Merge remote-tracking branch 'origin/main' into tlongwell/slsa-build-provenance

* origin/main: (68 commits)
  Upgraded npm packages for latest security updates (#7183)
  docs: reasoning effort levels for Codex provider (#6798)
  Fix speech local (#7181)
  chore: add .gooseignore to .gitignore (#6826)
  Improve error message logging from electron (#7130)
  chore(deps): bump jsonwebtoken from 9.3.1 to 10.3.0 (#6924)
  docs: standalone mcp apps and apps extension (#6791)
  workflow: auto-update cli-commands on release (#6755)
  feat(apps): Integrate AppRenderer from @mcp-ui/client SDK (#7013)
  fix(MCP): decode resource content (#7155)
  feat: reasoning_content in API for reasoning models (#6322)
  Fix/configure add provider custom headers (#7157)
  fix: handle keyring fallback as success (#7177)
  Update process-wrap to 9.0.3 (9.0.2 is yanked) (#7176)
  feat: support extra field in chatcompletion tool_calls for gemini openai compat (#6184)
  fix: replace panic with proper error handling in get_tokenizer (#7175)
  Lifei/smoke test for developer (#7174)
  fix text editor view broken (#7167)
  docs: White label guide (#6857)
  Add PATH detection back to developer extension (#7161)
  ...

# Conflicts:
#	.github/workflows/nightly.yml

Author: tlongwell-block

.github/workflows/build-cli.yml

@@ -65,7 +65,6 @@ jobs:
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
         with:
           ref: ${{ inputs.ref }}
-          fetch-depth: 0
 
       - name: Update version in Cargo.toml
         if: ${{ inputs.version != '' }}

.github/workflows/build-notify.yml

@@ -5,6 +5,7 @@ on:
     workflows:
       - CI
       - Release
+      - Canary
     types: [completed]
 
 

.github/workflows/bundle-desktop-intel.yml

@@ -48,7 +48,6 @@ jobs:
         with:
           # Only pass ref if it's explicitly set, otherwise let checkout action use its default behavior
           ref: ${{ inputs.ref != '' && inputs.ref || '' }}
-          fetch-depth: 0
 
       # Update versions before build
       - name: Update versions

.github/workflows/bundle-desktop-linux.yml

@@ -28,7 +28,6 @@ jobs:
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
         with:
           ref: ${{ inputs.ref }}
-          fetch-depth: 0
 
       - name: Update versions
         if: ${{ inputs.version != '' }}

.github/workflows/bundle-desktop-windows.yml

@@ -41,7 +41,6 @@ jobs:
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
         with:
           ref: ${{ inputs.ref != '' && inputs.ref || '' }}
-          fetch-depth: 0
 
       - name: Configure AWS credentials
         if: inputs.signing && inputs.signing == true
@@ -123,6 +122,13 @@ jobs:
             echo "Windows-specific files copied successfully"
           fi
 
+      - name: Force GitHub HTTPS for npm git dependencies
+        shell: bash
+        run: |
+          git config --global url."https://github.com/".insteadOf "ssh://git@github.com/"
+          git config --global url."https://github.com/".insteadOf "git@github.com:"
+          git config --global url."https://github.com/".insteadOf "git+ssh://git@github.com/"
+
       - name: Build desktop UI with npm
         shell: bash
         env:

.github/workflows/bundle-desktop.yml

@@ -76,7 +76,6 @@ jobs:
         with:
           # Only pass ref if it's explicitly set, otherwise let checkout action use its default behavior
           ref: ${{ inputs.ref != '' && inputs.ref || '' }}
-          fetch-depth: 0
 
       - name: Debug git status
         run: |

.github/workflows/canary.yml

@@ -1,7 +1,7 @@
 # This workflow is for canary releases, automatically triggered by push to main
 # This workflow is identical to "release.yml" with these exceptions:
 #  - Triggered by push to main
-#  - Github Release tagged as "canary"
+#  - GitHub Release tagged as "canary"
 on:
   push:
     paths-ignore:
@@ -139,7 +139,7 @@ jobs:
             Goose*.zip
             *.deb
             *.rpm
-            **/*.flatpak
+            *.flatpak
             download_cli.sh
           allowUpdates: true
           omitBody: true

