Goose 1.57.0 checks redirects before an allowlisted request proceeds

Goose 1.57.0 requires HTTPS for allowlisted destinations, validates redirects and blocks the request when policy evaluation fails. It also lets callers provide session IDs, starts a forked desktop agent only once, makes scheduled runs use recipe settings and turns an ACP turn-ending error into a failed session or prompt. Upgrade deployments that grant network access, then test an HTTPS URL that redirects to a blocked host and verify no request reaches the destination. ⁴

Relevant to: Goose operators using URL allowlists, scheduled recipes or externally tracked sessions.