Codex preserves CRLF, Goose scopes extensions per session

Arbitrary File Write via Write-Time Symlink Following (TOCTOU) in Claude Code anthropics/claude-code

Claude Code has an arbitrary file write that follows symlinks at write time (a TOCTOU window), so a malicious or compromised repo can redirect an agent write outside your project tree. No fixed version is named in the report, so the mitigation is environmental: restrict where the agent can write and keep it out of untrusted checkouts.

Make apply_patch preserve line endings unconditionally openai/codex

by copyberry

Updating a CRLF file with apply_patch used to normalize it to LF unless preservation was explicitly enabled; it now preserves the file's existing line endings unconditionally, and the apply_patch_preserve_line_endings flag is marked removed. If you were setting that flag, drop it from your config.

fix(acp): treat a client extension selection as the exact session set aaif-goose/goose

by TheSeydiCharyyev

A session requesting enabledExtensions: ["memory"] now runs Memory only. Previously initial_session_extensions started from the configured built-ins and pushed the client list on top, so the same request also pulled in Developer; an empty list now starts nothing, and sessions without enabledExtensions are unchanged.

fix(desktop): use a system Node.js in the Windows npx wrapper aaif-goose/goose

by TheSeydiCharyyev

On Windows, npx-run extensions use the Node.js already on PATH (npx.cmd next to it, Node 22 or newer) and Goose downloads its own portable Node only when it finds none. That removes a redundant download from first-run setup for most Windows users.

fix(llms): snap portable reasoning effort to the model's advertised levels cline/cline

by mkondratek

Portable reasoning effort is now snapped to the levels a model actually advertises before it reaches an OpenAI-compatible provider, instead of being written straight through as reasoning_effort. If you route thinking models through a gateway, you were previously sending invalid effort values; this fixes one of two known causes.

Resolve extensions into a per-inference lease aaif-goose/goose

by DOsinga

Step 4 of Goose's extension manager redesign lands per-extension tool caches under a tools_version counter, plus ExtensionSet and ExtensionLease, so tool lists resolve into a lease per inference rather than a manager-wide cache. Internal plumbing for now, but it is the foundation the rest of the redesign builds on.

fix(desktop): reconnect chat sessions after Cline Hub loss cline/cline

by abeatrix

The desktop client reconnects chat sessions after a Cline Hub connection loss instead of leaving you on a dead thread. Nothing to configure; it just stops the manual restart.