npm i

- Change from data.buffer to new Uint8Array(data) to fix ArrayBufferLike type compatibility with Blob constructor
- Fixes TS2322 errors about SharedArrayBuffer not being assignable to BlobPart

.claude/rules.md

@@ -0,0 +1,22 @@
+# Project Rules
+
+## General Development
+- **NEVER** commit or push without explicit confirmation
+
+## Build and Lint
+- **ALWAYS** run `npm run lint` after modifying TypeScript or JavaScript files
+- Run `npm run bootstrap` after changing plugin runtime or MCP server code
+
+## Plugin System
+
+### Backend Constraints
+- Always use `UpdateSource::Plugin` when calling database methods from plugin events
+- Never send timestamps (`createdAt`, `updatedAt`) from TypeScript - Rust backend controls these
+- Backend uses `NaiveDateTime` (no timezone) so avoid sending ISO timestamp strings
+
+### MCP Server
+- MCP server has **no active window context** - cannot call `window.workspaceId()`
+- Get workspace ID from `workspaceCtx.yaak.workspace.list()` instead
+
+## Rust Type Generation
+- Run `cd src-tauri && cargo test --package yaak-plugins` to regenerate TypeScript bindings after modifying Rust event types

.gitattributes

@@ -1,2 +1,7 @@
 src-tauri/vendored/**/* linguist-generated=true
 src-tauri/gen/schemas/**/* linguist-generated=true
+**/bindings/* linguist-generated=true
+src-tauri/yaak-templates/pkg/* linguist-generated=true
+
+# Ensure consistent line endings for test files that check exact content
+src-tauri/yaak-http/tests/test.txt text eol=lf

.github/FUNDING.yml

@@ -1,15 +1,3 @@
 # These are supported funding model platforms
 
 github: gschier
-patreon: # Replace with a single Patreon username
-open_collective: # Replace with a single Open Collective username
-ko_fi: # Replace with a single Ko-fi username
-tidelift: # Replace with a single Tidelift platform-name/package-name e.g., npm/babel
-community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry
-liberapay: # Replace with a single Liberapay username
-issuehunt: # Replace with a single IssueHunt username
-lfx_crowdfunding: # Replace with a single LFX Crowdfunding project-name e.g., cloud-foundry
-polar: # Replace with a single Polar username
-buy_me_a_coffee: # Replace with a single Buy Me a Coffee username
-thanks_dev: # Replace with a single thanks.dev username
-custom: https://yaak.app/pricing

.github/workflows/ci-js.yml

@@ -1,18 +0,0 @@
-on:
-  pull_request:
-    branches: [develop]
-
-name: CI (JS)
-
-jobs:
-  test:
-    name: Lint/Test
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-      - run: npm ci
-      - run: npm run lint
-      - run: npm test

.github/workflows/ci-rust.yml

@@ -1,36 +0,0 @@
-on:
-  pull_request:
-    branches: [develop]
-    paths:
-      - src-tauri/**
-      - .github/workflows/**
-
-name: CI (Rust)
-
-defaults:
-  run:
-    working-directory: src-tauri
-
-jobs:
-  test:
-    name: Check/Test
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - run: |
-          sudo apt-get update
-          sudo apt-get install -y libwebkit2gtk-4.1-dev
-      - uses: dtolnay/rust-toolchain@stable
-      - uses: actions/cache@v3
-        continue-on-error: false
-        with:
-          path: |
-            ~/.cargo/bin/
-            ~/.cargo/registry/index/
-            ~/.cargo/registry/cache/
-            ~/.cargo/git/db/
-            target/
-          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
-          restore-keys: ${{ runner.os }}-cargo-
-      - run: cargo check --all
-      - run: cargo test --all

.github/workflows/ci.yml

@@ -0,0 +1,31 @@
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+name: Lint and Test
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: Lint/Test
+    runs-on: macos-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: 'src-tauri'
+          shared-key: ci
+          cache-on-failure: true
+
+      - run: npm ci
+      - run: npm run lint
+      - name: Run JS Tests
+        run: npm test
+      - name: Run Rust Tests
+        run: cargo test --all
+        working-directory: src-tauri

