…ions

In some service mesh environments (e.g. Kubernetes with an Envoy sidecar),
all outbound HTTP must route through a local proxy rather than making direct
TCP connections to remote endpoints. Adds an optional `socket` field to
`ExtensionConfig::StreamableHttp` so connections can be routed through a
Unix domain socket, with `uri` preserved as the HTTP Host header and path.

Implements `rmcp::StreamableHttpClient` for a new `UnixSocketHttpClient`
using hyper + `tokio::net::UnixStream`, plugging into rmcp's existing
`StreamableHttpClientTransport::with_client()` extension point. Supports
both filesystem sockets and Linux abstract sockets (`@` prefix). Auth at
the transport layer (e.g. mutual TLS via the sidecar) makes OAuth retry
unnecessary on this path.

Configured via `socket: "@egress.sock"` alongside the existing `uri` field
in YAML config or the goosed API — no change for TCP-only deployments.

PR #7126 hardcoded self-signed HTTPS as the only server mode, breaking
headless deployments (K8s health probes, sidecar proxies, plain HTTP
clients) that expect HTTP. TLS is now controlled by the GOOSE_TLS env
var (default: true), so existing desktop deployments are unaffected and
server deployments can opt out with GOOSE_TLS=false.

  update UnixSocketHttpClient for rmcp 1.1.0 trait changes

  rmcp 1.1.0 added `custom_headers` parameter to `delete_session` and
  `get_stream` in the `StreamableHttpClient` trait, and now allows
  `MCP-Protocol-Version` through the reserved header check (the transport
  injects it after init).

  - Add `custom_headers` to `delete_session` and `get_stream` signatures
  - Extract shared `apply_custom_headers` helper used by all three methods
  - Allow `MCP-Protocol-Version` through reserved header check, matching
    upstream reqwest implementation behavior

* origin/main:
  fix: restore smart-approve mode (#7690)
  fix: make TLS configurable in goosed agent via GOOSE_TLS env var (#7686)

extract_auth_error only downcasted to StreamableHttpError<reqwest::Error>,
so OAuth retry never triggered for Unix socket connections which produce
StreamableHttpError<UnixSocketError>. Add a cfg(unix)-gated downcast for
the Unix socket error type so 401 responses correctly trigger OAuth flow.

Also creates a fresh UnixSocketHttpClient with only User-Agent for the
OAuth retry path, preventing stale Authorization headers from user
config being sent alongside the fresh OAuth token.

Clone default_headers and strip only Authorization for the OAuth retry
client, preserving user-configured headers like Host overrides and
routing headers that may be required by the upstream server.

* origin/main: (21 commits)
  fix(ui-desktop): unify path resolution around GOOSE_PATH_ROOT (#7335)
  fix: pass OAuth scopes to DCR and extract granted_scopes from token response (#7571)
  fix: write to real file if config.yaml is symlink (#7669)
  fix: preserve pairings when stopping gateway (#7733)
  fix: reduce server log verbosity — skip session in instrument, defaul… (#7729)
  fix: provider test infrastructure (#7738)
  fix: sanitize streamable HTTP extension names derived from URLs (#7740)
  refactor: derive GooseMode string conversions with strum (#7706)
  docs: Add Spraay Batch Payments MCP Extension Tutorial (#7525)
  fix: flake.nix (#7224)
  delete goose web (#7696)
  Add @angiejones as CODEOWNER for documentation (#7711)
  Add MLflow integration guide (#7563)
  docs: LM Studio availability (#7698)
  feat: add Avian as an LLM provider (#7561)
  Adds `linux-mcp-server` to the goose registry (#6979)
  fix: add #[serde(default)] to description field on 4 ExtensionConfig variants (#7708)
  feat: combine TUI UX from alexhancock/tui-goodness with publishing config from jackamadeo/package-tui (#7683)
  chore: cleanup old sandbox (#7700)
  Correct windows artifact (#7699)
  ...

