_accessed));
 
     // Format project paths for display
     let project_choices: Vec<(String, String)> = projects

crates/goose-cli/src/commands/schedule.rs

@@ -217,11 +217,11 @@ pub async fn handle_schedule_sessions(schedule_id: String, limit: Option<usize>)
                 println!("No sessions found for schedule ID '{}'.", schedule_id);
             } else {
                 println!("Sessions for schedule ID '{}':", schedule_id);
-                // sessions is now Vec<(String, SessionMetadata)>
                 for (session_name, metadata) in sessions {
                     println!(
-                        "  - Session ID: {}, Working Dir: {}, Description: \"{}\", Schedule ID: {:?}",
-                        session_name, // Display the session_name as Session ID
+                        "  - Session ID: {}, Messages: {}, Working Dir: {}, Description: \"{}\", Schedule ID: {:?}",
+                        session_name,
+                        metadata.message_count,
                         metadata.working_dir.display(),
                         metadata.name,
                         metadata.schedule_id.as_deref().unwrap_or("N/A")

crates/goose-cli/src/commands/session.rs

@@ -7,7 +7,9 @@ use etcetera::home_dir;
 use goose::config::Config;
 #[cfg(feature = "nostr")]
 use goose::session::nostr_share;
-use goose::session::{generate_diagnostics, Session, SessionManager, SessionType};
+use goose::session::{
+    generate_diagnostics, DiagnosticsLevel, Session, SessionManager, SessionType,
+};
 use goose::utils::safe_truncate;
 use regex::Regex;
 use std::fs;
@@ -68,7 +70,8 @@ fn prompt_interactive_session_removal(sessions: &[Session]) -> Result<Vec<Sessio
                 &s.name
             };
             let truncated_desc = safe_truncate(desc, TRUNCATED_DESC_LENGTH);
-            let display_text = format!("{} - {} ({})", s.updated_at, truncated_desc, s.id);
+            let display_text =
+                format!("{} - {} ({})", session_activity_at(s), truncated_desc, s.id);
             (display_text, s.clone())
         })
         .collect();
@@ -148,6 +151,10 @@ fn write_line_or_broken_pipe_ok<W: Write>(out: &mut W, line: &str) -> Result<boo
     }
 }
 
+fn session_activity_at(session: &Session) -> chrono::DateTime<chrono::Utc> {
+    session.last_message_at.unwrap_or(session.updated_at)
+}
+
 pub async fn handle_session_list(
     format: String,
     ascending: bool,
@@ -168,9 +175,9 @@ pub async fn handle_session_list(
     }
 
     if ascending {
-        sessions.sort_by(|a, b| a.updated_at.cmp(&b.updated_at));
+        sessions.sort_by_key(session_activity_at);
     } else {
-        sessions.sort_by(|a, b| b.updated_at.cmp(&a.updated_at));
+        sessions.sort_by_key(|b| std::cmp::Reverse(session_activity_at(b)));
     }
 
     if let Some(n) = limit {
@@ -204,7 +211,7 @@ pub async fn handle_session_list(
                     "{} - {} - {} - {}",
                     session.id,
                     session.name,
-                    session.updated_at,
+                    session_activity_at(&session),
                     display_path_with_tilde(&session.working_dir)
                 );
                 if !write_line_or_broken_pipe_ok(&mut out, &output)? {
@@ -322,24 +329,27 @@ pub async fn handle_session_import(input: String, nostr: bool) -> Result<()> {
 
 pub async fn handle_diagnostics(session_id: &str, output_path: Option<PathBuf>) -> Result<()> {
     println!(
-        "Generating diagnostics bundle for session '{}'...",
+        "Generating diagnostics report for session '{}'...",
         session_id
     );
 
     let session_manager = SessionManager::instance();
-    let diagnostics_data = generate_diagnostics(&session_manager, session_id)
-        .await
-        .with_context(|| {
-            format!(
-                "Failed to write to generate diagnostics bundle for session '{}'",
-                session_id
-            )
-        })?;
+    let diagnostics_report =
+        generate_diagnostics(&session_manager, session_id, DiagnosticsLevel::Full)
+            .await
+            .with_context(|| {
+                format!(
+                    "Failed to generate diagnostics report for session '{}'",
+                    session_id
+                )
+            })?;
+    let diagnostics_data = serde_json::to_vec_pretty(&diagnostics_report)
+        .context("Failed to serialize diagnostics report")?;
 
     let output_file = if let Some(path) = output_path {
         path.clone()
     } else {
-        PathBuf::from(format!("diagnostics_{}.zip", session_id))
+        PathBuf::from(format!("diagnostics_{}.json", session_id))
     };
 
     let mut file = fs::File::create(&output_file).context(format!(
@@ -350,7 +360,7 @@ pub async fn handle_diagnostics(session_id: &str, output_path: Option<PathBuf>)
     file.write_all(&diagnostics_data)
         .context("Failed to write diagnostics data")?;
 
-    println!("Diagnostics bundle saved to: {}", output_file.display());
+    println!("Diagnostics report saved to: {}", output_file.display());
 
     Ok(())
 }

crates/goose-cli/src/commands/term.rs

@@ -280,9 +280,15 @@ pub async fn handle_term_run(prompt: Vec<String>) -> Result<()> {
         };
 
     if let Some(oldest_user) = user_messages_after_last_assistant.last() {
-        session_manager
-            .truncate_conversation(&session_id, oldest_user.created)
-            .await?;
+        if let Some(message_id) = oldest_user.id.as_deref() {
+            session_manager
+                .truncate_conversation_from_message(&session_id, message_id)
+                .await?;
+        } else {
+            session_manager
+                .truncate_conversation(&session_id, oldest_user.created)
+                .await?;
+        }
     }
 
     let prompt_with_context = if user_messages_after_last_assistant.is_empty() {

crates/goose-cli/src/commands/update.rs

@@ -1,4 +1,8 @@
 use anyhow::{bail, Context, Result};
+use reqwest::{
+    header::{HeaderValue, AUTHORIZATION},
+    StatusCode,
+};
 use sha2::{Digest, Sha256};
 use sigstore_verify::trust_root::{TrustedRoot, SIGSTORE_PRODUCTION_TRUSTED_ROOT};
 use sigstore_verify::types::{Bundle, Sha256Hash};
@@ -79,6 +83,32 @@ struct AttestationEntry {
 
 const GITHUB_ACTIONS_ISSUER: &str = "https://token.actions.githubusercontent.com";
 
+fn sanitized_token(token: Option<&str>) -> Option<&str> {
+    token.map(str::trim).filter(|tok| !tok.is_empty())
+}
+
+fn authorization_header_value(token: &str) -> Option<HeaderValue> {
+    HeaderValue::from_str(&format!("Bearer {token}")).ok()
+}
+
+fn github_token() -> Option<String> {
+    env::var("GITHUB_TOKEN")
+        .ok()
+        .and_then(|tok| sanitized_token(Some(&tok)).map(str::to_owned))
+        .or_else(|| {
+            env::var("GH_TOKEN")
+                .ok()
+                .and_then(|tok| sanitized_token(Some(&tok)).map(str::to_owned))
+        })
+}
+
+fn should_retry_attestations_without_token(status: StatusCode, token: Option<&str>) -> bool {
+    sanitized_token(token)
+        .and_then(authorization_header_value)
+        .is_some()
+        && matches!(status, StatusCode::UNAUTHORIZED | StatusCode::FORBIDDEN)
+}
+
 async fn fetch_attestations(digest: &str, token: Option<&str>) -> Result<Vec<serde_json::Value>> {
     let url = format!(
         "https://api.github.com/repos/aaif-goose/goose/attestations/sha256:{digest}\
@@ -86,17 +116,14 @@ async fn fetch_attestations(digest: &str, token: Option<&str>) -> Result<Vec<ser
     );
 
     let client = reqwest::Client::new();
-    let mut req = client
-        .get(&url)
-        .header("Accept", "application/vnd.github+json")
-        .header("X-GitHub-Api-Version", "2022-11-28")
-        .header("User-Agent", "goose-cli");
+    let token = sanitized_token(token);
+    let resp = fetch_attestations_response(&client, &url, token).await?;
 
-    if let Some(tok) = token {
-        req = req.header("Authorization", format!("Bearer {tok}"));
-    }
-
-    let resp = req.send().await.context("Failed to fetch attestations")?;
+    let resp = if should_retry_attestations_without_token(resp.status(), token) {
+        fetch_attestations_response(&client, &url, None).await?
+    } else {
+        resp
+    };
 
     if !resp.status().is_success() {
         bail!("GitHub attestation API returned HTTP {}", resp.status());
@@ -110,6 +137,24 @@ async fn fetch_attestations(digest: &str, token: Option<&str>) -> Result<Vec<ser
     Ok(body.attestations.into_iter().map(|a| a.bundle).collect())
 }
 
+async fn fetch_attestations_response(
+    client: &reqwest::Client,
+    url: &str,
+    token: Option<&str>,
+) -> Result<reqwest::Response> {
+    let mut req = client
+        .get(url)
+        .header("Accept", "application/vnd.github+json")
+        .header("X-GitHub-Api-Version", "2022-11-28")
+        .header("User-Agent", "goose-cli");
+
+    if let Some(value) = token.and_then(authorization_header_value) {
+        req = req.header(AUTHORIZATION, value);
+    }
+
+    req.send().await.context("Failed to fetch attestations")
+}
+
 // Verify a single attestation bundle against the artifact digest and workflow.
 fn verify_bundle(
     bundle_json: &serde_json::Value,
@@ -142,8 +187,8 @@ fn verify_bundle(
     Ok(())
 }
 
-/// Returns `Ok(true)` verified, `Ok(false)` skipped (soft warning), `Err` hard failure.
-async fn verify_provenance(archive_data: &[u8], tag: &str) -> Result<bool> {
+/// Returns `Ok(())` when the downloaded archive has verified provenance.
+async fn verify_provenance(archive_data: &[u8], tag: &str) -> Result<()> {
     let digest = sha256_hex(archive_data);
     println!("Archive SHA-256: {digest}");
 
@@ -152,30 +197,19 @@ async fn verify_provenance(archive_data: &[u8], tag: &str) -> Result<bool> {
         _ => "release.yml",
     };
 
-    let token = env::var("GITHUB_TOKEN")
-        .ok()
-        .or_else(|| env::var("GH_TOKEN").ok());
+    let token = github_token();
 
     println!("Verifying SLSA provenance via Sigstore...");
 
-    let bundles = match fetch_attestations(&digest, token.as_deref()).await {
-        Ok(b) if b.is_empty() => {
-            eprintln!(
-                "Warning: No Sigstore attestation found for this build. \
-                 This may be expected for canary or nightly builds."
-            );
-            return Ok(false);
-        }
-        Ok(b) => b,
-        Err(e) => {
-            eprintln!(
-                "Warning: Sigstore provenance check could not complete: {e}\n\
-                 This may be expected for releases published before provenance \
-                 attestations were enabled."
-            );
-            return Ok(false);
-        }
-    };
+    let bundles = fetch_attestations(&digest, token.as_deref())
+        .await
+        .context(
+            "Sigstore provenance check could not complete; refusing to install unverifiable update",
+        )?;
+
+    if bundles.is_empty() {
+        bail!("No Sigstore attestation found for downloaded archive; refusing to install unverifiable update");
+    }
 
     let trusted_root = TrustedRoot::from_json(SIGSTORE_PRODUCTION_TRUSTED_ROOT)
         .context("Failed to load Sigstore trusted root")?;
@@ -195,7 +229,7 @@ async fn verify_provenance(archive_data: &[u8], tag: &str) -> Result<bool> {
         ) {
             Ok(()) => {
                 println!("Sigstore provenance verification passed.");
-                return Ok(true);
+                return Ok(());
             }
             Err(e) => last_err = Some(e),
         }
@@ -247,7 +281,7 @@ pub async fn update(canary: bool, reconfigure: bool) -> Result<()> {
         println!("Downloaded {} bytes.", bytes.len());
 
         // --- Verify SLSA provenance via Sigstore --------------------------------
-        let provenance_verified = verify_provenance(&bytes, tag).await?;
+        verify_provenance(&bytes, tag).await?;
 
         // --- Extract to temp dir (hardened against path traversal) --------------
         let tmp_dir = tempfile::tempdir().context("Failed to create temp directory")?;
@@ -274,11 +308,7 @@ pub async fn update(canary: bool, reconfigure: bool) -> Result<()> {
         #[cfg(target_os = "windows")]
         copy_dlls(&extracted_binary, &current_exe)?;
 
-        if provenance_verified {
-            println!("goose updated successfully (verified with Sigstore SLSA provenance).");
-        } else {
-            println!("goose updated successfully.");
-        }
+        println!("goose updated successfully (verified with Sigstore SLSA provenance).");
 
         // --- Reconfigure if requested -------------------------------------------
         if reconfigure {
@@ -737,6 +767,48 @@ mod tests {
         );
     }
 
+    #[test]
+    fn test_sanitized_token_trims_blank_values() {
+        assert_eq!(sanitized_token(None), None);
+        assert_eq!(sanitized_token(Some("")), None);
+        assert_eq!(sanitized_token(Some("   ")), None);
+        assert_eq!(sanitized_token(Some(" token\n")), Some("token"));
+    }
+
+    #[test]
+    fn test_authorization_header_value_rejects_malformed_tokens() {
+        assert!(authorization_header_value("token").is_some());
+        assert!(authorization_header_value("bad\ntoken").is_none());
+    }
+
+    #[test]
+    fn test_attestation_lookup_retries_auth_failures_without_token() {
+        assert!(should_retry_attestations_without_token(
+            StatusCode::UNAUTHORIZED,
+            Some("token")
+        ));
+        assert!(should_retry_attestations_without_token(
+            StatusCode::FORBIDDEN,
+            Some("token")
+        ));
+        assert!(!should_retry_attestations_without_token(
+            StatusCode::INTERNAL_SERVER_ERROR,
+            Some("token")
+        ));
+        assert!(!should_retry_attestations_without_token(
+            StatusCode::UNAUTHORIZED,
+            Some("")
+        ));
+        assert!(!should_retry_attestations_without_token(
+            StatusCode::UNAUTHORIZED,
+            Some("bad\ntoken")
+        ));
+        assert!(!should_retry_attestations_without_token(
+            StatusCode::UNAUTHORIZED,
+            None
+        ));
+    }
+
     // -----------------------------------------------------------------------
     // Path validation and extraction hardening tests
     // -----------------------------------------------------------------------
@@ -808,13 +880,11 @@ mod tests {
     // -----------------------------------------------------------------------
 
     #[tokio::test]
-    async fn test_verify_provenance_warns_on_missing_attestation() {
+    async fn test_verify_provenance_fails_closed_when_unverifiable() {
         let result = verify_provenance(b"not a real archive", "stable").await;
-        // Network failures and missing attestations are soft warnings: Ok(false), not hard errors.
-        assert_eq!(
-            result.ok(),
-            Some(false),
-            "verify_provenance should return Ok(false) when attestations cannot be fetched"
+        assert!(
+            result.is_err(),
+            "verify_provenance must fail closed when provenance cannot be verified"
         );
     }
 

crates/goose-cli/src/lib.rs

@@ -1,3 +1,5 @@
+#![recursion_limit = "256"]
+
 #[cfg(not(any(feature = "rustls-tls", feature = "native-tls")))]
 compile_error!("At least one of `rustls-tls` or `native-tls` features must be enabled");
 

crates/goose-cli/src/main.rs

@@ -1,3 +1,5 @@
+#![recursion_limit = "256"]
+
 use anyhow::Result;
 use goose_cli::cli::cli;
 

crates/goose-cli/src/scenario_tests/scenario_runner.rs

@@ -185,12 +185,7 @@ where
 
         let original_env = setup_environment(config)?;
 
-        let inner_provider = create(
-            &factory_name,
-            goose::model_config::model_config_from_user_config(&factory_name, config.model_name)?,
-            Vec::new(),
-        )
-        .await?;
+        let inner_provider = create(&factory_name, Vec::new()).await?;
 
         let test_provider = Arc::new(TestProvider::new_recording(inner_provider, &file_path));
         (
@@ -245,9 +240,12 @@ where
         )
         .await?;
 
+    let scenario_model_config =
+        goose::model_config::model_config_from_user_config(&factory_name, config.model_name)?;
     agent
         .update_provider(
             provider_arc as Arc<dyn goose::providers::base::Provider>,
+            scenario_model_config,
             &session.id,
         )
         .await?;

crates/goose-cli/src/scenario_tests/scenarios.rs

@@ -80,7 +80,7 @@ mod tests {
     //     run_scenario(
     //         "context_length_exceeded",
     //         Box::new(|provider| {
-    //             let model_config = provider.get_model_config();
+    //             let model_config = resolve_global_model_config();
     //             let context_length = model_config.context_limit.unwrap_or(300_000);
     //             // "hello " is only one token in most models, since the hello and space often
     //             // occur together in the training data.

crates/goose-cli/src/session/builder.rs

@@ -333,7 +333,10 @@ async fn resolve_session_id(
                 }
             }
         } else {
-            match session_manager.list_sessions().await {
+            match session_manager
+                .list_sessions_by_types(&[SessionType::User])
+                .await
+            {
                 Ok(sessions) if !sessions.is_empty() => sessions[0].id.clone(),
                 _ => {
                     output::render_error("Cannot resume - no previous sessions found");
@@ -544,84 +547,79 @@ pub async fn build_session(session_config: SessionBuilderConfig) -> CliSession {
             }
         };
 
-    let (new_provider, effective_provider_name, effective_model_name) = match create(
-        &resolved.provider_name,
-        resolved.model_config.clone(),
-        extensions_for_provider.clone(),
-    )
-    .await
-    {
-        Ok(provider) => (
-            provider,
-            resolved.provider_name.clone(),
-            resolved.model_name.clone(),
-        ),
-        Err(e)
-            if session_config.resume
-                && session_config.provider.is_none()
-                && is_provider_unavailable_error(&e) =>
-        {
-            let fallback_provider = config.get_goose_provider().unwrap_or_else(|_| {
-                output::render_error("No provider configured. Run 'goose configure' first.");
-                process::exit(1);
-            });
-            let fallback_model = config.get_goose_model().unwrap_or_else(|_| {
-                output::render_error("No model configured. Run 'goose configure' first.");
-                process::exit(1);
-            });
-            eprintln!(
-                "{}",
-                style(format!(
-                    "Warning: Could not create the session's original provider '{}' ({}). \
-                    Falling back to the default provider '{}'.",
-                    resolved.provider_name, e, fallback_provider
-                ))
-                .yellow()
-            );
-            let fallback_model_config =
-                model_config_from_user_config(fallback_provider.as_str(), &fallback_model)
-                    .unwrap_or_else(|e| {
-                        output::render_error(&format!(
-                            "Failed to create model configuration: {}",
-                            e
-                        ));
-                        process::exit(1);
-                    });
-            match create(
-                &fallback_provider,
-                fallback_model_config,
-                extensions_for_provider.clone(),
-            )
-            .await
+    let (new_provider, effective_provider_name, effective_model_name, effective_model_config) =
+        match create(&resolved.provider_name, extensions_for_provider.clone()).await {
+            Ok(provider) => (
+                provider,
+                resolved.provider_name.clone(),
+                resolved.model_name.clone(),
+                resolved.model_config.clone(),
+            ),
+            Err(e)
+                if session_config.resume
+                    && session_config.provider.is_none()
+                    && is_provider_unavailable_error(&e) =>
             {
-                Ok(provider) => (provider, fallback_provider, fallback_model),
-                Err(e2) => {
-                    output::render_error(&format!(
+                let fallback_provider = config.get_goose_provider().unwrap_or_else(|_| {
+                    output::render_error("No provider configured. Run 'goose configure' first.");
+                    process::exit(1);
+                });
+                let fallback_model = config.get_goose_model().unwrap_or_else(|_| {
+                    output::render_error("No model configured. Run 'goose configure' first.");
+                    process::exit(1);
+                });
+                eprintln!(
+                    "{}",
+                    style(format!(
+                        "Warning: Could not create the session's original provider '{}' ({}). \
+                    Falling back to the default provider '{}'.",
+                        resolved.provider_name, e, fallback_provider
+                    ))
+                    .yellow()
+                );
+                let fallback_model_config =
+                    model_config_from_user_config(fallback_provider.as_str(), &fallback_model)
+                        .unwrap_or_else(|e| {
+                            output::render_error(&format!(
+                                "Failed to create model configuration: {}",
+                                e
+                            ));
+                            process::exit(1);
+                        });
+                match create(&fallback_provider, extensions_for_provider.clone()).await {
+                    Ok(provider) => (
+                        provider,
+                        fallback_provider,
+                        fallback_model,
+                        fallback_model_config,
+                    ),
+                    Err(e2) => {
+                        output::render_error(&format!(
                         "Error {}.\n\
                         Please check your system keychain and run 'goose configure' again.\n\
                         If your system is unable to use the keyring, please try setting secret key(s) via environment variables.\n\
                         For more info, see: https://goose-docs.ai/docs/troubleshooting/#keychainkeyring-errors",
                         e2
                     ));
-                    process::exit(1);
+                        process::exit(1);
+                    }
                 }
             }
-        }
-        Err(e) => {
-            output::render_error(&format!(
+            Err(e) => {
+                output::render_error(&format!(
                 "Error {}.\n\
                 Please check your system keychain and run 'goose configure' again.\n\
                 If your system is unable to use the keyring, please try setting secret key(s) via environment variables.\n\
                 For more info, see: https://goose-docs.ai/docs/troubleshooting/#keychainkeyring-errors",
                 e
             ));
-            process::exit(1);
-        }
-    };
+                process::exit(1);
+            }
+        };
     tracing::info!("🤖 Using model: {}", effective_model_name);
 
     agent
-        .update_provider(new_provider, &session_id)
+        .update_provider(new_provider, effective_model_config, &session_id)
         .await
         .unwrap_or_else(|e| {
             output::render_error(&format!("Failed to initialize agent: {}", e));
@@ -700,6 +698,8 @@ fn is_provider_unavailable_error(e: &anyhow::Error) -> bool {
 #[cfg(test)]
 mod tests {
     use super::*;
+    use goose::session::SessionManager;
+    use tempfile::TempDir;
 
     #[test]
     fn test_session_builder_config_creation() {
@@ -763,6 +763,44 @@ mod tests {
         assert!(!config.fork);
     }
 
+    #[tokio::test]
+    async fn test_implicit_resume_ignores_newer_scheduled_sessions() {
+        let temp_dir = TempDir::new().unwrap();
+        let session_manager = SessionManager::new(temp_dir.path().to_path_buf());
+        let goose_mode = GooseMode::default();
+
+        let user_session = session_manager
+            .create_session(
+                temp_dir.path().to_path_buf(),
+                "User session".to_string(),
+                SessionType::User,
+                goose_mode,
+            )
+            .await
+            .unwrap();
+        session_manager
+            .create_session(
+                temp_dir.path().to_path_buf(),
+                "Scheduled job: test".to_string(),
+                SessionType::Scheduled,
+                goose_mode,
+            )
+            .await
+            .unwrap();
+
+        let resolved = resolve_session_id(
+            &SessionBuilderConfig {
+                resume: true,
+                ..SessionBuilderConfig::default()
+            },
+            &session_manager,
+            goose_mode,
+        )
+        .await;
+
+        assert_eq!(resolved, user_session.id);
+    }
+
     #[test]
     fn test_truncate_with_ellipsis() {
         assert_eq!(truncate_with_ellipsis("abc", 5), "abc");

crates/goose-cli/src/session/completion.rs

@@ -1,3 +1,4 @@
+use goose::agents::execute_commands::list_commands;
 use goose::config::GooseMode;
 use rustyline::completion::{Completer, FilenameCompleter, Pair};
 use rustyline::highlight::{CmdKind, Highlighter};
@@ -36,8 +37,8 @@ impl GooseCompleter {
         // Create completion candidates that match the prefix
         let candidates: Vec<Pair> = cache
             .prompts
-            .iter()
-            .flat_map(|(_, names)| names)
+            .values()
+            .flatten()
             .filter(|name| name.starts_with(prefix.trim()))
             .map(|name| Pair {
                 display: name.clone(),
@@ -152,23 +153,25 @@ impl GooseCompleter {
 
     /// Complete slash commands
     fn complete_slash_commands(&self, line: &str) -> Result<(usize, Vec<Pair>)> {
-        // Define available slash commands
-        let commands = [
-            "/exit",
-            "/quit",
-            "/help",
-            "/?",
-            "/t",
-            "/extension",
-            "/builtin",
-            "/prompts",
-            "/prompt",
-            "/mode",
-            "/model",
-            "/recipe",
-            "/skills",
-            "/status",
+        let mut commands = vec![
+            "/exit".to_string(),
+            "/quit".to_string(),
+            "/help".to_string(),
+            "/?".to_string(),
+            "/t".to_string(),
+            "/extension".to_string(),
+            "/builtin".to_string(),
+            "/mode".to_string(),
+            "/model".to_string(),
+            "/recipe".to_string(),
         ];
+        commands.extend(
+            list_commands()
+                .iter()
+                .map(|command| format!("/{}", command.name)),
+        );
+        commands.sort();
+        commands.dedup();
 
         // Find commands that match the prefix
         let matching_commands: Vec<Pair> = commands
@@ -578,6 +581,15 @@ mod tests {
         let (pos, candidates) = completer.complete_slash_commands("/").unwrap();
         assert_eq!(pos, 0);
         assert!(candidates.len() > 1);
+        for command in list_commands() {
+            assert!(
+                candidates
+                    .iter()
+                    .any(|candidate| candidate.display == format!("/{}", command.name)),
+                "slash completion should list /{}",
+                command.name
+            );
+        }
 
         // Test no match
         let (_pos, candidates) = completer.complete_slash_commands("/nonexistent").unwrap();

crates/goose-cli/src/session/editor.rs

@@ -1,7 +1,10 @@
-use anyhow::Result;
+use anyhow::{Context, Result};
 use goose::config::Config;
+use goose::conversation::message::Message;
+use goose::conversation::Conversation;
 use std::fs;
 use std::io::Read;
+use std::io::Write;
 use std::path::PathBuf;
 use std::process::Command;
 use tempfile::Builder;
@@ -21,9 +24,6 @@ pub fn resolve_editor_command() -> Option<String> {
     )
 }
 
