Merge remote-tracking branch 'origin/main' into summon_extension

* origin/main: (55 commits)
  test(mcp): add image tool test and consolidate MCP test fixtures (#7019)
  fix: remove Option from model listing return types, propagate errors (#7074)
  fix: lazy provider creation for goose acp (#7026) (#7066)
  Smoke tests: split compaction test and use debug build (#6984)
  fix(deps): trim bat to resolve RUSTSEC-2024-0320 (#7061)
  feat: expose AGENT_SESSION_ID env var to extension child processes (#7072)
  fix: add XML tool call parsing fallback for Qwen3-coder via Ollama (#6882)
  Remove clippy too_many_lines lint and decompose long functions (#7064)
  refactor: move disable_session_naming into AgentConfig (#7062)
  Add global config switch to disable automatic session naming (#7052)
  docs: add blog post - 8 Things You Didn't Know About Code Mode (#7059)
  fix: ensure animated elements are visible when prefers-reduced-motion is enabled (#7047)
  Show recommended model on failture (#7040)
  feat(ui): add session content search via API (#7050)
  docs: fix img url (#7053)
  Desktop UI for deleting custom providers (#7042)
  Add blog post: How I Used RPI to Build an OpenClaw Alternative (#7051)
  Remove build-dependencies section from Cargo.toml (#6946)
  add /rp-why skill blog post (#6997)
  fix: fix snake_case function names in code_execution instructions (#7035)
  ...

# Conflicts:
#	scripts/test_subrecipes.sh

Author: tlongwell-block

.github/copilot-instructions.md

@@ -56,7 +56,7 @@
 **Rust checks:**
 - `cargo fmt --check` - Code formatting (rustfmt)
 - `cargo test --jobs 2` - All tests
-- `./scripts/clippy-lint.sh` - Linting (clippy)
+- `cargo clippy --all-targets -- -D warnings` - Linting (clippy)
 - `just check-openapi-schema` - OpenAPI schema validation
 
 **Desktop app checks:**
@@ -76,7 +76,7 @@
 
 Do not comment on:
 - **Style/formatting** - CI handles this (rustfmt, prettier)
-- **Clippy warnings** - CI handles this (clippy-lint.sh)
+- **Clippy warnings** - CI handles this (clippy)
 - **Test failures** - CI handles this (full test suite)
 - **Missing dependencies** - CI handles this (npm ci will fail)
 - **Minor naming suggestions** - unless truly confusing

.github/workflows/cargo-audit.yml

@@ -0,0 +1,32 @@
+name: "Cargo Audit"
+on:
+  push:
+    paths:
+      # Run if workflow changes
+      - '.github/workflows/cargo-audit.yml'
+      # Run on changed dependencies
+      - '**/Cargo.toml'
+      - '**/Cargo.lock'
+      # Run if the configuration file changes
+      - '**/audit.toml'
+  # Rerun periodically to pick up new advisories
+  schedule:
+    - cron: '0 0 * * *'
+  # Run manually
+  workflow_dispatch:
+
+jobs:
+  audit:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      issues: write
+    steps:
+      - uses: actions/checkout@v4
+        # https://github.com/marketplace/actions/cargo-audit-your-rust-dependencies
+      - uses: actions-rust-lang/audit@72c09e02f132669d52284a3323acdb503cfc1a24
+        name: Audit Rust Dependencies
+        with:
+          # sqlx-mysql pulls in rsa, but goose only uses sqlite. cargo-audit
+          # can't distinguish used from unused deps (rustsec/rustsec#1119).
+          ignore: RUSTSEC-2023-0071

.github/workflows/ci.yml

@@ -95,7 +95,10 @@ jobs:
           # play nicely with hermit-managed rust
           hermit uninstall rustup
           export CARGO_INCREMENTAL=0
-          ./scripts/clippy-lint.sh
+          cargo clippy --all-targets -- -D warnings
+
+      - name: Check for banned TLS crates
+        run: ./scripts/check-no-native-tls.sh
 
   openapi-schema-check:
     name: Check OpenAPI Schema is Up-to-Date

.github/workflows/goose-issue-solver.yml

@@ -95,7 +95,7 @@ env:
       - [ ] cargo check
       - [ ] cargo test (affected crates)
       - [ ] cargo fmt
-      - [ ] ./scripts/clippy-lint.sh
+      - [ ] cargo clippy --all-targets -- -D warnings
       - [ ] Fix failures, retry up to 3 times
 
