## Problem
When editing a project environment in Table View with no key/value entries, the trailing blank row could freeze the UI after renaming the environment in the header and immediately clicking the blank `Input Name` field.
The blank row was simultaneously managed by React Aria's `ListBox autoFocus="last"`, an imperative `ListBoxItem.onFocus` handoff, and `OneLineEditor` autofocus/retry logic. In the single-item boundary case these focus owners could race with `FocusScope` restoration and async environment revalidation.
## Fix
- Keep the trailing blank row inside the existing React Aria `ListBox` so row semantics, styling, keyboard navigation, drag-and-drop, and state behavior remain unchanged.
- Remove `ListBox autoFocus="last"` and the blank-row `ListBoxItem` focus handoff.
- Give the blank row's `OneLineEditor` one-shot autofocus on initial editor mount. This works for both empty and non-empty lists and is cleared after the initial autofocus.
- Track editor refs by distinct name/value editor ids.
- Restore focus once to the editor that was active when a blank row was converted into a persisted pair, after the persisted data update has mounted the new editor.
This prevents repeated focus stealing while preserving focus through the blank-row-to-persisted-row transition.
## Summary
- Splits the single "Manage Environments" popover into two independent dropdowns — project-level and collection-level — each with a scope tooltip and an inheritance-order hint (folder overrides collection, which overrides project).
- Replaces the hidden "+" menu in the collection environment editor and the project-level full-page environment editor with explicit, always-visible "Add Sub Environment" / "Add Private Sub Environment" buttons.
- Adds an "Add Project Environment" action to the project dropdown (does not auto-select the new environment).
- Adds a keyboard shortcut for the project dropdown (Cmd/Ctrl+Alt+E), alongside the existing collection-environment shortcut (Cmd/Ctrl+Shift+E).
- Fixes smoke tests broken by removing the old single-picker trigger, and adds new coverage for the split dropdowns and create flows.
[INS-2791](https://konghq.atlassian.net/browse/INS-2791)
## Summary
- Switching a request's project environment (activeGlobalEnvironment) left the request pane's template values stale, since its remount `key` only tracked the workspace environment (activeEnvironment).
- Added the project environment id/modified timestamp to the URL bar's remount key so it also refreshes on project environment switch.
## Background
- In the latest vite up gradation, the log is `VITE v7.3.1 ready in 1145 ms` instead of `VITE ready in`
- Playwright SIGKILLs the process by default, which leaves a stale .vite-port file
## Changes
- Update the wait pattern
- Use gracefulShutdown
- Always try to cleanup when receive any exit event
## Background
- Cloud Sync workspace uses local workspace id as its id, which may duplicate with the workspace id in the local db. (Clone a github repo -> convert to cloud sync -> clone it again)
## Changes
- Use team project id + project id as the unique id
* fix(main): compare full origin, not string prefix, for renderer nav guard (INS-3622)
Use isTrustedAppOrigin (parsed origin comparison) instead of
url.startsWith(appUrl) for will-navigate and will-redirect on the main
window.
* fix(main): restrict trusted-origin check to http/https schemes (INS-3622)
blob:/data: URLs report an origin derived from embedded text, not
actual creation context, so they could spoof isTrustedAppOrigin.
[INS-3637](https://konghq.atlassian.net/browse/INS-3637)
## Summary
- SSE ("Event Stream") sends re-fetched the raw, unrendered request from the database instead of using the already-rendered/de-duplicated/interpolated request the renderer had computed, so headers/authentication/body reaching curl could diverge from what the user configured.
- `openCurlConnection` now takes one fully-rendered request object (`{ workspaceId, renderedRequest, initialPayload? }`) instead of piecemeal fields, drops the redundant DB read, and computes the auth header in-process via `getAuthHeader` instead of a separate IPC round trip.
- Fixed `createConfiguredCurlInstance`'s manual-proxy branch, which resolved protocol/hostname from the raw stored URL instead of the request's actual URL.
- Added `curl.test.ts` and `libcurl-promise.test.ts`; patched shared test infra (`setup-vitest.ts`, `src/__mocks__/electron.ts`) so named imports from `electron` resolve under the mock and `electron.app.on(...)` doesn't throw.
## Test plan
- [x] `npx tsc --noEmit` clean on changed files
- [x] `npx eslint` clean on changed files
- [x] `npx vitest run` — full suite: 162 files / 2244 passed, 15 pre-existing skips
- [x] Manually verify an SSE request (e.g. POST with `Accept: text/event-stream` to a streaming API) sends the expected single Accept header and correct body/auth
[INS-3637]: https://konghq.atlassian.net/browse/INS-3637?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ
* fix(cloud-sync): surface stale/reverted staged changes instead of silently committing them
status() diffed the working tree against HEAD only, so a key whose content
returned to HEAD while still staged (or was staged-then-deleted before ever
being committed) was invisible to both the staged and unstaged views —
takeSnapshot() would then commit the stale staged content unnoticed
(INS-3520).
