- Introduced `GitChangeList` enum to categorize changes as Staged or Unstaged.
- Implemented multiple test cases to verify the behavior of undiscardable changes:
- Committing a reordered file leaves the working tree clean.
- Confirming discard on a reordered file brings the change back.
- Mixed changes (real edits with reorders) are not flagged until the real edit is discarded.
- Non-Insomnia added and deleted files show no undiscardable warning.
- Files from older schemas are flagged as undiscardable.
- Real edits show no undiscardable warning in diffs or discard confirmations.
- Staged hand-reordered files show no undiscardable warning.
- Warnings are consistent in both diffs and discard confirmations for hand-reordered files.
- Added McpPrimitiveType enum to categorize sidebar row types.
- Introduced McpListAction enum to standardize action names in capability menus.
- Updated references in tests and flows to use new enums instead of string literals for improved maintainability and clarity.
- Refactored related tests to ensure compatibility with the new enum structure.
- Added new methods in McpClientFlow for handling capability errors, toggling capabilities, refreshing lists, and loading more items.
- Implemented a scriptable list-response server for testing various scenarios with MCP Client.
- Introduced comprehensive tests for error responses, including handling invalid entries, whole-response errors, and ensuring proper UI behavior for error panels.
- Updated McpClientPage to manage capability items and their associated error panels more effectively.
- Enhanced constants and configuration for better server interaction and testing.
- Added new methods in McpClientFlow for handling capability errors, toggling capabilities, refreshing lists, and loading more items.
- Implemented a scriptable list-response server for testing various scenarios with MCP Client.
- Introduced comprehensive tests for error responses, including handling invalid entries, whole-response errors, and ensuring proper UI behavior for error panels.
- Updated McpClientPage to manage capability items and their associated error panels more effectively.
- Enhanced constants and configuration for better server interaction and testing.
* chore: bumped zod@3.25.76 to zod@4.6.5
Zod 4 treats a required z.undefined() object key as non-optional, so
absent keys in the RequestCollectionSchema union discriminators failed.
Wrap those keys in .optional() to keep v3 semantics.
Update the deep-strict auth test to expect the unrecognized_keys issue
that zod 4 reports for the strict empty-object fallback branch.
* chore: bumped jsdom@25.0.1 to jsdom@30.1.2
- Clears @asamuzakjp/css-color@3.2.0 advisory (AIKIDO-2026-199800); css-color now 7.1.4.
- No source changes needed: none of the jsdom 26-30 breaking changes hit the repo's jsdom tests.
* chore: bumped @bufbuild/protobuf@1.10.1 to @bufbuild/protobuf@2.16.0
Moves the gRPC stack to connect v2 alongside protobuf v2 (connect-node
and connect 1.7.0 -> 2.2.0). This clears the transitive undici 5.29.0
and @fastify/busboy 2.1.1 under connect-node 1.x.
Source changes:
- grpc.ts: createPromiseClient is removed in v2, so the reflection
service is now built from a FileDescriptorProto via fromJson and
createFileRegistry (proto3.makeMessageType is removed). The unary call
goes through transport.unary directly because createClient cannot type
a runtime-built descriptor.
- grpc.ts: toBinary takes the schema (FileDescriptorSetSchema from wkt).
- grpc.test.ts: mock transport uses the v2 unary signature (no service
argument, method.output, fromJsonString).
* chore: regenerate insomnia JSON schema for dependency bumps
* test: add grpc reflection regression tests for connect v2
* test: add smoke tests for buf reflection API
* fix: don't auto-send gRPC reflection API key on request open
* fix: drop non-standard starts_with format from published schema
## Background
Hovering a `{{ _.vault.key }}` chip showed no source: vault secrets are stored under the reserved `__insomnia_vault` key in each environment and only surface under the runtime `vault` namespace after decryption, while the key source map was built by a parallel walk over the raw environment data in `getRenderContext`, duplicating the merge semantics that `buildRenderContext` implements for values.
