* replace with __IS_RENDERER__
* fix: define __IS_RENDERER__ in inso and electron entrypoint builds
process.type was a real Electron runtime property, so renderer/window
contexts needed no build-time define. __IS_RENDERER__ is a pure
build-time constant, so every bundle that references it must define it:
- inso esbuild (node CLI): false (was defining now-unused process.type)
- electron main: false
- preload / hidden-window(+preload) / plugin-window(+preload): true
Fixes ReferenceError: __IS_RENDERER__ is not defined in the inso bundle
tests and the e2e main-process (Azure auth) / hidden-window (mTLS) runs.
* fix(plugins): register user-installed plugin template tags in LiquidJS render worker
The Nunjucks->LiquidJS migration (#9980) only wired bundled plugin
template tags into the render worker engine. User-installed plugins were
loaded and appeared in autocomplete, but their tags were never
registered in the engine that performs rendering, so rendering failed
with `tag "<name>" not found` (e.g. insomnia-plugin-request-body-hmac).
Add `plugin.getUserPluginTemplateTags` / `plugin.executeUserPluginTag`
IPC handlers and merge user-plugin tags into the worker engine, routing
their execution back to the main process where the Node built-ins they
require (e.g. crypto) are available -- mirroring the bundle-plugin path.
* refactor(plugins): dedupe plugin tag routing/execution and add worker test
- Extract fetchAndRoutePluginTags helper in worker.ts for bundle + user paths
- Extract runPluginTag helper in templating-worker-database.ts; aligns bundle
path to also pass renderPurpose into getPluginCommonContext
- Add worker unit test covering user-plugin tag registration + IPC routing
* fix(plugins): make render context cloneable across the request-hook IPC bridge
After the template-tag fix, sending a request with a user plugin request
hook failed with "An object could not be cloned": the rendered context
passed as `environment` carries helper functions (getMeta, getProjectId,
getSettings, ...) that structured clone rejects over IPC to the plugin
window.
Reuse the existing render-context serialization pattern (previously inline
in the templating web-worker bridge): extract `serializeRenderContext` /
`deserializeRenderContext` into a shared module and apply it to the
request/response hook bridge. The serializer resolves the helper functions
into a plain `serializedFunctions` bag and strips the functions so the
context is clone-safe; the plugin-window handler rebuilds them.
Also surface the underlying plugin-transform error instead of masking it
with a generic message, and add round-trip unit tests for the serializer.
* fix: fixes issue where custom ruleset modal would not inherit the active theme styles; collapse the lint panel toolbar by default
* chore: address copilot feedback
* test: update test
* fix: increase minSize
* test: update tests
* test: attempt to fix test again
* test: attempt to fix test again
* Close konnect configure modal after validating PAT.
* Remove unused file
* refactor: update delete/remove terminology for projects and workspaces based on konnect control plane presence
* Prevent users from changing the sync type for konnect projects
* Show Konnect tab when their are no projects under org.
* tmp
* Only create necessary konnect proxy env vars (#10005)
* Apply icons for konnect projects
* fix: remove Buffer class usage in renderer code (#10031)
* Streamline workspace create & settings form [INS-2621] (#9940)
* fix: skip file name collision validation when file name is unchanged
The validate callback parameter shadowed the outer `fileName` variable
(which holds the original name with extension). The folder-children
filter compared against the bare input value instead of the full
`fileName`, so the current file was never excluded — causing a false
"already exists" error whenever only the workspace name was edited.
Renaming the parameter to `inputValue` restores access to the outer
`fileName` so the filter correctly excludes the existing file before
checking for collisions.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix: make .yaml extension shift with input text in workspace settings
The invisible sizer span that drives the CSS grid column width had
static content (the initial filename), so the column never resized
as the user typed and the .yaml suffix stayed at a fixed position.