- status() now diffs against the index (HEAD with the stage overlaid via a
new applyStageToState helper, also reused by takeSnapshot()) so these
cases surface as actionable unstaged entries, with explicit branches for
every stage/entry combination instead of a single blobId comparison that
was tautological for deletions.
- stage() drops an entry instead of storing it when the incoming content is
a no-op relative to HEAD, keeping the sparse stage map from accumulating
entries that would otherwise still show as staged and produce empty
commits.
- Removed the unused key field from status()'s return (and the Status
type), which was computed but never read anywhere.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
* Fix type check
* rm doc
---------
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
* chore: support dynamic port
* fix: handle missing .vite-port and prevent stale file race
- window-utils.ts: wrap .vite-port read in try/catch with fallback to
default port 3334, preventing crash when file is missing
- esbuild.entrypoints.ts: delete .vite-port at start of dev build so
wait-on doesn't pick up a stale port from a previous run
* fix: derive smoke-test webServer port from per-worktree .vite-port
Hardcoded url: 'http://localhost:3334' made playwright's webServer
reuse-detection cross-worktree: if another worktree's dev server was
already answering on 3334, this worktree's tests silently reused it
instead of starting their own. Read the worktree's own .vite-port file
(written by vite.config.ts) instead, falling back to plain stdout-regex
readiness when no port file exists yet.
PR #10097 dropped h-fit from the Modal className as an unrelated
side effect of a class rewrite, leaving the modal stretched to the
overlay's full height with empty space below the content.
* fix(test): ensure scoped selection for storage type and improve click reliability in project creation
* fix(test): expand shard matrix for smoke tests and repeat each test for git-local-repos
* fix(test): adjust shard matrix for smoke tests to match total shards
* fix(test): update shard matrix for smoke tests to include additional runs
* fix(test): update smoke test sharding to improve parallel execution and reliability
* fix(test): update smoke test configuration for improved execution and reporting
* fix(test): update smoke test configuration to use sharding for improved execution
* fix(test): refactor git repository relocation tests to use dedicated method for moving repositories
Opening an existing local folder as a git project could leave an empty
[user] name/email in the repo's .git/config, which blocks git's fallback
to the machine's global identity and breaks `git commit` outside Insomnia.
- Pass repoPath into GitVCS.init() for openGitRepoAction so the "native"
credentials provider can actually read user.name/user.email via
`git config` in that directory instead of always resolving empty.
- setAuthor() now skips writing config when no author name/email can be
resolved, instead of writing empty user.name/user.email keys.
* fix(ui): re-render url bar templates on project environment switch
The request URL bar's remount key only tracked the workspace
environment (activeEnvironment), so switching the project
environment (activeGlobalEnvironment) left stale nunjucks tag
values in the URL bar. The URL preview was unaffected since it
re-renders on any loader revalidation and refetches the render
context fresh from the DB.
* fix(ui): re-render mcp url bar templates on project environment switch
Same issue as the request URL bar: the remount key only tracked
the workspace environment, so switching the project environment
left stale nunjucks tag values.
* wip: sendRequest bridge fixes for QuickJS sandbox — known unresolved crash
Not working yet. insomnia.sendRequest() consistently crashes under the
real Electron/Worker/QuickJS environment with:
Aborted(Assertion failed: list_empty(&rt->gc_obj_list), at:
../../vendor/quickjs/quickjs.c,2036,JS_FreeRuntime)
on the FIRST real network round trip (via the
insomnia-templating-worker-database:// fetch bridge to
network.sendRequestWithoutSideEffects). This never reproduces in vitest
(mocked fetch, or a real Node http server) — only under real Electron
fetch() timing inside the dedicated Worker.
This commit includes three targeted fixes attempted so far, none of
which resolved it on their own or together:
1. insomnia.sendRequest('url string') omitted `headers` entirely; the
host handler doesn't default it, crashing
createConfiguredCurlInstance's `headers.find(...)` user-agent lookup.
This one IS a real, confirmed bug (unit-tested regression added) —
just not sufficient by itself to fix the crash above.
2. Deferred sendRequestViaFetch by one Promise.resolve().then() tick so
it doesn't run nested inside the QuickJS C-to-JS callback frame
(matching host-bridge.ts's installHostBridge pattern for the
template-tag sandbox).