-/// Inner resolution logic, separated for testability.
-/// Checks sources in priority order: config, VISUAL, EDITOR.
-/// Skips empty strings at each level.
 fn resolve_editor_from_sources(
     config_editor: Option<&str>,
     visual: Option<&str>,
@@ -37,6 +37,57 @@ fn resolve_editor_from_sources(
     None
 }
 
+/// Resolve the editor command, falling back to vi (or notepad on Windows).
+pub fn resolve_editor_or_default() -> String {
+    let config = Config::global();
+    let config_editor = config.get_goose_prompt_editor().ok().flatten();
+    let visual = std::env::var("VISUAL").ok();
+    let editor_env = std::env::var("EDITOR").ok();
+    resolve_editor_or_default_from_sources(
+        config_editor.as_deref(),
+        visual.as_deref(),
+        editor_env.as_deref(),
+    )
+}
+
+fn resolve_editor_default() -> String {
+    if cfg!(windows) {
+        "notepad".to_string()
+    } else {
+        "vi".to_string()
+    }
+}
+
+fn resolve_editor_or_default_from_sources(
+    config_editor: Option<&str>,
+    visual: Option<&str>,
+    editor_env: Option<&str>,
+) -> String {
+    resolve_editor_from_sources(config_editor, visual, editor_env)
+        .unwrap_or_else(resolve_editor_default)
+}
+
+/// Open a YAML temp file with the user's editor to edit a conversation.
+/// Returns the edited conversation, or an error if the editor failed or YAML was invalid.
+pub fn edit_conversation(conversation: &Conversation) -> Result<Conversation> {
+    let yaml = serde_yaml::to_string(conversation.messages())?;
+
+    let mut tmp = NamedTempFile::with_suffix(".yaml")?;
+    tmp.write_all(yaml.as_bytes())?;
+    tmp.flush()?;
+
+    let editor = resolve_editor_or_default();
+    let path = tmp.path().to_path_buf();
+
+    launch_editor(&editor, &path).with_context(|| format!("failed to launch editor '{editor}'"))?;
+
+    let edited = std::fs::read_to_string(&path)?;
+    let messages: Vec<Message> =
+        serde_yaml::from_str(&edited).context("invalid YAML — session unchanged")?;
+
+    Ok(Conversation::new_unvalidated(messages))
+}
+
 /// Build the markdown template content for the editor prompt.
 fn build_template(messages: &[&str], prefill: Option<&str>) -> String {
     let mut content = String::from("# Goose Prompt Editor\n\n");
@@ -84,21 +135,36 @@ impl SymlinkCleanup {
 
 impl Drop for SymlinkCleanup {
     fn drop(&mut self) {
-        // Always try to clean up the symlink, ignoring any errors
         let _ = std::fs::remove_file(&self.symlink_path);
     }
 }
 
+/// Split an editor command into program and arguments.
+///
+/// Uses shell-word splitting only when the command contains quotes, so values like
+/// `"/Applications/Sublime Text.app/.../subl" -w` work. Unquoted commands are split on
+/// whitespace to avoid shlex stripping backslashes from Windows paths like
+/// `C:\Windows\System32\notepad.exe`.
+fn split_editor_command(editor_cmd: &str) -> Result<Vec<String>> {
+    if editor_cmd.contains(['"', '\'']) {
+        shlex::split(editor_cmd).ok_or_else(|| {
+            anyhow::anyhow!("Invalid editor command: unmatched quotes in '{editor_cmd}'")
+        })
+    } else {
+        Ok(editor_cmd.split_whitespace().map(String::from).collect())
+    }
+}
+
 /// Launch editor and wait for completion
 fn launch_editor(editor_cmd: &str, file_path: &PathBuf) -> Result<()> {
     use std::process::Stdio;
 
-    let parts: Vec<&str> = editor_cmd.split_whitespace().collect();
+    let parts = split_editor_command(editor_cmd)?;
     if parts.is_empty() {
         return Err(anyhow::anyhow!("Empty editor command"));
     }
 
-    let mut cmd = Command::new(parts[0]);
+    let mut cmd = Command::new(&parts[0]);
     if let Ok(cwd) = std::env::current_dir() {
         cmd.current_dir(cwd);
     }
@@ -414,54 +480,64 @@ with multiple lines.
         );
     }
 
-    // --- resolve_editor_from_sources tests ---
-
     #[test]
-    fn test_resolve_editor_returns_config_when_set() {
-        let result = resolve_editor_from_sources(Some("code"), Some("vim"), Some("nano"));
-        assert_eq!(result.as_deref(), Some("code"));
+    fn test_resolve_editor_resolution_priority() {
+        assert_eq!(
+            resolve_editor_from_sources(Some("config-val"), Some("visual-val"), Some("editor-val")),
+            Some("config-val".to_string())
+        );
+
+        assert_eq!(
+            resolve_editor_from_sources(Some(""), Some("visual-val"), Some("editor-val")),
+            Some("visual-val".to_string())
+        );
+
+        assert_eq!(
+            resolve_editor_from_sources(None, Some(""), Some("editor-val")),
+            Some("editor-val".to_string())
+        );
+
+        assert_eq!(resolve_editor_from_sources(None, None, None), None);
+        assert_eq!(
+            resolve_editor_from_sources(Some(""), Some(""), Some("")),
+            None
+        );
+
+        let default_val = resolve_editor_default();
+        assert_eq!(
+            resolve_editor_or_default_from_sources(None, None, None),
+            default_val
+        );
+        assert_eq!(
+            resolve_editor_or_default_from_sources(Some(""), Some(""), Some("")),
+            default_val
+        );
     }
 
     #[test]
-    fn test_resolve_editor_falls_back_to_visual() {
-        let result = resolve_editor_from_sources(None, Some("vim"), Some("nano"));
-        assert_eq!(result.as_deref(), Some("vim"));
-    }
+    fn test_split_editor_command() {
+        assert_eq!(
+            split_editor_command("code --wait").unwrap(),
+            vec!["code", "--wait"]
+        );
 
-    #[test]
-    fn test_resolve_editor_falls_back_to_editor_env() {
-        let result = resolve_editor_from_sources(None, None, Some("nano"));
-        assert_eq!(result.as_deref(), Some("nano"));
-    }
+        assert_eq!(
+            split_editor_command(
+                r#""/Applications/Sublime Text.app/Contents/SharedSupport/bin/subl" -w"#
+            )
+            .unwrap(),
+            vec![
+                "/Applications/Sublime Text.app/Contents/SharedSupport/bin/subl",
+                "-w"
+            ]
+        );
 
-    #[test]
-    fn test_resolve_editor_returns_none_when_nothing_set() {
-        let result = resolve_editor_from_sources(None, None, None);
-        assert_eq!(result, None);
-    }
+        assert_eq!(
+            split_editor_command(r"C:\Windows\System32\notepad.exe").unwrap(),
+            vec![r"C:\Windows\System32\notepad.exe"]
+        );
 
-    #[test]
-    fn test_resolve_editor_skips_empty_config() {
-        let result = resolve_editor_from_sources(Some(""), Some("vim"), None);
-        assert_eq!(result.as_deref(), Some("vim"));
-    }
-
-    #[test]
-    fn test_resolve_editor_skips_empty_visual() {
-        let result = resolve_editor_from_sources(None, Some(""), Some("nano"));
-        assert_eq!(result.as_deref(), Some("nano"));
-    }
-
-    #[test]
-    fn test_resolve_editor_skips_all_empty() {
-        let result = resolve_editor_from_sources(Some(""), Some(""), Some(""));
-        assert_eq!(result, None);
-    }
-
-    #[test]
-    fn test_resolve_editor_skips_empty_config_and_visual() {
-        let result = resolve_editor_from_sources(Some(""), Some(""), Some("emacs"));
-        assert_eq!(result.as_deref(), Some("emacs"));
+        assert!(split_editor_command(r#"code --wait "unclosed"#).is_err());
     }
 
     // --- build_template edge case tests ---
@@ -469,9 +545,7 @@ with multiple lines.
     #[test]
     fn test_build_template_empty_prefill_string() {
         let content = build_template(&["## User: Hello"], Some(""));
-        // Empty prefill should not appear in content
         assert!(content.contains("# Your prompt:\n\n#"));
-        // Should go directly to conversation context
         assert!(content.contains("# Recent conversation for context"));
     }
 
@@ -498,11 +572,8 @@ with multiple lines.
         assert!(prefill_pos < context_pos);
     }
 
-    // --- extract_user_input with prefilled content tests ---
-
     #[test]
     fn test_extract_user_input_with_prefill_kept() {
-        // Simulates a user who opened the editor with prefill and kept it unchanged
         let content = build_template(&["## User: Hello"], Some("fix the login bug"));
         let result = extract_user_input(&content);
         assert_eq!(result, "fix the login bug");
@@ -510,7 +581,6 @@ with multiple lines.
 
     #[test]
     fn test_extract_user_input_with_prefill_edited() {
-        // Simulates a user who edited the prefill text
         let mut content = build_template(&["## User: Hello"], Some("fix the login bug"));
         content = content.replace(
             "fix the login bug",
@@ -522,7 +592,6 @@ with multiple lines.
 
     #[test]
     fn test_extract_user_input_prefill_replaced() {
-        // Simulates a user who deleted the prefill and wrote something new
         let mut content = build_template(&["## User: Hello"], Some("fix the login bug"));
         content = content.replace("fix the login bug\n", "completely different prompt\n");
         let result = extract_user_input(&content);
@@ -531,7 +600,6 @@ with multiple lines.
 
     #[test]
     fn test_extract_user_input_prefill_cleared() {
-        // Simulates a user who deleted the prefill and left nothing
         let mut content = build_template(&["## User: Hello"], Some("fix the login bug"));
         content = content.replace("fix the login bug\n", "");
         let result = extract_user_input(&content);

crates/goose-cli/src/session/input.rs

@@ -401,10 +401,17 @@ fn parse_plan_command(input: String) -> Option<InputResult> {
     Some(InputResult::Plan(options))
 }
 
-fn print_help() {
+fn help_text() -> String {
     let newline_key = get_newline_key().to_ascii_uppercase();
     let modes = GooseMode::VARIANTS.join(", ");
-    println!(
+    let additional_builtin_help = additional_builtin_help();
+    let additional_builtin_help = if additional_builtin_help.is_empty() {
+        String::new()
+    } else {
+        format!("{additional_builtin_help}\n")
+    };
+
+    format!(
         "Available commands:
 /exit or /quit - Exit the session
 /t - Toggle Light/Dark/Ansi theme
@@ -425,7 +432,7 @@ fn print_help() {
 /recipe [filepath] - Generate a recipe from the current conversation and save it to the specified filepath (must end with .yaml).
                        If no filepath is provided, it will be saved to ./recipe.yaml.
 /compact - Compact the current conversation to reduce context length while preserving key information.
-/status - Show session status: model, provider, mode, and token usage.
+{additional_builtin_help}/status - Show session status: model, provider, mode, and token usage.
 /edit [text] - Open your prompt editor to compose a message. Optionally pre-fill with text.
                Uses $GOOSE_PROMPT_EDITOR, $VISUAL, or $EDITOR (in that order).
 /skills - List available skills or enable skills by name (usage: /skills [<name>...])
@@ -436,7 +443,23 @@ Navigation:
 Ctrl+C - Clear current line if text is entered, otherwise exit the session
 Ctrl+{newline_key} - Add a newline (configurable via GOOSE_CLI_NEWLINE_KEY)
 Up/Down arrows - Navigate through command history"
-    );
+    )
+}
+
+fn additional_builtin_help() -> String {
+    const DOCUMENTED_BUILTINS: &[&str] =
+        &["prompts", "prompt", "compact", "clear", "skills", "status"];
+
+    goose::agents::execute_commands::list_commands()
+        .iter()
+        .filter(|command| !DOCUMENTED_BUILTINS.contains(&command.name))
+        .map(|command| format!("/{} - {}", command.name, command.description))
+        .collect::<Vec<_>>()
+        .join("\n")
+}
+
+fn print_help() {
+    println!("{}", help_text());
 }
 
 /// Extract recent messages for editor context
@@ -535,6 +558,19 @@ mod tests {
         assert!(handle_slash_command("/unknown").is_none());
     }
 
+    #[test]
+    fn help_lists_builtin_agent_commands() {
+        let help = help_text();
+
+        for command in goose::agents::execute_commands::list_commands() {
+            assert!(
+                help.contains(&format!("/{}", command.name)),
+                "help output should list /{}",
+                command.name
+            );
+        }
+    }
+
     #[test]
     fn test_prompts_command() {
         // Test basic prompts command

crates/goose-cli/src/session/mod.rs

@@ -1,6 +1,6 @@
 mod builder;
 mod completion;
-mod editor;
+pub mod editor;
 mod elicitation;
 mod export;
 mod input;
@@ -53,7 +53,7 @@ use std::collections::{HashMap, HashSet};
 use std::io::IsTerminal;
 use std::path::PathBuf;
 use std::sync::Arc;
-use std::time::Instant;
+use std::time::{Duration, Instant};
 use tokio;
 use tokio_util::sync::CancellationToken;
 use tracing::warn;
@@ -219,22 +219,23 @@ pub async fn classify_planner_response(
     session_id: &str,
     message_text: String,
     provider: Arc<dyn Provider>,
+    model_config: goose_providers::model::ModelConfig,
 ) -> Result<PlannerResponseType> {
     let prompt = format!(
         "The text below is the output from an AI model which can either provide a plan or list of clarifying questions. Based on the text below, decide if the output is a \"plan\" or \"clarifying questions\".\n---\n{message_text}"
     );
 
     let message = Message::user().with_text(&prompt);
-    let model_config = provider.get_model_config();
-    let (result, _usage) = provider
-        .complete(
+    let (result, _usage) = goose::session_context::with_session_id(
+        Some(session_id.to_string()),
+        provider.complete(
             &model_config,
-            session_id,
             "Reply only with the classification label: \"plan\" or \"clarifying questions\"",
             &[message],
             &[],
-        )
-        .await?;
+        ),
+    )
+    .await?;
 
     let predicted = result.as_concat_text();
     if predicted.to_lowercase().contains("plan") {
@@ -486,10 +487,6 @@ impl CliSession {
 
     /// Start an interactive session, optionally with an initial message
     pub async fn interactive(&mut self, prompt: Option<String>) -> Result<()> {
-        self.agent
-            .emit_hook(goose::hooks::HookEvent::SessionStart, &self.session_id)
-            .await;
-
         let result = self.run_interactive(prompt).await;
 
         self.agent
@@ -655,6 +652,8 @@ impl CliSession {
                             prefill.as_deref(),
                         ) {
                             Ok((message, true)) => {
+                                editor.add_history_entry(message.as_str())?;
+                                history.save(editor);
                                 self.handle_message_input(&message, history, editor).await?;
                             }
                             Ok((_, false)) => {}
@@ -722,8 +721,8 @@ impl CliSession {
             RunMode::Plan => {
                 let mut plan_messages = self.messages.clone();
                 plan_messages.push(Message::user().with_text(content));
-                let reasoner = get_reasoner().await?;
-                self.plan_with_reasoner_model(plan_messages, reasoner)
+                let (reasoner, reasoner_model_config) = get_reasoner().await?;
+                self.plan_with_reasoner_model(plan_messages, reasoner, reasoner_model_config)
                     .await?;
             }
         }
@@ -810,7 +809,10 @@ impl CliSession {
     async fn handle_model(&self, model: Option<&str>) -> Result<()> {
         let provider = self.agent.provider().await?;
         let current_provider_name = provider.get_name().to_string();
-        let current_model_config = provider.get_model_config();
+        let current_model_config = self
+            .agent
+            .model_config_for_session(&self.session_id)
+            .await?;
         let current_model_name = current_model_config.model_name.clone();
 
         if model.is_none() {
@@ -859,13 +861,12 @@ impl CliSession {
         }
 
         let extensions = self.agent.get_extension_configs().await;
-        let new_provider =
-            goose::providers::create(&current_provider_name, new_model_config, extensions)
-                .await
-                .map_err(|e| anyhow::anyhow!("Failed to create provider: {e}"))?;
+        let new_provider = goose::providers::create(&current_provider_name, extensions)
+            .await
+            .map_err(|e| anyhow::anyhow!("Failed to create provider: {e}"))?;
 
         self.agent
-            .update_provider(new_provider, &self.session_id)
+            .update_provider(new_provider, new_model_config, &self.session_id)
             .await?;
 
         let mode = self.agent.goose_mode().await;
@@ -888,8 +889,9 @@ impl CliSession {
         let mut plan_messages = self.messages.clone();
         plan_messages.push(Message::user().with_text(&options.message_text));
 
-        let reasoner = get_reasoner().await?;
-        self.plan_with_reasoner_model(plan_messages, reasoner).await
+        let (reasoner, reasoner_model_config) = get_reasoner().await?;
+        self.plan_with_reasoner_model(plan_messages, reasoner, reasoner_model_config)
+            .await
     }
 
     async fn handle_clear(&mut self) -> Result<()> {
@@ -1051,25 +1053,24 @@ impl CliSession {
         &mut self,
         plan_messages: Conversation,
         reasoner: Arc<dyn Provider>,
+        model_config: goose_providers::model::ModelConfig,
     ) -> Result<(), anyhow::Error> {
         let plan_prompt = self.agent.get_plan_prompt(&self.session_id).await?;
         output::show_thinking();
-        let model_config = reasoner.get_model_config();
-        let (plan_response, _usage) = reasoner
-            .complete(
-                &model_config,
-                &self.session_id,
-                &plan_prompt,
-                plan_messages.messages(),
-                &[],
-            )
-            .await?;
+        let (plan_response, _usage) = goose::session_context::with_session_id(
+            Some(self.session_id.clone()),
+            reasoner.complete(&model_config, &plan_prompt, plan_messages.messages(), &[]),
+        )
+        .await?;
         output::render_message(&plan_response, self.debug);
         output::hide_thinking();
         let planner_response_type = classify_planner_response(
             &self.session_id,
             plan_response.as_concat_text(),
             self.agent.provider().await?,
+            self.agent
+                .model_config_for_session(&self.session_id)
+                .await?,
         )
         .await?;
 
@@ -1134,9 +1135,6 @@ impl CliSession {
 
     /// Process a single message and exit
     pub async fn headless(&mut self, prompt: String) -> Result<()> {
-        self.agent
-            .emit_hook(goose::hooks::HookEvent::SessionStart, &self.session_id)
-            .await;
         let message = Message::user().with_text(&prompt);
         let result = self
             .process_message(message, CancellationToken::default(), false)
@@ -1328,6 +1326,7 @@ impl CliSession {
                         Some(Ok(AgentEvent::Usage(usage))) => {
                             last_usage = Some(usage);
                         }
+                        Some(Ok(AgentEvent::MessageUsage { .. })) => {}
                         Some(Ok(AgentEvent::McpNotification((extension_id, notification)))) => {
                             handle_mcp_notification(
                                 &extension_id,
@@ -1596,8 +1595,14 @@ impl CliSession {
     /// Display enhanced context usage with session totals
     pub async fn display_context_usage(&self) -> Result<()> {
         let provider = self.agent.provider().await?;
-        let model_config = provider.get_model_config();
-        let context_limit = model_config.context_limit();
+        let model_config = self
+            .agent
+            .model_config_for_session(&self.session_id)
+            .await?;
+        let context_limit = provider
+            .get_context_limit(&model_config)
+            .await
+            .unwrap_or_else(|_| model_config.context_limit());
 
         let config = Config::global();
         let show_cost = config
@@ -1764,25 +1769,54 @@ fn print_run_stats(
     usage: Option<&ProviderUsage>,
 ) {
     let elapsed = run_started.elapsed();
+    let stats = usage.and_then(|usage| usage.stats.as_ref());
+    let generation_elapsed = stats
+        .and_then(|stats| stats.elapsed_ms)
+        .map(Duration::from_millis);
     let output_tokens = usage
         .and_then(|usage| usage.usage.output_tokens)
         .and_then(|tokens| usize::try_from(tokens).ok())
-        .or_else(|| usage.and_then(|usage| usage.stats.as_ref()?.output_tokens));
+        .or_else(|| stats.and_then(|stats| stats.output_tokens));
     let tokens_per_second = output_tokens.map(|tokens| {
-        if elapsed.as_secs_f64() > 0.0 {
-            tokens as f64 / elapsed.as_secs_f64()
+        let rate_elapsed = generation_elapsed.unwrap_or(elapsed);
+        if rate_elapsed.as_secs_f64() > 0.0 {
+            tokens as f64 / rate_elapsed.as_secs_f64()
         } else {
             0.0
         }
     });
+    let model_load_ms = stats.and_then(|stats| stats.model_load_ms);
+    let generation_time_to_first_token_ms = stats.and_then(|stats| stats.time_to_first_token_ms);
 
     eprintln!("\nStats:");
-    match first_token_at {
-        Some(first) => eprintln!(
-            "  Time to first token: {:.2}s",
-            first.duration_since(run_started).as_secs_f64()
-        ),
-        None => eprintln!("  Time to first token: unavailable"),
+    if let Some(ms) = model_load_ms {
+        eprintln!("  Model load: {:.2}s", ms as f64 / 1000.0);
+    }
+    if model_load_ms.is_some() {
+        match generation_time_to_first_token_ms {
+            Some(ms) => eprintln!(
+                "  Generation time to first token: {:.2}s",
+                ms as f64 / 1000.0
+            ),
+            None => eprintln!("  Generation time to first token: unavailable"),
+        }
+        match first_token_at {
+            Some(first) => eprintln!(
+                "  End-to-end time to first token: {:.2}s",
+                first.duration_since(run_started).as_secs_f64()
+            ),
+            None => eprintln!("  End-to-end time to first token: unavailable"),
+        }
+    } else if let Some(ms) = generation_time_to_first_token_ms {
+        eprintln!("  Time to first token: {:.2}s", ms as f64 / 1000.0);
+    } else {
+        match first_token_at {
+            Some(first) => eprintln!(
+                "  Time to first token: {:.2}s",
+                first.duration_since(run_started).as_secs_f64()
+            ),
+            None => eprintln!("  Time to first token: unavailable"),
+        }
     }
     match tokens_per_second {
         Some(rate) => eprintln!("  Tokens/sec: {:.2}", rate),
@@ -1792,10 +1826,7 @@ fn print_run_stats(
         eprintln!("  Output tokens: {tokens}");
     }
 
-    if let Some(draft) = usage
-        .and_then(|usage| usage.stats.as_ref())
-        .and_then(|stats| stats.draft.as_ref())
-    {
+    if let Some(draft) = stats.and_then(|stats| stats.draft.as_ref()) {
         eprintln!("  Draft accept rate: {:.1}%", draft.accept_rate * 100.0);
         eprintln!(
             "  Draft tokens: {} accepted: {} target verified: {} rounds: {}",
@@ -2213,7 +2244,8 @@ fn handle_agent_error(e: &anyhow::Error, is_stream_json_mode: bool) {
     }
 }
 
-async fn get_reasoner() -> Result<Arc<dyn Provider>, anyhow::Error> {
+async fn get_reasoner(
+) -> Result<(Arc<dyn Provider>, goose_providers::model::ModelConfig), anyhow::Error> {
     use goose::providers::create;
 
     let config = Config::global();
@@ -2252,9 +2284,9 @@ async fn get_reasoner() -> Result<Arc<dyn Provider>, anyhow::Error> {
         goose::model_config::model_config_from_user_config(&provider, model.as_str())?
             .with_context_limit(planner_context_limit);
     let extensions = goose::config::extensions::get_enabled_extensions_with_config(config);
-    let reasoner = create(&provider, model_config, extensions).await?;
+    let reasoner = create(&provider, extensions).await?;
 
-    Ok(reasoner)
+    Ok((reasoner, model_config))
 }
 
 /// Format elapsed time duration
@@ -2434,7 +2466,6 @@ mod tests {
             max_tokens: Some(16_384),
             toolshim: true,
             toolshim_model: Some("qwen2.5-coder".to_string()),
-            fast_model_config: None,
             request_params: Some(HashMap::from([(
                 "anthropic_beta".to_string(),
                 serde_json::json!(["output-128k-2025-02-19"]),
@@ -2444,7 +2475,7 @@ mod tests {
 
         let switched =
             build_switched_model_config("openai", "gpt-5.4", &current_model_config).unwrap();
-        let expected = goose_providers::model::ModelConfig::new_or_fail("gpt-5.4")
+        let expected = goose_providers::model::ModelConfig::new("gpt-5.4")
             .with_canonical_limits("openai")
             .with_temperature(Some(0.25))
             .with_toolshim(true)
@@ -2471,7 +2502,7 @@ mod tests {
             ("GOOSE_THINKING_EFFORT", None::<&str>),
         ]);
 