.github/workflows/claude.yml

@@ -0,0 +1,50 @@
+name: Claude Code
+
+on:
+  issue_comment:
+    types: [created]
+  pull_request_review_comment:
+    types: [created]
+  issues:
+    types: [opened, assigned]
+  pull_request_review:
+    types: [submitted]
+
+jobs:
+  claude:
+    if: |
+      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
+      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
+      (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
+      (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
+      issues: read
+      id-token: write
+      actions: read # Required for Claude to read CI results on PRs
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+
+      - name: Run Claude Code
+        id: claude
+        uses: anthropics/claude-code-action@v1
+        with:
+          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+
+          # This is an optional setting that allows Claude to read CI results on PRs
+          additional_permissions: |
+            actions: read
+
+          # Optional: Give a custom prompt to Claude. If this is not specified, Claude will perform the instructions specified in the comment that tagged it.
+          # prompt: 'Update the pull request description to include a summary of changes.'
+
+          # Optional: Add claude_args to customize behavior and configuration
+          # See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
+          # or https://code.claude.com/docs/en/cli-reference for available options
+          # claude_args: '--allowed-tools Bash(gh pr:*)'
+

.github/workflows/release.yml

@@ -16,15 +16,34 @@ jobs:
           - platform: 'macos-latest' # for Arm-based Macs (M1 and above).
             args: '--target aarch64-apple-darwin'
             yaak_arch: 'arm64'
+            os: 'macos'
+            targets: 'aarch64-apple-darwin'
           - platform: 'macos-latest' # for Intel-based Macs.
             args: '--target x86_64-apple-darwin'
             yaak_arch: 'x64'
+            os: 'macos'
+            targets: 'x86_64-apple-darwin'
           - platform: 'ubuntu-22.04'
             args: ''
             yaak_arch: 'x64'
+            os: 'ubuntu'
+            targets: ''
+          - platform: 'ubuntu-22.04-arm'
+            args: ''
+            yaak_arch: 'arm64'
+            os: 'ubuntu'
+            targets: ''
           - platform: 'windows-latest'
             args: ''
             yaak_arch: 'x64'
+            os: 'windows'
+            targets: ''
+          # Windows ARM64
+          - platform: 'windows-latest'
+            args: '--target aarch64-pc-windows-msvc'
+            yaak_arch: 'arm64'
+            os: 'windows'
+            targets: 'aarch64-pc-windows-msvc'
     runs-on: ${{ matrix.platform }}
     timeout-minutes: 40
     steps:
@@ -33,54 +52,49 @@ jobs:
 
       - name: Setup Node
         uses: actions/setup-node@v4
-        with:
-          node-version: 22
 
       - name: install Rust stable
         uses: dtolnay/rust-toolchain@stable
         with:
-          # Those targets are only used on macos runners so it's in an `if` to slightly speed up windows and linux builds.
-          targets: ${{ matrix.platform == 'macos-latest' && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}
+          targets: ${{ matrix.targets }}
 
-      - uses: actions/cache@v3
-        continue-on-error: false
+      - uses: Swatinem/rust-cache@v2
         with:
-          path: |
-            ~/.cargo/bin/
-            ~/.cargo/registry/index/
-            ~/.cargo/registry/cache/
-            ~/.cargo/git/db/
-            src-tauri/target/
-          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
-          restore-keys: ${{ runner.os }}-cargo-
+          workspaces: 'src-tauri'
+          shared-key: ci
+          cache-on-failure: true
 
-      - name: install dependencies (ubuntu only)
-        if: matrix.platform == 'ubuntu-22.04' # This must match the platform value defined above.
+      - name: install dependencies (Linux only)
+        if: matrix.os == 'ubuntu'
         run: |
           sudo apt-get update
-          sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf
-
-      - name: install dependencies (windows only)
-        if: matrix.platform == 'windows-latest'
-        run: cargo install --force trusted-signing-cli
-
-      - name: Install NPM Dependencies
-        run: npm ci
+          sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf xdg-utils
 