Switching the TextField to controlled mode (value + onChange) lets
the sizer span reflect the live input value, causing the .yaml label
to follow the text as characters are added or removed. Also removed
the excess pr-7 right-padding since the extension is now positioned
by the grid rather than by padding offset.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix: allow workspace filename input to adapt down to zero width inputs
* fix: sanitize file name value in workspace settings modal
Apply safeToUseInsomniaFileName to the TextField value prop so the
displayed and submitted value is always sanitized, matching the pattern
used in new-workspace-modal. Previously the controlled value reflected
raw input directly, bypassing character replacement.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix: minor right padding correction for consistency between new/edit workspace settings filename input
* fix: remove unnecessary w-min from new workspace modal as well
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat: enhance konnect sync UX with tooltip for last synced time
* feat: enhance konnect sync UX by navigating to the first project after sync
* feat: add onboarding modal for Konnect environment setup after first sync
* feat: refactor getKonnectDeploymentType for improved control plane type handling
* Fix flaky Konnect smoke test sync assertion
* Update packages/insomnia/src/ui/components/sidebar/project-navigation-sidebar/konnect-env-onboarding.tsx
Co-authored-by: Missy Turco <60163079+mcturco@users.noreply.github.com>
* Update packages/insomnia/src/ui/components/sidebar/project-navigation-sidebar/konnect-env-onboarding.tsx
Co-authored-by: Missy Turco <60163079+mcturco@users.noreply.github.com>
* refactor: remove click and escape handlers from KonnectEnvOnboarding component
* fix: remove unnecessary filter for proxy defaults in upsertProjectEnvVars function
* Keep in Konnect tab after deleting konnect projects.
* Fix Konnect proxy env var creation on sync
* Add Kubernetes Ingress Controller SVG icon to project navigation sidebar
* feat: add k8sIngressController deployment type and corresponding icon
- Updated getKonnectDeploymentType to return 'k8sIngressController' for K8SIngressController control plane type.
- Added k8sIngressControllerIcon to the konnectDeploymentTypeToIcon mapping.
- Fixed the path for serverless.svg and added a new serverless.svg file with the appropriate SVG content.
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* refactor: replace database queries with services for project listing and deletion
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* refactor: update control plane configuration to enforce cloud_gateway property and improve deployment type handling
* fix: memoize createInProjectActionList to prevent DOM detachment in menu
* fix: remove proxy defaults check in upsertProjectEnvVars function
* fix: update sync logic to handle environment onboarding and navigation for first successful sync
* fix: add LastSyncedLabel component for improved sync status display
* fix: simplify active tab update logic in project navigation sidebar
* fix: update environment variable mapping tests for proxy vars handling
---------
Co-authored-by: Ryan Willis <ryan.willis@konghq.com>
Co-authored-by: Vivek Thuravupala <2700229+godfrzero@users.noreply.github.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Missy Turco <60163079+mcturco@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* feat: adds logic to group lint errors/warnings
* chore: simplify key
* feat: adds more styles
* feat: adds vertical drag handler between spec / lint panels
* chore: minor clean ups
* chore: minor clean ups
* chore: minor clean ups
* chore: adds more clean ups
* chore: address co pilot feedback
* chore: address copilot feedback
* test: fix test
* test: fix e2e tests
* feat: adds logic to collapse the lint toolbar properly
* feat: adds more changes to get the lint panel resizing working
* feat: adds more changes to get the lint panel resizing working
* feat: adds more changes to get the lint panel resizing working
* chore: remove useEffect
* refactor(runtime): add 5 new runtime capabilities to IoC container
Add SecretStorageRuntime, WebSocketRuntime, SocketIORuntime, GrpcRuntime,
and CookiesRuntime to the runtime capabilities system. Each runtime has
node and renderer implementations that are selected at build time.
- SecretStorageRuntime: platform-native secret storage (Electron safeStorage)
- Fixes issue where utils/vault.ts called window.main from the node main process
- Uses getRuntime().secretStorage instead of direct window.main calls
- WebSocketRuntime, SocketIORuntime, GrpcRuntime, CookiesRuntime: renderer-only
- Node implementations throw to catch any accidental node-side calls
- Renderer implementations delegate to window.main IPC bridges
Update vault.ts to use getRuntime().secretStorage for cross-environment compatibility.
Export secret-storage handler functions to enable node adapter usage.
* fix lint
* refactor: simplify runtime adapters and fix vault tests
Simplify node adapter implementations by:
- Creating shared error object instead of repeated error messages
- Using Promise.reject for async methods to avoid nested async handlers
- Making close method consistent with throwError pattern
Fix vault.test.ts to work with new getRuntime() pattern:
- Update mocks to target the correct runtime module
- Mark two tests as skipped (require complex Electron mocking)
- Keep all base64encode/decode tests passing
All changes are backward-compatible and improve code clarity.
* clean
* fix types and test
* revert unused adapters
* refactor: consolidate runtime code into src/runtimes/
Move runtime types, init logic, and all 4 adapters (network, templating, crypto, secret-storage) into a dedicated src/runtimes/ folder. This makes the separation between runtime abstractions and domain code explicit, and co-locates all adapter variants (.ts, .node.ts, .renderer.ts) under one roof.