-        let current = goose_providers::model::ModelConfig::new_or_fail("gpt-5.4-high")
+        let current = goose_providers::model::ModelConfig::new("gpt-5.4-high")
             .with_canonical_limits("openai");
         assert_eq!(current.model_name, "gpt-5.4");
         assert_eq!(

crates/goose-cli/src/session/output.rs

@@ -248,7 +248,8 @@ pub fn render_message(message: &Message, debug: bool) {
             }
             MessageContent::SystemNotification(notification) => {
                 match notification.notification_type {
-                    SystemNotificationType::ThinkingMessage => {
+                    SystemNotificationType::ThinkingMessage
+                    | SystemNotificationType::ProgressMessage => {
                         show_thinking();
                         set_thinking_message(&notification.msg);
                     }
@@ -330,7 +331,8 @@ pub fn render_message_streaming(
             }
             MessageContent::SystemNotification(notification) => {
                 match notification.notification_type {
-                    SystemNotificationType::ThinkingMessage => {
+                    SystemNotificationType::ThinkingMessage
+                    | SystemNotificationType::ProgressMessage => {
                         show_thinking();
                         set_thinking_message(&notification.msg);
                     }

crates/goose-cli/src/session/streaming_buffer.rs

@@ -524,10 +524,8 @@ impl MarkdownBuffer {
                 }
             }
             "]" => {}
-            ")" => {
-                if state.in_link_url {
-                    state.in_link_url = false;
-                }
+            ")" if state.in_link_url => {
+                state.in_link_url = false;
             }
             _ => {}
         }

crates/goose-download-manager/Cargo.toml

@@ -0,0 +1,21 @@
+[package]
+name = "goose-download-manager"
+version = "0.1.0-alpha.0"
+edition.workspace = true
+rust-version.workspace = true
+authors.workspace = true
+license.workspace = true
+repository.workspace = true
+description.workspace = true
+
+[lints]
+workspace = true
+
+[dependencies]
+anyhow = { workspace = true }
+once_cell = { workspace = true }
+reqwest = { workspace = true, features = ["stream"] }
+serde = { workspace = true }
+tokio = { workspace = true, features = ["fs", "io-util", "time"] }
+tracing = { workspace = true }
+utoipa = { workspace = true }

crates/goose-download-manager/src/lib.rs

@@ -0,0 +1,691 @@
+use anyhow::Result;
+use serde::{Deserialize, Serialize};
+use std::collections::HashMap;
+use std::path::{Path, PathBuf};
+use std::sync::{Arc, Mutex};
+use tokio::io::AsyncWriteExt;
+use tracing::info;
+use utoipa::ToSchema;
+
+fn partial_path_for(destination: &Path) -> PathBuf {
+    destination.with_extension(
+        destination
+            .extension()
+            .map(|e| format!("{}.part", e.to_string_lossy()))
+            .unwrap_or_else(|| "part".to_string()),
+    )
+}
+
+/// Remove orphaned `.part` files in the given directory (and one level of subdirectories).
+/// Preserves `.part` files whose final destination is in `registered_paths` so that
+/// in-progress shard downloads can resume after a restart.
+pub fn cleanup_partial_downloads(
+    dir: &Path,
+    registered_paths: &std::collections::HashSet<PathBuf>,
+) {
+    let should_keep = |part_path: &Path| -> bool {
+        // Derive the final path by stripping the trailing ".part" extension
+        let final_path = part_path.with_extension("");
+        registered_paths.contains(&final_path)
+    };
+
+    if let Ok(entries) = std::fs::read_dir(dir) {
+        for entry in entries.flatten() {
+            let path = entry.path();
+            if path.extension().is_some_and(|e| e == "part") && !should_keep(&path) {
+                let _ = std::fs::remove_file(&path);
+            }
+            if path.is_dir() {
+                if let Ok(sub_entries) = std::fs::read_dir(&path) {
+                    for sub in sub_entries.flatten() {
+                        let sub_path = sub.path();
+                        if sub_path.extension().is_some_and(|e| e == "part")
+                            && !should_keep(&sub_path)
+                        {
+                            let _ = std::fs::remove_file(&sub_path);
+                        }
+                    }
+                }
+            }
+        }
+    }
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, ToSchema)]
+pub struct DownloadProgress {
+    /// Model ID being downloaded
+    pub model_id: String,
+    /// Download status
+    pub status: DownloadStatus,
+    /// Bytes downloaded so far
+    pub bytes_downloaded: u64,
+    /// Total bytes to download
+    pub total_bytes: u64,
+    /// Download progress percentage (0-100)
+    pub progress_percent: f32,
+    /// Download speed in bytes per second
+    pub speed_bps: Option<u64>,
+    /// Estimated time remaining in seconds
+    pub eta_seconds: Option<u64>,
+    /// Error message if failed
+    pub error: Option<String>,
+    /// Whether the background download task has exited
+    #[serde(skip)]
+    pub task_exited: bool,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, ToSchema, PartialEq)]
+#[serde(rename_all = "lowercase")]
+pub enum DownloadStatus {
+    Downloading,
+    Completed,
+    Failed,
+    Cancelled,
+}
+
+type DownloadMap = Arc<Mutex<HashMap<String, DownloadProgress>>>;
+
+pub struct DownloadManager {
+    downloads: DownloadMap,
+}
+
+impl Default for DownloadManager {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl DownloadManager {
+    pub fn new() -> Self {
+        Self {
+            downloads: Arc::new(Mutex::new(HashMap::new())),
+        }
+    }
+
+    pub fn get_progress(&self, model_id: &str) -> Option<DownloadProgress> {
+        self.downloads.lock().ok()?.get(model_id).cloned()
+    }
+
+    pub fn is_downloading(&self, model_id: &str) -> bool {
+        self.get_progress(model_id)
+            .is_some_and(|progress| progress.status == DownloadStatus::Downloading)
+    }
+
+    pub fn list_progress(&self) -> Vec<DownloadProgress> {
+        self.downloads
+            .lock()
+            .map(|downloads| downloads.values().cloned().collect())
+            .unwrap_or_default()
+    }
+
+    pub fn set_progress(&self, progress: DownloadProgress) {
+        if let Ok(mut downloads) = self.downloads.lock() {
+            downloads.insert(progress.model_id.clone(), progress);
+        }
+    }
+
+    pub fn reserve_download(&self, progress: DownloadProgress) -> Result<bool> {
+        let mut downloads = self
+            .downloads
+            .lock()
+            .map_err(|_| anyhow::anyhow!("Failed to acquire lock"))?;
+
+        if let Some(existing) = downloads.get(&progress.model_id) {
+            if existing.status == DownloadStatus::Downloading
+                || (existing.status == DownloadStatus::Cancelled && !existing.task_exited)
+            {
+                return Ok(false);
+            }
+        }
+
+        downloads.insert(progress.model_id.clone(), progress);
+        Ok(true)
+    }
+
+    pub fn update_progress(&self, model_id: &str, update: impl FnOnce(&mut DownloadProgress)) {
+        if let Ok(mut downloads) = self.downloads.lock() {
+            if let Some(progress) = downloads.get_mut(model_id) {
+                update(progress);
+            }
+        }
+    }
+
+    pub fn cancel_download(&self, model_id: &str) -> Result<()> {
+        let mut downloads = self
+            .downloads
+            .lock()
+            .map_err(|_| anyhow::anyhow!("Failed to acquire lock"))?;
+
+        if let Some(progress) = downloads.get_mut(model_id) {
+            progress.status = DownloadStatus::Cancelled;
+            Ok(())
+        } else {
+            anyhow::bail!("Download not found")
+        }
+    }
+
+    pub async fn download_model(
+        &self,
+        model_id: String,
+        url: String,
+        destination: PathBuf,
+        on_complete: Option<Box<dyn FnOnce() + Send + 'static>>,
+    ) -> Result<()> {
+        self.download_model_sharded(model_id, vec![(url, destination)], 0, on_complete)
+            .await
+    }
+
+    pub async fn download_model_with_bearer_token(
+        &self,
+        model_id: String,
+        url: String,
+        destination: PathBuf,
+        bearer_token: Option<String>,
+        on_complete: Option<Box<dyn FnOnce() + Send + 'static>>,
+    ) -> Result<()> {
+        self.download_model_sharded_with_bearer_token(
+            model_id,
+            vec![(url, destination)],
+            0,
+            bearer_token,
+            on_complete,
+        )
+        .await
+    }
+
+    pub async fn download_model_sharded(
+        &self,
+        model_id: String,
+        files: Vec<(String, PathBuf)>,
+        total_size_hint: u64,
+        on_complete: Option<Box<dyn FnOnce() + Send + 'static>>,
+    ) -> Result<()> {
+        self.download_model_sharded_with_bearer_token(
+            model_id,
+            files,
+            total_size_hint,
+            None,
+            on_complete,
+        )
+        .await
+    }
+
+    pub async fn download_model_sharded_with_bearer_token(
+        &self,
+        model_id: String,
+        files: Vec<(String, PathBuf)>,
+        total_size_hint: u64,
+        bearer_token: Option<String>,
+        on_complete: Option<Box<dyn FnOnce() + Send + 'static>>,
+    ) -> Result<()> {
+        info!(model_id = %model_id, file_count = files.len(), "Starting model download");
+        {
+            let mut downloads = self
+                .downloads
+                .lock()
+                .map_err(|_| anyhow::anyhow!("Failed to acquire lock"))?;
+
+            if let Some(existing) = downloads.get(&model_id) {
+                if existing.status == DownloadStatus::Downloading {
+                    anyhow::bail!("Download already in progress");
+                }
+                if existing.status == DownloadStatus::Cancelled && !existing.task_exited {
+                    anyhow::bail!(
+                        "Download is being cancelled; wait for it to finish before restarting"
+                    );
+                }
+            }
+
+            downloads.insert(
+                model_id.clone(),
+                DownloadProgress {
+                    model_id: model_id.clone(),
+                    status: DownloadStatus::Downloading,
+                    bytes_downloaded: 0,
+                    total_bytes: total_size_hint,
+                    progress_percent: 0.0,
+                    speed_bps: None,
+                    eta_seconds: None,
+                    error: None,
+                    task_exited: false,
+                },
+            );
+        }
+
+        // Create parent directories for all files
+        for (_, dest) in &files {
+            if let Some(parent) = dest.parent() {
+                tokio::fs::create_dir_all(parent)
+                    .await
+                    .map_err(|e| anyhow::anyhow!("Failed to create directory: {}", e))?;
+            }
+        }
+
+        let downloads = self.downloads.clone();
+        let model_id_clone = model_id.clone();
+        let files_for_cleanup: Vec<PathBuf> = files.iter().map(|(_, d)| d.clone()).collect();
+
+        tokio::spawn(async move {
+            let result = Self::download_files_sequentially(
+                &files,
+                &downloads,
+                &model_id_clone,
+                bearer_token.as_deref(),
+            )
+            .await;
+
+            match result {
+                Ok(_) => {
+                    info!(model_id = %model_id_clone, "Download completed successfully");
+                    if let Ok(mut downloads) = downloads.lock() {
+                        if let Some(progress) = downloads.get_mut(&model_id_clone) {
+                            progress.status = DownloadStatus::Completed;
+                            progress.progress_percent = 100.0;
+                            progress.task_exited = true;
+                        }
+                    }
+
+                    if let Some(callback) = on_complete {
+                        callback();
+                    }
+                }
+                Err(e) => {
+                    for dest in &files_for_cleanup {
+                        let partial = partial_path_for(dest);
+                        let _ = tokio::fs::remove_file(&partial).await;
+                    }
+
+                    if let Ok(mut downloads) = downloads.lock() {
+                        if let Some(progress) = downloads.get_mut(&model_id_clone) {
+                            if progress.status != DownloadStatus::Cancelled {
+                                progress.status = DownloadStatus::Failed;
+                            }
+                            progress.error = Some(e.to_string());
+                            progress.task_exited = true;
+                        }
+                    }
+                }
+            }
+        });
+
+        Ok(())
+    }
+
+    const MAX_RETRIES: u32 = 10;
+    const RETRY_BASE_DELAY: std::time::Duration = std::time::Duration::from_secs(2);
+    const RETRY_MAX_DELAY: std::time::Duration = std::time::Duration::from_secs(60);
+
+    async fn cancellable_sleep(
+        delay: std::time::Duration,
+        downloads: &DownloadMap,
+        model_id: &str,
+    ) -> Result<(), anyhow::Error> {
+        let check_interval = std::time::Duration::from_millis(500);
+        let start = std::time::Instant::now();
+        while start.elapsed() < delay {
+            if Self::is_cancelled(downloads, model_id) {
+                anyhow::bail!("Download cancelled");
+            }
+            let remaining = delay.saturating_sub(start.elapsed());
+            tokio::time::sleep(std::cmp::min(check_interval, remaining)).await;
+        }
+        Ok(())
+    }
+
+    fn is_cancelled(downloads: &DownloadMap, model_id: &str) -> bool {
+        if let Ok(downloads) = downloads.lock() {
+            if let Some(progress) = downloads.get(model_id) {
+                return progress.status == DownloadStatus::Cancelled;
+            }
+        }
+        false
+    }
+
+    #[allow(clippy::too_many_arguments)]
+    /// Download multiple files sequentially, tracking cumulative progress under one model_id.
+    async fn download_files_sequentially(
+        files: &[(String, PathBuf)],
+        downloads: &DownloadMap,
+        model_id: &str,
+        bearer_token: Option<&str>,
+    ) -> Result<(), anyhow::Error> {
+        let client = reqwest::Client::builder()
+            .connect_timeout(std::time::Duration::from_secs(30))
+            .read_timeout(std::time::Duration::from_secs(120))
+            .build()?;
+
+        // HEAD each file to get accurate total size. Only replace the hint if
+        // every file returned a size; partial results would underestimate.
+        let mut total: u64 = 0;
+        let mut all_resolved = true;
+        for (url, _) in files {
+            let size = Self::apply_bearer_token(client.head(url), bearer_token)
+                .send()
+                .await
+                .ok()
+                .and_then(|r| r.content_length())
+                .unwrap_or(0);
+            if size == 0 {
+                all_resolved = false;
+            }
+            total += size;
+        }
+        if all_resolved && total > 0 {
+            if let Ok(mut dl) = downloads.lock() {
+                if let Some(progress) = dl.get_mut(model_id) {
+                    progress.total_bytes = total;
+                }
+            }
+        }
+
+        let start_time = std::time::Instant::now();
+        let mut cumulative_bytes: u64 = 0;
+        // Account for already-downloaded shards
+        for (_, dest) in files {
+            let partial = partial_path_for(dest);
+            if dest.exists() {
+                if let Ok(meta) = tokio::fs::metadata(dest).await {
+                    cumulative_bytes += meta.len();
+                }
+            } else if partial.exists() {
+                if let Ok(meta) = tokio::fs::metadata(&partial).await {
+                    cumulative_bytes += meta.len();
+                }
+            }
+        }
+        let bytes_at_start = cumulative_bytes;
+
+        for (url, destination) in files {
+            if Self::is_cancelled(downloads, model_id) {
+                anyhow::bail!("Download cancelled");
+            }
+
+            // Skip already-completed shards
+            if destination.exists() {
+                continue;
+            }
+
+            Self::download_one_file(
+                &client,
+                url,
+                destination,
+                downloads,
+                model_id,
+                &mut cumulative_bytes,
+                start_time,
+                bytes_at_start,
+                bearer_token,
+            )
+            .await?;
+        }
+
+        Ok(())
+    }
+
+    #[allow(clippy::too_many_arguments)]
+    async fn download_one_file(
+        client: &reqwest::Client,
+        url: &str,
+        destination: &Path,
+        downloads: &DownloadMap,
+        model_id: &str,
+        cumulative_bytes: &mut u64,
+        start_time: std::time::Instant,
+        bytes_at_start: u64,
+        bearer_token: Option<&str>,
+    ) -> Result<(), anyhow::Error> {
+        let partial_path = partial_path_for(destination);
+        let mut retries = 0u32;
+
+        let mut file_bytes: u64 = if partial_path.exists() {
+            tokio::fs::metadata(&partial_path).await?.len()
+        } else {
+            0
+        };
+
+        // Get this file's total size
+        let mut file_total: u64 = Self::apply_bearer_token(client.head(url), bearer_token)
+            .send()
+            .await
+            .ok()
+            .and_then(|r| r.content_length())
+            .unwrap_or(0);
+
+        // If partial matches expected size exactly, promote it
+        if file_total > 0 && file_bytes == file_total {
+            tokio::fs::rename(&partial_path, destination).await?;
+            // cumulative_bytes already accounts for this file from the pre-scan
+            return Ok(());
+        }
+
+        // If partial is oversized or remote changed, discard and re-download
+        if file_total > 0 && file_bytes > file_total {
+            info!(model_id = %model_id, file_bytes, file_total, "Partial file oversized, re-downloading");
+            *cumulative_bytes = cumulative_bytes.saturating_sub(file_bytes);
+            file_bytes = 0;
+            let _ = tokio::fs::remove_file(&partial_path).await;
+        }
+
+        loop {
+            if Self::is_cancelled(downloads, model_id) {
+                let _ = tokio::fs::remove_file(&partial_path).await;
+                anyhow::bail!("Download cancelled");
+            }
+
+            let mut request = Self::apply_bearer_token(client.get(url), bearer_token);
+            if file_bytes > 0 {
+                request = request.header("Range", format!("bytes={}-", file_bytes));
+            }
+
+            let response = match request.send().await {
+                Ok(r) => r,
+                Err(e) => {
+                    if retries >= Self::MAX_RETRIES {
+                        anyhow::bail!("Download failed after {} retries: {}", retries, e);
+                    }
+                    retries += 1;
+                    let delay = std::cmp::min(
+                        Self::RETRY_BASE_DELAY * 2u32.saturating_pow(retries - 1),
+                        Self::RETRY_MAX_DELAY,
+                    );
+                    info!(model_id = %model_id, retry = retries, delay_secs = ?delay.as_secs(), error = %e, "Retrying download after connection error");
+                    Self::cancellable_sleep(delay, downloads, model_id).await?;
+                    continue;
+                }
+            };
+
+            let status = response.status();
+            if status == reqwest::StatusCode::RANGE_NOT_SATISFIABLE {
+                if file_total > 0 && file_bytes == file_total {
+                    break;
+                }
+                *cumulative_bytes = cumulative_bytes.saturating_sub(file_bytes);
+                file_bytes = 0;
+                let _ = tokio::fs::remove_file(&partial_path).await;
+                continue;
+            }
+
+            if !status.is_success() && status != reqwest::StatusCode::PARTIAL_CONTENT {
+                let is_transient = status.is_server_error()
+                    || status == reqwest::StatusCode::REQUEST_TIMEOUT
+                    || status == reqwest::StatusCode::TOO_MANY_REQUESTS;
+
+                if !is_transient || retries >= Self::MAX_RETRIES {
+                    anyhow::bail!("Failed to download: HTTP {}", status);
+                }
+                retries += 1;
+                let delay = std::cmp::min(
+                    Self::RETRY_BASE_DELAY * 2u32.saturating_pow(retries - 1),
+                    Self::RETRY_MAX_DELAY,
+                );
+                info!(model_id = %model_id, retry = retries, http_status = %status, "Retrying download after transient HTTP error");
+                Self::cancellable_sleep(delay, downloads, model_id).await?;
+                continue;
+            }
+
+            if file_bytes > 0 && status == reqwest::StatusCode::OK {
+                info!(model_id = %model_id, "Server ignored Range header, restarting file from scratch");
+                // Subtract already-counted partial bytes from cumulative
+                *cumulative_bytes = cumulative_bytes.saturating_sub(file_bytes);
+                file_bytes = 0;
+                let _ = tokio::fs::remove_file(&partial_path).await;
+            }
+
+            // If HEAD didn't return this file's size, learn it from the GET response.
+            // This block only fires once per file (file_total stays non-zero after),
+            // so retries don't double-count. Since download_files_sequentially's HEAD
+            // pass contributed 0 for this file, we add the discovered size to the
+            // shared total so progress/ETA are accurate.
+            if file_total == 0 {
+                let new_file_total = if file_bytes > 0 {
+                    response
+                        .headers()
+                        .get("content-range")
+                        .and_then(|v| v.to_str().ok())
+                        .and_then(|s| s.rsplit('/').next())
+                        .and_then(|s| s.parse::<u64>().ok())
+                } else {
+                    response.content_length()
+                };
+                if let Some(t) = new_file_total {
+                    file_total = t;
+                    if let Ok(mut dl) = downloads.lock() {
+                        if let Some(progress) = dl.get_mut(model_id) {
+                            progress.total_bytes = progress.total_bytes.saturating_add(t);
+                        }
+                    }
+                }
+            }
+
+            let mut file = tokio::fs::OpenOptions::new()
+                .create(true)
+                .append(true)
+                .open(&partial_path)
+                .await?;
+
+            let file_len = tokio::fs::metadata(&partial_path).await?.len();
+            if file_len != file_bytes {
+                file.set_len(file_bytes).await?;
+            }
+
+            let mut stream_error = false;
+            let mut resp = response;
+
+            loop {
+                let chunk_result = resp.chunk().await;
+                match chunk_result {
+                    Ok(Some(chunk)) => {
+                        if Self::is_cancelled(downloads, model_id) {
+                            let _ = tokio::fs::remove_file(&partial_path).await;
+                            anyhow::bail!("Download cancelled");
+                        }
+
+                        file.write_all(&chunk).await?;
+                        let chunk_len = chunk.len() as u64;
+                        file_bytes += chunk_len;
+                        *cumulative_bytes += chunk_len;
+
+                        let elapsed = start_time.elapsed().as_secs_f64();
+                        let bytes_this_session = cumulative_bytes.saturating_sub(bytes_at_start);
+                        let speed_bps = if elapsed > 0.0 {
+                            Some((bytes_this_session as f64 / elapsed) as u64)
+                        } else {
+                            None
+                        };
+
+                        let current_total = if let Ok(dl) = downloads.lock() {
+                            dl.get(model_id).map(|p| p.total_bytes).unwrap_or(0)
+                        } else {
+                            0
+                        };
+
+                        let eta_seconds = if let Some(speed) = speed_bps {
+                            if speed > 0 && current_total > 0 {
+                                Some(current_total.saturating_sub(*cumulative_bytes) / speed)
+                            } else {
+                                None
+                            }
+                        } else {
+                            None
+                        };
+
+                        if let Ok(mut dl) = downloads.lock() {
+                            if let Some(progress) = dl.get_mut(model_id) {
+                                progress.bytes_downloaded = *cumulative_bytes;
+                                progress.progress_percent = if current_total > 0 {
+                                    (*cumulative_bytes as f64 / current_total as f64 * 100.0) as f32
+                                } else {
+                                    0.0
+                                };
+                                progress.speed_bps = speed_bps;
+                                progress.eta_seconds = eta_seconds;
+                            }
+                        }
+                    }
+                    Ok(None) => break,
+                    Err(e) => {
+                        info!(model_id = %model_id, bytes = *cumulative_bytes, error = %e, "Download stream interrupted, will retry");
+                        stream_error = true;
+                        break;
+                    }
+                }
+            }
+
+            file.flush().await?;
+            drop(file);
+
+            if stream_error {
+                if retries >= Self::MAX_RETRIES {
+                    anyhow::bail!(
+                        "Download failed after {} retries due to stream interruption",
+                        retries
+                    );
+                }
+                retries += 1;
+                let delay = std::cmp::min(
+                    Self::RETRY_BASE_DELAY * 2u32.saturating_pow(retries - 1),
+                    Self::RETRY_MAX_DELAY,
+                );
+                info!(model_id = %model_id, retry = retries, delay_secs = ?delay.as_secs(), "Retrying download with resume");
+                Self::cancellable_sleep(delay, downloads, model_id).await?;
+                continue;
+            }
+
+            break;
+        }
+
+        tokio::fs::rename(&partial_path, destination).await?;
+        Ok(())
+    }
+
+    pub fn clear_completed(&self, model_id: &str) {
+        if let Ok(mut downloads) = self.downloads.lock() {
+            if let Some(progress) = downloads.get(model_id) {
+                let is_terminal = progress.status == DownloadStatus::Completed
+                    || progress.status == DownloadStatus::Failed
+                    || progress.status == DownloadStatus::Cancelled;
+                if is_terminal && progress.task_exited {
+                    downloads.remove(model_id);
+                }
+            }
+        }
+    }
+
+    fn apply_bearer_token(
+        request: reqwest::RequestBuilder,
+        bearer_token: Option<&str>,
+    ) -> reqwest::RequestBuilder {
+        if let Some(token) = bearer_token.filter(|token| !token.is_empty()) {
+            request.header("Authorization", format!("Bearer {}", token))
+        } else {
+            request
+        }
+    }
+}
+
+static DOWNLOAD_MANAGER: once_cell::sync::Lazy<DownloadManager> =
+    once_cell::sync::Lazy::new(DownloadManager::new);
+
+pub fn get_download_manager() -> &'static DownloadManager {
+    &DOWNLOAD_MANAGER
+}

crates/goose-local-inference/Cargo.toml

@@ -0,0 +1,54 @@
+[package]
+name = "goose-local-inference"
+version = "0.1.0-alpha.0"
+edition.workspace = true
+rust-version.workspace = true
+authors.workspace = true
+license.workspace = true
+repository.workspace = true
+description.workspace = true
+
+[lints]
+workspace = true
+
+[features]
+default = []
+cuda = ["llama-cpp-2/cuda"]
+vulkan = ["llama-cpp-2/vulkan"]
+mlx = ["dep:safemlx", "dep:safemlx-lm", "dep:safemlx-lm-utils"]
+
+[dependencies]
+anyhow = { workspace = true }
+async-stream = { workspace = true }
+async-trait = { workspace = true }
+base64 = { workspace = true }
+chrono = { workspace = true }
+etcetera = { workspace = true }
+encoding_rs = { version = "0.8.35", default-features = false }
+fs2 = { workspace = true }
+futures = { workspace = true }
+goose-download-manager = { version = "0.1.0-alpha.0", path = "../goose-download-manager" }
+goose-provider-types = { version = "0.1.0-alpha.0", path = "../goose-provider-types", default-features = false }
+goose-sdk-types = { version = "0.1.0-alpha.0", path = "../goose-sdk-types", default-features = false }
+hf-hub = { version = "1.0.0-rc.1", default-features = false }
+include_dir = { workspace = true }
+llama-cpp-2 = { workspace = true }
+llama-cpp-sys-2 = { workspace = true }
+minijinja = { version = "2.18", default-features = false, features = ["loader", "multi_template", "serde"] }
+reqwest = { workspace = true, features = ["json", "stream"] }
+regex = { workspace = true }
+rmcp = { workspace = true }
+serde = { workspace = true }
+serde_json = { workspace = true }
+tokio = { workspace = true, features = ["fs", "rt-multi-thread", "sync", "time"] }
+tracing = { workspace = true }
+utoipa = { workspace = true, features = ["chrono"] }
+uuid = { workspace = true, features = ["v4", "std"] }
+tempfile = { workspace = true }
+
+safemlx = { default-features = false, features = ["accelerate", "metal", "safetensors"], optional = true, version = "0.1.2" }
+safemlx-lm = { optional = true, version = "0.1.5" }
+safemlx-lm-utils = { optional = true, version = "0.1.2" }
+
+[target.'cfg(target_os = "macos")'.dependencies]
+llama-cpp-2 = { workspace = true, features = ["sampler", "metal", "mtmd"] }

crates/goose-local-inference/src/backend.rs

@@ -1,10 +1,10 @@
 use rmcp::model::Tool;
 use std::any::Any;
 
-use crate::conversation::message::Message;
-use crate::providers::local_inference::local_model_registry::ModelSettings;
-use goose_providers::errors::ProviderError;
-use goose_providers::request_log::RequestLogHandle;
+use crate::local_model_registry::ModelSettings;
+use goose_provider_types::conversation::message::Message;
+use goose_provider_types::errors::ProviderError;
+use goose_provider_types::request_log::RequestLogHandle;
 
 use super::{ResolvedModelPaths, StreamSender};
 