.github/workflows/docs-update-cli-ref.yml

@@ -0,0 +1,304 @@
+# Automatically updates the CLI Commands Guide when CLI commands or options
+# change between releases.
+#
+# Triggers: Manual (for testing) or on release (production)
+# Testing: Use dry_run mode to review outputs without creating PRs
+# See: documentation/automation/cli-command-tracking/TESTING.md
+
+name: Update CLI Documentation
+
+on:
+  workflow_dispatch:  # Manual trigger for testing
+    inputs:
+      old_version:
+        description: 'Previous version (e.g., v1.14.0). Leave empty to auto-detect.'
+        required: false
+        type: string
+      new_version:
+        description: 'New version (e.g., v1.15.0). Leave empty to use HEAD.'
+        required: false
+        type: string
+      dry_run:
+        description: 'Dry run mode - generate files but do not create PR'
+        required: false
+        type: boolean
+        default: true
+      
+  # Automatic triggering on releases
+  # Uses edited to catch when release-action updates the release with artifacts
+  release:
+    types: [edited]
+
+permissions:
+  contents: write       # Create branches and commit files
+  pull-requests: write  # Create PRs
+
+jobs:
+  update-docs:
+    name: Update CLI Documentation
+    runs-on: ubuntu-latest
+    
+    env:
+      ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+    
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          fetch-depth: 0  # Fetch all history for version comparison
+          fetch-tags: true  # Fetch all tags so we can checkout version tags
+      
+      - name: Fetch upstream tags (for forks)
+        if: github.repository != 'block/goose'
+        run: |
+          # Add upstream remote and fetch tags (only needed when testing in forks)
+          git remote add upstream https://github.com/block/goose.git || git remote set-url upstream https://github.com/block/goose.git
+          git fetch upstream --tags --force
+          echo "✅ Fetched tags from upstream (fork mode)"
+          echo "Total tags available: $(git tag | wc -l)"
+      
+      - name: Install system dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y jq ripgrep
+      
+      - name: Set up Rust
+        uses: actions-rust-lang/setup-rust-toolchain@1780873c7b576612439a134613cc4cc74ce5538c # v1
+        with:
+          toolchain: stable
+      
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        with:
+          python-version: '3.11'
+      
+      - name: Set up Node.js
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: '20'
+      
+      - name: Install goose CLI
+        run: |
+          mkdir -p /home/runner/.local/bin
+          curl -fsSL https://github.com/block/goose/releases/download/stable/download_cli.sh \
+            | CONFIGURE=false GOOSE_BIN_DIR=/home/runner/.local/bin bash
+          echo "/home/runner/.local/bin" >> $GITHUB_PATH
+          goose --version
+      
+      - name: Configure goose for CI
+        env:
+          GOOSE_PROVIDER: ${{ vars.GOOSE_PROVIDER || 'anthropic' }}
+          GOOSE_MODEL: ${{ vars.GOOSE_MODEL || 'claude-opus-4-5' }}
+        run: |
+          mkdir -p ~/.config/goose
+          cat <<EOF > ~/.config/goose/config.yaml
+          GOOSE_PROVIDER: $GOOSE_PROVIDER
+          GOOSE_MODEL: $GOOSE_MODEL
+          keyring: false
+          EOF
+
+          # Also export into the job environment so later steps can log the values
+          echo "GOOSE_PROVIDER=$GOOSE_PROVIDER" >> "$GITHUB_ENV"
+          echo "GOOSE_MODEL=$GOOSE_MODEL" >> "$GITHUB_ENV"
+
+          echo "✅ Created goose config:"
+          cat ~/.config/goose/config.yaml
+      
+      - name: Determine versions to compare
+        id: versions
+        env:
+          GH_TOKEN: ${{ github.token }}
+          INPUT_OLD_VERSION: ${{ github.event.inputs.old_version }}
+          INPUT_NEW_VERSION: ${{ github.event.inputs.new_version }}
+          EVENT_NAME: ${{ github.event_name }}
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+        run: |
+          get_previous_release() {
