Sync upstream changes through 2026-07-02

.github/actions/generate-release-pr-body/pr_body_template.txt

@@ -2,7 +2,7 @@
 
 ## Test before Release
 
-1. Close and reopen this PR to trigger CI and produce the Desktop bundle for testing. Reason: workflows don't run on PRs opened by `GITHUB_TOKEN` ([docs](https://docs.github.com/en/actions/using-workflows/triggering-a-workflow#triggering-a-workflow-from-a-workflow)).
+1. Approve the workflows for this PR (scroll to bottom) to trigger CI and produce the Desktop bundle for testing.
 2. Make sure all check workflows pass.
 3. Install the Desktop bundle from the download links (posted as a comment below when it is ready).
 4. Complete the goose Release Manual Testing Checklist (posted as a comment below).

.github/copilot-instructions.md

@@ -56,7 +56,6 @@
 - `cargo fmt --check` - Code formatting (rustfmt)
 - `cargo test --jobs 2` - All tests
 - `cargo clippy --all-targets -- -D warnings` - Linting (clippy)
-- `just check-openapi-schema` - OpenAPI schema validation
 
 **Desktop app checks:**
 - `pnpm install --frozen-lockfile` - Fresh dependency install (in `ui/desktop/`)

.github/workflows/bundle-desktop-intel.yml

@@ -73,11 +73,11 @@ jobs:
           key: intel-macos-deployment-target-12
 
 
-      - name: Build goose-server for Intel macOS (x86_64)
+      - name: Build desktop backend for Intel macOS (x86_64)
         run: |
           source ./bin/activate-hermit
           rustup target add x86_64-apple-darwin
-          cargo build --release -p goose-server --target x86_64-apple-darwin
+          cargo build --release -p goose-cli --bin goose --target x86_64-apple-darwin
 
 
 
@@ -95,9 +95,13 @@ jobs:
           # Check disk space after cleanup
           df -h
 
-      - name: Copy binaries into Electron folder
+      - name: Copy backend binary into Electron folder
         run: |
-          cp target/x86_64-apple-darwin/release/goosed ui/desktop/src/bin/goosed
+          mkdir -p ui/desktop/src/bin
+          rm -f ui/desktop/src/bin/goose
+          cp target/x86_64-apple-darwin/release/goose ui/desktop/src/bin/goose
+          chmod +x ui/desktop/src/bin/goose
+          ls -la ui/desktop/src/bin/
 
       - name: Cache pnpm dependencies
         uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8  # v6.0.0
@@ -153,6 +157,10 @@ jobs:
           fi
         working-directory: ui/desktop
 
+      - name: Verify macOS updater resources
+        run: node scripts/verify-mac-update-resources.js "out/Goose-darwin-x64/Goose.app"
+        working-directory: ui/desktop
+
       - name: Clean up signing keychain
         if: always()
         run: |

.github/workflows/bundle-desktop-linux.yml

@@ -124,7 +124,7 @@ jobs:
         with:
           key: linux-${{ matrix.build-on }}-${{ matrix.variant }}
 
-      - name: Build goosed binary
+      - name: Build desktop backend binary
         env:
           RUST_LOG: debug
           RUST_BACKTRACE: 1
@@ -137,15 +137,16 @@ jobs:
             FEATURE_ARGS=(--features vulkan)
           fi
 
-          cargo build --release --target ${TARGET} -p goose-server "${FEATURE_ARGS[@]}"
+          cargo build --release --target ${TARGET} -p goose-cli --bin goose "${FEATURE_ARGS[@]}"
 
-      - name: Copy binaries into Electron folder
+      - name: Copy backend binary into Electron folder
         run: |
-          echo "Copying binaries to ui/desktop/src/bin/"
+          echo "Copying backend binary to ui/desktop/src/bin/"
           export TARGET="x86_64-unknown-linux-gnu"
           mkdir -p ui/desktop/src/bin
-          cp target/$TARGET/release/goosed ui/desktop/src/bin/
-          chmod +x ui/desktop/src/bin/goosed
+          rm -f ui/desktop/src/bin/goose
+          cp target/$TARGET/release/goose ui/desktop/src/bin/
+          chmod +x ui/desktop/src/bin/goose
           ls -la ui/desktop/src/bin/
 