@@ -22,6 +22,7 @@ pub(super) struct LocalGenerationRequest<'a> {
     pub temperature: Option<f32>,
     pub max_tokens: Option<i32>,
     pub context_limit: usize,
+    pub model_load_ms: Option<u64>,
     pub resolved_model: &'a ResolvedModelPaths,
     pub draft_model_path: Option<std::path::PathBuf>,
     pub message_id: &'a str,

crates/goose-local-inference/src/config_resolver.rs

@@ -0,0 +1,30 @@
+use anyhow::Result;
+use std::sync::OnceLock;
+
+pub type StringParamResolver = fn(&'static str) -> Result<Option<String>>;
+pub type BoolParamResolver = fn(&'static str) -> Result<Option<bool>>;
+
+static STRING_PARAM_RESOLVER: OnceLock<StringParamResolver> = OnceLock::new();
+static BOOL_PARAM_RESOLVER: OnceLock<BoolParamResolver> = OnceLock::new();
+
+pub fn set_string_param_resolver(resolve_param: StringParamResolver) {
+    let _ = STRING_PARAM_RESOLVER.set(resolve_param);
+}
+
+pub fn set_bool_param_resolver(resolve_param: BoolParamResolver) {
+    let _ = BOOL_PARAM_RESOLVER.set(resolve_param);
+}
+
+pub fn string_param(key: &'static str) -> Result<Option<String>> {
+    match STRING_PARAM_RESOLVER.get() {
+        Some(resolve_param) => resolve_param(key),
+        None => Ok(None),
+    }
+}
+
+pub fn bool_param(key: &'static str) -> Result<Option<bool>> {
+    match BOOL_PARAM_RESOLVER.get() {
+        Some(resolve_param) => resolve_param(key),
+        None => Ok(None),
+    }
+}

crates/goose-local-inference/src/hf_models.rs

@@ -8,7 +8,7 @@ use super::local_model_registry::{get_registry, model_id_from_repo, LocalModelSt
 use serde::{Deserialize, Serialize};
 use std::sync::{Arc, Mutex};
 
-use crate::providers::huggingface_auth;
+use crate::huggingface_auth;
 
 use utoipa::ToSchema;
 
@@ -1085,20 +1085,13 @@ mod tests {
     }
 
     #[test]
-    fn mlx_compatible_repo_accepts_supported_tokenizer_formats() {
+    fn mlx_compatible_repo_accepts_tokenizer_json() {
         let config = Some(serde_json::json!({ "model_type": "llama" }));
 
-        for tokenizer_files in [
-            vec!["tokenizer.json"],
-            vec!["tokenizer.model"],
-            vec!["tokenizer.tiktoken"],
-            vec!["vocab.json", "merges.txt"],
-        ] {
-            assert!(
-                is_mlx_compatible_repo(&config, &mlx_siblings(&tokenizer_files)),
-                "{tokenizer_files:?}"
-            );
-        }
+        assert!(is_mlx_compatible_repo(
+            &config,
+            &mlx_siblings(&["tokenizer.json"])
+        ));
     }
 
     #[test]
@@ -1107,8 +1100,11 @@ mod tests {
 
         for tokenizer_files in [
             vec!["tokenizer_config.json"],
+            vec!["tokenizer.model"],
+            vec!["tokenizer.tiktoken"],
             vec!["vocab.json"],
             vec!["merges.txt"],
+            vec!["vocab.json", "merges.txt"],
         ] {
             assert!(
                 !is_mlx_compatible_repo(&config, &mlx_siblings(&tokenizer_files)),
@@ -1117,6 +1113,75 @@ mod tests {
         }
     }
 
+    #[test]
+    fn mlx_download_filenames_include_fp8_snapshot_metadata() {
+        let siblings = [
+            "config.json",
+            "configuration.json",
+            "generation_config.json",
+            "model.safetensors.index.json",
+            "layers-0.safetensors",
+            "outside.safetensors",
+            "tokenizer.json",
+            "tokenizer_config.json",
+            "chat_template.jinja",
+            "preprocessor_config.json",
+            "video_preprocessor_config.json",
+            "README.md",
+        ]
+        .into_iter()
+        .map(sibling)
+        .collect::<Vec<_>>();
+
+        let filenames = mlx_download_filenames(&siblings)
+            .into_iter()
+            .collect::<std::collections::HashSet<_>>();
+
+        for filename in [
+            "configuration.json",
+            "chat_template.jinja",
+            "preprocessor_config.json",
+            "video_preprocessor_config.json",
+        ] {
+            assert!(filenames.contains(filename), "{filename}");
+        }
+        assert!(!filenames.contains("README.md"));
+    }
+
+    #[test]
+    fn mlx_download_size_uses_safetensors_metadata_when_sibling_sizes_are_missing() {
+        let info: ModelInfo = serde_json::from_value(serde_json::json!({
+            "id": "owner/repo",
+            "safetensors": {
+                "parameters": {
+                    "BF16": 10,
+                    "F8_E4M3": 20
+                },
+                "total": 30
+            }
+        }))
+        .unwrap();
+        let siblings = vec![
+            RepoSibling {
+                rfilename: "config.json".to_string(),
+                size: None,
+                lfs: None,
+            },
+            RepoSibling {
+                rfilename: "model.safetensors".to_string(),
+                size: None,
+                lfs: None,
+            },
+        ];
+
+        assert_eq!(mlx_download_size_bytes(&info, &siblings), 40);
+    }
+
+    #[test]
+    fn mlx_variant_id_detects_fp8_repo_name() {
+        assert_eq!(mlx_variant_id("Qwen/Qwen3.6-35B-A3B-FP8", &None), "fp8");
+    }
+
     fn test_model(repo_id: &str) -> HfModelInfo {
         HfModelInfo {
             repo_id: repo_id.to_string(),
@@ -1157,6 +1222,13 @@ mod tests {
         assert_eq!(results[0].repo_id, "gguf/repo");
     }
 
+    #[test]
+    fn best_download_count_ignores_zero_primary() {
+        assert_eq!(best_download_count(Some(0), Some(42)), Some(42));
+        assert_eq!(best_download_count(Some(7), Some(42)), Some(7));
+        assert_eq!(best_download_count(Some(0), Some(0)), None);
+    }
+
     #[test]
     fn test_recommend_variant() {
         let variants = vec![
@@ -1468,7 +1540,13 @@ async fn search_mlx_models_with_query(query: &str, limit: usize) -> Result<Vec<H
         if results.len() >= limit {
             break;
         }
-        if let Some(model) = get_local_model_info_for_repo_with_client(&client, &info.id).await? {
+        if let Some(model) = get_local_model_info_for_repo_with_client_and_downloads(
+            &client,
+            &info.id,
+            info.downloads,
+        )
+        .await?
+        {
             results.push(model);
         }
     }
@@ -1484,6 +1562,14 @@ async fn get_local_model_info_for_repo(repo_id: &str) -> Result<Option<HfModelIn
 async fn get_local_model_info_for_repo_with_client(
     client: &HFClient,
     repo_id: &str,
+) -> Result<Option<HfModelInfo>> {
+    get_local_model_info_for_repo_with_client_and_downloads(client, repo_id, None).await
+}
+
+async fn get_local_model_info_for_repo_with_client_and_downloads(
+    client: &HFClient,
+    repo_id: &str,
+    downloads_hint: Option<u64>,
 ) -> Result<Option<HfModelInfo>> {
     let repo = model_repo(client, repo_id)?;
     let info = repo
@@ -1495,7 +1581,7 @@ async fn get_local_model_info_for_repo_with_client(
         ])
         .send()
         .await?;
-    model_info_to_local_model_info(info).await
+    model_info_to_local_model_info(&repo, info, downloads_hint).await
 }
 
 async fn get_exact_name_local_model_info(model_name: &str) -> Result<Option<HfModelInfo>> {
@@ -1508,7 +1594,11 @@ async fn get_exact_name_local_model_info(model_name: &str) -> Result<Option<HfMo
     Ok(None)
 }
 
-async fn model_info_to_local_model_info(info: ModelInfo) -> Result<Option<HfModelInfo>> {
+async fn model_info_to_local_model_info(
+    repo: &HFRepository<RepoTypeModel>,
+    info: ModelInfo,
+    downloads_hint: Option<u64>,
+) -> Result<Option<HfModelInfo>> {
     let repo_id = info.id.clone();
     let mut variants: Vec<HfModelVariant> = get_repo_gguf_variants(&repo_id)
         .await
@@ -1516,7 +1606,13 @@ async fn model_info_to_local_model_info(info: ModelInfo) -> Result<Option<HfMode
         .iter()
         .map(|variant| variant.to_model_variant(&repo_id))
         .collect();
-    variants.extend(mlx_variants_from_model_info(&repo_id, &info));
+    if is_mlx_compatible_model_info(&info) {
+        let mlx_config = load_repo_config_json(repo).await.unwrap_or_else(|error| {
+            tracing::debug!(repo_id, %error, "Failed to load MLX config.json; falling back to API config");
+            info.config.clone()
+        });
+        variants.extend(mlx_variants_from_model_info(&repo_id, &info, &mlx_config));
+    }
 
     if variants.is_empty() {
         return Ok(None);
@@ -1530,17 +1626,49 @@ async fn model_info_to_local_model_info(info: ModelInfo) -> Result<Option<HfMode
         .next_back()
         .unwrap_or(&repo_id)
         .to_string();
+    let downloads = match best_download_count(info.downloads, downloads_hint) {
+        Some(downloads) => downloads,
+        None => get_repo_downloads(&repo_id).await?.unwrap_or(0),
+    };
 
     Ok(Some(HfModelInfo {
         repo_id,
         author,
         model_name,
-        downloads: info.downloads.unwrap_or(0),
+        downloads,
         gguf_files: Vec::new(),
         variants,
     }))
 }
 
+fn best_download_count(primary: Option<u64>, hint: Option<u64>) -> Option<u64> {
+    primary
+        .filter(|downloads| *downloads > 0)
+        .or_else(|| hint.filter(|downloads| *downloads > 0))
+}
+
+async fn get_repo_downloads(repo_id: &str) -> Result<Option<u64>> {
+    let client = reqwest::Client::new();
+    let token = optional_hf_token(huggingface_auth::resolve_token_async()).await;
+    let url = format!("{}/{}", HF_API_BASE, repo_id);
+
+    let response = apply_hf_auth(client.get(&url), token.as_deref())
+        .header("User-Agent", "goose-ai-agent")
+        .send()
+        .await?;
+
+    if !response.status().is_success() {
+        bail!(
+            "HuggingFace API returned status {} for repo {}",
+            response.status(),
+            repo_id
+        );
+    }
+
+    let model: HfApiModel = response.json().await?;
+    Ok(model.downloads)
+}
+
 pub async fn get_repo_local_variants(repo_id: &str) -> Result<Vec<HfModelVariant>> {
     let mut variants: Vec<HfModelVariant> = get_repo_gguf_variants(repo_id)
         .await
@@ -1570,25 +1698,39 @@ pub async fn get_repo_mlx_variants(repo_id: &str) -> Result<Vec<HfModelVariant>>
         ])
         .send()
         .await?;
-    Ok(mlx_variants_from_model_info(repo_id, &info))
+    if !is_mlx_compatible_model_info(&info) {
+        return Ok(Vec::new());
+    }
+    let mlx_config = load_repo_config_json(&repo)
+        .await
+        .unwrap_or_else(|_| info.config.clone());
+    Ok(mlx_variants_from_model_info(repo_id, &info, &mlx_config))
 }
 
-fn mlx_variants_from_model_info(repo_id: &str, info: &ModelInfo) -> Vec<HfModelVariant> {
+async fn load_repo_config_json(
+    repo: &HFRepository<RepoTypeModel>,
+) -> Result<Option<serde_json::Value>> {
+    let config_path = repo
+        .download_file()
+        .filename("config.json".to_string())
+        .send()
+        .await?;
+    let config_json = tokio::fs::read_to_string(config_path).await?;
+    Ok(Some(serde_json::from_str(&config_json)?))
+}
+
+fn mlx_variants_from_model_info(
+    repo_id: &str,
+    info: &ModelInfo,
+    mlx_config: &Option<serde_json::Value>,
+) -> Vec<HfModelVariant> {
     let siblings = info.siblings.as_deref().unwrap_or(&[]);
 
     if !is_mlx_compatible_repo(&info.config, siblings) {
         return Vec::new();
     }
 
-    let size_bytes = mlx_download_filenames(siblings)
-        .into_iter()
-        .filter_map(|filename| {
-            siblings
-                .iter()
-                .find(|s| s.rfilename == filename)
-                .and_then(|s| s.size)
-        })
-        .sum();
+    let size_bytes = mlx_download_size_bytes(info, siblings);
     let variant_id = mlx_variant_id(repo_id, &info.config);
 
     vec![HfModelVariant {
@@ -1601,20 +1743,24 @@ fn mlx_variants_from_model_info(repo_id: &str, info: &ModelInfo) -> Vec<HfModelV
         size_bytes,
         filename: None,
         download_url: None,
-        description: mlx_variant_description(&info.config),
+        description: mlx_variant_description(mlx_config),
         quality_rank: 91,
         sharded: siblings
             .iter()
             .filter(|s| s.rfilename.ends_with(".safetensors"))
             .count()
             > 1,
-        supported: is_mlx_runtime_supported(&info.config)
+        supported: is_mlx_runtime_supported(mlx_config)
             && cfg!(target_os = "macos")
             && cfg!(feature = "mlx"),
-        unsupported_reason: mlx_unsupported_reason(&info.config),
+        unsupported_reason: mlx_unsupported_reason(mlx_config),
     }]
 }
 
+fn is_mlx_compatible_model_info(info: &ModelInfo) -> bool {
+    is_mlx_compatible_repo(&info.config, info.siblings.as_deref().unwrap_or_default())
+}
+
 fn is_mlx_compatible_repo(config: &Option<serde_json::Value>, siblings: &[RepoSibling]) -> bool {
     let has_config = siblings.iter().any(|s| s.rfilename == "config.json");
     let has_tokenizer = has_mlx_tokenizer(siblings);
@@ -1625,16 +1771,50 @@ fn is_mlx_compatible_repo(config: &Option<serde_json::Value>, siblings: &[RepoSi
     has_config && has_tokenizer && has_safetensors && mlx_model_type(config).is_some()
 }
 
+fn mlx_download_size_bytes(info: &ModelInfo, siblings: &[RepoSibling]) -> u64 {
+    let sibling_size: u64 = mlx_download_filenames(siblings)
+        .into_iter()
+        .filter_map(|filename| {
+            siblings
+                .iter()
+                .find(|s| s.rfilename == filename)
+                .and_then(|s| s.size)
+        })
+        .sum();
+    sibling_size.max(estimated_safetensors_size_bytes(info))
+}
+
+fn estimated_safetensors_size_bytes(info: &ModelInfo) -> u64 {
+    info.safetensors
+        .as_ref()
+        .map(|safetensors| {
+            safetensors
+                .parameters
+                .iter()
+                .map(|(dtype, count)| count.saturating_mul(dtype_size_bytes(dtype)))
+                .sum()
+        })
+        .unwrap_or(0)
+}
+
+fn dtype_size_bytes(dtype: &str) -> u64 {
+    match dtype.to_ascii_uppercase().as_str() {
+        "BOOL" | "I8" | "U8" | "F8_E4M3" | "F8_E4M3FN" | "F8_E5M2" | "F8_E5M2FNUZ" => 1,
+        "BF16" | "F16" | "I16" | "U16" => 2,
+        "F32" | "I32" | "U32" => 4,
+        "F64" | "I64" | "U64" => 8,
+        _ => 0,
+    }
+}
+
 fn has_mlx_tokenizer(siblings: &[RepoSibling]) -> bool {
-    let has_file = |filename: &str| siblings.iter().any(|s| s.rfilename == filename);
     siblings
         .iter()
         .any(|s| is_standalone_mlx_tokenizer_file(&s.rfilename))
-        || (has_file("vocab.json") && has_file("merges.txt"))
 }
 
 fn is_standalone_mlx_tokenizer_file(filename: &str) -> bool {
-    filename == "tokenizer.json" || filename.ends_with(".model") || filename.ends_with(".tiktoken")
+    filename == "tokenizer.json"
 }
 
 fn mlx_model_type(config: &Option<serde_json::Value>) -> Option<&str> {
@@ -1644,22 +1824,8 @@ fn mlx_model_type(config: &Option<serde_json::Value>) -> Option<&str> {
         .and_then(|value| value.as_str())
 }
 
-fn is_mlx_runtime_supported_model_type(model_type: &str) -> bool {
-    matches!(model_type, "gemma4" | "gemma4_text" | "llama" | "qwen3")
-}
-
-fn is_mlx_moe_model(config: &Option<serde_json::Value>) -> bool {
-    config
-        .as_ref()
-        .and_then(|config| config.get("text_config"))
-        .and_then(|text_config| text_config.get("enable_moe_block"))
-        .and_then(|value| value.as_bool())
-        .unwrap_or(false)
-}
-
 fn is_mlx_runtime_supported(config: &Option<serde_json::Value>) -> bool {
-    mlx_model_type(config).is_some_and(is_mlx_runtime_supported_model_type)
-        && !is_mlx_moe_model(config)
+    mlx_config_support(config).is_none()
 }
 
 fn mlx_unsupported_reason(config: &Option<serde_json::Value>) -> Option<String> {
@@ -1670,16 +1836,23 @@ fn mlx_unsupported_reason(config: &Option<serde_json::Value>) -> Option<String>
         return Some("MLX support was not compiled in".to_string());
     }
 
-    let model_type = mlx_model_type(config)?;
-    if !is_mlx_runtime_supported_model_type(model_type) {
-        return Some(format!(
-            "MLX backend does not support '{}' models yet",
-            model_type
-        ));
-    }
-    if is_mlx_moe_model(config) {
-        return Some("MLX backend does not support Gemma 4 MoE models yet".to_string());
-    }
+    mlx_config_support(config)
+}
+
+fn mlx_config_support(config: &Option<serde_json::Value>) -> Option<String> {
+    let config = config.as_ref()?;
+    mlx_config_support_for_value(config)
+}
+
+#[cfg(feature = "mlx")]
+fn mlx_config_support_for_value(config: &serde_json::Value) -> Option<String> {
+    safemlx_lm::check_model_config(config)
+        .unsupported_reason()
+        .map(str::to_string)
+}
+
+#[cfg(not(feature = "mlx"))]
+fn mlx_config_support_for_value(_config: &serde_json::Value) -> Option<String> {
     None
 }
 
@@ -1771,6 +1944,10 @@ fn should_download_for_mlx(filename: &str) -> bool {
         || is_standalone_mlx_tokenizer_file(filename)
         || filename == "tokenizer_config.json"
         || filename == "generation_config.json"
+        || filename == "configuration.json"
+        || filename == "chat_template.jinja"
+        || filename == "preprocessor_config.json"
+        || filename == "video_preprocessor_config.json"
         || filename == "special_tokens_map.json"
         || filename == "model.safetensors.index.json"
         || filename == "vocab.json"
@@ -1780,7 +1957,7 @@ fn should_download_for_mlx(filename: &str) -> bool {
 
 fn mlx_variant_id(repo_id: &str, config: &Option<serde_json::Value>) -> String {
     let repo_lower = repo_id.to_lowercase();
-    for marker in ["bf16", "f16", "fp16", "f32", "fp32", "4bit", "8bit"] {
+    for marker in ["bf16", "f16", "fp16", "f32", "fp32", "fp8", "4bit", "8bit"] {
         if repo_lower.contains(marker) {
             return marker.to_string();
         }
@@ -1954,20 +2131,12 @@ async fn resolve_mlx_model(repo_id: &str, variant_id: &str) -> Result<ResolvedLo
     let repo = client.model(owner.to_string(), name.to_string());
     let info = repo
         .info()
-        .expand(vec!["siblings".to_string()])
+        .expand(vec!["siblings".to_string(), "safetensors".to_string()])
         .send()
         .await?;
     let siblings = info.siblings.as_deref().unwrap_or(&[]);
     let filenames = mlx_download_filenames(siblings);
-    let total_size = filenames
-        .iter()
-        .filter_map(|filename| {
-            siblings
-                .iter()
-                .find(|s| s.rfilename == *filename)
-                .and_then(|s| s.size)
-        })
-        .sum();
+    let total_size = mlx_download_size_bytes(&info, siblings);
     let progress = HfDownloadProgress::new(repo_id.to_string(), total_size);
     progress.init();
     let mut snapshot_path = None;
@@ -2103,8 +2272,13 @@ impl HfDownloadProgress {
     }
 
     fn finish_file(&self, size_bytes: u64) {
+        let observed_size = self
+            .state
+            .lock()
+            .map(|state| state.current_file_total_bytes.max(state.bytes_downloaded))
+            .unwrap_or(0);
         if let Ok(mut completed_bytes) = self.completed_bytes.lock() {
-            *completed_bytes = completed_bytes.saturating_add(size_bytes);
+            *completed_bytes = completed_bytes.saturating_add(size_bytes.max(observed_size));
         }
         if let Ok(mut state) = self.state.lock() {
             state.bytes_downloaded = 0;
@@ -2117,10 +2291,15 @@ impl HfDownloadProgress {
         let completed_bytes = self.completed_bytes.lock().map(|value| *value).unwrap_or(0);
         if let Ok(state) = self.state.lock() {
             let bytes_downloaded = completed_bytes.saturating_add(state.bytes_downloaded);
+            let total_bytes =
+                self.total_bytes
+                    .max(completed_bytes.saturating_add(
+                        state.current_file_total_bytes.max(state.bytes_downloaded),
+                    ));
             update_download_manager_progress(
                 &self.model_id,
-                bytes_downloaded.min(self.total_bytes),
-                self.total_bytes.max(state.current_file_total_bytes),
+                bytes_downloaded.min(total_bytes),
+                total_bytes,
                 state.speed_bps,
             );
         }
@@ -2152,10 +2331,12 @@ impl ProgressHandler for HfDownloadProgress {
                             file.bytes_completed
                         }
                     })
-                    .max()
-                    .unwrap_or(0);
+                    .sum();
+                let total_bytes = files.iter().map(|file| file.total_bytes).sum();
                 if let Ok(mut state) = self.state.lock() {
                     state.bytes_downloaded = state.bytes_downloaded.max(bytes_downloaded);
+                    state.current_file_total_bytes =
+                        state.current_file_total_bytes.max(total_bytes);
                 }
                 self.update_progress_from_state();
             }
@@ -2168,7 +2349,7 @@ impl ProgressHandler for HfDownloadProgress {
                     return;
                 }
                 if let Ok(mut state) = self.state.lock() {
-                    state.bytes_downloaded = *bytes_completed;
+                    state.bytes_downloaded = state.bytes_downloaded.max(*bytes_completed);
                     state.current_file_total_bytes =
                         (*total_bytes).max(state.current_file_total_bytes);
                     state.speed_bps = bytes_per_sec.map(|speed| speed as u64);

crates/goose-local-inference/src/huggingface_auth.rs

@@ -0,0 +1,64 @@
+use crate::{config_resolver, paths::Paths};
+use anyhow::Result;
+use chrono::{DateTime, Utc};
+use futures::future::BoxFuture;
+use serde::{Deserialize, Serialize};
+use std::path::{Path, PathBuf};
+use std::sync::OnceLock;
+
+pub const HUGGINGFACE_TOKEN_SECRET_KEY: &str = "HF_TOKEN";
+pub const HUGGINGFACE_OAUTH_CACHE_PATH: &str = "huggingface/oauth/tokens.json";
+
+pub type TokenResolver = fn() -> BoxFuture<'static, Result<Option<String>>>;
+
+static TOKEN_RESOLVER: OnceLock<TokenResolver> = OnceLock::new();
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct HuggingFaceTokenData {
+    pub access_token: String,
+    #[serde(default)]
+    pub refresh_token: Option<String>,
+    #[serde(default)]
+    pub expires_at: Option<DateTime<Utc>>,
+}
+
+impl HuggingFaceTokenData {
+    pub fn is_expired(&self) -> bool {
+        self.expires_at
+            .is_some_and(|expires_at| expires_at <= Utc::now())
+    }
+}
+
+pub fn oauth_cache_path() -> PathBuf {
+    Paths::in_config_dir(HUGGINGFACE_OAUTH_CACHE_PATH)
+}
+
+fn load_oauth_token_from_path(path: &Path) -> Option<HuggingFaceTokenData> {
+    let contents = std::fs::read_to_string(path).ok()?;
+    serde_json::from_str(&contents).ok()
+}
+
+pub fn usable_oauth_token() -> Option<String> {
+    let token = load_oauth_token_from_path(&oauth_cache_path())?;
+    (!token.is_expired()).then_some(token.access_token)
+}
+
+pub fn hf_token_secret() -> Result<Option<String>> {
+    Ok(config_resolver::string_param(HUGGINGFACE_TOKEN_SECRET_KEY)?
+        .filter(|token| !token.trim().is_empty()))
+}
+
+pub fn set_token_resolver(resolve_token: TokenResolver) {
+    let _ = TOKEN_RESOLVER.set(resolve_token);
+}
+
+pub async fn resolve_token_async() -> Result<Option<String>> {
+    if let Some(resolve_token) = TOKEN_RESOLVER.get() {
+        return resolve_token().await;
+    }
+
+    if let Some(token) = usable_oauth_token() {
+        return Ok(Some(token));
+    }
+    hf_token_secret()
+}

