v1.57.0

✨ Features

• Allowlist: require HTTPS and validate redirects, block on policy failure #12619
• Allow callers to supply Goose session IDs #13098

🐛 Bug Fixes

• Linux window icons restored in desktop app #13120
• OpenRouter: resolve variant suffixes like :free and :nitro to the base model #12979
• Use catalog_provider_id for vision lookup on custom providers #12993
• Desktop: start the agent only once after a fork #13139
• Scheduler: use recipe settings in scheduled runs #13138
• Voice: use system trust for WebSockets #13075
• Prompt: surface MiniJinja render errors in custom system prompts #12794
• Providers: request summarized thinking from Claude models #13029
• Code-mode: keep recipe final_output tool for the model #13102
• CLI: configure unavailable default provider #13024
• Windows build error #13081
• Developer: terminate owned shell process trees on cancellation #12958
• ACP: fail session/prompt when a turn ends on an error #13043
• Databricks: send the system prompt as system on the MLflow chat route #13057

🔧 Improvements

• Bump zstd to 0.14.3 for RUSTSEC advisories #13162
• Remove jsonwebtoken to avoid ignoring its cargo-deny advisories #13141
• Address cargo-deny failures on main #13076
• Bump @modelcontextprotocol/sdk from 1.30.0 to 1.32.0 #13059
• Remove ACP client-delegated developer tools #13144
• Build release candidate even if there are conflicts #12780