       - name: Free Rust build artifacts before packaging

.github/workflows/bundle-desktop-windows.yml

@@ -113,42 +113,48 @@ jobs:
         env:
           CUDA_COMPUTE_CAP: ${{ inputs.windows_variant == 'cuda' && '80' || '' }}
         run: |
-          Write-Output "Building Windows executable..."
-          if ("${{ inputs.windows_variant }}" -eq "cuda") {
-            cargo build --release --target x86_64-pc-windows-msvc -p goose-server --features cuda
+          $isCuda = "${{ inputs.windows_variant }}" -eq "cuda"
+
+          Write-Output "Building Windows ACP backend"
+          if ($isCuda) {
+            cargo build --release --target x86_64-pc-windows-msvc -p goose-cli --bin goose --features cuda
           } else {
-            cargo build --release --target x86_64-pc-windows-msvc -p goose-server
+            cargo build --release --target x86_64-pc-windows-msvc -p goose-cli --bin goose
           }
+          $binaryPath = "./target/x86_64-pc-windows-msvc/release/goose.exe"
 
           # Verify build succeeded
-          if (-not (Test-Path "./target/x86_64-pc-windows-msvc/release/goosed.exe")) {
-            Write-Error "Windows binary not found."
+          if (-not (Test-Path $binaryPath)) {
+            Write-Error "Windows backend binary not found: $binaryPath"
             Get-ChildItem ./target/x86_64-pc-windows-msvc/release/ -ErrorAction SilentlyContinue
             exit 1
           }
 
-          Write-Output "Windows binary found."
-          Get-Item ./target/x86_64-pc-windows-msvc/release/goosed.exe
+          Write-Output "Windows backend binary found."
+          Get-Item $binaryPath
 
       - name: Prepare Windows binary
         shell: bash
         run: |
-          if [ ! -f "./target/x86_64-pc-windows-msvc/release/goosed.exe" ]; then
-            echo "Windows binary not found."
+          BACKEND_BINARY="./target/x86_64-pc-windows-msvc/release/goose.exe"
+
+          if [ ! -f "$BACKEND_BINARY" ]; then
+            echo "Windows backend binary not found: $BACKEND_BINARY"
             exit 1
           fi
 
           echo "Cleaning destination directory..."
           rm -rf ./ui/desktop/src/bin
           mkdir -p ./ui/desktop/src/bin
 
-          echo "Copying Windows binary..."
-          cp -f ./target/x86_64-pc-windows-msvc/release/goosed.exe ./ui/desktop/src/bin/
+          echo "Copying Windows backend binary..."
+          cp -f "$BACKEND_BINARY" ./ui/desktop/src/bin/
 
           if [ -d "./ui/desktop/src/platform/windows/bin" ]; then
             echo "Copying Windows platform files..."
             for file in ./ui/desktop/src/platform/windows/bin/*.{exe,dll,cmd}; do
-              if [ -f "$file" ] && [ "$(basename "$file")" != "goosed.exe" ]; then
+              filename="$(basename "$file")"
+              if [ -f "$file" ] && [ "$filename" != "goose.exe" ]; then
                 cp -f "$file" ./ui/desktop/src/bin/
               fi
             done
@@ -229,14 +235,14 @@ jobs:
           certificate-profile-name: ${{ secrets.AZURE_CERTIFICATE_PROFILE_NAME }}
           files: |
             ${{ github.workspace }}/dist-windows/Goose.exe
-            ${{ github.workspace }}/dist-windows/resources/bin/goosed.exe
+            ${{ github.workspace }}/dist-windows/resources/bin/goose.exe
 
       - name: Verify signed executables
         shell: pwsh
         run: |
           $files = @(
             "dist-windows/Goose.exe",
-            "dist-windows/resources/bin/goosed.exe"
+            "dist-windows/resources/bin/goose.exe"
           )
           foreach ($file in $files) {
             Write-Output "Verifying signature: $file"

.github/workflows/bundle-desktop.yml

@@ -118,8 +118,10 @@ jobs:
           key: macos-deployment-target-12
 
       # Build the project
-      - name: Build goosed
-        run: source ./bin/activate-hermit && cargo build --release -p goose-server
+      - name: Build desktop backend
+        run: |
+          source ./bin/activate-hermit
+          cargo build --release -p goose-cli --bin goose
 
       # Post-build cleanup to free space
       - name: Post-build cleanup
@@ -134,9 +136,13 @@ jobs:
           # Check disk space after cleanup
           df -h
 
-      - name: Copy binaries into Electron folder
+      - name: Copy backend binary into Electron folder
         run: |
-          cp target/release/goosed ui/desktop/src/bin/goosed
+          mkdir -p ui/desktop/src/bin
+          rm -f ui/desktop/src/bin/goose
+          cp target/release/goose ui/desktop/src/bin/goose
+          chmod +x ui/desktop/src/bin/goose
+          ls -la ui/desktop/src/bin/
 