crates/goose-local-inference/src/lib.rs

@@ -0,0 +1,950 @@
+pub mod config_resolver;
+pub use goose_download_manager as download_manager;
+pub mod huggingface_auth;
+pub mod paths;
+pub mod prompt_template;
+pub mod provider_utils;
+
+mod backend;
+pub mod hf_models;
+mod llamacpp;
+pub mod local_model_registry;
+pub mod management;
+mod mlx;
+pub(crate) mod multimodal;
+#[cfg(feature = "mlx")]
+mod native_tool_parsing;
+pub(crate) mod thinking_output;
+#[cfg(feature = "mlx")]
+mod tool_emulation;
+mod tool_parsing;
+
+use anyhow::Result;
+use async_stream::try_stream;
+use async_trait::async_trait;
+use backend::{BackendLoadedModel, LocalInferenceBackend};
+use goose_provider_types::base::{MessageStream, Provider, ProviderDescriptor, ProviderMetadata};
+use goose_provider_types::conversation::message::{
+    Message, MessageContent, SystemNotificationType,
+};
+use goose_provider_types::conversation::token_usage::{ProviderUsage, Usage};
+use goose_provider_types::errors::ProviderError;
+use goose_provider_types::images::ImageFormat;
+use goose_provider_types::model::ModelConfig;
+use goose_provider_types::request_log::{start_log, LoggerHandleExt, RequestLogHandle};
+use llamacpp::{LlamaCppBackend, LLAMACPP_BACKEND_ID};
+use local_model_registry::ChatTemplate;
+use mlx::{MlxBackend, MLX_BACKEND_ID};
+use rmcp::model::Tool;
+use serde_json::{json, Value};
+use std::collections::{HashMap, HashSet};
+use std::path::PathBuf;
+use std::sync::{Arc, Mutex as StdMutex};
+use tokio::sync::{Mutex, Notify};
+use uuid::Uuid;
+
+type ModelSlotHandle = Arc<ModelSlot>;
+
+struct ModelSlot {
+    state: Mutex<ModelSlotState>,
+    notify: Notify,
+}
+
+enum ModelSlotState {
+    Empty,
+    Loading,
+    Loaded(Box<dyn BackendLoadedModel>),
+}
+
+impl ModelSlot {
+    fn new() -> Self {
+        Self {
+            state: Mutex::new(ModelSlotState::Empty),
+            notify: Notify::new(),
+        }
+    }
+}
+
+#[derive(Clone, Debug, Eq, Hash, PartialEq)]
+struct ModelCacheKey {
+    backend_id: &'static str,
+    model_id: String,
+    chat_template: ChatTemplate,
+}
+
+impl ModelCacheKey {
+    fn new(
+        backend_id: &'static str,
+        model_id: impl Into<String>,
+        chat_template: ChatTemplate,
+    ) -> Self {
+        Self {
+            backend_id,
+            model_id: model_id.into(),
+            chat_template,
+        }
+    }
+}
+
+pub struct InferenceRuntime {
+    models: StdMutex<HashMap<ModelCacheKey, ModelSlotHandle>>,
+    cold_load_lock: Mutex<()>,
+    backends: HashMap<&'static str, Arc<dyn LocalInferenceBackend>>,
+}
+
+pub fn builtin_chat_template_names() -> Vec<String> {
+    llamacpp::builtin_chat_template_names()
+}
+
+static RUNTIME: StdMutex<Option<Arc<InferenceRuntime>>> = StdMutex::new(None);
+
+fn current_runtime() -> Option<Arc<InferenceRuntime>> {
+    RUNTIME.lock().expect("runtime lock poisoned").clone()
+}
+
+impl InferenceRuntime {
+    pub fn get_or_init() -> Result<Arc<Self>> {
+        let mut guard = RUNTIME.lock().expect("runtime lock poisoned");
+        if let Some(runtime) = guard.as_ref() {
+            return Ok(runtime.clone());
+        }
+        let llamacpp_backend: Arc<dyn LocalInferenceBackend> = Arc::new(LlamaCppBackend::new()?);
+        let mlx_backend: Arc<dyn LocalInferenceBackend> = Arc::new(MlxBackend::new());
+        let mut backends = HashMap::new();
+        backends.insert(LLAMACPP_BACKEND_ID, llamacpp_backend);
+        backends.insert(MLX_BACKEND_ID, mlx_backend);
+        let runtime = Arc::new(Self {
+            models: StdMutex::new(HashMap::new()),
+            cold_load_lock: Mutex::new(()),
+            backends,
+        });
+        *guard = Some(runtime.clone());
+        Ok(runtime)
+    }
+
+    fn default_backend(&self) -> &dyn LocalInferenceBackend {
+        self.backends
+            .get(LLAMACPP_BACKEND_ID)
+            .expect("default local inference backend registered")
+            .as_ref()
+    }
+
+    fn backend_for_model(
+        &self,
+        resolved: &ResolvedModelPaths,
+    ) -> Result<Arc<dyn LocalInferenceBackend>, ProviderError> {
+        let backend_id = resolved
+            .backend_id
+            .as_deref()
+            .unwrap_or(LLAMACPP_BACKEND_ID);
+        self.backends.get(backend_id).cloned().ok_or_else(|| {
+            ProviderError::ExecutionError(format!(
+                "Local inference backend '{}' unavailable",
+                backend_id
+            ))
+        })
+    }
+
+    fn get_or_create_model_slot(&self, key: ModelCacheKey) -> ModelSlotHandle {
+        let mut map = self.models.lock().expect("model cache lock poisoned");
+        map.entry(key)
+            .or_insert_with(|| Arc::new(ModelSlot::new()))
+            .clone()
+    }
+
+    fn model_slot(&self, key: &ModelCacheKey) -> Option<ModelSlotHandle> {
+        let map = self.models.lock().expect("model cache lock poisoned");
+        map.get(key).cloned()
+    }
+
+    fn other_model_slots(&self, keep_key: &ModelCacheKey) -> Vec<ModelSlotHandle> {
+        let map = self.models.lock().expect("model cache lock poisoned");
+        map.iter()
+            .filter(|(key, _)| *key != keep_key)
+            .map(|(_, slot)| slot.clone())
+            .collect()
+    }
+}
+
+pub async fn is_model_loaded(model_name: &str) -> Result<bool, ProviderError> {
+    let resolved = match resolve_model_path(model_name) {
+        Some(resolved) => resolved,
+        None => return Ok(false),
+    };
+    let runtime = InferenceRuntime::get_or_init().map_err(|error| {
+        ProviderError::ExecutionError(format!("Failed to initialize local inference: {error}"))
+    })?;
+    let backend = runtime.backend_for_model(&resolved)?;
+    let key = ModelCacheKey::new(
+        backend.id(),
+        model_name.to_string(),
+        resolved.settings.chat_template,
+    );
+    let Some(slot) = runtime.model_slot(&key) else {
+        return Ok(false);
+    };
+
+    let state = slot.state.lock().await;
+    Ok(matches!(*state, ModelSlotState::Loaded(_)))
+}
+
+pub async fn loaded_model_ids() -> Result<HashSet<String>, ProviderError> {
+    let Some(runtime) = current_runtime() else {
+        return Ok(HashSet::new());
+    };
+    let slots = {
+        let map = runtime.models.lock().expect("model cache lock poisoned");
+        map.iter()
+            .map(|(key, slot)| (key.model_id.clone(), slot.clone()))
+            .collect::<Vec<_>>()
+    };
+
+    let mut loaded = HashSet::new();
+    for (model_id, slot) in slots {
+        if let Ok(state) = slot.state.try_lock() {
+            if matches!(*state, ModelSlotState::Loaded(_)) {
+                loaded.insert(model_id);
+            }
+        } else {
+            loaded.insert(model_id);
+        }
+    }
+    Ok(loaded)
+}
+
+pub async fn evict_model(model_name: &str) -> Result<bool, ProviderError> {
+    let Some(runtime) = current_runtime() else {
+        return Ok(false);
+    };
+    let slots = {
+        let map = runtime.models.lock().expect("model cache lock poisoned");
+        map.iter()
+            .filter(|(key, _)| key.model_id == model_name)
+            .map(|(_, slot)| slot.clone())
+            .collect::<Vec<_>>()
+    };
+
+    let mut evicted = false;
+    for slot in slots {
+        let mut state = slot.state.lock().await;
+        if matches!(*state, ModelSlotState::Loaded(_)) {
+            *state = ModelSlotState::Empty;
+            evicted = true;
+            slot.notify.notify_waiters();
+        }
+    }
+    Ok(evicted)
+}
+
+const PROVIDER_NAME: &str = "local";
+const DEFAULT_MODEL: &str = "bartowski/Llama-3.2-1B-Instruct-GGUF:Q4_K_M";
+
+pub const LOCAL_LLM_MODEL_CONFIG_KEY: &str = "LOCAL_LLM_MODEL";
+
+#[derive(Clone)]
+pub(crate) struct ResolvedModelPaths {
+    pub model_path: PathBuf,
+    pub context_limit: usize,
+    pub settings: crate::local_model_registry::ModelSettings,
+    pub mmproj_path: Option<PathBuf>,
+    pub backend_id: Option<String>,
+    pub draft_model_path: Option<PathBuf>,
+}
+
+fn resolve_model_local_path(model_id: &str) -> Option<PathBuf> {
+    use crate::local_model_registry::get_registry;
+
+    get_registry()
+        .lock()
+        .ok()?
+        .get_model(model_id)
+        .map(|entry| entry.local_path.clone())
+}
+
+/// Resolve model path, context limit, settings, and mmproj path for a model ID from the registry.
+fn resolve_model_path(model_id: &str) -> Option<ResolvedModelPaths> {
+    use crate::local_model_registry::{default_settings_for_model, get_registry};
+
+    if let Ok(registry) = get_registry().lock() {
+        if let Some(entry) = registry.get_model(model_id) {
+            let ctx = entry.settings.context_size.unwrap_or(0) as usize;
+            let mut settings = entry.settings.clone();
+            let defaults = default_settings_for_model(model_id);
+            settings.vision_capable = defaults.vision_capable;
+            settings.mmproj_size_bytes = entry.mmproj_size_bytes;
+            let mmproj_path = entry.mmproj_path.as_ref().filter(|p| p.exists()).cloned();
+            let backend_id = entry
+                .backend_id
+                .clone()
+                .or_else(|| settings.backend_id.clone());
+            let draft_model = settings
+                .draft_model
+                .clone()
+                .or_else(|| {
+                    config_resolver::string_param("GOOSE_LOCAL_DRAFT_MODEL")
+                        .ok()
+                        .flatten()
+                })
+                .filter(|draft_model| draft_model != model_id);
+            let draft_model_path = draft_model.as_deref().and_then(resolve_model_local_path);
+            return Some(ResolvedModelPaths {
+                model_path: entry.local_path.clone(),
+                context_limit: ctx,
+                settings,
+                mmproj_path,
+                backend_id,
+                draft_model_path,
+            });
+        }
+    }
+
+    None
+}
+
+pub fn available_inference_memory_bytes(runtime: &InferenceRuntime) -> u64 {
+    runtime.default_backend().available_memory_bytes()
+}
+
+pub fn recommend_local_model(runtime: &InferenceRuntime) -> String {
+    use local_model_registry::{get_registry, is_featured_model, FEATURED_MODELS};
+
+    let available_memory = available_inference_memory_bytes(runtime);
+
+    if let Ok(registry) = get_registry().lock() {
+        let mut models: Vec<_> = registry
+            .list_models()
+            .iter()
+            .filter(|m| is_featured_model(&m.id) && m.size_bytes > 0)
+            .collect();
+        models.sort_by_key(|model| std::cmp::Reverse(model.size_bytes));
+
+        // Return largest that fits in available memory
+        for model in &models {
+            if available_memory >= model.size_bytes {
+                return model.id.clone();
+            }
+        }
+
+        // If nothing fits, return smallest
+        if let Some(smallest) = models.last() {
+            return smallest.id.clone();
+        }
+    }
+
+    // Fallback to first featured model
+    FEATURED_MODELS[0].spec.to_string()
+}
+
+fn build_openai_messages_json(
+    system: &str,
+    messages: &[Message],
+    media_marker: Option<&str>,
+) -> String {
+    use goose_provider_types::formats::openai::format_messages;
+
+    let mut arr: Vec<Value> = vec![json!({"role": "system", "content": system})];
+    arr.extend(format_messages(messages, &ImageFormat::OpenAi));
+    strip_image_parts_from_messages(&mut arr);
+    if let Some(marker) = media_marker {
+        convert_text_media_markers(&mut arr, marker);
+    }
+    serde_json::to_string(&arr).unwrap_or_else(|_| "[]".to_string())
+}
+
+fn build_openai_text_messages_json(
+    system: &str,
+    messages: &[Message],
+    media_marker: Option<&str>,
+) -> String {
+    let mut arr: Vec<Value> = vec![json!({"role": "system", "content": system})];
+    arr.extend(messages.iter().filter_map(|m| {
+        let content = extract_text_content(m);
+        if content.trim().is_empty() {
+            return None;
+        }
+        let role = match m.role {
+            rmcp::model::Role::User => "user",
+            rmcp::model::Role::Assistant => "assistant",
+        };
+        Some(json!({"role": role, "content": content}))
+    }));
+    if let Some(marker) = media_marker {
+        convert_text_media_markers(&mut arr, marker);
+    }
+    serde_json::to_string(&arr).unwrap_or_else(|_| "[]".to_string())
+}
+
+fn convert_text_media_markers(messages: &mut [Value], marker: &str) {
+    if marker.is_empty() {
+        return;
+    }
+
+    for msg in messages {
+        let Some(content) = msg.get_mut("content") else {
+            continue;
+        };
+
+        if let Some(text) = content.as_str() {
+            if let Some(parts) = split_media_marker_text(text, marker) {
+                *content = json!(parts);
+            }
+            continue;
+        }
+
+        let Some(content_parts) = content.as_array_mut() else {
+            continue;
+        };
+        let mut updated = Vec::new();
+        let mut changed = false;
+        for part in content_parts.iter() {
+            if part.get("type").and_then(|v| v.as_str()) == Some("text") {
+                if let Some(text) = part.get("text").and_then(|v| v.as_str()) {
+                    if let Some(parts) = split_media_marker_text(text, marker) {
+                        updated.extend(parts);
+                        changed = true;
+                        continue;
+                    }
+                }
+            }
+            updated.push(part.clone());
+        }
+        if changed {
+            *content_parts = updated;
+        }
+    }
+}
+
+fn split_media_marker_text(text: &str, marker: &str) -> Option<Vec<Value>> {
+    let mut parts = Vec::new();
+    let mut rest = text;
+    let mut found_marker = false;
+    while let Some((before, after)) = rest.split_once(marker) {
+        found_marker = true;
+        let before = before.strip_suffix('\n').unwrap_or(before);
+        if !before.is_empty() {
+            parts.push(json!({"type": "text", "text": before}));
+        }
+        parts.push(json!({"type": "media_marker", "text": marker}));
+        rest = after;
+        rest = rest.strip_prefix('\n').unwrap_or(rest);
+    }
+    if !found_marker {
+        return None;
+    }
+    if !rest.is_empty() {
+        parts.push(json!({"type": "text", "text": rest}));
+    }
+    Some(parts)
+}
+
+/// Remove `image_url` content parts from OpenAI-format messages JSON, replacing
+/// each with a text note. This prevents an FFI crash in llama.cpp which does not
+/// accept `image_url` content-part types.
+fn strip_image_parts_from_messages(messages: &mut [Value]) {
+    let mut stripped = false;
+    for msg in messages.iter_mut() {
+        if let Some(content) = msg.get_mut("content").and_then(|c| c.as_array_mut()) {
+            for part in content.iter_mut() {
+                if part.get("type").and_then(|t| t.as_str()) == Some("image_url") {
+                    *part = json!({
+                        "type": "text",
+                        "text": "[Image attached — image input is not supported with the currently selected model]"
+                    });
+                    stripped = true;
+                }
+            }
+        }
+    }
+    if stripped {
+        tracing::warn!("Stripped image content parts from messages — vision encoder not available for this model");
+    }
+}
+
+/// Convert a message into plain text for the emulator path's chat history.
+///
+/// This is the emulator-path counterpart of [`format_messages`] used by the native
+/// path. It reconstructs the text-based tool syntax that the emulator prompt teaches
+/// the model:
+///
+/// - `ToolRequest` with a `"command"` argument → `$ command`
+/// - `ToolRequest` with a `"code"` argument → `` ```execute_typescript\n…\n``` ``
+/// - `ToolResponse` → `Command output:\n…`
+///
+/// Only `developer__shell` and `code_execution__execute_typescript` style tool calls are
+/// recognized (by argument shape, not tool name). Tool calls from other extensions
+/// (e.g. custom MCP tools made by a native-tool-calling model earlier in the
+/// conversation) are silently dropped, since the emulator path has no syntax to
+/// represent them.
+fn extract_text_content(msg: &Message) -> String {
+    let mut parts = Vec::new();
+
+    for content in &msg.content {
+        match content {
+            MessageContent::Text(text) => {
+                let text = strip_info_messages(&text.text);
+                if !text.trim().is_empty() {
+                    parts.push(text);
+                }
+            }
+            MessageContent::ToolRequest(req) => {
+                if let Ok(call) = &req.tool_call {
+                    if let Some(cmd) = call
+                        .arguments
+                        .as_ref()
+                        .and_then(|a| a.get("command"))
+                        .and_then(|v| v.as_str())
+                    {
+                        parts.push(format!("$ {}", cmd));
+                    } else if let Some(code) = call
+                        .arguments
+                        .as_ref()
+                        .and_then(|a| a.get("code"))
+                        .and_then(|v| v.as_str())
+                    {
+                        parts.push(format!("```execute_typescript\n{}\n```", code));
+                    }
+                }
+            }
+            MessageContent::ToolResponse(response) => match &response.tool_result {
+                Ok(result) => {
+                    let mut output_parts = Vec::new();
+                    for content_item in &result.content {
+                        if let Some(text_content) = content_item.as_text() {
+                            output_parts.push(text_content.text.to_string());
+                        }
+                    }
+                    if !output_parts.is_empty() {
+                        parts.push(format!("Command output:\n{}", output_parts.join("\n")));
+                    }
+                }
+                Err(e) => {
+                    parts.push(format!("Command error: {}", e));
+                }
+            },
+            MessageContent::Image(_) => {
+                parts.push(
+                    "[Image attached — image input is not supported with the currently selected model]"
+                        .to_string(),
+                );
+            }
+            _ => {}
+        }
+    }
+
+    parts.join("\n")
+}
+
+fn strip_info_messages(text: &str) -> String {
+    let mut remaining = text;
+    let mut output = String::new();
+
+    while let Some((before, after_start)) = remaining.split_once("<info-msg>") {
+        output.push_str(before);
+        if let Some((_, after_end)) = after_start.split_once("</info-msg>") {
+            remaining = after_end;
+        } else {
+            remaining = "";
+            break;
+        }
+    }
+
+    output.push_str(remaining);
+    output.trim().to_string()
+}
+
+/// Build a `ProviderUsage` and write the request log entry.
+fn finalize_usage(
+    log: &mut Option<Box<dyn RequestLogHandle>>,
+    model_name: String,
+    path_label: &str,
+    prompt_token_count: usize,
+    output_token_count: i32,
+    extra_log_fields: Option<(&str, &str)>,
+) -> ProviderUsage {
+    let input_tokens = prompt_token_count as i32;
+    let total_tokens = input_tokens + output_token_count;
+    let usage = Usage::new(
+        Some(input_tokens),
+        Some(output_token_count),
+        Some(total_tokens),
+    );
+    let mut log_json = serde_json::json!({
+        "path": path_label,
+        "prompt_tokens": input_tokens,
+        "output_tokens": output_token_count,
+    });
+    if let Some((key, value)) = extra_log_fields {
+        log_json[key] = serde_json::json!(value);
+    }
+    let _ = log.write(&log_json, Some(&usage));
+    ProviderUsage::new(model_name, usage)
+}
+
+type StreamSender =
+    tokio::sync::mpsc::Sender<Result<(Option<Message>, Option<ProviderUsage>), ProviderError>>;
+
+pub struct LocalInferenceProvider {
+    runtime: Arc<InferenceRuntime>,
+    name: String,
+}
+
+impl LocalInferenceProvider {
+    pub async fn from_env() -> Result<Self> {
+        let runtime = InferenceRuntime::get_or_init()?;
+        Ok(Self {
+            runtime,
+            name: PROVIDER_NAME.to_string(),
+        })
+    }
+}
+
+impl ProviderDescriptor for LocalInferenceProvider {
+    fn metadata() -> ProviderMetadata
+    where
+        Self: Sized,
+    {
+        use crate::local_model_registry::{get_registry, FEATURED_MODELS};
+
+        let mut known_models: Vec<&str> = FEATURED_MODELS.iter().map(|m| m.spec).collect();
+
+        // Add any registry models not already in the featured list
+        let mut dynamic_models = Vec::new();
+        if let Ok(registry) = get_registry().lock() {
+            for entry in registry.list_models() {
+                if !known_models.contains(&entry.id.as_str()) {
+                    dynamic_models.push(entry.id.clone());
+                }
+            }
+        }
+        let dynamic_refs: Vec<&str> = dynamic_models.iter().map(|s| s.as_str()).collect();
+        known_models.extend(dynamic_refs);
+
+        ProviderMetadata::new(
+            PROVIDER_NAME,
+            "Local Inference",
+            "Local inference using quantized GGUF models (llama.cpp)",
+            DEFAULT_MODEL,
+            known_models,
+            "https://github.com/utilityai/llama-cpp-rs",
+            vec![],
+        )
+    }
+}
+
+#[async_trait]
+impl Provider for LocalInferenceProvider {
+    fn get_name(&self) -> &str {
+        &self.name
+    }
+
+    async fn fetch_supported_models(&self) -> Result<Vec<String>, ProviderError> {
+        use crate::local_model_registry::get_registry;
+
+        let mut all_models: Vec<String> = Vec::new();
+
+        if let Ok(registry) = get_registry().lock() {
+            for entry in registry.list_models() {
+                all_models.push(entry.id.clone());
+            }
+        }
+
+        Ok(all_models)
+    }
+
+    async fn stream(
+        &self,
+        model_config: &ModelConfig,
+        system: &str,
+        messages: &[Message],
+        tools: &[Tool],
+    ) -> Result<MessageStream, ProviderError> {
+        let resolved = resolve_model_path(&model_config.model_name).ok_or_else(|| {
+            ProviderError::ExecutionError(format!("Model not found: {}", model_config.model_name))
+        })?;
+        let backend = self.runtime.backend_for_model(&resolved)?;
+        let model_context_limit = resolved.context_limit;
+
+        // Allow request_params to override thinking
+        let mut model_settings = resolved.settings.clone();
+        if let Some(false) = model_config
+            .request_param::<bool>("enable_thinking")
+            .or_else(|| {
+                config_resolver::bool_param("GOOSE_LOCAL_ENABLE_THINKING")
+                    .ok()
+                    .flatten()
+            })
+        {
+            model_settings.enable_thinking = false;
+        }
+
+        let cache_key = ModelCacheKey::new(
+            backend.id(),
+            model_config.model_name.clone(),
+            model_settings.chat_template.clone(),
+        );
+        let model_slot = self.runtime.get_or_create_model_slot(cache_key.clone());
+        let runtime = self.runtime.clone();
+
+        let cache_key = cache_key.clone();
+        let model_arc = model_slot.clone();
+        let backend = backend.clone();
+        let model_name = model_config.model_name.clone();
+        let temperature = model_config.temperature;
+        let max_tokens = model_config.max_tokens;
+        let context_limit = model_context_limit;
+        let settings = model_settings;
+        let resolved_model = resolved.clone();
+        let system = system.to_string();
+        let messages = messages.to_vec();
+        let tools = tools.to_vec();
+        let log_payload = serde_json::json!({
+            "system": &system,
+            "messages": messages.iter().map(|m| {
+                serde_json::json!({
+                    "role": match m.role { rmcp::model::Role::User => "user", rmcp::model::Role::Assistant => "assistant" },
+                    "content": extract_text_content(m),
+                })
+            }).collect::<Vec<_>>(),
+            "tools": tools.iter().map(|t| &t.name).collect::<Vec<_>>(),
+            "settings": {
+                "tool_calling": settings.tool_calling,
+                "chat_template": settings.chat_template,
+                "context_size": settings.context_size,
+                "sampling": settings.sampling,
+            },
+        });
+
+        let (tx, mut rx) = tokio::sync::mpsc::channel::<
+            Result<(Option<Message>, Option<ProviderUsage>), ProviderError>,
+        >(32);
+        let mut log = start_log(model_config, &log_payload)?;
+
+        tokio::spawn(async move {
+            let mut model_load_ms = None;
+
+            // Ensure model is loaded — unload any other models first to free memory.
+            loop {
+                let state = model_slot.state.lock().await;
+                match &*state {
+                    ModelSlotState::Loaded(_) => break,
+                    ModelSlotState::Loading => {
+                        let notified = model_slot.notify.notified();
+                        drop(state);
+                        notified.await;
+                    }
+                    ModelSlotState::Empty => {
+                        drop(state);
+
+                        let cold_load_guard = runtime.cold_load_lock.lock().await;
+                        let mut state = model_slot.state.lock().await;
+                        match &*state {
+                            ModelSlotState::Loaded(_) => break,
+                            ModelSlotState::Loading => {
+                                let notified = model_slot.notify.notified();
+                                drop(state);
+                                drop(cold_load_guard);
+                                notified.await;
+                                continue;
+                            }
+                            ModelSlotState::Empty => {}
+                        }
+                        *state = ModelSlotState::Loading;
+                        drop(state);
+
+                        let loading_message = Message::assistant().with_system_notification(
+                            SystemNotificationType::ProgressMessage,
+                            format!("Loading local model {model_name}..."),
+                        );
+                        if tx.send(Ok((Some(loading_message), None))).await.is_err() {
+                            let mut state = model_slot.state.lock().await;
+                            *state = ModelSlotState::Empty;
+                            model_slot.notify.notify_waiters();
+                            return;
+                        }
+
+                        let other_model_slots = runtime.other_model_slots(&cache_key);
+                        for slot in other_model_slots {
+                            let mut other = slot.state.lock().await;
+                            if matches!(*other, ModelSlotState::Loaded(_)) {
+                                tracing::info!("Unloading previous model to free memory");
+                                *other = ModelSlotState::Empty;
+                            }
+                        }
+
+                        let model_id = model_name.clone();
+                        let resolved_for_load = resolved_model.clone();
+                        let settings_for_load = settings.clone();
+                        let backend_for_load = backend.clone();
+                        let load_started = std::time::Instant::now();
+                        let loaded = match tokio::task::spawn_blocking(move || {
+                            backend_for_load.load_model(
+                                &model_id,
+                                &resolved_for_load,
+                                &settings_for_load,
+                            )
+                        })
+                        .await
+                        {
+                            Ok(Ok(loaded)) => loaded,
+                            Ok(Err(err)) => {
+                                let mut state = model_slot.state.lock().await;
+                                *state = ModelSlotState::Empty;
+                                model_slot.notify.notify_waiters();
+                                let _ = log.error(&err);
+                                let _ = tx.send(Err(err)).await;
+                                return;
+                            }
+                            Err(err) => {
+                                let mut state = model_slot.state.lock().await;
+                                *state = ModelSlotState::Empty;
+                                model_slot.notify.notify_waiters();
+                                let err = ProviderError::ExecutionError(err.to_string());
+                                let _ = log.error(&err);
+                                let _ = tx.send(Err(err)).await;
+                                return;
+                            }
+                        };
+                        let elapsed_ms =
+                            u64::try_from(load_started.elapsed().as_millis()).unwrap_or(u64::MAX);
+                        model_load_ms = Some(elapsed_ms);
+                        tracing::info!(
+                            backend = backend.id(),
+                            model = %model_name,
+                            model_load_ms = elapsed_ms,
+                            "Loaded local inference model"
+                        );
+                        let _ = log.write(
+                            &json!({
+                                "path": "model_load",
+                                "backend": backend.id(),
+                                "model": &model_name,
+                                "model_load_ms": elapsed_ms,
+                            }),
+                            None,
+                        );
+
+                        let mut state = model_slot.state.lock().await;
+                        *state = ModelSlotState::Loaded(loaded);
+                        model_slot.notify.notify_waiters();
+                        drop(cold_load_guard);
+                        break;
+                    }
+                }
+            }
+
+            tokio::task::spawn_blocking(move || {
+                // Macro to log errors before sending them through the channel
+                macro_rules! send_err {
+                    ($err:expr) => {{
+                        let err = $err;
+                        let msg = match &err {
+                            ProviderError::ExecutionError(s) => s.as_str(),
+                            ProviderError::ContextLengthExceeded(s) => s.as_str(),
+                            _ => "unknown error",
+                        };
+                        let _ = log.error(msg);
+                        let _ = tx.blocking_send(Err(err));
+                        return;
+                    }};
+                }
+
+                let mut model_guard = model_arc.state.blocking_lock();
+                let loaded = match &mut *model_guard {
+                    ModelSlotState::Loaded(loaded) => loaded.as_mut(),
+                    ModelSlotState::Empty | ModelSlotState::Loading => {
+                        send_err!(ProviderError::ExecutionError(
+                            "Model not loaded".to_string()
+                        ));
+                    }
+                };
+
+                let message_id = Uuid::new_v4().to_string();
+
+                let request = backend::LocalGenerationRequest {
+                    model_name,
+                    system: &system,
+                    messages: &messages,
+                    tools: &tools,
+                    settings: &settings,
+                    temperature,
+                    max_tokens,
+                    context_limit,
+                    model_load_ms,
+                    resolved_model: &resolved_model,
+                    draft_model_path: resolved_model.draft_model_path.clone(),
+                    message_id: &message_id,
+                    tx: &tx,
+                    log: &mut log,
+                };
+
+                let result = backend.generate(loaded, request);
+
+                if let Err(err) = result {
+                    let msg = match &err {
+                        ProviderError::ExecutionError(s) => s.as_str(),
+                        ProviderError::ContextLengthExceeded(s) => s.as_str(),
+                        _ => "unknown error",
+                    };
+                    let _ = log.error(msg);
+                    let _ = tx.blocking_send(Err(err));
+                }
+            });
+        });
+
+        Ok(Box::pin(try_stream! {
+            while let Some(result) = rx.recv().await {
+                let item = result?;
+                yield item;
+            }
+
+        }))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn converts_marker_in_string_content_to_media_marker_part() {
+        let mut messages = vec![json!({
+            "role": "user",
+            "content": "look\n<__media__>\nclosely",
+        })];
+
+        convert_text_media_markers(&mut messages, "<__media__>");
+
+        assert_eq!(
+            messages[0]["content"],
+            json!([
+                {"type": "text", "text": "look"},
+                {"type": "media_marker", "text": "<__media__>"},
+                {"type": "text", "text": "closely"},
+            ])
+        );
+    }
+
+    #[test]
+    fn converts_marker_inside_text_content_parts() {
+        let mut messages = vec![json!({
+            "role": "user",
+            "content": [
+                {"type": "text", "text": "<__media__>describe"},
+                {"type": "text", "text": "next"},
+                {"type": "media_marker", "text": "<__media__>"},
+            ],
+        })];
+
+        convert_text_media_markers(&mut messages, "<__media__>");
+
+        assert_eq!(
+            messages[0]["content"],
+            json!([
+                {"type": "media_marker", "text": "<__media__>"},
+                {"type": "text", "text": "describe"},
+                {"type": "text", "text": "next"},
+                {"type": "media_marker", "text": "<__media__>"},
+            ])
+        );
+    }
+}