       ## Phase 6: Confirm (MANDATORY)

.github/workflows/pr-smoke-test.yml

@@ -45,7 +45,7 @@ jobs:
               - '!documentation/**'
 
   build-binary:
-    name: Build Release Binary
+    name: Build Binary
     runs-on: ubuntu-latest
     needs: changes
     if: needs.changes.outputs.code == 'true' || github.event_name == 'workflow_dispatch'
@@ -65,15 +65,15 @@ jobs:
       - name: Cache Rust dependencies
         uses: Swatinem/rust-cache@v2
 
-      - name: Build Release Binary for Smoke Tests
+      - name: Build Binary for Smoke Tests
         run: |
-          cargo build --release
+          cargo build --bin goose
 
       - name: Upload Binary for Smoke Tests
         uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6.0.0
         with:
           name: goose-binary
-          path: target/release/goose
+          path: target/debug/goose
           retention-days: 1
 
   smoke-tests:
@@ -90,10 +90,10 @@ jobs:
         uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131  # v7.0.0
         with:
           name: goose-binary
-          path: target/release
+          path: target/debug
 
       - name: Make Binary Executable
-        run: chmod +x target/release/goose
+        run: chmod +x target/debug/goose
 
       - name: Run Smoke Tests with Provider Script
         env:
@@ -152,17 +152,6 @@ jobs:
         run: |
           bash scripts/test_subrecipes.sh
 
-      - name: Run Compaction Tests
-        env:
-          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
-          GOOSE_PROVIDER: anthropic
-          GOOSE_MODEL: claude-sonnet-4-5-20250929
-          HOME: /tmp/goose-home
-          GOOSE_DISABLE_KEYRING: 1
-          SKIP_BUILD: 1
-        run: |
-          bash scripts/test_compaction.sh
-
   smoke-tests-code-exec:
     name: Smoke Tests (Code Execution)
     runs-on: ubuntu-latest
@@ -177,10 +166,10 @@ jobs:
         uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131  # v7.0.0
         with:
           name: goose-binary
-          path: target/release
+          path: target/debug
 
       - name: Make Binary Executable
-        run: chmod +x target/release/goose
+        run: chmod +x target/debug/goose
 
       - name: Run Provider Tests (Code Execution Mode)
         env:
@@ -200,3 +189,43 @@ jobs:
           mkdir -p $HOME/.local/share/goose/sessions
           mkdir -p $HOME/.config/goose
           bash scripts/test_providers.sh --code-exec
+
+  compaction-tests:
+    name: Compaction Tests
+    runs-on: ubuntu-latest
+    needs: build-binary
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
+        with:
+          ref: ${{ github.event.inputs.branch || github.ref }}
+
+      - name: Download Binary
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131  # v7.0.0
+        with:
+          name: goose-binary
+          path: target/debug
+
+      - name: Make Binary Executable
+        run: chmod +x target/debug/goose
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@61cb8a9741eeb8a550a1b8544337180c0fc8476b  # v7.2.0
+
+      - name: Run Compaction Tests
+        env:
+          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+          GOOSE_PROVIDER: anthropic
+          GOOSE_MODEL: claude-sonnet-4-5-20250929
+          HOME: /tmp/goose-home
+          GOOSE_DISABLE_KEYRING: 1
+          SKIP_BUILD: 1
+        run: |
+          mkdir -p $HOME/.local/share/goose/sessions
+          mkdir -p $HOME/.config/goose
+          bash scripts/test_compaction.sh

AGENTS.md

@@ -28,8 +28,7 @@ just record-mcp-tests        # record MCP
 ### Lint/Format
 ```bash
 cargo fmt
-./scripts/clippy-lint.sh
-cargo clippy --fix
+cargo clippy --all-targets -- -D warnings
 ```
 
 ### UI
@@ -63,7 +62,7 @@ ui/desktop/           # Electron app
 # 3. cargo fmt
 # 4. cargo build
 # 5. cargo test -p <crate>
-# 6. ./scripts/clippy-lint.sh
+# 6. cargo clippy --all-targets -- -D warnings
 # 7. [if server] just generate-openapi
 ```
 
@@ -92,7 +91,7 @@ Logging: Clean up existing logs, don't add more unless for errors or security ev
 Never: Edit ui/desktop/openapi.json manually
 Never: Edit Cargo.toml use cargo add
 Never: Skip cargo fmt
-Never: Merge without ./scripts/clippy-lint.sh
+Never: Merge without running clippy
 Never: Comment self-evident operations (`// Initialize`, `// Return result`), getters/setters, constructors, or standard Rust idioms
 
 ## Entry Points

CONTRIBUTING.md

@@ -103,7 +103,7 @@ When making changes to the Rust code, test them on the CLI or run checks, tests,
 cargo check  # verify changes compile
 cargo test  # run tests with changes
 cargo fmt   # format code
-./scripts/clippy-lint.sh # run the linter
+cargo clippy --all-targets -- -D warnings # run the linter
 ```
 
 ### Node