       - name: Cache pnpm dependencies
         uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8  # v6.0.0
@@ -185,6 +191,10 @@ jobs:
           fi
         working-directory: ui/desktop
 
+      - name: Verify macOS updater resources
+        run: node scripts/verify-mac-update-resources.js "out/Goose-darwin-arm64/Goose.app"
+        working-directory: ui/desktop
+
       - name: Clean up signing keychain
         if: always()
         run: |

.github/workflows/canary.yml

@@ -67,7 +67,7 @@ jobs:
           path: download_cli.sh
 
   # ------------------------------------------------------------
-  # 4) Bundle Desktop App (macOS only) - builds goosed and Electron app
+  # 4) Bundle Desktop App (macOS only)
   # ------------------------------------------------------------
   bundle-desktop:
     needs: [prepare-version]
@@ -80,7 +80,7 @@ jobs:
       signing: false
 
   # ------------------------------------------------------------
-  # 5) Bundle Desktop App (macOS Intel) - builds goosed and Electron app
+  # 5) Bundle Desktop App (macOS Intel)
   # ------------------------------------------------------------
   bundle-desktop-intel:
     needs: [prepare-version]
@@ -93,7 +93,7 @@ jobs:
       signing: false
 
   # ------------------------------------------------------------
-  # 6) Bundle Desktop App (Linux) - builds goosed and Electron app
+  # 6) Bundle Desktop App (Linux)
   # ------------------------------------------------------------
   bundle-desktop-linux:
     needs: [prepare-version]
@@ -102,7 +102,7 @@ jobs:
       version: ${{ needs.prepare-version.outputs.version }}
 
   # ------------------------------------------------------------
-  # 6) Bundle Desktop App (Windows) - builds goosed and Electron app
+  # 6) Bundle Desktop App (Windows)
   # ------------------------------------------------------------
   bundle-desktop-windows:
     needs: [prepare-version]
@@ -138,7 +138,7 @@ jobs:
           merge-multiple: true
 
       - name: Attest build provenance
-        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32  # v4.1.0
+        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373  # v4.1.1
         with:
           subject-path: |
             goose-*.tar.bz2

.github/workflows/ci.yml

@@ -41,7 +41,7 @@ jobs:
       - name: Checkout Code
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
-      - uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 # v1.16.1
+      - uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
 
       - name: Run cargo fmt
         run: cargo fmt --check
@@ -55,7 +55,7 @@ jobs:
       - name: Checkout Code
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
-      - uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 # v1.16.1
+      - uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
 
       - name: Install Dependencies
         run: |
@@ -119,7 +119,7 @@ jobs:
           echo "msrv=$msrv" >> "$GITHUB_OUTPUT"
           echo "MSRV: $msrv"
 
-      - uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6  # v1
+      - uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659  # v1
         with:
           toolchain: ${{ steps.msrv.outputs.msrv }}
 
@@ -145,7 +145,7 @@ jobs:
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
-      - uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 # v1.16.1
+      - uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
 
       - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4  # v2.9.1
 
@@ -167,7 +167,7 @@ jobs:
       - name: Checkout Code
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
-      - uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 # v1.16.1
+      - uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
 
       - name: Install Dependencies
         run: |
@@ -183,12 +183,6 @@ jobs:
           cd ui/desktop && pnpm install --frozen-lockfile
           cd ../sdk && pnpm install --frozen-lockfile
 
-      - name: Check OpenAPI Schema is Up-to-Date
-        run: |
-          source ./bin/activate-hermit
-          hermit uninstall rustup
-          just check-openapi-schema
-
       - name: Check ACP Schema is Up-to-Date
         run: |
           source ./bin/activate-hermit

.github/workflows/create-version-bump-pr.yaml

@@ -85,7 +85,7 @@ jobs:
 
           **Please follow these steps:**
 
-          1. Close and reopen this PR to trigger CI checks. Reason: workflows don't run on PRs opened by `GITHUB_TOKEN` ([docs](https://docs.github.com/en/actions/using-workflows/triggering-a-workflow#triggering-a-workflow-from-a-workflow)).
+          1. Approve workflows for this PR to trigger CI checks.
           2. Review and resolve any merge conflicts.
           3. Approve and merge this PR.
           4. The `release/${{ env.version }}` PR will be created automatically.

.github/workflows/docs-update-cli-ref.yml

@@ -63,7 +63,7 @@ jobs:
           sudo apt-get install -y jq ripgrep
 
       - name: Set up Rust
-        uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 # v1.16.1
+        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
         with:
           toolchain: stable