Skip to content

feat(acp): allow session/new to request a Hidden session via _meta.hidden - #10811

Merged
matt2e merged 1 commit into
mainfrom
featsecurity-infer-explanation-for-ml-only-security-alerts
Jul 30, 2026
Merged

feat(acp): allow session/new to request a Hidden session via _meta.hidden#10811
matt2e merged 1 commit into
mainfrom
featsecurity-infer-explanation-for-ml-only-security-alerts

Conversation

@matt2e

@matt2e matt2e commented Jul 30, 2026

Copy link
Copy Markdown
Collaborator

Summary

Allows ACP clients to request a Hidden session by passing "hidden": true in the _meta object of a session/new request.

  • Extracts session-type resolution into a session_type_from_meta helper: _meta.hidden: true yields SessionType::Hidden (taking precedence over the client key); otherwise the existing behavior is preserved (client present → SessionType::User, absent → SessionType::Acp).
  • Adds a meta_bool helper that treats missing or non-boolean values as false, so a malformed hidden value falls back to the prior session-type logic rather than erroring.

Testing

Added unit tests covering: hidden: true alone and combined with client, absent/false hidden preserving Acp, non-boolean hidden falling back to User, and the existing clientUser path.

🤖 Generated with Claude Code

…dden

Clients can now pass "hidden": true in session/new _meta to create a
Hidden session, taking precedence over the "client" key. Absent, null,
or false values preserve the existing User/Acp behavior, and non-boolean
values are rejected with invalid_params.

Signed-off-by: Matt Toohey <contact@matttoohey.com>
@matt2e
matt2e force-pushed the featsecurity-infer-explanation-for-ml-only-security-alerts branch from 30b06cf to 1a09305 Compare July 30, 2026 03:39
@matt2e
matt2e requested a review from lifeizhou-ap July 30, 2026 03:41

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1a09305eeb

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment on lines +254 to +255
if meta_bool(meta, "hidden")? {
return Ok(SessionType::Hidden);

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Preserve ACP recall scope for hidden sessions

When an external ACP client omits client but sends _meta.hidden: true, this collapses the session to SessionType::Hidden instead of retaining that it came from ACP. Chat Recall later scopes searches only by the persisted SessionType: Acp sessions search ACP history, while every other type searches User/Scheduled history (crates/goose/src/agents/platform_extensions/chatrecall.rs:103-106). In a hidden ACP session with Chat Recall enabled, the agent can therefore read desktop/legacy history and cannot recall ACP history, which regresses ACP session isolation. Consider preserving ACP provenance for hidden ACP sessions or updating the downstream scope logic before storing these sessions as plain Hidden.

Useful? React with 👍 / 👎.

@matt2e matt2e Jul 30, 2026

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this is a limitation of a single "type" per session in Goose's existing data model

@matt2e
matt2e added this pull request to the merge queue Jul 30, 2026
Merged via the queue into main with commit 2694fff Jul 30, 2026
26 checks passed
@matt2e
matt2e deleted the featsecurity-infer-explanation-for-ml-only-security-alerts branch July 30, 2026 06:03
lifeizhou-ap added a commit to vincenzopalazzo/goose that referenced this pull request Jul 31, 2026
* main: (224 commits)
  fix(desktop): allow removing images when editing user messages (aaif-goose#9979)
  Fetch cursor-agent models from CLI (aaif-goose#10367)
  fix(cerebras): preserve thinking inline for models that reject reasoning_content (aaif-goose#10774)
  perf: make CLI streaming render incremental instead of O(n^2) (aaif-goose#10487)
  Moving to issues as the new PRs (aaif-goose#10818)
  ci: defer privileged recipe scans for forks (aaif-goose#10825)
  docs: adopt issue-first contribution workflow (aaif-goose#10819)
  Add Azure AI Foundry multi-LLM provider (aaif-goose#10622)
  fix(together): parse model list response (aaif-goose#10576)
  docs: remove retired site resources (aaif-goose#10817)
  feat: streaming shell output while commands run (aaif-goose#10808)
  feat(acp): allow session/new to request a Hidden session via _meta.hidden (aaif-goose#10811)
  chore: removed stale text pnpm workspace (aaif-goose#10809)
  feat(otel): emit GenAI semantic convention attributes (aaif-goose#10700)
  fix: avoid double loading full conversation on session open (aaif-goose#10794)
  feat(providers): forward images and MCP embedded-resource blobs in Anthropic and Google formats (aaif-goose#10340)
  Deprecate and remove ui/text TUI (aaif-goose#10799)
  Upgrade to rmcp 3.0 (aaif-goose#10789)
  fix(release): signing environment (aaif-goose#10797)
  feat(tools): collapse const-union enums in tool schemas (aaif-goose#10577)
  ...
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants