Skip to content

Goose 1.57.0 tightens HTTPS redirect checks and session controls

Updated Goose

Summary

Redirect validation and caller-supplied session IDs accompany scheduling and provider-resolution fixes.

Tool
Goose
Date
Pricing
Not stated in the sources we cited.

Goose 1.57.0 changes how its HTTPS allowlist handles redirects: validation fails closed rather than allowing an unchecked redirect destination. This is a specific control documented by the project, not a claim that every network or agent action is safe.

Control session identity

Callers can supply session IDs. Applications integrating Goose can therefore associate a session with their own workflow identifiers instead of relying only on an automatically chosen ID.

Scheduled and provider-backed work

The release fixes scheduled recipe settings and resolves OpenRouter variants such as :free and :nitro against the base model. That compatibility fix is not a statement that every model or account has free access.

Other changes cover custom-provider vision lookup, duplicate fork starts and cancellation of owned process trees. ACP turn errors are propagated to the caller. Teams relying on scheduled recipes, subprocess cancellation or redirect restrictions have concrete behaviors to review when upgrading.

See the goose hub.

More from Goose

View all

Questions

What is Goose?

Goose is an open-source AI agent maintained in the block/goose repository. GitHub's description is an open source, extensible AI agent that goes beyond code suggestions. The LICENSE file is Apache-2.0, copyright 2024 Block, Inc.

What are Goose alternatives?

OpenCode, Cline, and Aider are the coding-agent alternatives linked here.

Filed on Agent Radar. Claims in this note are limited to the sources above.