3. executePendingJobs() returns a DisposableResult that must itself be
disposed — discarding it leaked a handle. Fixed in both
installSendRequestBridge and driveTaskToCompletion.
4. Added a disposedRef guard so a late-arriving fetch response after
vm.dispose() is a safe no-op instead of touching a dead context.
Also includes the smoke test (quickjs-script-sandbox.test.ts) that
reproduces the crash reliably — the second test in that file (worker
UI-responsiveness) passes; the sendRequest round-trip test does not.
Branched off PR 2 (37d19c1da8) per the rollout plan —
https://gist.github.com/jackkav/3ebf8768bf84be024a3a138874919354 — so
this can be picked up independently without blocking PR 0/PR 1 landing.
Next step for whoever picks this up: bisect further with instrumented
console.error tracing of vm.alive at each step (deferred here, not
committed) to find exactly which call touches vm after disposal — my
three fixes were reasonable hypotheses but didn't close it.
* test: add __sendRequest to the globalThis allowlist after rebase
The merged globalThis-leak test's ALLOWED_EXTRA_GLOBALS predates this
branch's sendRequest bridge landing back on top of develop's rebase target;
without this the merged test fails since __sendRequest is now a real
bridged global.
* fix(quickjs): free bridge promise resolvers before disposing the VM
`vm.newPromise()` allocates three JSValues — the promise plus its `resolve`
and `reject` functions — and quickjs-emscripten frees the two functions only
from inside `resolve()`/`reject()`. `installSendRequestBridge` returned the
promise handle but could skip both (the `disposedRef` guard did exactly that),
so a `sendRequest()` still in flight at teardown left two live function objects
in the runtime and `JS_FreeRuntime` aborted on
`assert(list_empty(&rt->gc_obj_list))` — a native Emscripten abort that takes
down the Worker and the WASM module shared with the template-tag sandbox.
Track every unsettled deferred and dispose it before `vm.dispose()`, which is
the cleanup the library documents for this case. Guard the late-response path
on `vm.alive`/`deferred.alive` instead of a hand-rolled flag.
Also plumb the templating-db auth token from `run-script-quickjs.ts` through
the worker into the engine — it was accepted but never passed, so every bridge
fetch was rejected 401 by the protocol's auth gate.
The crash reproduces in vitest after all: the mocked fetch in the existing
tests settles in the same microtask checkpoint as the call, so the deferred was
always settled before teardown. Settling it on a later macrotask reproduces the
exact production abort, so the smoke test no longer needs `test.fail()`.
* fix(quickjs): return the response value from sendRequestWithoutSideEffects
The handler returned `new Response(JSON.stringify(result))` while every other
handler in `pluginToMainAPI` returns a plain value and lets the caller wrap it.
`resolveDbByKey` does `JSON.stringify(await handler(body))`, so a `Response`
stringified to `"{}"` — the sendRequest bridge received an empty object, and
`response.code` / `response.body` were undefined. The template-tag sandbox's
`network.sendRequestWithoutSideEffects` path was broken the same way.
Also record a second, unrelated `gc_obj_list` abort that the teardown fix does
not address and that predates this branch: allocation-heavy work performed
inside `executePendingJobs()` (anything after the script's first `await`) leaves
live GC objects and aborts at `JS_FreeRuntime`, from ~100k objects up. Reduced
to a reproducer with no bridge, no host functions, no interrupt handler, no
memory limit and no `resolvePromise`; unaffected by every host-side mitigation
tried, and present on both quickjs-emscripten sync variants. Tracked as a
`.fails()` test so it flips red when an engine bump fixes it.
The sendRequest bridge is what makes that latent engine bug routine — it is the
first thing to put multi-megabyte host data into the VM.
Corrects the "later run proves the module survived" comment: a fresh context on
the same WASM module succeeds even after an abort, so that assertion never
detected anything.
* fix(quickjs): address Copilot review feedback on sendRequest bridge
- Normalize request.header (singular, per RequestOptions) as well as
request.headers, and accept {key, value} header entries alongside
{name, value}.
- Coerce request.url to a string, since RequestOptions allows a
Url-like object there and the host handler needs a plain string.
- sendRequestViaFetch no longer unconditionally JSON.parses the
response body — a non-JSON body (empty response, HTML error page,
etc.) now surfaces a clear "non-JSON response"/status-based error
instead of an opaque SyntaxError masking the real failure.
- The callback-style rejection handler no longer assumes err is an
Error instance (guards on err && err.message).
The authToken concern from the same review round was already fixed by
5ad0278188 on this branch (plumbed from run-script-quickjs.ts through
the worker into the engine) before this commit.
Added unit test coverage for all four fixes.