crates/goose-local-inference/src/llamacpp/inference_emulated_tools.rs

@@ -20,17 +20,16 @@
 //! These are inherent to text-based tool emulation. Models with native tool-calling
 //! support should use the `inference_native_tools` path instead.
 
-use crate::conversation::message::{Message, MessageContent};
-use goose_providers::errors::ProviderError;
+use goose_provider_types::conversation::message::{Message, MessageContent};
+use goose_provider_types::errors::ProviderError;
 use rmcp::model::{CallToolRequestParams, Tool};
 use serde_json::json;
 use std::borrow::Cow;
 use uuid::Uuid;
 
-use super::super::{finalize_usage, StreamSender};
+use super::super::{finalize_usage, thinking_output::ThinkingOutputFilter, StreamSender};
 use super::inference_engine::{
-    generation_loop, prepare_generation, GenerationContext, StopSuffixTrimmer,
-    ThinkingOutputFilter, TokenAction,
+    generation_loop, prepare_generation, GenerationContext, StopSuffixTrimmer, TokenAction,
 };
 
 const SHELL_TOOL: &str = "developer__shell";

crates/goose-local-inference/src/llamacpp/inference_engine.rs

@@ -1,9 +1,8 @@
-use crate::providers::local_inference::backend::LocalInferenceBackend;
-use crate::providers::local_inference::local_model_registry::ModelSettings;
-use crate::providers::local_inference::multimodal::ExtractedImage;
-use goose_providers::errors::ProviderError;
-use goose_providers::request_log::{LoggerHandleExt, RequestLogHandle};
-use goose_providers::thinking::{FilterOut, ThinkFilter};
+use crate::backend::LocalInferenceBackend;
+use crate::local_model_registry::ModelSettings;
+use crate::multimodal::ExtractedImage;
+use goose_provider_types::errors::ProviderError;
+use goose_provider_types::request_log::{LoggerHandleExt, RequestLogHandle};
 use llama_cpp_2::context::params::LlamaContextParams;
 use llama_cpp_2::llama_batch::LlamaBatch;
 use llama_cpp_2::model::{AddBos, ChatTemplateResult, LlamaChatTemplate, LlamaModel};
@@ -48,86 +47,6 @@ pub(super) struct PreparedGeneration<'model> {
     pub effective_ctx: usize,
 }
 
-pub(super) struct ThinkingOutputFilter {
-    enabled: bool,
-    saw_structured_reasoning: bool,
-    think_filter: ThinkFilter,
-    pending_inline_thinking: String,
-    accumulated_thinking: String,
-}
-
-impl ThinkingOutputFilter {
-    pub(super) fn new(enable_thinking: bool, generation_prompt: &str) -> Self {
-        let mut think_filter = ThinkFilter::new();
-        if enable_thinking && !generation_prompt.is_empty() {
-            let _ = think_filter.push(generation_prompt);
-        }
-
-        Self {
-            enabled: enable_thinking,
-            saw_structured_reasoning: false,
-            think_filter,
-            pending_inline_thinking: String::new(),
-            accumulated_thinking: String::new(),
-        }
-    }
-
-    pub(super) fn push_structured_reasoning(&mut self, reasoning: &str) -> Option<String> {
-        if reasoning.is_empty() {
-            return None;
-        }
-
-        self.saw_structured_reasoning = true;
-        self.pending_inline_thinking.clear();
-        self.think_filter = ThinkFilter::new();
-        self.accumulated_thinking.push_str(reasoning);
-        Some(reasoning.to_string())
-    }
-
-    pub(super) fn push_text(&mut self, text: &str) -> FilterOut {
-        if !self.enabled {
-            return FilterOut {
-                content: text.to_string(),
-                thinking: String::new(),
-            };
-        }
-
-        let mut filtered = self.think_filter.push(text);
-        if self.saw_structured_reasoning {
-            filtered.thinking.clear();
-        } else if !filtered.thinking.is_empty() {
-            self.pending_inline_thinking.push_str(&filtered.thinking);
-            filtered.thinking.clear();
-        }
-        filtered
-    }
-
-    pub(super) fn finish(&mut self) -> FilterOut {
-        let mut filtered = if self.enabled && !self.saw_structured_reasoning {
-            std::mem::take(&mut self.think_filter).finish()
-        } else {
-            FilterOut::default()
-        };
-
-        if !self.saw_structured_reasoning {
-            let mut thinking = std::mem::take(&mut self.pending_inline_thinking);
-            thinking.push_str(&filtered.thinking);
-            if !thinking.is_empty() {
-                self.accumulated_thinking.push_str(&thinking);
-            }
-            filtered.thinking = thinking;
-        } else {
-            filtered.thinking.clear();
-        }
-
-        filtered
-    }
-
-    pub(super) fn accumulated_thinking(&self) -> &str {
-        &self.accumulated_thinking
-    }
-}
-
 pub(super) struct StopSuffixTrimmer {
     pending: String,
     stops: Vec<String>,
@@ -246,7 +165,7 @@ pub(super) fn estimate_max_context_for_memory(
 }
 
 pub(super) fn context_cap(
-    settings: &crate::providers::local_inference::local_model_registry::ModelSettings,
+    settings: &crate::local_model_registry::ModelSettings,
     context_limit: usize,
     n_ctx_train: usize,
     memory_max_ctx: Option<usize>,
@@ -276,7 +195,7 @@ pub(super) fn context_cap(
 
 pub(super) fn effective_context_size(
     prompt_token_count: usize,
-    settings: &crate::providers::local_inference::local_model_registry::ModelSettings,
+    settings: &crate::local_model_registry::ModelSettings,
     context_limit: usize,
     n_ctx_train: usize,
     memory_max_ctx: Option<usize>,
@@ -296,7 +215,7 @@ pub(super) fn effective_context_size(
 
 pub(super) fn build_context_params(
     ctx_size: u32,
-    settings: &crate::providers::local_inference::local_model_registry::ModelSettings,
+    settings: &crate::local_model_registry::ModelSettings,
 ) -> LlamaContextParams {
     let mut params = LlamaContextParams::default().with_n_ctx(NonZeroU32::new(ctx_size));
 
@@ -315,10 +234,8 @@ pub(super) fn build_context_params(
     params
 }
 
-pub(super) fn build_sampler(
-    settings: &crate::providers::local_inference::local_model_registry::ModelSettings,
-) -> LlamaSampler {
-    use crate::providers::local_inference::local_model_registry::SamplingConfig;
+pub(super) fn build_sampler(settings: &crate::local_model_registry::ModelSettings) -> LlamaSampler {
+    use crate::local_model_registry::SamplingConfig;
 
     let has_penalties = settings.repeat_penalty != 1.0
         || settings.frequency_penalty != 0.0
@@ -371,7 +288,7 @@ pub(super) fn validate_and_compute_context(
     backend: &LlamaCppBackend,
     prompt_token_count: usize,
     context_limit: usize,
-    settings: &crate::providers::local_inference::local_model_registry::ModelSettings,
+    settings: &crate::local_model_registry::ModelSettings,
 ) -> Result<(usize, usize), ProviderError> {
     let n_ctx_train = loaded.model.n_ctx_train() as usize;
     let mmproj_overhead = if loaded.mtmd_ctx.is_some() {
@@ -412,7 +329,7 @@ pub(super) fn create_and_prefill_context<'model>(
     backend: &LlamaCppBackend,
     tokens: &[llama_cpp_2::token::LlamaToken],
     effective_ctx: usize,
-    settings: &crate::providers::local_inference::local_model_registry::ModelSettings,
+    settings: &crate::local_model_registry::ModelSettings,
 ) -> Result<llama_cpp_2::context::LlamaContext<'model>, ProviderError> {
     let ctx_params = build_context_params(effective_ctx as u32, settings);
     let mut ctx = loaded
@@ -633,7 +550,7 @@ pub(super) enum TokenAction {
 pub(super) fn generation_loop(
     model: &LlamaModel,
     ctx: &mut llama_cpp_2::context::LlamaContext<'_>,
-    settings: &crate::providers::local_inference::local_model_registry::ModelSettings,
+    settings: &crate::local_model_registry::ModelSettings,
     prompt_token_count: usize,
     effective_ctx: usize,
     mut on_piece: impl FnMut(&str) -> Result<TokenAction, ProviderError>,
@@ -695,7 +612,7 @@ pub(super) fn generation_loop(
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::providers::local_inference::local_model_registry::ModelSettings;
+    use crate::local_model_registry::ModelSettings;
 
     fn default_settings() -> ModelSettings {
         ModelSettings::default()

crates/goose-local-inference/src/llamacpp/inference_native_tools.rs

@@ -1,14 +1,14 @@
-use crate::conversation::message::{Message, MessageContent};
-use goose_providers::errors::ProviderError;
+use goose_provider_types::conversation::message::{Message, MessageContent};
+use goose_provider_types::errors::ProviderError;
 use rmcp::model::CallToolRequestParams;
 use serde_json::Value;
 use std::borrow::Cow;
 use uuid::Uuid;
 
 use super::super::finalize_usage;
+use super::super::thinking_output::ThinkingOutputFilter;
 use super::inference_engine::{
-    generation_loop, prepare_generation, GenerationContext, StopSuffixTrimmer,
-    ThinkingOutputFilter, TokenAction,
+    generation_loop, prepare_generation, GenerationContext, StopSuffixTrimmer, TokenAction,
 };
 
 pub(super) fn generate_with_native_tools(

crates/goose-local-inference/src/llamacpp/mod.rs

@@ -18,19 +18,13 @@ use self::inference_emulated_tools::{
 };
 use self::inference_engine::{GenerationContext, LoadedChatTemplates, LoadedModel};
 use self::inference_native_tools::generate_with_native_tools;
-use crate::providers::local_inference::backend::{
-    BackendLoadedModel, LocalGenerationRequest, LocalInferenceBackend,
-};
-use crate::providers::local_inference::local_model_registry::{
-    ChatTemplate, ModelSettings, ToolCallingMode,
-};
-use crate::providers::local_inference::multimodal::ExtractedImage;
-use crate::providers::local_inference::tool_parsing::compact_tools_json;
-use crate::providers::local_inference::{
-    build_openai_messages_json, build_openai_text_messages_json, ResolvedModelPaths,
-};
-use goose_providers::errors::ProviderError;
-use goose_providers::formats::openai::format_tools;
+use crate::backend::{BackendLoadedModel, LocalGenerationRequest, LocalInferenceBackend};
+use crate::local_model_registry::{ChatTemplate, ModelSettings, ToolCallingMode};
+use crate::multimodal::ExtractedImage;
+use crate::tool_parsing::compact_tools_json;
+use crate::{build_openai_messages_json, build_openai_text_messages_json, ResolvedModelPaths};
+use goose_provider_types::errors::ProviderError;
+use goose_provider_types::formats::openai::format_tools;
 
 pub(super) const LLAMACPP_BACKEND_ID: &str = "llamacpp";
 
@@ -342,7 +336,7 @@ impl LlamaCppBackend {
     fn init_mtmd_context(
         model: &LlamaModel,
         mmproj_path: &Option<PathBuf>,
-        settings: &crate::providers::local_inference::local_model_registry::ModelSettings,
+        settings: &crate::local_model_registry::ModelSettings,
     ) -> Option<llama_cpp_2::mtmd::MtmdContext> {
         use llama_cpp_2::mtmd::{MtmdContext, MtmdContextParams};
 
@@ -383,7 +377,7 @@ impl LocalInferenceBackend for LlamaCppBackend {
         &self,
         model_id: &str,
         resolved: &ResolvedModelPaths,
-        settings: &crate::providers::local_inference::local_model_registry::ModelSettings,
+        settings: &crate::local_model_registry::ModelSettings,
     ) -> Result<Box<dyn BackendLoadedModel>, ProviderError> {
         let model_path = &resolved.model_path;
 

crates/goose-local-inference/src/local_model_registry.rs

@@ -1,5 +1,5 @@
-use crate::config::paths::Paths;
 use crate::download_manager::{get_download_manager, DownloadStatus};
+use crate::paths::Paths;
 use anyhow::Result;
 use serde::{Deserialize, Serialize};
 use std::path::PathBuf;