       - name: Install Protoc for plugin-runtime
         uses: arduino/setup-protoc@v3
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
 
-      # Some things (eg. WASM package) requires building before lint will work
-      - name: Run bootstrap
-        run: npm run bootstrap
+      - name: Install trusted-signing-cli (Windows only)
+        if: matrix.os == 'windows'
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $dir = "$env:USERPROFILE\trusted-signing"
+          New-Item -ItemType Directory -Force -Path $dir | Out-Null
+          $url = "https://github.com/Levminer/trusted-signing-cli/releases/download/0.8.0/trusted-signing-cli.exe"
+          $exe = Join-Path $dir "trusted-signing-cli.exe"
+          Invoke-WebRequest -Uri $url -OutFile $exe
+          echo $dir >> $env:GITHUB_PATH
+          & $exe --version
 
-      - name: Run lint
-        run: npm run lint
-
-      - name: Run tests
+      - run: npm ci
+      - run: npm run lint
+      - name: Run JS Tests
         run: npm test
+      - name: Run Rust Tests
+        run: cargo test --all
+        working-directory: src-tauri
 
       - name: Set version
         run: npm run replace-version
@@ -97,17 +111,17 @@ jobs:
           TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_KEY_PASSWORD }}
 
           # Apple signing stuff
-          APPLE_CERTIFICATE: ${{ matrix.platform == 'macos-latest' && secrets.APPLE_CERTIFICATE }}
-          APPLE_CERTIFICATE_PASSWORD: ${{ matrix.platform == 'macos-latest' && secrets.APPLE_CERTIFICATE_PASSWORD }}
-          APPLE_ID: ${{ matrix.platform == 'macos-latest' && secrets.APPLE_ID }}
-          APPLE_PASSWORD: ${{ matrix.platform == 'macos-latest' && secrets.APPLE_PASSWORD }}
-          APPLE_SIGNING_IDENTITY: ${{ matrix.platform == 'macos-latest' && secrets.APPLE_SIGNING_IDENTITY }}
-          APPLE_TEAM_ID: ${{ matrix.platform == 'macos-latest' && secrets.APPLE_TEAM_ID }}
+          APPLE_CERTIFICATE: ${{ matrix.os == 'macos' && secrets.APPLE_CERTIFICATE }}
+          APPLE_CERTIFICATE_PASSWORD: ${{ matrix.os == 'macos' && secrets.APPLE_CERTIFICATE_PASSWORD }}
+          APPLE_ID: ${{ matrix.os == 'macos' && secrets.APPLE_ID }}
+          APPLE_PASSWORD: ${{ matrix.os == 'macos' && secrets.APPLE_PASSWORD }}
+          APPLE_SIGNING_IDENTITY: ${{ matrix.os == 'macos' && secrets.APPLE_SIGNING_IDENTITY }}
+          APPLE_TEAM_ID: ${{ matrix.os == 'macos' && secrets.APPLE_TEAM_ID }}
 
           # Windows signing stuff
-          AZURE_CLIENT_ID: ${{ matrix.platform == 'windows-latest' && secrets.AZURE_CLIENT_ID }}
-          AZURE_CLIENT_SECRET: ${{ matrix.platform == 'windows-latest' && secrets.AZURE_CLIENT_SECRET }}
-          AZURE_TENANT_ID: ${{ matrix.platform == 'windows-latest' && secrets.AZURE_TENANT_ID }}
+          AZURE_CLIENT_ID: ${{ matrix.os == 'windows' && secrets.AZURE_CLIENT_ID }}
+          AZURE_CLIENT_SECRET: ${{ matrix.os == 'windows' && secrets.AZURE_CLIENT_SECRET }}
+          AZURE_TENANT_ID: ${{ matrix.os == 'windows' && secrets.AZURE_TENANT_ID }}
         with:
           tagName: 'v__VERSION__'
           releaseName: 'Release __VERSION__'