* origin/main:
  feat(summon): make skill supporting files individually loadable via load() (#7583)
  Keep toast open on failed extension (#7771)

connect_addr is a blocking syscall from std that can stall a tokio
worker thread if the sidecar is slow to accept. Move it to
spawn_blocking so the async runtime stays responsive.

* origin/main: (72 commits)
  No Check do Check (#7942)
  Log 500 errors and also show error for direct download (#7936)
  fix: retry on authentication failure with credential refresh (#7812)
  Remove java/.ai-usage-marker directory (#7925)
  test(acp): add terminal delegation fixtures and fix shell singleton (#7923)
  fix: bump pctx_code_mode to 0.3.0 for iterator type checking fix (#7892)
  feat: persist GooseMode per-session via session DB (#7854)
  feat(otel): propagate session.id to spans and log records (#7490)
  fix(test): add env_lock to is_openai_reasoning_model tests (#7917)
  fix(acp): pass session_id when loading extensions so skills are discovered (#7868)
  updated canonical models (#7920)
  feat(autovisualiser): Migrate the autovisualiser extension to MCP Apps  (#7852)
  fix: add tool_choice and parallel_tool_calls to chatgpt_codex provider (#7867)
  fix: tool confirmation handling for multiple requests (#7856)
  Remove dead OllamaSetup onboarding flow (#7861)
  fix: resolve tokio::sync::Mutex deadlock in recipe retry path (#7832)
  Upgrade Electron 40.6.0 → 41.0.0 (#7851)
  Only show up to 50 lines of source code (#7578)
  fix: stop writing without error when hitting broken pipe for goose session list (#7858)
  feat(acp): add session/set_mode handler (#7801)
  ...

* origin/main: (62 commits)
  Tweak the release process: no more merge to main (#7994)
  fix: gemini models via databricks (#8042)
  feat(apps): Pass toolInfo to MCP Apps via hostContext (#7506)
  fix: remove configured marker when deleting oauth provider configuration (#7887)
  docs: add vmware-aiops MCP extension documentation (#8055)
  Show setup instructions for ACP providers in settings modal (#8065)
  deps: replace sigstore-verification with sigstore-verify to kill vulns (#8064)
  feat(acp): add session/set_config and stabilize list, delete and close (#7984)
  docs: Correct `gosoe` typo to `goose` (#8062)
  fix: use default provider and model when provider in session no longer exists (#8035)
  feat: add GOOSE_SHELL env var to configure preferred shell (#7909)
  fix(desktop): fullscreen header bar + always-visible close controls (#8033)
  docs: add Claude Code approve mode permission routing documentation (#7949)
  chatgpt_codex: Support reasoning and gpt-5.4 (#7941)
  refactor(anthropic): fix N+1 thinking message storage issue (#7958)
  fix: handle mid-stream error events in OpenAI SSE streaming (#8031)
  Fix apps extension: coerce string arguments from inner LLM responses (#8030)
  feat: ability to expand sidebar to see chats names  (#7816)
  Fix config for GOOSE_MAX_BACKGROUND_TASKS (#7940)
  set MACOSX_DEPLOYMENT_TARGET=12.0 (#7947)
  ...

… lint

CI sets `RUSTFLAGS=-D warnings` which promotes this newer clippy lint
to an error.

…ield

CI sets RUSTFLAGS=-D warnings which promotes redundant_closure to an
error. Also apply substitute_env_vars to the socket field so configs
like socket: "$ENVOY_SOCK" resolve correctly, matching how uri and
headers are already handled.

* origin/main:
  fix: use pnpm when publishing (#8092)
  Alexhancock/publish npm file format fix (#8091)
  fix: iteration on the publish-npm workflow (#8087)
  chore: ignore unmaintained warning for proc-macro-error (#8084)
  chore: clean up stray recipe.yaml (#8086)
  chore(release): bump version to 1.29.0 (minor) (#8088)
  Update lockfile references (#8085)
  Fix version bump (#8083)
  Add a code review step which uses a short-lived provider token (#7932)