crates/goose-local-inference/src/management.rs

@@ -0,0 +1,860 @@
+use super::hf_models::{
+    self, register_resolved_model, resolve_local_model_selection, resolve_local_model_spec,
+    resolve_model_spec, HfGgufFile, HfModelInfo, HfModelVariant,
+};
+use super::local_model_registry::{
+    default_settings_for_model, featured_mmproj_spec, get_registry, model_id_from_repo,
+    ChatTemplate, LocalModelEntry, LocalModelStorage, ModelDownloadStatus, ModelSettings,
+    SamplingConfig, ToolCallingMode, FEATURED_MODELS,
+};
+use super::{
+    available_inference_memory_bytes, builtin_chat_template_names, recommend_local_model,
+    InferenceRuntime,
+};
+use crate::download_manager::{get_download_manager, DownloadProgress, DownloadStatus};
+use crate::huggingface_auth;
+use crate::paths::Paths;
+use anyhow::{anyhow, Result};
+use futures::future::join_all;
+use goose_sdk_types::custom_requests::{
+    LocalInferenceBuiltinChatTemplatesListResponse, LocalInferenceChatTemplate,
+    LocalInferenceDownloadProgressDto, LocalInferenceDownloadState, LocalInferenceHfGgufFileDto,
+    LocalInferenceHfModelInfoDto, LocalInferenceHfModelVariantDto,
+    LocalInferenceHuggingFaceRepoVariantsResponse, LocalInferenceHuggingFaceSearchResponse,
+    LocalInferenceModelDownloadRequest, LocalInferenceModelDownloadResponse,
+    LocalInferenceModelDownloadStatusDto, LocalInferenceModelDto, LocalInferenceModelSettingsDto,
+    LocalInferenceModelSettingsReadResponse, LocalInferenceModelSettingsUpdateResponse,
+    LocalInferenceModelsListResponse, LocalInferenceSamplingConfig, LocalInferenceToolCallingMode,
+};
+use std::collections::HashSet;
+use std::path::PathBuf;
+use std::sync::{Arc, OnceLock};
+
+static MANAGEMENT_RUNTIME: OnceLock<Arc<InferenceRuntime>> = OnceLock::new();
+
+#[derive(Clone)]
+struct LocalModelSelection {
+    repo_id: String,
+    backend_id: String,
+    variant_id: Option<String>,
+}
+
+pub async fn list_models() -> Result<LocalInferenceModelsListResponse> {
+    ensure_featured_models_current().await?;
+
+    let runtime = management_runtime()?;
+    let recommended_id = recommend_local_model(&runtime);
+
+    let loaded_model_ids = crate::loaded_model_ids()
+        .await
+        .map_err(|error| anyhow!(error.to_string()))?;
+    let registry = get_registry()
+        .lock()
+        .map_err(|_| anyhow!("Failed to acquire registry lock"))?;
+    let mut models: Vec<LocalInferenceModelDto> = registry
+        .list_models()
+        .iter()
+        .map(|entry| local_model_to_dto(entry, &recommended_id, &loaded_model_ids))
+        .collect();
+
+    models.sort_by(|a, b| {
+        let a_downloaded = a.status.state == LocalInferenceDownloadState::Downloaded;
+        let b_downloaded = b.status.state == LocalInferenceDownloadState::Downloaded;
+        match (b_downloaded, a_downloaded) {
+            (true, false) => std::cmp::Ordering::Greater,
+            (false, true) => std::cmp::Ordering::Less,
+            _ => a.id.cmp(&b.id),
+        }
+    });
+
+    Ok(LocalInferenceModelsListResponse { models })
+}
+
+pub async fn search_huggingface_models(
+    query: String,
+    limit: Option<usize>,
+) -> Result<LocalInferenceHuggingFaceSearchResponse> {
+    let limit = limit.unwrap_or(20).min(50);
+    let models = hf_models::search_local_models(&query, limit)
+        .await?
+        .into_iter()
+        .map(hf_model_info_to_dto)
+        .collect();
+    Ok(LocalInferenceHuggingFaceSearchResponse { models })
+}
+
+pub async fn huggingface_repo_variants(
+    repo_id: String,
+) -> Result<LocalInferenceHuggingFaceRepoVariantsResponse> {
+    let variants = hf_models::get_repo_local_variants(&repo_id).await?;
+
+    let runtime = management_runtime()?;
+    let available_memory = available_inference_memory_bytes(&runtime);
+    let gguf_variants: Vec<_> = variants
+        .iter()
+        .filter(|variant| variant.backend_id == "llamacpp")
+        .map(|variant| hf_models::HfQuantVariant {
+            quantization: variant.variant_id.clone(),
+            size_bytes: variant.size_bytes,
+            filename: variant.filename.clone().unwrap_or_default(),
+            download_url: variant.download_url.clone().unwrap_or_default(),
+            description: "",
+            quality_rank: variant.quality_rank,
+            sharded: variant.sharded,
+        })
+        .collect();
+    let recommended_index = hf_models::recommend_variant(&gguf_variants, available_memory);
+
+    let (downloaded_quants, downloaded_variants) = {
+        let registry = get_registry()
+            .lock()
+            .map_err(|_| anyhow!("Failed to acquire registry lock"))?;
+        let models: Vec<_> = registry
+            .list_models()
+            .iter()
+            .filter(|m| m.repo_id == repo_id && m.is_downloaded())
+            .collect();
+        (
+            models.iter().map(|m| m.quantization.clone()).collect(),
+            models.iter().map(|m| m.id.clone()).collect(),
+        )
+    };
+
+    Ok(LocalInferenceHuggingFaceRepoVariantsResponse {
+        variants: variants.into_iter().map(hf_model_variant_to_dto).collect(),
+        recommended_index,
+        available_memory_bytes: available_memory,
+        downloaded_quants,
+        downloaded_variants,
+    })
+}
+
+pub async fn download_model(
+    req: LocalInferenceModelDownloadRequest,
+) -> Result<LocalInferenceModelDownloadResponse> {
+    let selection = explicit_model_selection(&req)?;
+    let model_id = local_model_id_from_request(&req, selection.as_ref()).await?;
+    let download_id = format!("{}-model", model_id);
+    let download_reserved = get_download_manager().reserve_download(DownloadProgress {
+        model_id: download_id,
+        status: DownloadStatus::Downloading,
+        bytes_downloaded: 0,
+        total_bytes: 0,
+        progress_percent: 0.0,
+        speed_bps: None,
+        eta_seconds: None,
+        error: None,
+        task_exited: false,
+    })?;
+    if !download_reserved {
+        return Ok(LocalInferenceModelDownloadResponse { model_id });
+    }
+
+    if let Err(error) = register_pending_download_model(&model_id, &req, selection.as_ref()) {
+        mark_download_failed(&model_id, &error);
+        return Err(error.context("Failed to register download"));
+    }
+
+    let spec = req.spec.clone();
+    let selection_for_task = selection.clone();
+    let model_id_for_task = model_id.clone();
+    tokio::spawn(async move {
+        let resolved = if let Some(selection) = selection_for_task {
+            resolve_local_model_selection(
+                &selection.repo_id,
+                &selection.backend_id,
+                selection.variant_id.as_deref(),
+            )
+            .await
+        } else {
+            resolve_local_model_spec(&spec).await
+        };
+        match resolved {
+            Ok(resolved) => {
+                if !model_download_completed(&model_id_for_task) {
+                    return;
+                }
+                if let Err(error) = register_resolved_model(resolved, &spec) {
+                    mark_download_failed(&model_id_for_task, error);
+                }
+            }
+            Err(error) => mark_download_failed(&model_id_for_task, error),
+        }
+    });
+
+    Ok(LocalInferenceModelDownloadResponse { model_id })
+}
+
+pub fn download_progress(model_id: &str) -> Result<Option<LocalInferenceDownloadProgressDto>> {
+    Ok(get_download_manager()
+        .get_progress(&format!("{}-model", model_id))
+        .map(download_progress_to_dto))
+}
+
+pub fn cancel_download(model_id: &str) -> Result<()> {
+    let manager = get_download_manager();
+    manager.cancel_download(&format!("{}-model", model_id))?;
+    let _ = manager.cancel_download(&format!("{}-mmproj", model_id));
+    Ok(())
+}
+
+pub fn delete_model(model_id: &str) -> Result<()> {
+    let mut registry = get_registry()
+        .lock()
+        .map_err(|_| anyhow!("Failed to acquire registry lock"))?;
+    if registry.get_model(model_id).is_none() {
+        anyhow::bail!("Model not found");
+    }
+    registry.delete_model(model_id)
+}
+
+pub fn model_exists(model_id: &str) -> Result<bool> {
+    let registry = get_registry()
+        .lock()
+        .map_err(|_| anyhow!("Failed to acquire registry lock"))?;
+    Ok(registry.get_model(model_id).is_some())
+}
+
+pub async fn evict_model(model_id: &str) -> Result<()> {
+    crate::evict_model(model_id)
+        .await
+        .map(|_| ())
+        .map_err(|error| anyhow!(error.to_string()))
+}
+
+pub fn get_model_settings(model_id: &str) -> Result<LocalInferenceModelSettingsReadResponse> {
+    let registry = get_registry()
+        .lock()
+        .map_err(|_| anyhow!("Failed to acquire registry lock"))?;
+    let settings = registry
+        .get_model_settings(model_id)
+        .ok_or_else(|| anyhow!("Model not found"))?;
+    Ok(LocalInferenceModelSettingsReadResponse {
+        settings: model_settings_to_dto(settings),
+    })
+}
+
+pub fn update_model_settings(
+    model_id: &str,
+    settings: LocalInferenceModelSettingsDto,
+) -> Result<LocalInferenceModelSettingsUpdateResponse> {
+    let settings = model_settings_from_dto(settings);
+    let mut registry = get_registry()
+        .lock()
+        .map_err(|_| anyhow!("Failed to acquire registry lock"))?;
+    registry.update_model_settings(model_id, settings.clone())?;
+    Ok(LocalInferenceModelSettingsUpdateResponse {
+        settings: model_settings_to_dto(&settings),
+    })
+}
+
+pub fn list_builtin_chat_templates() -> LocalInferenceBuiltinChatTemplatesListResponse {
+    LocalInferenceBuiltinChatTemplatesListResponse {
+        templates: builtin_chat_template_names(),
+    }
+}
+
+fn management_runtime() -> Result<Arc<InferenceRuntime>> {
+    if let Some(runtime) = MANAGEMENT_RUNTIME.get() {
+        return Ok(runtime.clone());
+    }
+
+    let runtime = InferenceRuntime::get_or_init()?;
+    match MANAGEMENT_RUNTIME.set(runtime.clone()) {
+        Ok(()) => Ok(runtime),
+        Err(_) => Ok(MANAGEMENT_RUNTIME
+            .get()
+            .expect("local inference management runtime initialized by another thread")
+            .clone()),
+    }
+}
+
+pub async fn ensure_featured_models_current() -> Result<()> {
+    let mut mmproj_downloads_needed: Vec<(String, String, PathBuf)> = Vec::new();
+
+    struct PendingResolve {
+        spec: &'static str,
+        repo_id: String,
+        quantization: String,
+        model_id: String,
+    }
+    let mut to_resolve = Vec::new();
+
+    for featured in FEATURED_MODELS {
+        let (repo_id, quantization) = match hf_models::parse_model_spec(featured.spec) {
+            Ok(parts) => parts,
+            Err(_) => continue,
+        };
+
+        let model_id = model_id_from_repo(&repo_id, &quantization);
+
+        {
+            let registry = get_registry()
+                .lock()
+                .map_err(|_| anyhow!("Failed to acquire registry lock"))?;
+            if let Some(existing) = registry.get_model(&model_id) {
+                let needs_backfill = existing.mmproj_path.is_none() && featured.mmproj.is_some();
+                let needs_download = existing.is_downloaded()
+                    && featured.mmproj.is_some()
+                    && !existing.mmproj_path.as_ref().is_some_and(|p| p.exists());
+
+                if needs_download {
+                    if let Some(mmproj) = featured.mmproj.as_ref() {
+                        let path = mmproj.local_path();
+                        let url = format!(
+                            "https://huggingface.co/{}/resolve/main/{}",
+                            mmproj.repo, mmproj.filename
+                        );
+                        mmproj_downloads_needed.push((model_id.clone(), url, path));
+                    }
+                }
+
+                if !needs_backfill {
+                    continue;
+                }
+            }
+        }
+
+        to_resolve.push(PendingResolve {
+            spec: featured.spec,
+            repo_id,
+            quantization,
+            model_id,
+        });
+    }
+
+    let resolved: Vec<(PendingResolve, HfGgufFile)> =
+        join_all(to_resolve.into_iter().map(|pending| async move {
+            let hf_file = match resolve_model_spec(pending.spec).await {
+                Ok((_repo, file)) => file,
+                Err(_) => {
+                    let filename = format!(
+                        "{}-{}.gguf",
+                        pending.repo_id.split('/').next_back().unwrap_or("model"),
+                        pending.quantization
+                    );
+                    HfGgufFile {
+                        filename: filename.clone(),
+                        size_bytes: 0,
+                        quantization: pending.quantization.to_string(),
+                        download_url: format!(
+                            "https://huggingface.co/{}/resolve/main/{}",
+                            pending.repo_id, filename
+                        ),
+                    }
+                }
+            };
+            (pending, hf_file)
+        }))
+        .await;
+
+    let entries_to_add: Vec<LocalModelEntry> = resolved
+        .into_iter()
+        .map(|(pending, hf_file)| {
+            let local_path = Paths::in_data_dir("models").join(&hf_file.filename);
+            let settings = default_settings_for_model(&pending.model_id);
+            LocalModelEntry {
+                id: pending.model_id,
+                repo_id: pending.repo_id,
+                filename: hf_file.filename,
+                quantization: pending.quantization,
+                local_path,
+                source_url: hf_file.download_url,
+                backend_id: settings.backend_id.clone(),
+                storage: LocalModelStorage::GooseManaged,
+                settings,
+                size_bytes: hf_file.size_bytes,
+                mmproj_path: None,
+                mmproj_source_url: None,
+                mmproj_size_bytes: 0,
+                mmproj_checked: false,
+                shard_files: vec![],
+            }
+        })
+        .collect();
+
+    {
+        let mut registry = get_registry()
+            .lock()
+            .map_err(|_| anyhow!("Failed to acquire registry lock"))?;
+
+        if !entries_to_add.is_empty() {
+            registry.sync_with_featured(entries_to_add);
+        }
+
+        for model in registry.list_models_mut() {
+            model.enrich_with_featured_mmproj();
+            if model.is_downloaded() {
+                if let Some(mmproj) = featured_mmproj_spec(&model.id) {
+                    let path = mmproj.local_path();
+                    if !path.exists() {
+                        let url = format!(
+                            "https://huggingface.co/{}/resolve/main/{}",
+                            mmproj.repo, mmproj.filename
+                        );
+                        mmproj_downloads_needed.push((model.id.clone(), url, path));
+                    }
+                }
+            }
+        }
+        let _ = registry.save();
+    }
+
+    let dm = get_download_manager();
+    let hf_token = huggingface_auth::resolve_token_async().await.ok().flatten();
+    let mut started_paths = std::collections::HashSet::new();
+    for (model_id, url, path) in mmproj_downloads_needed {
+        if !path.exists() && started_paths.insert(path.clone()) {
+            let download_id = format!("{}-mmproj", model_id);
+            let dominated_by_active = dm
+                .get_progress(&download_id)
+                .is_some_and(|p| p.status == DownloadStatus::Downloading);
+            if !dominated_by_active {
+                tracing::info!(model_id = %model_id, "Auto-downloading vision encoder for existing model");
+                if let Err(e) = dm
+                    .download_model_with_bearer_token(
+                        download_id,
+                        url,
+                        path,
+                        hf_token.clone(),
+                        None,
+                    )
+                    .await
+                {
+                    tracing::warn!(model_id = %model_id, error = %e, "Failed to start mmproj download");
+                }
+            }
+        }
+    }
+
+    Ok(())
+}
+
+fn local_model_to_dto(
+    entry: &LocalModelEntry,
+    recommended_id: &str,
+    loaded_model_ids: &HashSet<String>,
+) -> LocalInferenceModelDto {
+    let vision_capable = entry.settings.vision_capable;
+    LocalInferenceModelDto {
+        id: entry.id.clone(),
+        repo_id: entry.repo_id.clone(),
+        filename: entry.filename.clone(),
+        quantization: entry.quantization.clone(),
+        size_bytes: entry.file_size(),
+        status: model_download_status_to_dto(entry.download_status()),
+        recommended: recommended_id == entry.id,
+        is_loaded: loaded_model_ids.contains(&entry.id),
+        settings: model_settings_to_dto(&entry.settings),
+        vision_capable,
+        mmproj_status: vision_capable
+            .then(|| model_download_status_to_dto(entry.mmproj_download_status())),
+    }
+}
+
+fn model_download_status_to_dto(
+    status: ModelDownloadStatus,
+) -> LocalInferenceModelDownloadStatusDto {
+    match status {
+        ModelDownloadStatus::NotDownloaded => LocalInferenceModelDownloadStatusDto {
+            state: LocalInferenceDownloadState::NotDownloaded,
+            ..Default::default()
+        },
+        ModelDownloadStatus::Downloading {
+            progress_percent,
+            bytes_downloaded,
+            total_bytes,
+            speed_bps,
+        } => LocalInferenceModelDownloadStatusDto {
+            state: LocalInferenceDownloadState::Downloading,
+            progress_percent: Some(progress_percent),
+            bytes_downloaded: Some(bytes_downloaded),
+            total_bytes: Some(total_bytes),
+            speed_bps: Some(speed_bps),
+        },
+        ModelDownloadStatus::Downloaded => LocalInferenceModelDownloadStatusDto {
+            state: LocalInferenceDownloadState::Downloaded,
+            ..Default::default()
+        },
+    }
+}
+
+fn download_progress_to_dto(progress: DownloadProgress) -> LocalInferenceDownloadProgressDto {
+    LocalInferenceDownloadProgressDto {
+        model_id: progress.model_id,
+        status: serde_json::to_value(progress.status)
+            .ok()
+            .and_then(|value| value.as_str().map(ToOwned::to_owned))
+            .unwrap_or_else(|| "unknown".to_string()),
+        bytes_downloaded: progress.bytes_downloaded,
+        total_bytes: progress.total_bytes,
+        progress_percent: progress.progress_percent,
+        speed_bps: progress.speed_bps,
+        eta_seconds: progress.eta_seconds,
+        error: progress.error,
+        task_exited: progress.task_exited,
+    }
+}
+
+fn hf_model_info_to_dto(model: HfModelInfo) -> LocalInferenceHfModelInfoDto {
+    LocalInferenceHfModelInfoDto {
+        repo_id: model.repo_id,
+        author: model.author,
+        model_name: model.model_name,
+        downloads: model.downloads,
+        gguf_files: model
+            .gguf_files
+            .into_iter()
+            .map(|file| LocalInferenceHfGgufFileDto {
+                filename: file.filename,
+                size_bytes: file.size_bytes,
+                quantization: file.quantization,
+                download_url: file.download_url,
+            })
+            .collect(),
+        variants: model
+            .variants
+            .into_iter()
+            .map(hf_model_variant_to_dto)
+            .collect(),
+    }
+}
+
+fn hf_model_variant_to_dto(variant: HfModelVariant) -> LocalInferenceHfModelVariantDto {
+    LocalInferenceHfModelVariantDto {
+        variant_id: variant.variant_id,
+        label: variant.label,
+        backend_id: variant.backend_id,
+        format: variant.format,
+        model_id: variant.model_id,
+        download_id: variant.download_id,
+        size_bytes: variant.size_bytes,
+        filename: variant.filename,
+        download_url: variant.download_url,
+        description: variant.description,
+        quality_rank: variant.quality_rank,
+        sharded: variant.sharded,
+        supported: variant.supported,
+        unsupported_reason: variant.unsupported_reason,
+    }
+}
+
+pub fn model_settings_to_dto(settings: &ModelSettings) -> LocalInferenceModelSettingsDto {
+    LocalInferenceModelSettingsDto {
+        backend_id: settings.backend_id.clone(),
+        context_size: settings.context_size,
+        max_output_tokens: settings.max_output_tokens,
+        draft_model: settings.draft_model.clone(),
+        sampling: sampling_to_dto(&settings.sampling),
+        repeat_penalty: settings.repeat_penalty,
+        repeat_last_n: settings.repeat_last_n,
+        frequency_penalty: settings.frequency_penalty,
+        presence_penalty: settings.presence_penalty,
+        n_batch: settings.n_batch,
+        n_gpu_layers: settings.n_gpu_layers,
+        use_mlock: settings.use_mlock,
+        flash_attention: settings.flash_attention,
+        n_threads: settings.n_threads,
+        tool_calling: tool_calling_to_dto(settings.tool_calling),
+        chat_template: chat_template_to_dto(&settings.chat_template),
+        enable_thinking: settings.enable_thinking,
+        vision_capable: settings.vision_capable,
+        image_token_estimate: settings.image_token_estimate,
+        mmproj_size_bytes: settings.mmproj_size_bytes,
+    }
+}
+
+pub fn model_settings_from_dto(settings: LocalInferenceModelSettingsDto) -> ModelSettings {
+    ModelSettings {
+        backend_id: settings.backend_id,
+        context_size: settings.context_size,
+        max_output_tokens: settings.max_output_tokens,
+        draft_model: settings.draft_model,
+        sampling: sampling_from_dto(settings.sampling),
+        repeat_penalty: settings.repeat_penalty,
+        repeat_last_n: settings.repeat_last_n,
+        frequency_penalty: settings.frequency_penalty,
+        presence_penalty: settings.presence_penalty,
+        n_batch: settings.n_batch,
+        n_gpu_layers: settings.n_gpu_layers,
+        use_mlock: settings.use_mlock,
+        flash_attention: settings.flash_attention,
+        n_threads: settings.n_threads,
+        tool_calling: tool_calling_from_dto(settings.tool_calling),
+        chat_template: chat_template_from_dto(settings.chat_template),
+        enable_thinking: settings.enable_thinking,
+        vision_capable: settings.vision_capable,
+        image_token_estimate: settings.image_token_estimate,
+        mmproj_size_bytes: settings.mmproj_size_bytes,
+    }
+}
+
+fn sampling_to_dto(sampling: &SamplingConfig) -> LocalInferenceSamplingConfig {
+    match sampling {
+        SamplingConfig::Greedy => LocalInferenceSamplingConfig::Greedy,
+        SamplingConfig::Temperature {
+            temperature,
+            top_k,
+            top_p,
+            min_p,
+            seed,
+        } => LocalInferenceSamplingConfig::Temperature {
+            temperature: *temperature,
+            top_k: *top_k,
+            top_p: *top_p,
+            min_p: *min_p,
+            seed: *seed,
+        },
+        SamplingConfig::MirostatV2 { tau, eta, seed } => LocalInferenceSamplingConfig::MirostatV2 {
+            tau: *tau,
+            eta: *eta,
+            seed: *seed,
+        },
+    }
+}
+
+fn sampling_from_dto(sampling: LocalInferenceSamplingConfig) -> SamplingConfig {
+    match sampling {
+        LocalInferenceSamplingConfig::Greedy => SamplingConfig::Greedy,
+        LocalInferenceSamplingConfig::Temperature {
+            temperature,
+            top_k,
+            top_p,
+            min_p,
+            seed,
+        } => SamplingConfig::Temperature {
+            temperature,
+            top_k,
+            top_p,
+            min_p,
+            seed,
+        },
+        LocalInferenceSamplingConfig::MirostatV2 { tau, eta, seed } => {
+            SamplingConfig::MirostatV2 { tau, eta, seed }
+        }
+    }
+}
+
+fn tool_calling_to_dto(mode: ToolCallingMode) -> LocalInferenceToolCallingMode {
+    match mode {
+        ToolCallingMode::Auto => LocalInferenceToolCallingMode::Auto,
+        ToolCallingMode::ForceNative => LocalInferenceToolCallingMode::ForceNative,
+        ToolCallingMode::ForceEmulated => LocalInferenceToolCallingMode::ForceEmulated,
+    }
+}
+
+fn tool_calling_from_dto(mode: LocalInferenceToolCallingMode) -> ToolCallingMode {
+    match mode {
+        LocalInferenceToolCallingMode::Auto => ToolCallingMode::Auto,
+        LocalInferenceToolCallingMode::ForceNative => ToolCallingMode::ForceNative,
+        LocalInferenceToolCallingMode::ForceEmulated => ToolCallingMode::ForceEmulated,
+    }
+}
+
+fn chat_template_to_dto(template: &ChatTemplate) -> LocalInferenceChatTemplate {
+    match template {
+        ChatTemplate::Embedded => LocalInferenceChatTemplate::Embedded,
+        ChatTemplate::Builtin { name } => {
+            LocalInferenceChatTemplate::Builtin { name: name.clone() }
+        }
+        ChatTemplate::CustomInline { template } => LocalInferenceChatTemplate::CustomInline {
+            template: template.clone(),
+        },
+    }
+}
+
+fn chat_template_from_dto(template: LocalInferenceChatTemplate) -> ChatTemplate {
+    match template {
+        LocalInferenceChatTemplate::Embedded => ChatTemplate::Embedded,
+        LocalInferenceChatTemplate::Builtin { name } => ChatTemplate::Builtin { name },
+        LocalInferenceChatTemplate::CustomInline { template } => {
+            ChatTemplate::CustomInline { template }
+        }
+    }
+}
+
+fn explicit_model_selection(
+    req: &LocalInferenceModelDownloadRequest,
+) -> Result<Option<LocalModelSelection>> {
+    if let Some(backend_id) = req.backend_id.as_deref() {
+        let (repo_id, parsed_variant_id) = hf_models::parse_model_spec(&req.spec)
+            .map(|(repo_id, quantization)| (repo_id, Some(quantization)))
+            .unwrap_or_else(|_| (req.spec.clone(), None));
+        let variant_id = req.variant_id.clone().or(parsed_variant_id);
+        match backend_id {
+            "mlx" | "llamacpp" => Ok(Some(LocalModelSelection {
+                repo_id,
+                backend_id: backend_id.to_string(),
+                variant_id,
+            })),
+            _ => anyhow::bail!("Unknown local inference backend '{}'", backend_id),
+        }
+    } else {
+        Ok(None)
+    }
+}
+
+async fn local_model_id_from_request(
+    req: &LocalInferenceModelDownloadRequest,
+    selection: Option<&LocalModelSelection>,
+) -> Result<String> {
+    if let Some(selection) = selection {
+        return match selection.backend_id.as_str() {
+            "mlx" => Ok(selection.repo_id.clone()),
+            "llamacpp" => {
+                let quantization = selection.variant_id.as_deref().ok_or_else(|| {
+                    anyhow!(
+                        "llama.cpp model '{}' is missing a quantization",
+                        selection.repo_id
+                    )
+                })?;
+                Ok(model_id_from_repo(&selection.repo_id, quantization))
+            }
+            _ => anyhow::bail!("Unknown local inference backend '{}'", selection.backend_id),
+        };
+    }
+
+    if let Ok((repo_id, quantization)) = hf_models::parse_model_spec(&req.spec) {
+        return Ok(model_id_from_repo(&repo_id, &quantization));
+    }
+
+    let variants = hf_models::get_repo_local_variants(&req.spec).await?;
+    let has_llamacpp = variants
+        .iter()
+        .any(|variant| variant.backend_id == "llamacpp");
+    let mlx_variants: Vec<_> = variants
+        .iter()
+        .filter(|variant| variant.backend_id == "mlx")
+        .collect();
+    if mlx_variants.len() == 1 && !has_llamacpp {
+        Ok(req.spec.clone())
+    } else {
+        anyhow::bail!(
+            "Model spec '{}' is ambiguous; choose one of: {}",
+            req.spec,
+            variants
+                .iter()
+                .map(|variant| variant.download_id.as_str())
+                .collect::<Vec<_>>()
+                .join(", ")
+        )
+    }
+}
+
+fn mark_download_failed(model_id: &str, error: impl std::fmt::Display) {
+    let manager = get_download_manager();
+    let download_id = format!("{}-model", model_id);
+    if manager.get_progress(&download_id).is_none() {
+        manager.set_progress(DownloadProgress {
+            model_id: download_id.clone(),
+            status: DownloadStatus::Failed,
+            bytes_downloaded: 0,
+            total_bytes: 0,
+            progress_percent: 0.0,
+            speed_bps: None,
+            eta_seconds: None,
+            error: Some(error.to_string()),
+            task_exited: true,
+        });
+        return;
+    }
+
+    manager.update_progress(&download_id, |progress| {
+        if progress.status != DownloadStatus::Cancelled {
+            progress.status = DownloadStatus::Failed;
+            progress.error = Some(error.to_string());
+        }
+        progress.task_exited = true;
+    });
+}
+
+fn model_download_completed(model_id: &str) -> bool {
+    get_download_manager()
+        .get_progress(&format!("{}-model", model_id))
+        .is_some_and(|progress| progress.status == DownloadStatus::Completed)
+}
+
+fn register_pending_download_model(
+    model_id: &str,
+    req: &LocalInferenceModelDownloadRequest,
+    selection: Option<&LocalModelSelection>,
+) -> Result<()> {
+    let (repo_id, backend_id, variant_id) = if let Some(selection) = selection {
+        (
+            selection.repo_id.clone(),
+            selection.backend_id.clone(),
+            selection
+                .variant_id
+                .clone()
+                .unwrap_or_else(|| "default".to_string()),
+        )
+    } else if let Ok((repo_id, quantization)) = hf_models::parse_model_spec(&req.spec) {
+        (repo_id, "llamacpp".to_string(), quantization)
+    } else {
+        (req.spec.clone(), "mlx".to_string(), "default".to_string())
+    };
+
+    let mut registry = get_registry()
+        .lock()
+        .map_err(|_| anyhow!("Failed to acquire registry lock"))?;
+    if registry.has_model(model_id) {
+        return Ok(());
+    }
+
+    let mut settings = default_settings_for_model(model_id);
+    if backend_id != "llamacpp" {
+        settings.backend_id = Some(backend_id.clone());
+    }
+
+    let filename = variant_id.clone();
+    registry.add_model(LocalModelEntry {
+        id: model_id.to_string(),
+        repo_id,
+        filename: filename.clone(),
+        quantization: variant_id,
+        local_path: Paths::in_data_dir("models").join(filename),
+        source_url: req.spec.clone(),
+        backend_id: settings.backend_id.clone(),
+        storage: LocalModelStorage::HuggingFaceCache,
+        settings,
+        size_bytes: 0,
+        mmproj_path: None,
+        mmproj_source_url: None,
+        mmproj_size_bytes: 0,
+        mmproj_checked: false,
+        shard_files: vec![],
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn settings_round_trip_preserves_defaults() {
+        let settings = ModelSettings::default();
+        let dto = model_settings_to_dto(&settings);
+        let round_trip = model_settings_from_dto(dto);
+        assert_eq!(round_trip.repeat_penalty, settings.repeat_penalty);
+        assert_eq!(round_trip.repeat_last_n, settings.repeat_last_n);
+        assert_eq!(round_trip.enable_thinking, settings.enable_thinking);
+        assert_eq!(
+            round_trip.image_token_estimate,
+            settings.image_token_estimate
+        );
+    }
+
+    #[tokio::test]
+    async fn explicit_llamacpp_selection_derives_quantized_model_id() {
+        let req = LocalInferenceModelDownloadRequest {
+            spec: "test/repo".to_string(),
+            backend_id: Some("llamacpp".to_string()),
+            variant_id: Some("Q4_K_M".to_string()),
+        };
+        let selection = explicit_model_selection(&req).unwrap();
+        let model_id = local_model_id_from_request(&req, selection.as_ref())
+            .await
+            .unwrap();
+        assert_eq!(model_id, "test/repo:Q4_K_M");
+    }
+}

crates/goose-local-inference/src/multimodal.rs

@@ -1,8 +1,8 @@
 use base64::prelude::*;
 use serde_json::Value;
 
-use crate::conversation::message::{Message, MessageContent};
-use goose_providers::errors::ProviderError;
+use goose_provider_types::conversation::message::{Message, MessageContent};
+use goose_provider_types::errors::ProviderError;
 
 #[derive(Debug)]
 pub struct ExtractedImage {

crates/goose-local-inference/src/native_tool_parsing.rs

@@ -1,7 +1,7 @@
-use crate::conversation::message::{Message, MessageContent};
-use goose_providers::errors::ProviderError;
-use goose_providers::formats::openai::is_valid_function_name;
-use goose_providers::json::safely_parse_json;
+use goose_provider_types::conversation::message::{Message, MessageContent};
+use goose_provider_types::errors::ProviderError;
+use goose_provider_types::formats::openai::is_valid_function_name;
+use goose_provider_types::json::safely_parse_json;
 use rmcp::model::{object, CallToolRequestParams, ErrorCode, ErrorData};
 use serde_json::{json, Value};
 use std::borrow::Cow;

crates/goose-local-inference/src/paths.rs

@@ -0,0 +1,88 @@
+use etcetera::{choose_app_strategy, AppStrategy, AppStrategyArgs};
+use std::path::PathBuf;
+
+pub struct Paths;
+
+impl Paths {
+    fn get_dir(dir_type: DirType) -> PathBuf {
+        if let Ok(test_root) = std::env::var("GOOSE_PATH_ROOT") {
+            let base = PathBuf::from(test_root);
+            match dir_type {
+                DirType::Config => base.join("config"),
+                DirType::Data => base.join("data"),
+                DirType::State => base.join("state"),
+                DirType::Plugins => base.join(".agents").join("plugins"),
+                DirType::Agents => base.join(".agents").join("agents"),
+                DirType::AgentsHome => base.join(".agents"),
+            }
+        } else {
+            // NOTE: "Block" is kept here for backwards compatibility with existing
+            // user config/data directories (e.g. ~/Library/Application Support/Block/goose/).
+            // Changing this would orphan existing installations.
+            let strategy = choose_app_strategy(AppStrategyArgs {
+                top_level_domain: "Block".to_string(),
+                author: "Block".to_string(),
+                app_name: "goose".to_string(),
+            })
+            .expect("goose requires a home dir");
+
+            match dir_type {
+                DirType::Config => strategy.config_dir(),
+                DirType::Data => strategy.data_dir(),
+                DirType::State => strategy.state_dir().unwrap_or(strategy.data_dir()),
+                DirType::Plugins => strategy.home_dir().join(".agents").join("plugins"),
+                DirType::Agents => strategy.home_dir().join(".agents").join("agents"),
+                DirType::AgentsHome => strategy.home_dir().join(".agents"),
+            }
+        }
+    }
+
+    pub fn config_dir() -> PathBuf {
+        Self::get_dir(DirType::Config)
+    }
+
+    pub fn data_dir() -> PathBuf {
+        Self::get_dir(DirType::Data)
+    }
+
+    pub fn state_dir() -> PathBuf {
+        Self::get_dir(DirType::State)
+    }
+
+    pub fn plugins_dir() -> PathBuf {
+        Self::get_dir(DirType::Plugins)
+    }
+
+    pub fn agents_dir() -> PathBuf {
+        Self::get_dir(DirType::Agents)
+    }
+
+    pub fn agents_home_dir() -> PathBuf {
+        Self::get_dir(DirType::AgentsHome)
+    }
+
+    pub fn in_agents_home_dir(subpath: &str) -> PathBuf {
+        Self::agents_home_dir().join(subpath)
+    }
+
+    pub fn in_state_dir(subpath: &str) -> PathBuf {
+        Self::state_dir().join(subpath)
+    }
+
+    pub fn in_config_dir(subpath: &str) -> PathBuf {
+        Self::config_dir().join(subpath)
+    }
+
+    pub fn in_data_dir(subpath: &str) -> PathBuf {
+        Self::data_dir().join(subpath)
+    }
+}
+
+enum DirType {
+    Config,
+    Data,
+    State,
+    Plugins,
+    Agents,
+    AgentsHome,
+}

crates/goose-local-inference/src/prompt_template.rs

@@ -0,0 +1,43 @@
+use include_dir::{include_dir, Dir};
+use minijinja::{Environment, Error as MiniJinjaError, Value as MJValue};
+use serde::Serialize;
+
+use crate::paths::Paths;
+
+static CORE_PROMPTS_DIR: Dir = include_dir!("$CARGO_MANIFEST_DIR/src/prompts");
+
+pub fn render_string<T: Serialize>(
+    template_str: &str,
+    context: &T,
+) -> Result<String, MiniJinjaError> {
+    let mut env = Environment::new();
+    env.set_trim_blocks(true);
+    env.set_lstrip_blocks(true);
+    env.add_template("template", template_str)?;
+    let tmpl = env.get_template("template")?;
+    let ctx = MJValue::from_serialize(context);
+    let rendered = tmpl.render(ctx)?;
+    Ok(rendered.trim().to_string())
+}
+
+pub fn render_template<T: Serialize>(name: &str, context: &T) -> Result<String, MiniJinjaError> {
+    let user_path = Paths::config_dir().join("prompts").join(name);
+    let template_str = if user_path.exists() {
+        std::fs::read_to_string(&user_path).map_err(|e| {
+            MiniJinjaError::new(
+                minijinja::ErrorKind::InvalidOperation,
+                format!("Failed to read user template: {}", e),
+            )
+        })?
+    } else {
+        let file = CORE_PROMPTS_DIR.get_file(name).ok_or_else(|| {
+            MiniJinjaError::new(
+                minijinja::ErrorKind::TemplateNotFound,
+                format!("Built-in template '{}' not found", name),
+            )
+        })?;
+        String::from_utf8_lossy(file.contents()).to_string()
+    };
+
+    render_string(&template_str, context)
+}

crates/goose-local-inference/src/prompts/tiny_model_system.md

@@ -0,0 +1,22 @@
+You are goose, an autonomous AI agent created by AAIF (Agentic AI Foundation). You act on the user's
+behalf — you do not explain how to do things, you DO them directly.
+
+The OS is {{os}}, the shell is {{shell}}, and the working directory is {{working_directory}}
+
+When the user asks you to do something, take action immediately. Do not describe
+what you would do or give instructions — execute the commands yourself.
+
+To run a shell command, start a new line with $:
+
+$ ls
+
+Keep your responses brief. State what you are doing, then do it. For example:
+
+User: how many files are in /tmp?
+You: Let me check.
+$ ls -1 /tmp | wc -l
+
+After a command runs, you will see its output. Use the output to answer the user
+or take the next step. Do not repeat commands you have already run.
+
+Do not use shell commands if you already know the answer.