.gitignore

@@ -15,6 +15,8 @@ dist-ssr
 # Editor directories and files
 .vscode/*
 !.vscode/extensions.json
+!.vscode/settings.json
+!.vscode/launch.json
 .idea
 .DS_Store
 *.suo
@@ -23,6 +25,7 @@ dist-ssr
 *.sln
 *.sw?
 .eslintcache
+out
 
 *.sqlite
 *.sqlite-*
@@ -31,3 +34,5 @@ dist-ssr
 
 .tmp
 tmp
+.zed
+codebook.toml

.prettierignore

@@ -1,4 +0,0 @@
-node_modules/
-dist/
-out/
-.prettierrc.cjs

.prettierrc.js

@@ -1,8 +0,0 @@
-export default {
-  "trailingComma": "all",
-  "tabWidth": 2,
-  "semi": true,
-  "singleQuote": true,
-  "printWidth": 100,
-  "bracketSpacing": true
-}

.vscode/extensions.json

@@ -0,0 +1,3 @@
+{
+  "recommendations": ["biomejs.biome", "rust-lang.rust-analyzer", "bradlc.vscode-tailwindcss"]
+}

.vscode/launch.json

@@ -0,0 +1,26 @@
+{
+  "version": "0.2.0",
+  "configurations": [
+    {
+      "type": "node",
+      "request": "launch",
+      "name": "Dev App",
+      "runtimeExecutable": "npm",
+      "runtimeArgs": ["run", "start"]
+    },
+    {
+      "type": "node",
+      "request": "launch",
+      "name": "Build App",
+      "runtimeExecutable": "npm",
+      "runtimeArgs": ["run", "start"]
+    },
+    {
+      "type": "node",
+      "request": "launch",
+      "name": "Bootstrap",
+      "runtimeExecutable": "npm",
+      "runtimeArgs": ["run", "bootstrap"]
+    }
+  ]
+}

.vscode/settings.json

@@ -0,0 +1,6 @@
+{
+  "editor.defaultFormatter": "biomejs.biome",
+  "editor.formatOnSave": true,
+  "biome.enabled": true,
+  "biome.lint.format.enable": true
+}

DEVELOPMENT.md

@@ -54,9 +54,35 @@ Rerun the app to apply the migrations.
 
 _Note: For safety, development builds use a separate database location from production builds._
 
-## Lezer Grammer Generation
+## Lezer Grammar Generation
 
 ```sh
 # Example
 lezer-generator components/core/Editor/<LANG>/<LANG>.grammar > components/core/Editor/<LANG>/<LANG>.ts
 ```
+
+## Linting & Formatting
+
+This repo uses Biome for linting and formatting (replacing ESLint + Prettier).
+
+- Lint the entire repo:
+
+```sh
+npm run lint
+```
+
+- Auto-fix lint issues where possible:
+
+```sh
+npm run lint:fix
+```
+
+- Format code:
+
+```sh
+npm run format
+```
+
+Notes:
+- Many workspace packages also expose the same scripts (`lint`, `lint:fix`, and `format`).
+- TypeScript type-checking still runs separately via `tsc --noEmit` in relevant packages.