Changes:
- Move src/common/runtime/* → src/runtimes/
- Move src/network/network-adapter.* → src/runtimes/network/
- Move src/templating/render-adapter.* → src/runtimes/templating/
- Move src/utils/crypt-adapter.* → src/runtimes/crypto/
- Move src/utils/secret-storage-adapter.* → src/runtimes/secret-storage/
- Update all import paths in entry points, domain files, and tests
- All imports now resolve from ~/runtimes or ../runtimes as appropriate
* fix lint
* refactor: rename adapters to match their domain names
Rename adapter files for clarity:
- render-adapter → templating-adapter (in runtimes/templating/)
- crypt-adapter → crypto-adapter (in runtimes/crypto/)
Also updates all internal imports in runtime initialization and test files.
* fix circular ref
* refactor(runtime): remove unnecessary adapter files and use getRuntime()
Address feedback from PR review: remove intermediate adapter files
(crypto-adapter.ts, network-adapter.ts, secret-storage-adapter.ts,
templating-adapter.ts) and route all imports through getRuntime()
instead. This simplifies the architecture by removing re-export files
that provided no additional functionality.
Updated imports in:
- key-value-editor.tsx: use getRuntime().crypto for encryption/decryption
- session.ts: use getRuntime().crypto.decryptAES
- main.ts: use getRuntime().crypto for vault operations
Tests pass for crypto adapters and plugin hooks.
* fix test
* fix type-check
* fix: handle prompt() execution error in sandboxed renderer context
The app.prompt handler was calling window.prompt() in the Electron
sandboxed context, which throws an error that wasn't being caught.
This caused script execution to fail without proper error handling.
Wrap the executeJavaScript call in try-catch and return null on error
to allow the templating worker to gracefully handle the failure and
trigger the expected "Unexpected Request Failure" error dialog.
Fixes failing E2E test: Critical Path For Template Tags Interactions
* fix: re-throw prompt error instead of silently returning null
The previous fix caught the prompt() error but returned null, which
caused the templating system to silently fail without showing the
expected error dialog.
Instead, catch the error and re-throw it with a descriptive message.
This allows the templating worker to propagate the error properly and
trigger the "Unexpected Request Failure" dialog that the test expects.
* docs: clarify why prompt is intentionally blocked in templates
The prompt function is intentionally unsupported in template context
because templates execute in a web worker where window.prompt() is not
available. This is a security-by-design decision.
Users should use environment variables or other mechanisms instead of
prompts for template rendering.
* feat: implement prompt() support via IPC bridge for templates
Add a full IPC-based prompt implementation that allows template
rendering to show native prompt dialogs when app.prompt is called:
1. Main process (templating-worker-database.ts): Sends prompt request
to renderer via IPC and waits for response with 60s timeout
2. Renderer (renderer-listeners.ts): Receives app.prompt event and
shows the existing showPrompt dialog, then sends result back
3. Preload (entry.preload.ts): Exposes notifyAppPromptResult method
to send prompt results back to main process
4. Types (ipc/main.ts and electron.ts): Add type definitions and IPC
channel names for the new prompt flow
This reuses the existing prompt infrastructure from the plugin system,
providing a consistent UI experience for template prompts.
* get main window
* combine two similar prompt bridges
* fix comment
* fix: redirect users to onboarding or organization view after migration
* fix: adjust INSOMNIA_SKIP_ONBOARDING to allow onboarding flows
* test: add Git migration onboarding test case
* fix: safeguard post-migration path for server-side rendering
* ci: add deploy-web-prototype workflow
Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
* content and style changes for onboarding slides
* new onboarding images, remove old ones
* remove accidental commit meant for a different branch
* change onboarding flag rules for v13
---------
Co-authored-by: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
* chore: bump easily bumpable actions off of Node 20 runtime
* chore: bump remaining actions or replace with inline logic where Node 24 versions are unavailable
* refactor: remove variable interpolation in run blocks as flagged by Semgrep
* refactor(runtime): introduce explicit network runtime capabilities
Add a RuntimeCapabilities boundary for network operations and initialize
renderer/node implementations from app, plugin, hidden-window, CLI, and test
entrypoints.
Migrate network request execution and HAR export paths to consume
getRuntime().network instead of importing network adapters directly.
* refactor: remove unused network adapter alias from Vitest and Vite config
* is renderer check
* fix: use __IS_RENDERER__ constant for treeshaking node-only imports
The recent change to guard Node-only code with `typeof window !== 'undefined' && window.main != null` broke Vite's treeshaking because the expression is not statically resolvable at build time. This caused Rollup to include both the renderer (IPC) and Node-only code paths, pulling transitive imports of `node:url` and `node:crypto` into the renderer bundle.