* fix(quickjs): survive the WASM teardown abort instead of losing the run
Allocating ~100k+ objects after a script's first `await` — which a multi-MB
`insomnia.sendRequest()` response body does on its own — leaves QuickJS's
runtime un-freeable, and `JS_FreeRuntime` aborts the WASM module. The script
has already finished by then and everything we return is plain host-side JS, so
the abort was destroying a run whose result was intact.
Catch it at teardown, warn into the script's logs, and report it through a new
`onEngineFault` callback. Catching inside `finally` means a genuine script error
or timeout still wins. The worker forwards the fault as `engineFaulted` and the
client retires that worker, so no later script runs on a module that aborted.
Retirement is drain-aware: `self.onmessage` doesn't serialize, so a second
script can be mid-execution. The worker leaves rotation immediately but is only
terminated once its in-flight runs settle, and the crash handler now rejects
only its own worker's runs rather than every pending call.
Verified before implementing: the abort is catchable, host-collected data
survives it intact, and the module is still *correct* afterwards — arithmetic,
JSON, string and global operations all check out across repeated runs. Retiring
the worker anyway is defensive, since that only samples the behaviour we
happened to test.
This is containment, not a fix. The underlying defect is in quickjs-emscripten's
WASM build, not in QuickJS: the identical vendored engine source built natively
is clean well past the failing size at every optimization level, with and
without -fwrapv, with CONFIG_STACK_CHECK, and with the same raw-context
intrinsic subset the shim uses — while both WASM engines abort at both
optimization levels. Tracked upstream as
https://github.com/justjake/quickjs-emscripten/issues/269.
* fix(quickjs): close three sendRequest bridge findings (#10404)
* fix(quickjs): reject caller-controlled caCertficatePath/authentication in sendRequestWithoutSideEffects
* fix(quickjs): bound the script sandbox's runtime stack size
Unbounded guest recursion overflowed the host WASM stack before QuickJS's own
depth check could fire, masking the real error behind a fatal gc_obj_list
assertion at vm.dispose(). setMaxStackSize(256KB) lets QuickJS's own check win.
* fix(quickjs): deny multipart/file-upload bodies in the sendRequest bridge
network.sendRequestWithoutSideEffects's cacert/authentication fields are already
pinned regardless of caller input, but its `body` was forwarded unvalidated. A
multipart/form-data body's file parts (body.params[].fileName) reach
buildMultipart, which reads each part's fileName off disk with no ownership/
allowlist check -- unlike every other local-file read reachable from a request
definition. A script reaches this by calling the raw __sendRequest bridge global
directly, bypassing insomnia.sendRequest()'s wrapper, which only ever builds a
text/plain body.
Scoped the fix to the QuickJS bridge itself (assertSupportedSendRequestBody,
run before the bridge's fetch() is dispatched) rather than the shared handler,
since that handler is also used by the legacy hidden-window script sandbox and
the template-tag sandbox, each with its own already-privileged execution model
that should keep working as-is.
Two regression tests: one drives the real QuickJS bridge end-to-end and confirms
the request is now denied before it ever reaches curlRequest; the other drives
the legacy (non-QuickJS) sendRequestWithoutSideEffects implementation directly
and confirms it's unaffected -- the same multipart body still goes through.
---------
Co-authored-by: kwburns-kong <kyle.burns@konghq.com>
* poc: opt-in QuickJS sandbox for pre-request/after-response scripts
Adds settings.useQuickJsScriptSandbox (default off) and wires it into the
existing hidden-BrowserWindow dispatch point in concurrency.renderer.ts, so
scripts can optionally run in the QuickJS-WASM sandbox already used for
plugin template tags instead of the hidden window.
This PoC supports console, insomnia.environment/variables get/set, and
read-only insomnia.request; insomnia.sendRequest() and insomnia.test()/
pm.test() are not yet bridged and throw a clear error.
Full rollout plan (worker-boundary move, async host bridge, test-lifecycle
and request-mutation parity, security verification, telemetry/soak, and
eventually flipping the default to opt-out) is written up here:
https://gist.github.com/jackkav/3ebf8768bf84be024a3a138874919354
* fix: address Copilot review feedback on QuickJS script sandbox PoC
- Timeout error now reports the configured duration instead of an epoch
deadline timestamp.
- insomnia.request is deep-frozen so mutation attempts are silently
no-ops consistently, rather than appearing to succeed inside the
script while never reaching the host.
- Fix operator-precedence bug in a test script (?? binds looser than +).
- Add an aria-label to the new sandbox toggle Switch for screen readers.