## Changes
- Move key source registration into `buildRenderContext`, where the values are merged. Registration runs in the same order the runtime resolves values: the `__insomnia_vault` entries of every environment are recorded under the `vault` namespace first, then every environment's plain data walk — so a legacy plaintext `vault` key, which import and sync can carry without reserved-key validation, wins over sealed values just like it does in the final vault spread.
- Unify source labels to `<environment type> : <name>` — Project Environment, Collection Environment and Folder Environment; runner upload data and script variables keep their own type names.
- Prefix the source line in the hover tooltip with `Source`, matching the live preview modal.
- Rename the setting to "Template tags show variable source and value" so its scope is obvious from the name.
* migrate request related p2
- grpc-request
- cookie-jar
- fix ts errors
* add unit test to check field mismatch
* migrate request group model
* migrate the socket io request and import parser
* migrate websocket schema and fix ts error
* fix order issue and add unit tests
* fix: Warn when a Git Sync change cannot be discarded [INS-3689]
When a committed YAML file is not in the exact format Insomnia generates
(hand-edited, or written by an older version), discarding it restores the
file, the repo file watcher imports it and re-exports it, and the change
reappears. Users get stuck with a change they can never discard.
Detect this up front by replaying the import -> export round-trip in memory
on the raw index/HEAD content. When the result equals the working copy, the
whole diff is Insomnia re-generating the file, so the Commit Changes modal
shows a warning above the diff and the discard confirmation explains that
the file needs to be committed once.
- Add sync/git/canonical-file.ts, which mirrors database.update (initModel)
and the getWithDescendants ordering (created, then _id)
- Split getInsomniaV5DataExport into a DB fetch and a pure
serializeInsomniaV5Export
- Return rawHead/rawStage from GitVCS.fileStatus, since head/stage are
migrated and reordered for display
- Export initModel from insomnia-data/node
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* refactor: Replay the Git Sync round-trip on a scratch database [INS-3689]
The undiscardable-change check reimplemented parts of the import/export
pipeline (initModel, getWithDescendants ordering) to avoid touching the app
database. That copy would silently drift whenever the real pipeline changes.
Run the real pipeline instead: write the imported docs to a scratch
in-memory NeDB instance and export them with getInsomniaV5DataExport.
- Keep NeDB collections, change buffer and listeners per instance in
createNedbDatabase. They were module-level, so a second instance's init()
would have replaced the app's collections. flushChangesImpl is now handed
to the wrapper instead of being exported.
- Add an optional db parameter to getInsomniaV5DataExport and drop the
serializeInsomniaV5Export split and the initModel export
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* fix: Ignore import timestamps when detecting undiscardable changes [INS-3689]
Import fills a missing meta.created/modified with the current time, so a
hand-added entry without timestamps got a different value in the replay
than in the working copy the watcher wrote earlier. The exact comparison
then failed and the warning never showed, although the change still came
back after every discard.
Compare the replay with the working copy using hasSignificantChanges, the
same rules the Unstaged changes list uses, so differences the list already
ignores no longer hide the warning.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: Reword the undiscardable change warning [INS-3689]
Explain the cause in user terms, using the wording suggested in the ticket.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* chore: Shorten the undiscardable change warning [INS-3689]
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* refactor: Rename committedContent to baselineContent [INS-3689]
The content a discard restores is the staged content when there is one, so
it is not necessarily committed.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The type represents the response pane (response data plus console, stream
events and script test results), not the network response, and clashed
with the insomnia-data Response name. Update flows, pages, specs, JSDoc
and the write-insomnia-test skill accordingly.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
- Implemented a mock bin server for handling HTTP requests and responses.
- Created an OAuth2 server with endpoints for authorization and token management.
- Added a Socket.IO server for real-time communication.
- Developed a WebSocket echo server for testing WebSocket connections.
- Updated package.json scripts to use TypeScript files with esr.
- Configured Playwright to start mock servers during tests.
- Introduced TypeScript configuration for the insomnia-test package.
## Background
Users can define the same variable at many environment levels (project, collection base/sub, folder, script-local). When hovering or clicking a variable in an editor there was no way to tell where its value comes from.