+            gh release list --limit 2 --json tagName --jq '.[].tagName' | sed -n '2p'
+          }
+          
+          if [ -n "$INPUT_OLD_VERSION" ]; then
+            OLD_VERSION="$INPUT_OLD_VERSION"
+          else
+            OLD_VERSION=$(get_previous_release)
+          fi
+          
+          if [ -n "$INPUT_NEW_VERSION" ]; then
+            NEW_VERSION="$INPUT_NEW_VERSION"
+          elif [ "$EVENT_NAME" = "release" ]; then
+            NEW_VERSION="$RELEASE_TAG"
+          else
+            NEW_VERSION="HEAD"  # For testing unreleased changes
+          fi
+          
+          if [ -z "$OLD_VERSION" ] || [ -z "$NEW_VERSION" ]; then
+            echo "Error: Could not determine versions to compare"
+            exit 1
+          fi
+          
+          echo "old_version=$OLD_VERSION" >> $GITHUB_OUTPUT
+          echo "new_version=$NEW_VERSION" >> $GITHUB_OUTPUT
+          echo "OLD_VERSION=$OLD_VERSION" >> $GITHUB_ENV
+          echo "NEW_VERSION=$NEW_VERSION" >> $GITHUB_ENV
+          
+          echo "✅ Comparing $OLD_VERSION → $NEW_VERSION"
+      
+      - name: Extract and compare CLI structures
+        id: extract
+        timeout-minutes: 30  # Building goose takes time
+        working-directory: documentation/automation/cli-command-tracking
+        env:
+          GOOSE_REPO: ${{ github.workspace }}
+        run: |
+          set -o pipefail  # Ensure pipeline failures are caught
+          
+          mkdir -p output
+          ./scripts/run-pipeline.sh "$OLD_VERSION" "$NEW_VERSION" 2>&1 | tee output/pipeline.log
+          
+          HAS_CHANGES=$(jq -r '.has_changes' output/cli-changes.json)
+          echo "has_changes=$HAS_CHANGES" >> $GITHUB_OUTPUT
+          
+          if [ "$HAS_CHANGES" = "false" ]; then
+            echo "✅ No changes detected"
+          else
+            echo "✅ Changes detected"
+          fi
+      
+      - name: Update goose-cli-commands.md (AI synthesis)
+        if: steps.extract.outputs.has_changes == 'true'
+        timeout-minutes: 10
+        working-directory: documentation/automation/cli-command-tracking/output
+        env:
+          CLI_COMMANDS_PATH: ${{ github.workspace }}/documentation/docs/guides/goose-cli-commands.md
+        run: |
+          echo "🔍 Environment diagnostics:"
+          echo "  GOOSE_PROVIDER: $GOOSE_PROVIDER"
+          echo "  GOOSE_MODEL: $GOOSE_MODEL"
+          echo "  ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY:0:8}..." # Show first 8 chars only
+          echo "  CLI_COMMANDS_PATH: $CLI_COMMANDS_PATH"
+          echo "  HOME: $HOME"
+          echo "  PATH: $PATH"
+          echo ""
+          echo "📁 Goose config file:"
+          cat ~/.config/goose/config.yaml || echo "Config file not found!"
+          echo ""
+          echo "📁 Current directory:"
+          pwd
+          ls -la
+          echo ""
+          echo "🤖 Applying changes to goose-cli-commands.md..."
+          goose run --recipe ../recipes/update-cli-commands.yaml
+      
+      - name: Upload automation outputs
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: cli-docs-update-${{ steps.versions.outputs.old_version }}-to-${{ steps.versions.outputs.new_version }}
+          path: |
+            documentation/automation/cli-command-tracking/output/*.json
+            documentation/automation/cli-command-tracking/output/*.md
+            documentation/automation/cli-command-tracking/output/*.log
+          retention-days: 30
+      
+      - name: Create Pull Request
+        if: |
+          steps.extract.outputs.has_changes == 'true' && 
+          (github.event.inputs.dry_run != 'true' || github.event_name == 'release')
+        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0  # v8.1.0
+        with:
+          branch: docs/auto-cli-commands-${{ steps.versions.outputs.new_version }}
+          delete-branch: true
+          
+          commit-message: |
+            docs: Update CLI commands for ${{ steps.versions.outputs.new_version }}
+            
+            Automated update based on CLI changes between ${{ steps.versions.outputs.old_version }} and ${{ steps.versions.outputs.new_version }}.