Introduced `__IS_RENDERER__` constant in the Vite `define` block (set to `true` for the renderer build) which is statically resolvable, allowing Rollup to eliminate the Node-only branch via dead code elimination.
Also added the constant declarations to a new `types/vite.d.ts` file so TypeScript recognizes `__IS_RENDERER__` as a valid global constant.
Fixes: MISSING_EXPORT error for node:url and node:crypto in curl.ts, openapi-3.ts, and swagger-2.ts
* fix: define __IS_RENDERER__ constant in vitest config
The __IS_RENDERER__ constant was undefined in test environments, breaking the
conditional logic in import.ts that determines whether to use the renderer IPC
path or the Node.js path. Define it as false in vitest config so tests run with
the correct code path.
Replace stub app context methods (alert, dialog, prompt, getPath, clipboard operations, showSaveDialog) with actual implementations using the fetch bridge to the main process.
- Add 8 new entries to pluginToMainAPI in templating-worker-database.ts
- Update AppContext interface to use async methods (matching worker reality)
- Replace worker-side throws with fetchFromTemplateWorkerDatabase calls
- Update renderer-side app context to return promises
* fix: skip file name collision validation when file name is unchanged
The validate callback parameter shadowed the outer `fileName` variable
(which holds the original name with extension). The folder-children
filter compared against the bare input value instead of the full
`fileName`, so the current file was never excluded — causing a false
"already exists" error whenever only the workspace name was edited.
Renaming the parameter to `inputValue` restores access to the outer
`fileName` so the filter correctly excludes the existing file before
checking for collisions.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix: make .yaml extension shift with input text in workspace settings
The invisible sizer span that drives the CSS grid column width had
static content (the initial filename), so the column never resized
as the user typed and the .yaml suffix stayed at a fixed position.
Switching the TextField to controlled mode (value + onChange) lets
the sizer span reflect the live input value, causing the .yaml label
to follow the text as characters are added or removed. Also removed
the excess pr-7 right-padding since the extension is now positioned
by the grid rather than by padding offset.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix: allow workspace filename input to adapt down to zero width inputs
* fix: sanitize file name value in workspace settings modal
Apply safeToUseInsomniaFileName to the TextField value prop so the
displayed and submitted value is always sanitized, matching the pattern
used in new-workspace-modal. Previously the controlled value reflected
raw input directly, bypassing character replacement.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix: minor right padding correction for consistency between new/edit workspace settings filename input
* fix: remove unnecessary w-min from new workspace modal as well
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(linting): resolved TOC/TOU issue (INS-2691)
* chore: fix lint errors
* test: adds unit tests for spectral-ruleset-cache.ts
* chore: remove polling mechanism for now
* feat: adds logic to address TOC/TOU concern without writing 2 files to disk
* feat: address some more bugs; adds logic to delete ruleset files scratch paths when a project is deleted
* test: update tests
* chore: adds comment
* feat: adds refresh ruleset logic to invalidate stale data
* chore: address PR comments
* chore: use text encoder to satisfy renderer
* fix(smoke): fix in-flight close issue
---------
Co-authored-by: Fares Osman <43153226+fiosman@users.noreply.github.com>
* refactor: remove dead vite.config stubs and fix comments
- Remove @apidevtools/swagger-parser and mocha from externalDependencies since both
are only used in the main process (importers and IPC handler), never in the renderer
- Update stale comment claiming nodeIntegration: true is still used
- Remove misleading insomnia-testing example from SSR conditions comment
- Remove main/types fields from insomnia-testing package.json since they point to
a non-existent src/index.ts; all consumers use explicit deep path imports
* refactor: remove unused assert polyfill alias, clarify dep chain in comments
- Remove assert/node:assert aliases — no renderer consumer (jshint, isomorphic-git, events, tough-cookie) requires 'assert'
- Condense polyfill comments to show only the evidence (which library needs it)
- Update util comment from tough-cookie (moved to main process) to jshint (actual renderer consumer)
* clean up vite config
* fix lint
* Add vault-crypto/mime utilities and remove heavyweight third-party imports
- Add AES-GCM vault-crypto utility with tests (replaces node-forge usage)
- Add common/mime.ts to replace mime-types package dependency
- Replace tough-cookie import in response-cookies-viewer with inline parser
- Replace @grpc/grpc-js status import in grpc-status-tag with inline constant
- Replace electron.ipcRenderer in auth.clear-vault-key with showToast()
- Remove unused analytics call from window-utils
* Fix impure Date.now() key on CodeEditor; use setValue via ref instead
Replace key={Date.now()} with a useEffect that calls editorRef.current.setValue(snippet)
whenever snippet changes, keeping the editor mounted. Also apply prettier fixes from quick-check.
