feat(goose): bundle goose-acp with the app - #1110

- New agent: the Goose type menu offers goose's own default provider and
  model, or a dialog to choose a provider, save its key into goose, pick a
  model, and test the connection. The card body keeps only instructions.
- Settings: provider and model per agent, and Runtime diagnostics listing
  the agent's goose sessions with their transcripts, read through
  session/list and _goose/unstable/session/export.
- A turn that writes text without calling send is posted as the agent's
  reply rather than reported as a failure.
- A missing goose-acp says so; test connection deletes its session.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Signed-off-by: Salman Mohammed <[email protected]>

Replace MCP-over-ACP with a generic plugin host capability: a plugin that
declares `host.mcp` can start loopback MCP servers (Streamable HTTP,
stateless, JSON replies) with `host.serveMcp`. The native listener binds
127.0.0.1:0, checks a per-server bearer token, and hands each JSON-RPC
message to the page, which answers it. Tools that sign with an agent's key
still run in the app; the agent gets only the URL and token.

Refusals are 404, never 401/403, since MCP clients start OAuth on those.
Servers stop when the plugin closes them, the page reloads, or the app exits.

The goose plugin now starts one server per ACP session and declares it as
an `http` MCP server in `session/new` (in `_meta.enabledExtensions`, which
goose main uses instead of `mcpServers` when present). It requires
`mcpCapabilities.http`, so it runs on goose main without #12882.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…-http-mcp-main

The Goose plugin no longer needs goose-acp installed. scripts/build-goose-acp.mjs
builds it from the goose commit pinned in runtime/goose-acp.json, with only the
features the plugin uses, and stages it in src-tauri/resources/bin, which every
package ships. Packaged builds use the small lean profile (15 MB on macOS, down
from 110 MB for a whole-workspace build); `just desktop` passes --dev for Cargo's
faster dev profile. A rerun with an unchanged pin is a no-op.

A process declared with "bundled": true runs the copy in the app's bin
resources and never searches PATH. Each release job checks its package
contains goose-acp, and Windows selects Strawberry Perl for vendored OpenSSL.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Parse HTTP with hyper's HTTP/1 server instead of by hand, as review
asked; the listener keeps only its MCP and token rules. hyper is
already in the tree through reqwest; this adds its server feature.

Also drop code the bridge never needs: the buffer for messages that
arrive before `serve` returns (none can, since the token comes with
the reply), JSON-RPC batches (MCP removed them in 2025-06-18), and a
second catch in goose's MCP handler that the host already does.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Signed-off-by: Salman Mohammed <[email protected]>

…gin-http-mcp-main

Signed-off-by: Salman Mohammed <[email protected]>

# Conflicts:
#	.github/workflows/release.yml

This reverts commit fe7a855. Bundling moves to its own PR, to merge after
this one.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

The Goose plugin no longer needs goose-acp installed. scripts/build-goose-acp.mjs
builds it from the goose commit pinned in runtime/goose-acp.json, with only the
features the plugin uses, and stages it in src-tauri/resources/bin, which every
package ships. Packaged builds use the small lean profile (15 MB on macOS, down
from 110 MB for a whole-workspace build); `just desktop` passes --dev for Cargo's
faster dev profile. A rerun with an unchanged pin is a no-op.

A process declared with "bundled": true runs the copy in the app's bin
resources and never searches PATH. Each release job checks its package
contains goose-acp, and Windows selects Strawberry Perl for vendored OpenSSL.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Signed-off-by: Salman Mohammed <[email protected]>

Signed-off-by: Salman Mohammed <[email protected]>

Move the goose agent's sessions and transcripts out of the Settings
tab's Runtime diagnostics and into an Activity tab, as Claude Code
and Codex do since #1040.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Signed-off-by: Salman Mohammed <[email protected]>

…into sm/goose-acp-bundle

# Conflicts:
#	.github/workflows/release.yml

main replaced the type menu's CreateModelMenu with a CreateModel field, so
goose shows its default or chosen provider and model as a button that opens
the provider dialog.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

main replaced the type menu's CreateModelMenu with a CreateModel field, so
goose shows its default or chosen provider and model as a button that opens
the provider dialog.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

main's #1011 moved watch and timer wakes, their prompts and the attention
tools into the shared agent harness. goose now runs a wake as a standalone
turn (runOnce) in a one-off session, as Claude and Codex do, and drops its
own copy of the lanes and wake prompt. Every session lists the attention
tools, and the end-of-turn note comes from turnNote.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

…oose-acp-bundle