+          
+          title: "docs: Update CLI Commands Guide for ${{ steps.versions.outputs.new_version }}"
+          body: |
+            ## Summary
+
+            This PR updates the CLI Commands Guide based on command and option changes detected between **${{ steps.versions.outputs.old_version }}** and **${{ steps.versions.outputs.new_version }}**.
+
+            ### Type of Change
+            - [x] Documentation
+
+            ### AI Assistance
+            - [x] This PR was created or reviewed with AI assistance
+
+            #### 🤖 Automation Details
+            
+            - **Workflow**: docs-update-cli-ref.yml
+            - **Triggered by**: ${{ github.event_name }}
+            - **Previous version**: ${{ steps.versions.outputs.old_version }}
+            - **New version**: ${{ steps.versions.outputs.new_version }}
+            
+            #### 📋 Changes Detected
+            
+            Review the workflow artifacts for detailed change analysis:
+            - cli-changes.json - Structured diff of changes
+            - cli-changes.md - Human-readable change documentation
+            - update-summary.md - Summary of documentation updates applied
+            
+            Download artifacts from the [workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}).
+            
+            ### ✅ Review Checklist
+            
+            - [ ] Verify all CLI changes are accurately documented
+            - [ ] Check that examples are updated correctly
+            - [ ] Ensure new commands are in the correct sections
+            - [ ] Confirm no unintended changes were made
+            
+            ### 🔗 Related
+            
+            - Release: ${{ github.event.release.html_url || 'N/A' }}
+            
+            ---
+            
+            *This PR was automatically generated by the CLI Documentation Automation workflow.*
+          
+          labels: |
+            documentation
+            automated
+            cli-commands
+      
+      - name: Workflow summary
+        if: always()
+        env:
+          OLD_VERSION: ${{ steps.versions.outputs.old_version }}
+          NEW_VERSION: ${{ steps.versions.outputs.new_version }}
+          HAS_CHANGES: ${{ steps.extract.outputs.has_changes }}
+          DRY_RUN: ${{ github.event.inputs.dry_run || 'false' }}
+        run: |
+          echo "## 📊 CLI Documentation Update Summary" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "**Version Comparison**: $OLD_VERSION → $NEW_VERSION" >> $GITHUB_STEP_SUMMARY
+          echo "**Changes Detected**: $HAS_CHANGES" >> $GITHUB_STEP_SUMMARY
+          echo "**Dry Run Mode**: $DRY_RUN" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          
+          if [ "$HAS_CHANGES" = "true" ]; then
+            echo "### ✅ Documentation Updated" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "The CLI Commands Guide has been updated to reflect changes in $NEW_VERSION." >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            
+            if [ "$DRY_RUN" = "true" ]; then
+              echo "**Note**: Running in dry-run mode - no PR was created. Review the artifacts to see the generated changes." >> $GITHUB_STEP_SUMMARY
+            else
+              echo "A pull request has been created with the documentation updates." >> $GITHUB_STEP_SUMMARY
+            fi
+          else
+            echo "### ℹ️ No Changes Needed" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "No CLI command changes were detected between $OLD_VERSION and $NEW_VERSION." >> $GITHUB_STEP_SUMMARY
+          fi
+          
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "### 📦 Artifacts" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "Download the workflow artifacts to review:" >> $GITHUB_STEP_SUMMARY
+          echo "- Extracted CLI structures" >> $GITHUB_STEP_SUMMARY
+          echo "- Change detection results" >> $GITHUB_STEP_SUMMARY
+          echo "- Human-readable change documentation" >> $GITHUB_STEP_SUMMARY
+          echo "- Documentation update summary" >> $GITHUB_STEP_SUMMARY