[INS-3943](https://konghq.atlassian.net/browse/INS-3943)
## Changes
- **Render context**: track variable source metadata (`keyContextMeta`) alongside `keyContext` — source label plus the owning workspace / environment / folder ids. Fix `keySource` ancestor ordering to match `buildRenderContext` (closest folder wins), which previously reported the wrong source for shadowed keys — this also affected the existing "Show variable source and value" setting. Keys overridden by runner upload data or `insomnia.variables.set` get a non-navigable source meta (no workspaceId, label `uploadData` / `scriptLocalVariables`) so consumers never point at an environment that no longer supplies the value; the meta label doubles as the `keySource` string the "Show variable source and value" setting renders.
- **Live preview modal**: "Edit Variable" shows a Source row (inside the Live Preview block) with an Open action.
- **Hover tooltip**: hovering a variable shows value + source + Open, rendered by a global `VariableSourceTooltipHost` using the shared tooltip stack (`useOverlayPosition` + `tooltip__bubble` styling). Undefined variables surface the render error instead of vanishing.
- **Open action routing** (via `buildResourceUrl` from the navigation route registry, so the hook holds no hand-built URLs and no tab-specific code):
- folder environment → the folder pane (`?tab=environment`), by plain navigation; the tab-list route sync (`useInsomniaTab`) activates the matching tab or creates a temporary one — the same generic mechanism every deep link uses;
- project environment (environment-type workspace) → its workspace page (`?environmentId=`), likewise plain navigation; both deep-link params are validated against the target's own resources and consumed after applying, so forwarded search params cannot re-select them later;
- collection environment → the workspace's **Manage Environments modal** (the same dialog the environment picker's manage button opens) opened in place, with the source environment preselected. Editors reach it through a new `OPEN_ENVIRONMENTS_MODAL` event on `uiEventBus`, hosted by the workspace pane header.
- **E2E**: data-driven suite `variable-source-live-preview.test.ts` — 5 environment levels × {send value, modal Source/preview/Open, hover tooltip, "Show variable source and value" inline display} + error-chip and tooltip-content-keep-alive regressions. Collection scenarios assert the Manage Environments modal opens with the env row preselected.
## Design notes
- Tooltip timing lives in a small controller (`variable-source-tooltip.ts`) because the trigger is a CodeMirror widget outside the React tree; rendering/positioning/events on the bubble use the existing react-aria stack. No new dependencies.
- The Open hook (`use-open-variable-source.ts`) is reachable from root-mounted modals (CodePromptModal → MarkdownEditor → CodeEditor), so it must not statically import the tab system or the environments modal — either import closes a circular reference back to `root.tsx` (verified against `dependency-cruiser`, which counts type-only and dynamic imports). The tab system is reached through the generic route sync instead, and the modal through the event bus; the modal is hosted by `WorkspacePaneHeader`, which already imports it — zero new edges in the module graph (`check-cycle-references` reports the baseline count).
- Collection environments have no page of their own; the picker's Manage Environments dialog is the canonical editing surface, so Open reuses it instead of navigating. The earlier draft's dedicated env-page tab id (`${workspaceId}-env`) and `buildTabFromNavigation` overrides were removed — `workspace:environment` was already registered in the navigation route registry, so the generic mechanism covers it.
- Old-syntax `{{ a }}` variables have no source: the source map is keyed under the `_` namespace only. Extending it to bare keys is a potential follow-up.
- Security review: no findings (no XSS/prototype-pollution/open-redirect/secrets-exposure regressions; vault masking parity with develop).
The id preservation in addSetCookiesToToughCookieJar() (added in #10475) had no
test for the case this ticket describes: replaying an identical Set-Cookie
response, or a response that sets only one of several cookies, must keep the
existing cookie ids so the Git-synced cookie jar does not get dirtied.
Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>
- Add mock-bin-server.js to handle HTTP requests and responses for mock routes.
- Create mock-route.ts and mock-server.ts models to define the structure of mock routes and servers.
- Develop mock-server.page.ts for UI interactions with the mock server, including route creation, editing, and deletion.
- Implement tests for creating, editing, deleting, and exporting/importing mock servers and routes.
- Ensure request logging and response definitions are correctly handled and verified in tests.
Bob Qiu