* poc: move QuickJS script execution to a dedicated Web Worker (PR 1)
Splits run-script-quickjs.ts into:
- quickjs-script-engine.ts: the pure QuickJS execution logic (unchanged
behavior), runnable from anywhere.
- quickjs-script.worker.ts: a Web Worker entry point that runs the engine
off the renderer's main thread.
- run-script-quickjs.ts: now a thin client that lazily creates the worker
(only when useQuickJsScriptSandbox is actually used) and correlates
postMessage/response pairs by id, matching the existing
templating-handler.ts/templating.worker.ts pattern used for template
tags.
A runaway script (e.g. an infinite loop) now blocks only the disposable
worker instead of the renderer's UI thread. A worker-level crash rejects
every in-flight call and the next call gets a fresh worker.
concurrency.renderer.ts is unchanged apart from continuing to import
runScriptInQuickJs by the same name/path.
Ref: PR 1 of the rollout plan — https://gist.github.com/jackkav/3ebf8768bf84be024a3a138874919354
* style: formatting pass on quickjs worker-client test
* poc: async host bridge + insomnia.sendRequest() parity for QuickJS sandbox (PR 2)
Bridges insomnia.sendRequest() to a real HTTP request instead of throwing,
reusing the existing insomnia-templating-worker-database:// fetch protocol
and its network.sendRequestWithoutSideEffects handler (the same one the
template-tag sandbox already uses) rather than adding a second protocol
scheme. This is the same fetch-to-custom-protocol pattern
templating.worker.ts uses to reach the main process from a dedicated Web
Worker, generalized to a second async host bridge inside
quickjs-script-engine.ts (a VM promise resolved off a real fetch(),
settled via executePendingJobs() — no asyncify).
- quickjs-script-engine.ts: installSendRequestBridge() + BOOTSTRAP's
insomnia.sendRequest() now normalizes a URL string or a plain
{url, method, headers, body} object, calls the bridge, and rebuilds a
response object ({code, status, headers, body, responseTime, json(),
text()}) — supports both the Postman-style (error, response) callback
and awaiting the returned promise. insomnia.test()/pm.test() still
throws (unchanged).
- run-script-quickjs.ts (client): fetches the templating-db auth token
once via window.main.templatingDb.getAuthToken() (same pattern as
ui/worker/templating-handler.ts) and forwards it on every postMessage.
- quickjs-script.worker.ts: passes the auth token through to the engine.
Known gaps (documented in quickjs-script-engine.ts, deferred to a later
parity PR): no auth/client-certs/cookies/multipart-or-urlencoded bodies,
and the response object doesn't yet match the hidden-window Response
class's full surface (chai assertions, originalRequest, cookies).
Ref: PR 2 of the rollout plan — https://gist.github.com/jackkav/3ebf8768bf84be024a3a138874919354
* Revert "poc: async host bridge + insomnia.sendRequest() parity for QuickJS sandbox (PR 2)"
This reverts commit 37d19c1da8.
* test: add e2e smoke test for QuickJS sandbox (PR 0 + PR 1 only)
Proves the opt-in QuickJS engine and Web Worker boundary work end to
end in the real Electron app, not just in vitest's mocked unit tests:
- console.log, insomnia.environment.get/set, and read-only
insomnia.request all work through the real Worker/QuickJS pipeline
(canary: `typeof require` confirms the script actually ran in
QuickJS, not the legacy hidden-window engine).
- A runaway (`while(true){}`) script blocks only its dedicated Worker —
the app UI stays responsive and interactive while it churns.
insomnia.sendRequest() (PR 2) is intentionally not exercised — it's
been split into its own WIP branch/PR (#10392) pending a real fix for
a QuickJSUseAfterFree crash that only reproduces under real Electron
timing.
Uses "testQueryParams", a request at the workspace root with no body
and no folder-inherited scripts. Every other candidate in this fixture
either references environment variables undefined until a script runs
(triggering Insomnia's "N environment variables are missing"
confirmation dialog) or inherits a folder-level after-response script
calling an API this minimal engine doesn't bridge, which turns an
otherwise-successful send into a displayed "Error" status. Asserting
via the Console tab (console.log output) instead of an echoed response
body sidesteps template rendering entirely.
Ref: PR 0/1 of the rollout plan — https://gist.github.com/jackkav/3ebf8768bf84be024a3a138874919354
* fix(scripting): guard __proto__/constructor/prototype keys in QuickJS env/var bridge (#10395)
A script-supplied "__proto__"/"constructor"/"prototype" key reaching the bridge's store object could rewire its prototype or shadow those names; the bridge now rejects these keys before assignment.
---------
Co-authored-by: kwburns-kong <kyle.burns@konghq.com>
xiaodemen