README.md

@@ -19,10 +19,10 @@
 
 
 <p align="center">
-  <!-- sponsors-premium --><a href="https://github.com/MVST-Solutions"><img src="https:&#x2F;&#x2F;github.com&#x2F;MVST-Solutions.png" width="80px" alt="User avatar: MVST-Solutions" /></a>&nbsp;&nbsp;<a href="https://github.com/dharsanb"><img src="https:&#x2F;&#x2F;github.com&#x2F;dharsanb.png" width="80px" alt="User avatar: dharsanb" /></a>&nbsp;&nbsp;<a href="https://github.com/railwayapp"><img src="https:&#x2F;&#x2F;github.com&#x2F;railwayapp.png" width="80px" alt="User avatar: railwayapp" /></a>&nbsp;&nbsp;<a href="https://github.com/caseyamcl"><img src="https:&#x2F;&#x2F;github.com&#x2F;caseyamcl.png" width="80px" alt="User avatar: caseyamcl" /></a>&nbsp;&nbsp;<a href="https://github.com/andriyor"><img src="https:&#x2F;&#x2F;github.com&#x2F;andriyor.png" width="80px" alt="User avatar: andriyor" /></a>&nbsp;&nbsp;<a href="https://github.com/"><img src="https:&#x2F;&#x2F;raw.githubusercontent.com&#x2F;JamesIves&#x2F;github-sponsors-readme-action&#x2F;dev&#x2F;.github&#x2F;assets&#x2F;placeholder.png" width="80px" alt="User avatar: " /></a>&nbsp;&nbsp;<!-- sponsors-premium -->
+  <!-- sponsors-premium --><a href="https://github.com/MVST-Solutions"><img src="https:&#x2F;&#x2F;github.com&#x2F;MVST-Solutions.png" width="80px" alt="User avatar: MVST-Solutions" /></a>&nbsp;&nbsp;<a href="https://github.com/dharsanb"><img src="https:&#x2F;&#x2F;github.com&#x2F;dharsanb.png" width="80px" alt="User avatar: dharsanb" /></a>&nbsp;&nbsp;<a href="https://github.com/railwayapp"><img src="https:&#x2F;&#x2F;github.com&#x2F;railwayapp.png" width="80px" alt="User avatar: railwayapp" /></a>&nbsp;&nbsp;<a href="https://github.com/caseyamcl"><img src="https:&#x2F;&#x2F;github.com&#x2F;caseyamcl.png" width="80px" alt="User avatar: caseyamcl" /></a>&nbsp;&nbsp;<a href="https://github.com/bytebase"><img src="https:&#x2F;&#x2F;github.com&#x2F;bytebase.png" width="80px" alt="User avatar: bytebase" /></a>&nbsp;&nbsp;<a href="https://github.com/"><img src="https:&#x2F;&#x2F;raw.githubusercontent.com&#x2F;JamesIves&#x2F;github-sponsors-readme-action&#x2F;dev&#x2F;.github&#x2F;assets&#x2F;placeholder.png" width="80px" alt="User avatar: " /></a>&nbsp;&nbsp;<!-- sponsors-premium -->
 </p>
 <p align="center">
-  <!-- sponsors-base --><a href="https://github.com/seanwash"><img src="https:&#x2F;&#x2F;github.com&#x2F;seanwash.png" width="50px" alt="User avatar: seanwash" /></a>&nbsp;&nbsp;<a href="https://github.com/jerath"><img src="https:&#x2F;&#x2F;github.com&#x2F;jerath.png" width="50px" alt="User avatar: jerath" /></a>&nbsp;&nbsp;<a href="https://github.com/itsa-sh"><img src="https:&#x2F;&#x2F;github.com&#x2F;itsa-sh.png" width="50px" alt="User avatar: itsa-sh" /></a>&nbsp;&nbsp;<a href="https://github.com/dmmulroy"><img src="https:&#x2F;&#x2F;github.com&#x2F;dmmulroy.png" width="50px" alt="User avatar: dmmulroy" /></a>&nbsp;&nbsp;<a href="https://github.com/timcole"><img src="https:&#x2F;&#x2F;github.com&#x2F;timcole.png" width="50px" alt="User avatar: timcole" /></a>&nbsp;&nbsp;<a href="https://github.com/VLZH"><img src="https:&#x2F;&#x2F;github.com&#x2F;VLZH.png" width="50px" alt="User avatar: VLZH" /></a>&nbsp;&nbsp;<a href="https://github.com/terasaka2k"><img src="https:&#x2F;&#x2F;github.com&#x2F;terasaka2k.png" width="50px" alt="User avatar: terasaka2k" /></a>&nbsp;&nbsp;<a href="https://github.com/majudhu"><img src="https:&#x2F;&#x2F;github.com&#x2F;majudhu.png" width="50px" alt="User avatar: majudhu" /></a>&nbsp;&nbsp;<!-- sponsors-base -->
