feat(extensions): add Unix socket transport for StreamableHttp extensions

crates/goose-acp/src/server.rs

@@ -101,6 +101,7 @@ fn mcp_server_to_extension_config(mcp_server: McpServer) -> Result<ExtensionConf
                 .into_iter()
                 .map(|h| (h.name, h.value))
                 .collect(),
+            socket: None,
             timeout: None,
             bundled: Some(false),
             available_tools: vec![],
@@ -1729,6 +1730,7 @@ mod tests {
                 "Authorization".into(),
                 "Bearer ghp_xxxxxxxxxxxx".into()
             )]),
+            socket: None,
             timeout: None,
             bundled: Some(false),
             available_tools: vec![],

crates/goose-cli/src/commands/configure.rs

@@ -1161,6 +1161,7 @@ fn configure_streamable_http_extension() -> anyhow::Result<()> {
             envs: Envs::new(envs),
             env_keys,
             headers,
+            socket: None,
             description,
             timeout: Some(timeout),
             bundled: None,

crates/goose-cli/src/recipes/secret_discovery.rs

@@ -169,6 +169,7 @@ mod tests {
                     bundled: None,
                     available_tools: Vec::new(),
                     headers: HashMap::new(),
+                    socket: None,
                 },
                 ExtensionConfig::Stdio {
                     name: "slack-mcp".to_string(),
@@ -265,6 +266,7 @@ mod tests {
                     bundled: None,
                     available_tools: Vec::new(),
                     headers: HashMap::new(),
+                    socket: None,
                 },
                 ExtensionConfig::Stdio {
                     name: "service-b".to_string(),
@@ -324,6 +326,7 @@ mod tests {
                 bundled: None,
                 available_tools: Vec::new(),
                 headers: HashMap::new(),
+                socket: None,
             }]),
             sub_recipes: Some(vec![SubRecipe {
                 name: "child-recipe".to_string(),

crates/goose-cli/src/session/mod.rs

@@ -337,6 +337,7 @@ impl CliSession {
             envs: Envs::new(HashMap::new()),
             env_keys: Vec::new(),
             headers: HashMap::new(),
+            socket: None,
             description: goose::config::DEFAULT_EXTENSION_DESCRIPTION.to_string(),
             timeout: Some(timeout),
             bundled: None,
@@ -2031,6 +2032,7 @@ mod tests {
             envs: Envs::default(),
             env_keys: vec![],
             headers: HashMap::new(),
+            socket: None,
             description: goose::config::DEFAULT_EXTENSION_DESCRIPTION.to_string(),
             timeout: Some(300),
             bundled: None,
@@ -2046,6 +2048,7 @@ mod tests {
             envs: Envs::default(),
             env_keys: vec![],
             headers: HashMap::new(),
+            socket: None,
             description: goose::config::DEFAULT_EXTENSION_DESCRIPTION.to_string(),
             timeout: Some(300),
             bundled: None,
@@ -2061,6 +2064,7 @@ mod tests {
             envs: Envs::default(),
             env_keys: vec![],
             headers: HashMap::new(),
+            socket: None,
             description: goose::config::DEFAULT_EXTENSION_DESCRIPTION.to_string(),
             timeout: Some(300),
             bundled: None,

crates/goose/Cargo.toml

@@ -155,6 +155,15 @@ encoding_rs = "0.8.35"
 pastey = "0.2.1"
 shell-words = { workspace = true }
 
+# Unix domain socket HTTP transport for StreamableHttp extensions
+[target.'cfg(unix)'.dependencies]
+hyper = { version = "1", features = ["client", "http1"] }
+hyper-util = { version = "0.1", features = ["tokio"] }
+http-body-util = "0.1"
+sse-stream = "0.2"
+bytes = { workspace = true }
+http = { workspace = true }
+
 [target.'cfg(target_os = "windows")'.dependencies]
 winapi = { workspace = true }
 

crates/goose/src/acp/provider.rs

@@ -1458,6 +1458,7 @@ mod tests {
             envs: Envs::default(),
             env_keys: vec![],
             headers: HashMap::from([("Authorization".into(), "Bearer ghp_xxxxxxxxxxxx".into())]),
+            socket: None,
             timeout: None,
             bundled: Some(false),
             available_tools: vec![],
@@ -1511,6 +1512,7 @@ mod tests {
             envs: Envs::default(),
             env_keys: vec![],
             headers: HashMap::from([("Authorization".into(), "Bearer ghp_xxxxxxxxxxxx".into())]),
+            socket: None,
             timeout: None,
             bundled: Some(false),
             available_tools: vec![],

