Update Goose and disable bundled skills in Agent Mode

[AnthonyRonning]

Summary

• update Maple's exact Goose dependency from 3c1fdd69 to current upstream main at c3111c71 (the merge commit for feat(skills): allow disabling built-in skills aaif-goose/goose#10600)
• construct Maple's runtime Skills client with with_builtin_skills(false), keeping trusted filesystem/project/plugin skills while excluding Goose-bundled skills such as goose-doc-guide
• adapt Maple's custom shell path to the new Goose timeout and AGENT_SESSION_ID behavior
• enforce Goose's content-audience projection when rebuilding persisted Agent timelines, including mixed public/private text and tool content

The pin covers 89 upstream commits. Every commit in the range was reviewed against Maple's directly embedded Goose boundary:
aaif-goose/goose@3c1fdd6...c3111c7

Compatibility details

• omitted shell timeouts now resolve through Goose configuration/defaults; explicit zero remains unbounded, matching upstream
• Maple forwards the current task ID as AGENT_SESSION_ID across native and Flatpak shell construction and removes stale inherited values when absent
• persisted timeline reconstruction calls Goose's user-visible projection so assistant-only provider/MCP state does not reappear after reload
• surviving visible text blocks are aggregated into one stable timeline row, avoiding persisted replace coalescing loss

Validation

• repository pre-commit gate passed:
  • Prettier format check
  • production frontend build
  • frontend test suite
  • cargo test --all-targets: 134 passed
• just rust-lint passed
• dependency lock regenerated byte-for-byte in an independent review
• independent reviews of the dependency bump, Skills wiring, shell compatibility, timeline audience handling, and test coverage found no remaining validated blockers
• paid-user macOS GUI test against the exact workspace bundle:
  • received and accepted the one-time project-folder trust prompt
  • skill descriptions exposed only the two project skills; goose-doc-guide was absent
  • loaded a temporary harmless project skill through load_skill
  • rendered Loaded skill: maple-goose-builtin-smoke as a completed timeline card
  • returned the skill's exact expected response without running commands
  • temporary skill fixture was removed before commit

---

Summary by CodeRabbit

• New Features

  • Project-specific skills are now prioritized during Agent Mode, while built-in skills remain available for execution.
  • Shell commands can now retain agent session context for improved task continuity.

• Bug Fixes

  • Timeline history now excludes provider-private content and displays only user-visible information.
  • Shell timeout handling is more consistent, including support for configured defaults and unlimited execution.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 2acbd400-aa6e-4811-b040-3bc1003e2358

📥 Commits

Reviewing files that changed from the base of the PR and between 3e2f3ed and 0dffb6f.

⛔ Files ignored due to path filters (1)

• frontend/src-tauri/Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (3)

• frontend/src-tauri/Cargo.toml
• frontend/src-tauri/src/agent.rs
• frontend/src-tauri/src/agent/developer_tools.rs

---

📝 Walkthrough

Walkthrough

Agent Mode now discovers project skills without built-ins, persists only user-visible timeline content, and propagates session IDs plus configured default timeouts through bounded shell execution. The Goose dependency is pinned to a newer revision.

Changes

Agent execution and visibility

Layer / File(s)	Summary
Project-scoped skills discovery frontend/src-tauri/src/agent.rs	Transient skills clients exclude built-in skills, while tests validate project skill discovery and loading behavior.
User-visible timeline projection frontend/src-tauri/src/agent.rs	Timeline rows are rebuilt from user-visible content, consolidating visible text and excluding provider-private content from persisted outputs.
Bounded shell timeout and session propagation frontend/src-tauri/Cargo.toml, frontend/src-tauri/src/agent/developer_tools.rs	Shell execution uses Goose’s configured default timeout when omitted and propagates AGENT_SESSION_ID across supported process-launch paths, with updated coverage.

Estimated code review effort: 4 (Complex) | ~45 minutes

Possibly related PRs

• OpenSecretCloud/Maple#644: Overlaps in Maple Skills setup and user-visible timeline projection logic.

Sequence Diagram(s)

sequenceDiagram
  participant MCPTool
  participant BoundedShell
  participant SpawnedShell
  MCPTool->>BoundedShell: Pass session ID and shell parameters
  BoundedShell->>BoundedShell: Resolve timeout
  BoundedShell->>SpawnedShell: Set AGENT_SESSION_ID and execute
  SpawnedShell-->>BoundedShell: Return bounded output

Loading

Poem

A bunny hops where skills are found,
Built-ins vanish without a sound.
Private words stay out of sight,
Shells carry sessions through the night.
Timeout clocks now know their tune—
Fresh Goose code arrives by moon.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately captures the two main changes: upgrading Goose and disabling bundled skills in Agent Mode.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex-maple-goose-latest-builtins-maple

---

_{Comment @coderabbitai help to get the list of available commands.}

[cloudflare-workers-and-pages]

Deploying maple with    Cloudflare Pages

Latest commit:	0dffb6f
Status:	✅  Deploy successful!
Preview URL:	https://34c73ab2.maple-ca8.pages.dev
Branch Preview URL:	https://codex-maple-goose-latest-bui.maple-ca8.pages.dev

View logs

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.