Goose 1.49 Adds a Fail-Closed Mode for Agent Tool Interception and Completes Cross-Lifecycle Audit Identifiers

The Agentic AI Foundation released Goose 1.49 on September 3. Rather than adding new models, the update focuses on tightening controls and observability when agents execute tools. Goose hooks can run external policy programs before a model invokes shell, file, or MCP tools; the new release adds `on_failure: block` to the `PreToolUse` action. If a policy program fails to start, times out, receives no input, produces unparseable output, or exits with a nonzero status without providing a valid decision, the agent can reject the tool call outright.

This addresses a common but dangerous edge case: previously, hook failures were logged by default, but the tool would still execute. The new release retains `allow` as the default to avoid abruptly breaking existing workflows, so upgrading alone will not automatically make a deployment fail-closed. Teams that rely on hooks to block privileged commands must still configure each rule individually. `on_failure` also applies only to selected `PreToolUse` command hooks. Malformed configuration files or invalid matchers may cause rules to be skipped, so it should not be treated as a complete sandbox.

Another key change is the `PreToolUseResult` event, along with a `tool_call_id` that remains stable across the pre-call, result, success, and failure stages. Logging systems can now distinguish explicit policy denials from failures in the hook itself and correctly correlate repeated tool calls with identical content. Version 1.49 also adds per-turn model tool allowlists, precedence for permission denials, MCP tool visibility checks, suppression of sensitive telemetry, and several path restrictions. However, the release notes do not map these fixes to CVEs or specific attack scenarios. Engineering teams should next test negative paths such as hook timeouts, garbled output, and process crashes, and verify that their audit backends actually retain the new event fields.