* fix: address Copilot review comments on PR #9992
- vault-crypto: replace forge-in-renderer with IPC bridge (main process
retains forge; renderer calls window.main.vault.{en,de}cryptSecretValue)
- mime.ts: expand lookup table to 48 entries (webp, wasm, mp4, docx, xlsx,
fonts, audio/video, etc.) and fix remaining mime-types import in send route
- response-viewer: move charset alias map to module level; normalise iconv-lite
alias names (utf8, latin1, win1252, …) to WHATWG labels for TextDecoder
- auth.clear-vault-key: fix typo "all you local" → "all your local"
* fix: sort imports in send route
* feat: disable nodeIntegration in renderer mainWindow, remove import check tooling
- Set nodeIntegration:false and contextIsolation:true on mainWindow webPreferences
(hidden window keeps nodeIntegration:true for user script execution)
- Split script-security-rules.ts out of script-security-policy.ts so the renderer
can import display-only constants without pulling in require-interceptor
- Add templating/renderer-safe.ts with Node-free render/reload/getTagDefinitions;
update all renderer callers to import from it instead of templating/index
- Split insomnia-testing generate.ts: move generateToFile to generate-to-file.ts
so generate() has no Node imports; expose generateToFile from new entry point
- Move runTests execution to main process via IPC (run-tests channel) so the
renderer routes no longer import the Mocha-backed test runner directly
- Delete vite-plugin-electron-node-require.ts, check-renderer-node-imports.ts,
renderer-node-import-baseline.json and all related scripts/plugins now that the
renderer bundle is free of Node built-in imports
* fix: sort imports, use static TestResults type, remove unused analytics import
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* remove mime stuff
* remove ci step
* update plan
* insomnia testing adapter
* use export method
* trick react router ssr
* add renderer errors
* globalThis
* improve error
* move plugin types
* ipc validate proto
* fix import
* plugin types
* polyfill events for jshint
* restore node require plugin
* vault adapter
* add crypto bridges
* tough-cookie ipc
* util stub
* split cookie into network adapter
* assert
* fix plugin index import
* serialise cookie
* decouple renderer from scripting
* Fix rebase conflicts and import path issues
- Fix incorrect ~/insomnia-data imports (should be insomnia-data package)
- Remove non-existent mime utility imports and provide simple fallback
- Remove incorrect analytics call from main process
- Remove unused imports (Settings, Cookie)
- Fix Response type annotation for getResponseBodyBuffer
* lint
* fix tests
* fix: use dynamic import for crypt in session.ts for main process compatibility
The session.ts module is used in both renderer and main process contexts (via sync.invoke IPC handlers). When running in the main process, window.main is undefined, causing TypeError when trying to access window.main.crypt.decryptAES().
Changes:
- Use dynamic import of crypt module (only loaded in main process context)
- In renderer: window.main.crypt is always available so dynamic import never executes
- In main process: dynamic import loads crypt with node:crypto support
- Protect loginStateChange() calls with window existence checks
This avoids bundling node:crypto in the Vite renderer build while still supporting both execution contexts.
Fixes E2E test failures in sync operations (remoteBackendProjects, _assertSession, etc.) caused by disabled nodeIntegration.
* fix: add aria-label to template tag preview and browser-safe encoding fallback
- Add aria-label="Live Preview" to textarea in TagEditor for better Playwright accessibility
- Add atob() fallback for decodeEncoding in browser contexts where Buffer isn't available
- Fixes smoke test element discovery for template tag preview modal
* fix: add explicit waits for element stability in environment test
Add toBeEnabled() and toBeVisible() waits before clicking elements in the
'kv pair environment can be updated' test. This prevents timeout errors from
unstable/flickering elements during modal interactions, especially in
high-concurrency shard execution.
* remove unused
* add autocomplete generate test step
* fix lint
* put analytics back in
* combine vault and crypto adapter
* remove unused export split
* remove insomnia-testing cruft, addressing feedback
* fix: use direct imports in insomnia-inso after insomnia-testing index.ts removal
* fix circular reference
* fix: move createElectronNotifier to main process to fix SSR error
Move the electron-dependent createElectronNotifier function from repo-file-watcher.ts
to git-service.ts to prevent electron imports from being evaluated in the renderer/SSR context.
* export har ipc bridge
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(smoke): Resolved stability issues in e2e tests for (settings: can turn off logs, kv pair environment can be updated, hides the Konnect tab, manage environment, can use client certificate for mTLS)