crates/goose/src/agents/extension.rs

@@ -232,6 +232,11 @@ pub enum ExtensionConfig {
         env_keys: Vec<String>,
         #[serde(default)]
         headers: HashMap<String, String>,
+        /// Unix domain socket path to route HTTP through (e.g. "@egress.sock" for Envoy sidecar).
+        /// When set, the physical connection goes through this socket while `uri` is used for the
+        /// HTTP Host header and path. Useful in K8s environments where DNS only resolves via Envoy.
+        #[serde(default)]
+        socket: Option<String>,
         // NOTE: set timeout to be optional for compatibility.
         // However, new configurations should include this field.
         timeout: Option<u64>,
@@ -305,6 +310,7 @@ impl ExtensionConfig {
             envs: Envs::default(),
             env_keys: Vec::new(),
             headers: HashMap::new(),
+            socket: None,
             description: description.into(),
             timeout: Some(timeout.into()),
             bundled: None,
@@ -459,6 +465,7 @@ impl ExtensionConfig {
                 envs,
                 env_keys,
                 headers,
+                socket,
                 timeout,
                 bundled,
                 available_tools,
@@ -478,6 +485,7 @@ impl ExtensionConfig {
                     envs: Envs::new(merged),
                     env_keys: vec![],
                     headers,
+                    socket,
                     timeout,
                     bundled,
                     available_tools,
@@ -494,9 +502,12 @@ impl std::fmt::Display for ExtensionConfig {
             ExtensionConfig::Sse { name, .. } => {
                 write!(f, "SSE({}: unsupported)", name)
             }
-            ExtensionConfig::StreamableHttp { name, uri, .. } => {
-                write!(f, "StreamableHttp({}: {})", name, uri)
-            }
+            ExtensionConfig::StreamableHttp {
+                name, uri, socket, ..
+            } => match socket {
+                Some(s) => write!(f, "StreamableHttp({}: {} via {})", name, uri, s),
+                None => write!(f, "StreamableHttp({}: {})", name, uri),
+            },
             ExtensionConfig::Stdio {
                 name, cmd, args, ..
             } => {
@@ -678,6 +689,7 @@ available_tools: []
             )]
             .into_iter()
             .collect(),
+            socket: None,
             timeout: None,
             bundled: None,
             available_tools: vec![],
@@ -698,6 +710,7 @@ available_tools: []
             )]
             .into_iter()
             .collect(),
+            socket: None,
             timeout: None,
             bundled: None,
             available_tools: vec![],
@@ -771,6 +784,7 @@ available_tools: []
             )]
             .into_iter()
             .collect(),
+            socket: None,
             timeout: None,
             bundled: None,
             available_tools: vec![],
@@ -788,6 +802,7 @@ available_tools: []
             headers: [("Authorization".to_string(), "Bearer secret_value".to_string())]
                 .into_iter()
                 .collect(),
+            socket: None,
             timeout: None,
             bundled: None,
             available_tools: vec![],
@@ -802,6 +817,7 @@ available_tools: []
             envs: extension::Envs::default(),
             env_keys: vec!["MY_SECRET".into()],
             headers: std::collections::HashMap::new(),
+            socket: None,
             timeout: None,
             bundled: None,
             available_tools: vec![],
@@ -817,6 +833,7 @@ available_tools: []
             }),
             env_keys: vec![],
             headers: std::collections::HashMap::new(),
+            socket: None,
             timeout: None,
             bundled: None,
             available_tools: vec![],
@@ -867,4 +884,64 @@ available_tools: []
         cfg.set("MY_SECRET", &"secret_value", true).unwrap();
         assert_eq!(config.resolve(&cfg).await.unwrap(), expected);
     }
+
+    #[test]
+    fn test_deserialize_streamable_http_with_socket() {
+        let config: ExtensionConfig = serde_yaml::from_str(
+            "type: streamable_http\nname: ai-app-info\ndescription: test\nuri: http://example.com/mcp\nsocket: \"@egress.sock\"\n",
+        )
+        .unwrap();
+        if let ExtensionConfig::StreamableHttp { socket, .. } = config {
+            assert_eq!(socket, Some("@egress.sock".to_string()));
+        } else {
+            panic!("unexpected variant");
+        }
+    }
+
+    #[test]
+    fn test_deserialize_streamable_http_without_socket() {
+        let config: ExtensionConfig = serde_yaml::from_str(
+            "type: streamable_http\nname: ai-app-info\ndescription: test\nuri: http://example.com/mcp\n",
+        )
+        .unwrap();
+        if let ExtensionConfig::StreamableHttp { socket, .. } = config {
+            assert_eq!(socket, None);
+        } else {
+            panic!("unexpected variant");
+        }
+    }
+
+    #[test]
+    fn test_display_streamable_http_without_socket() {
+        let config = ExtensionConfig::streamable_http(
+            "ai-app-info",
+            "http://example.com/mcp",
+            "test",
+            300u64,
+        );
+        assert_eq!(
+            format!("{config}"),
+            "StreamableHttp(ai-app-info: http://example.com/mcp)"
+        );
+    }
+
+    #[test]
+    fn test_display_streamable_http_with_socket() {
+        let config = ExtensionConfig::StreamableHttp {
+            name: "ai-app-info".to_string(),
+            uri: "http://example.com/mcp".to_string(),
+            description: "test".to_string(),
+            timeout: Some(300),
+            headers: Default::default(),
+            envs: Default::default(),
+            env_keys: vec![],
+            socket: Some("@egress.sock".to_string()),
+            bundled: None,
+            available_tools: vec![],
+        };
+        assert_eq!(
+            format!("{config}"),
+            "StreamableHttp(ai-app-info: http://example.com/mcp via @egress.sock)"
+        );
+    }
 }