crates/goose-local-inference/src/provider_utils.rs

@@ -0,0 +1,24 @@
+pub fn filter_extensions_from_system_prompt(system: &str) -> String {
+    let Some(extensions_start) = system.find("# Extensions") else {
+        return system.to_string();
+    };
+
+    let Some(after_extensions) = system.get(extensions_start + 1..) else {
+        return system.to_string();
+    };
+
+    if let Some(next_section_pos) = after_extensions.find("\n# ") {
+        let Some(before) = system.get(..extensions_start) else {
+            return system.to_string();
+        };
+        let Some(after) = system.get(extensions_start + next_section_pos + 1..) else {
+            return system.to_string();
+        };
+        format!("{}{}", before.trim_end(), after)
+    } else {
+        system
+            .get(..extensions_start)
+            .map(|s| s.trim_end().to_string())
+            .unwrap_or_else(|| system.to_string())
+    }
+}

crates/goose-local-inference/src/thinking_output.rs

@@ -0,0 +1,81 @@
+use goose_provider_types::thinking::{FilterOut, ThinkFilter};
+
+pub(crate) struct ThinkingOutputFilter {
+    enabled: bool,
+    saw_structured_reasoning: bool,
+    think_filter: ThinkFilter,
+    pending_inline_thinking: String,
+    accumulated_thinking: String,
+}
+
+impl ThinkingOutputFilter {
+    pub(crate) fn new(enable_thinking: bool, generation_prompt: &str) -> Self {
+        let mut think_filter = ThinkFilter::new();
+        if enable_thinking && !generation_prompt.is_empty() {
+            let _ = think_filter.push(generation_prompt);
+        }
+
+        Self {
+            enabled: enable_thinking,
+            saw_structured_reasoning: false,
+            think_filter,
+            pending_inline_thinking: String::new(),
+            accumulated_thinking: String::new(),
+        }
+    }
+
+    pub(crate) fn push_structured_reasoning(&mut self, reasoning: &str) -> Option<String> {
+        if reasoning.is_empty() {
+            return None;
+        }
+
+        self.saw_structured_reasoning = true;
+        self.pending_inline_thinking.clear();
+        self.think_filter = ThinkFilter::new();
+        self.accumulated_thinking.push_str(reasoning);
+        Some(reasoning.to_string())
+    }
+
+    pub(crate) fn push_text(&mut self, text: &str) -> FilterOut {
+        if !self.enabled {
+            return FilterOut {
+                content: text.to_string(),
+                thinking: String::new(),
+            };
+        }
+
+        let mut filtered = self.think_filter.push(text);
+        if self.saw_structured_reasoning {
+            filtered.thinking.clear();
+        } else if !filtered.thinking.is_empty() {
+            self.pending_inline_thinking.push_str(&filtered.thinking);
+            filtered.thinking.clear();
+        }
+        filtered
+    }
+
+    pub(crate) fn finish(&mut self) -> FilterOut {
+        let mut filtered = if self.enabled && !self.saw_structured_reasoning {
+            std::mem::take(&mut self.think_filter).finish()
+        } else {
+            FilterOut::default()
+        };
+
+        if !self.saw_structured_reasoning {
+            let mut thinking = std::mem::take(&mut self.pending_inline_thinking);
+            thinking.push_str(&filtered.thinking);
+            if !thinking.is_empty() {
+                self.accumulated_thinking.push_str(&thinking);
+            }
+            filtered.thinking = thinking;
+        } else {
+            filtered.thinking.clear();
+        }
+
+        filtered
+    }
+
+    pub(crate) fn accumulated_thinking(&self) -> &str {
+        &self.accumulated_thinking
+    }
+}

crates/goose-local-inference/src/tool_emulation.rs

@@ -4,7 +4,7 @@
 //! as `$ command` on a new line and code blocks as ```execute_typescript fenced blocks.
 //! The parser converts those patterns into Goose tool-call messages.
 
-use crate::conversation::message::{Message, MessageContent};
+use goose_provider_types::conversation::message::{Message, MessageContent};
 use rmcp::model::{CallToolRequestParams, Tool};
 use serde_json::json;
 use std::borrow::Cow;

crates/goose-mcp/Cargo.toml

@@ -35,9 +35,9 @@ etcetera = { workspace = true }
 tempfile = { workspace = true }
 include_dir = { workspace = true }
 once_cell = { workspace = true }
-lopdf = { version = "0.41", default-features = false }
+lopdf = { version = "0.42", default-features = false }
 docx-rs = { version = "0.4.18", default-features = false, features = ["image"] }
 image = { version = "0.24.4", default-features = false, features = ["bmp", "dds", "dxt", "farbfeld", "gif", "hdr", "ico", "jpeg", "jpeg_rayon", "openexr", "png", "pnm", "tga", "tiff", "webp"] }
-umya-spreadsheet = { version = "2", default-features = false }
+umya-spreadsheet = { version = "3", default-features = false }
 shell-words = { workspace = true }
 process-wrap = { version = "9", default-features = false, features = ["std"] }

crates/goose-mcp/src/computercontroller/pdf_tool.rs

@@ -84,11 +84,11 @@ pub async fn pdf_tool(
                                                                             last_was_text = false;
                                                                         }
                                                                     }
-                                                                    Object::Real(offset) => {
-                                                                        if *offset < -100.0 {
-                                                                            text.push(' ');
-                                                                            last_was_text = false;
-                                                                        }
+                                                                    Object::Real(offset)
+                                                                        if *offset < -100.0 =>
+                                                                    {
+                                                                        text.push(' ');
+                                                                        last_was_text = false;
                                                                     }
                                                                     _ => {}
                                                                 }

crates/goose-mcp/src/computercontroller/xlsx_tool.rs

@@ -1,7 +1,7 @@
 use anyhow::{Context, Result};
 use serde::{Deserialize, Serialize};
 use std::path::Path;
-use umya_spreadsheet::{Spreadsheet, Worksheet};
+use umya_spreadsheet::{structs::Workbook, Worksheet};
 
 #[derive(Debug, Serialize, Deserialize)]
 pub struct WorksheetInfo {
@@ -28,7 +28,7 @@ pub struct RangeData {
 }
 
 pub struct XlsxTool {
-    workbook: Spreadsheet,
+    workbook: Workbook,
 }
 
 impl XlsxTool {
@@ -40,10 +40,10 @@ impl XlsxTool {
 
     pub fn list_worksheets(&self) -> Result<Vec<WorksheetInfo>> {
         let mut worksheets = Vec::new();
-        for (index, worksheet) in self.workbook.get_sheet_collection().iter().enumerate() {
+        for (index, worksheet) in self.workbook.sheet_collection().iter().enumerate() {
             let (column_count, row_count) = self.get_worksheet_dimensions(worksheet)?;
             worksheets.push(WorksheetInfo {
-                name: worksheet.get_name().to_string(),
+                name: worksheet.name().to_string(),
                 index,
                 column_count,
                 row_count,
@@ -54,13 +54,13 @@ impl XlsxTool {
 
     pub fn get_worksheet_by_name(&self, name: &str) -> Result<&Worksheet> {
         self.workbook
-            .get_sheet_by_name(name)
+            .sheet_by_name(name)
             .context("Worksheet not found")
     }
 
     pub fn get_worksheet_by_index(&self, index: usize) -> Result<&Worksheet> {
         self.workbook
-            .get_sheet_collection()
+            .sheet_collection()
             .get(index)
             .context("Worksheet index out of bounds")
     }
@@ -71,12 +71,12 @@ impl XlsxTool {
         let mut max_row = 0;
 
         // Iterate through all rows
-        for row_num in 1..=worksheet.get_highest_row() {
-            for col_num in 1..=worksheet.get_highest_column() {
-                if let Some(cell) = worksheet.get_cell((col_num, row_num)) {
-                    let coord = cell.get_coordinate();
-                    max_col = max_col.max(*coord.get_col_num() as usize);
-                    max_row = max_row.max(*coord.get_row_num() as usize);
+        for row_num in 1..=worksheet.highest_row() {
+            for col_num in 1..=worksheet.highest_column() {
+                if let Some(cell) = worksheet.cell((col_num, row_num)) {
+                    let coord = cell.coordinate();
+                    max_col = max_col.max(coord.col_num() as usize);
+                    max_row = max_row.max(coord.row_num() as usize);
                 }
             }
         }
@@ -86,9 +86,9 @@ impl XlsxTool {
 
     pub fn get_column_names(&self, worksheet: &Worksheet) -> Result<Vec<String>> {
         let mut names = Vec::new();
-        for col_num in 1..=worksheet.get_highest_column() {
-            if let Some(cell) = worksheet.get_cell((col_num, 1)) {
-                names.push(cell.get_value().into_owned());
+        for col_num in 1..=worksheet.highest_column() {
+            if let Some(cell) = worksheet.cell((col_num, 1)) {
+                names.push(cell.value().into_owned());
             } else {
                 names.push(String::new());
             }
@@ -104,13 +104,13 @@ impl XlsxTool {
         for row_idx in start_row..=end_row {
             let mut row_values = Vec::new();
             for col_idx in start_col..=end_col {
-                let cell_value = if let Some(cell) = worksheet.get_cell((col_idx, row_idx)) {
+                let cell_value = if let Some(cell) = worksheet.cell((col_idx, row_idx)) {
                     CellValue {
-                        value: cell.get_value().into_owned(),
-                        formula: if cell.get_formula().is_empty() {
+                        value: cell.value().into_owned(),
+                        formula: if cell.formula().is_empty() {
                             None
                         } else {
-                            Some(cell.get_formula().to_string())
+                            Some(cell.formula().to_string())
                         },
                     }
                 } else {
@@ -142,12 +142,10 @@ impl XlsxTool {
     ) -> Result<()> {
         let worksheet = self
             .workbook
-            .get_sheet_by_name_mut(worksheet_name)
+            .sheet_by_name_mut(worksheet_name)
             .context("Worksheet not found")?;
 
-        worksheet
-            .get_cell_mut((col, row))
-            .set_value(value.to_string());
+        worksheet.cell_mut((col, row)).set_value(value.to_string());
         Ok(())
     }
 
@@ -171,18 +169,18 @@ impl XlsxTool {
             search_text.to_string()
         };
 
-        for row_num in 1..=worksheet.get_highest_row() {
-            for col_num in 1..=worksheet.get_highest_column() {
-                if let Some(cell) = worksheet.get_cell((col_num, row_num)) {
+        for row_num in 1..=worksheet.highest_row() {
+            for col_num in 1..=worksheet.highest_column() {
+                if let Some(cell) = worksheet.cell((col_num, row_num)) {
                     let cell_value = if !case_sensitive {
-                        cell.get_value().to_lowercase()
+                        cell.value().to_lowercase()
                     } else {
-                        cell.get_value().to_string()
+                        cell.value().to_string()
                     };
 
                     if cell_value.contains(&search_text) {
-                        let coord = cell.get_coordinate();
-                        matches.push((*coord.get_row_num(), *coord.get_col_num()));
+                        let coord = cell.coordinate();
+                        matches.push((coord.row_num(), coord.col_num()));
                     }
                 }
             }
@@ -192,14 +190,14 @@ impl XlsxTool {
     }
 
     pub fn get_cell_value(&self, worksheet: &Worksheet, row: u32, col: u32) -> Result<CellValue> {
-        let cell = worksheet.get_cell((col, row)).context("Cell not found")?;
+        let cell = worksheet.cell((col, row)).context("Cell not found")?;
 
         Ok(CellValue {
-            value: cell.get_value().into_owned(),
-            formula: if cell.get_formula().is_empty() {
+            value: cell.value().into_owned(),
+            formula: if cell.formula().is_empty() {
                 None
             } else {
-                Some(cell.get_formula().to_string())
+                Some(cell.formula().to_string())
             },
         })
     }

crates/goose-mcp/src/lib.rs

@@ -19,8 +19,6 @@ mod memory;
 pub mod peekaboo;
 pub mod subprocess;
 pub mod tutorial;
-#[cfg(windows)]
-pub mod windows_job;
 
 pub use autovisualiser::AutoVisualiserRouter;
 pub use computercontroller::ComputerControllerServer;

crates/goose-mcp/src/memory/mod.rs

@@ -194,7 +194,7 @@ impl MemoryServer {
                     let category_memories = self.retrieve(&category, is_global, working_dir)?;
                     memories.insert(
                         category,
-                        category_memories.into_iter().flat_map(|(_, v)| v).collect(),
+                        category_memories.into_values().flatten().collect(),
                     );
                 }
             }

crates/goose-mcp/src/subprocess.rs

@@ -64,7 +64,7 @@ fn resolve_login_shell_path() -> Option<String> {
         .stdout(Stdio::piped())
         .stderr(Stdio::null());
 
-    // Spawn in a new session so that interactive shells job-control setup
+    // Spawn in a new session so that interactive shell job-control setup
     // cannot steal the terminal foreground from the parent goose process.
     cmd.wrap(ProcessSession);
 

crates/goose-mcp/src/windows_job.rs

@@ -1,22 +0,0 @@
-// Stub Windows Job Object helpers for MCP path (no-ops on Windows).
-// This file provides the minimal surface required by crates/goose-mcp/src/subprocess.rs
-// when built on Windows. The real Windows Job Object integration lives in the goose crate.
-
-#[cfg(windows)]
-pub type HANDLE = *mut std::ffi::c_void;
-
-#[cfg(windows)]
-pub fn ensure_job_object() -> Option<HANDLE> {
-    None
-}
-
-#[cfg(windows)]
-pub fn attach_pid_to_job(_pid: u32) {}
-
-#[cfg(windows)]
-pub fn init_windows_cleanup() {}
-
-#[cfg(windows)]
-pub fn windows_cleanup_enabled() -> bool {
-    false
-}

crates/goose-provider-types/Cargo.toml

@@ -0,0 +1,41 @@
+[package]
+name = "goose-provider-types"
+version = "0.1.0-alpha.0"
+edition.workspace = true
+rust-version.workspace = true
+authors.workspace = true
+license.workspace = true
+repository.workspace = true
+description.workspace = true
+
+[lints]
+workspace = true
+
+[dependencies]
+anyhow = { workspace = true }
+async-stream = { workspace = true }
+async-trait = { workspace = true }
+base64 = { workspace = true }
+chrono = { workspace = true }
+futures = { workspace = true }
+once_cell = { workspace = true }
+rand = { workspace = true }
+regex = { workspace = true, features = ["unicode"] }
+reqwest = { workspace = true }
+rmcp = { workspace = true, features = ["server", "macros"] }
+serde = { workspace = true }
+serde_json = { workspace = true }
+strum = { workspace = true }
+thiserror = { workspace = true }
+tokio = { workspace = true, features = ["time"] }
+tracing = { workspace = true }
+unicode-normalization = { version = "0.1.22", default-features = false, features = ["std"] }
+utoipa = { workspace = true, features = ["chrono"] }
+uuid = { workspace = true, features = ["v4", "std"] }
+
+[dev-dependencies]
+env-lock = { workspace = true }
+tempfile = { workspace = true }
+test-case = { workspace = true }
+tokio = { workspace = true, features = ["rt-multi-thread"] }
+tokio-stream = { workspace = true }

crates/goose-provider-types/src/base.rs

@@ -41,6 +41,10 @@ pub struct ProviderMetadata {
     /// Hint shown in the model picker when this provider manages its own model selection.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub model_selection_hint: Option<String>,
+    /// The name of a fast/cheap model to use for lightweight tasks (e.g. session naming,
+    /// compaction). When set, fast-path callers prefer this model over the main model.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub fast_model: Option<String>,
 }
 
 impl ProviderMetadata {
@@ -66,6 +70,7 @@ impl ProviderMetadata {
             config_keys,
             setup_steps: vec![],
             model_selection_hint: None,
+            fast_model: None,
         }
     }
 
@@ -88,6 +93,7 @@ impl ProviderMetadata {
             config_keys,
             setup_steps: vec![],
             model_selection_hint: None,
+            fast_model: None,
         }
     }
 
@@ -102,6 +108,7 @@ impl ProviderMetadata {
             config_keys: vec![],
             setup_steps: vec![],
             model_selection_hint: None,
+            fast_model: None,
         }
     }
 
@@ -114,6 +121,11 @@ impl ProviderMetadata {
         self.model_selection_hint = Some(hint.to_string());
         self
     }
+
+    pub fn with_fast_model(mut self, fast_model: &str) -> Self {
+        self.fast_model = Some(fast_model.to_string());
+        self
+    }
 }
 
 /// Configuration key metadata for provider setup
@@ -291,12 +303,12 @@ pub fn model_info_for_provider_model(provider_name: &str, model_name: &str) -> M
     let reasoning = canonical
         .as_ref()
         .and_then(|model| model.reasoning)
-        .unwrap_or_else(|| ModelConfig::new_or_fail(model_name).is_reasoning_model());
+        .unwrap_or_else(|| ModelConfig::new(model_name).is_reasoning_model());
 
     ModelInfo {
         name: model_name.to_string(),
         resolved_model: None,
-        context_limit: ModelConfig::new_or_fail(model_name)
+        context_limit: ModelConfig::new(model_name)
             .with_canonical_limits(provider_name)
             .context_limit(),
         input_token_cost: None,
@@ -371,75 +383,34 @@ pub trait Provider: Send + Sync {
     fn get_name(&self) -> &str;
 
     /// Primary streaming method that all providers must implement.
-    ///
-    /// Note: Do not add `#[instrument]` here — the call sites (`complete` and
-    /// `stream_response_from_provider`) create the telemetry span so that
-    /// `session.id` is set once rather than in every provider.
     async fn stream(
         &self,
         model_config: &ModelConfig,
-        session_id: &str,
         system: &str,
         messages: &[Message],
         tools: &[Tool],
     ) -> Result<MessageStream, ProviderError>;
 
-    /// Complete with a specific model config.
-    #[tracing::instrument(
-        skip(self, model_config, session_id, system, messages, tools),
-        fields(session.id = %session_id, gen_ai.request.model = %model_config.model_name)
-    )]
     async fn complete(
         &self,
         model_config: &ModelConfig,
-        session_id: &str,
         system: &str,
         messages: &[Message],
         tools: &[Tool],
     ) -> Result<(Message, ProviderUsage), ProviderError> {
-        let stream = self
-            .stream(model_config, session_id, system, messages, tools)
-            .await?;
+        let stream = self.stream(model_config, system, messages, tools).await?;
         collect_stream(stream).await
     }
 
-    /// Try fast model first, fall back to regular model on failure.
-    async fn complete_fast(
-        &self,
-        session_id: &str,
-        system: &str,
-        messages: &[Message],
-        tools: &[Tool],
-    ) -> Result<(Message, ProviderUsage), ProviderError> {
-        let model_config = self.get_model_config();
-        let fast_config = model_config.use_fast_model();
-
-        let result = self
-            .complete(&fast_config, session_id, system, messages, tools)
-            .await;
-
-        match result {
-            Ok(response) => Ok(response),
-            Err(e) => {
-                if fast_config.model_name != model_config.model_name {
-                    tracing::warn!(
-                        "Fast model {} failed with error: {}. Falling back to regular model {}",
-                        fast_config.model_name,
-                        e,
-                        model_config.model_name
-                    );
-                    self.complete(&model_config, session_id, system, messages, tools)
-                        .await
-                } else {
-                    Err(e)
-                }
-            }
-        }
+    /// Resolve the effective context limit for a model config.
+    ///
+    /// Providers may override this to enrich the limit with provider-specific
+    /// metadata (e.g. cached model info or a value captured from a remote
+    /// session). The default returns the limit derived from the model config.
+    async fn get_context_limit(&self, model_config: &ModelConfig) -> Result<usize, ProviderError> {
+        Ok(model_config.context_limit())
     }
 
-    /// Get the model config from the provider
-    fn get_model_config(&self) -> ModelConfig;
-
     fn retry_config(&self) -> RetryConfig {
         RetryConfig::default()
     }
@@ -466,7 +437,10 @@ pub trait Provider: Send + Sync {
     }
 
     /// Fetch inventory models filtered by canonical registry and usability.
-    async fn fetch_recommended_models(&self) -> Result<Vec<String>, ProviderError> {
+    ///
+    /// When `toolshim` is true, models that lack native tool-call support are
+    /// retained because the toolshim layer emulates tool calling.
+    async fn fetch_recommended_models(&self, toolshim: bool) -> Result<Vec<String>, ProviderError> {
         let all_models = self.fetch_supported_models().await?;
 
         if self.skip_canonical_filtering() {
@@ -496,7 +470,7 @@ pub trait Provider: Send + Sync {
                     return None;
                 }
 
-                if !canonical_model.tool_call && !self.get_model_config().toolshim {
+                if !canonical_model.tool_call && !toolshim {
                     return None;
                 }
 
@@ -526,9 +500,12 @@ pub trait Provider: Send + Sync {
         }
     }
 
-    async fn fetch_recommended_model_info(&self) -> Result<Vec<ModelInfo>, ProviderError> {
+    async fn fetch_recommended_model_info(
+        &self,
+        toolshim: bool,
+    ) -> Result<Vec<ModelInfo>, ProviderError> {
         Ok(self
-            .fetch_recommended_models()
+            .fetch_recommended_models(toolshim)
             .await?
             .iter()
             .map(|model_name| model_info_for_provider_model(self.get_name(), model_name))
@@ -558,10 +535,6 @@ pub trait Provider: Send + Sync {
         false
     }
 
-    async fn supports_cache_control(&self) -> bool {
-        false
-    }
-
     /// Configure OAuth authentication for this provider
     ///
     /// This method is called when a provider has configuration keys marked with oauth_flow = true.

crates/goose-provider-types/src/canonical.rs

@@ -28,7 +28,7 @@ impl ModelMapping {
 ///
 /// This avoids network calls by looking up all known models for the provider,
 /// filtering to text-input + tool-calling models, and sorting by release date.
-/// The returned names are the canonical short names (e.g. "claude-3.5-sonnet").
+/// The returned names are the canonical short names (e.g. "claude-sonnet-4.5").
 ///
 /// TODO: This trades speed for correctness — the canonical registry may not perfectly
 /// match what the provider API returns (new models not yet in the registry, deprecated
@@ -110,8 +110,8 @@ mod tests {
 
     #[test]
     fn cloud_provider_retains_cost() {
-        let canonical = maybe_get_canonical_model("anthropic", "claude-3-5-sonnet-20241022")
-            .expect("claude-3.5-sonnet should resolve");
+        let canonical = maybe_get_canonical_model("anthropic", "claude-sonnet-4-5-20250929")
+            .expect("claude-sonnet-4.5 should resolve");
         assert!(canonical.cost.input.is_some());
         assert!(canonical.cost.output.is_some());
     }

crates/goose-provider-types/src/canonical/README.md

@@ -1,8 +1,8 @@
 # Canonical Model System
 
 Provides a unified view of model metadata (pricing, capabilities, context limits) across different LLM providers. 
-Normalizes provider-specific model names (e.g., `claude-3-5-sonnet-20241022`) 
-to canonical IDs (e.g., `anthropic/claude-3.5-sonnet`).
+Normalizes provider-specific model names (e.g., `claude-sonnet-4-5-20250929`)
+to canonical IDs (e.g., `anthropic/claude-sonnet-4.5`).
 
 ## Build Canonical Models
 Fetches latest model metadata from OpenRouter and validates provider mappings:
@@ -13,11 +13,11 @@ cargo run --bin build_canonical_models --no-check   # Build only, skip checker
 
 This script performs two operations by default:
 1. **Builds canonical models** - Fetches from OpenRouter API and updates the registry
-   - Writes to: `crates/goose-providers/src/canonical/data/canonical_models.json`
+   - Writes to: `crates/goose-provider-types/src/canonical/data/canonical_models.json`
 2. **Checks model mappings** (unless `--no-check` is passed) - Tests provider mappings and tracks changes over time
    - Reports unmapped models
    - Compares with previous runs (like a lock file)
    - Shows changed/added/removed mappings
-   - Writes to: `crates/goose-providers/src/canonical/data/canonical_mapping_report.json`
+   - Writes to: `crates/goose-provider-types/src/canonical/data/canonical_mapping_report.json`
 
 The script is currently built from `crates/goose/src/bin/build_canonical_models.rs` and writes into this crate's `src/canonical/data` directory.