+  <!-- sponsors-base --><a href="https://github.com/seanwash"><img src="https:&#x2F;&#x2F;github.com&#x2F;seanwash.png" width="50px" alt="User avatar: seanwash" /></a>&nbsp;&nbsp;<a href="https://github.com/jerath"><img src="https:&#x2F;&#x2F;github.com&#x2F;jerath.png" width="50px" alt="User avatar: jerath" /></a>&nbsp;&nbsp;<a href="https://github.com/itsa-sh"><img src="https:&#x2F;&#x2F;github.com&#x2F;itsa-sh.png" width="50px" alt="User avatar: itsa-sh" /></a>&nbsp;&nbsp;<a href="https://github.com/dmmulroy"><img src="https:&#x2F;&#x2F;github.com&#x2F;dmmulroy.png" width="50px" alt="User avatar: dmmulroy" /></a>&nbsp;&nbsp;<a href="https://github.com/timcole"><img src="https:&#x2F;&#x2F;github.com&#x2F;timcole.png" width="50px" alt="User avatar: timcole" /></a>&nbsp;&nbsp;<a href="https://github.com/VLZH"><img src="https:&#x2F;&#x2F;github.com&#x2F;VLZH.png" width="50px" alt="User avatar: VLZH" /></a>&nbsp;&nbsp;<a href="https://github.com/terasaka2k"><img src="https:&#x2F;&#x2F;github.com&#x2F;terasaka2k.png" width="50px" alt="User avatar: terasaka2k" /></a>&nbsp;&nbsp;<a href="https://github.com/andriyor"><img src="https:&#x2F;&#x2F;github.com&#x2F;andriyor.png" width="50px" alt="User avatar: andriyor" /></a>&nbsp;&nbsp;<a href="https://github.com/majudhu"><img src="https:&#x2F;&#x2F;github.com&#x2F;majudhu.png" width="50px" alt="User avatar: majudhu" /></a>&nbsp;&nbsp;<a href="https://github.com/axelrindle"><img src="https:&#x2F;&#x2F;github.com&#x2F;axelrindle.png" width="50px" alt="User avatar: axelrindle" /></a>&nbsp;&nbsp;<a href="https://github.com/jirizverina"><img src="https:&#x2F;&#x2F;github.com&#x2F;jirizverina.png" width="50px" alt="User avatar: jirizverina" /></a>&nbsp;&nbsp;<a href="https://github.com/chip-well"><img src="https:&#x2F;&#x2F;github.com&#x2F;chip-well.png" width="50px" alt="User avatar: chip-well" /></a>&nbsp;&nbsp;<a href="https://github.com/GRAYAH"><img src="https:&#x2F;&#x2F;github.com&#x2F;GRAYAH.png" width="50px" alt="User avatar: GRAYAH" /></a>&nbsp;&nbsp;<!-- sponsors-base -->
 </p>
 
 ![Yaak API Client](https://yaak.app/static/screenshot.png)

biome.json

@@ -0,0 +1,51 @@
+{
+  "$schema": "https://biomejs.dev/schemas/2.3.7/schema.json",
+  "linter": {
+    "enabled": true,
+    "rules": {
+      "recommended": true,
+      "a11y": {
+        "useKeyWithClickEvents": "off"
+      }
+    }
+  },
+  "formatter": {
+    "enabled": true,
+    "indentStyle": "space",
+    "indentWidth": 2,
+    "lineWidth": 100,
+    "bracketSpacing": true
+  },
+  "css": {
+    "parser": {
+      "tailwindDirectives": true
+    },
+    "linter": {
+      "enabled": false
+    }
+  },
+  "javascript": {
+    "formatter": {
+      "quoteStyle": "single",
+      "jsxQuoteStyle": "double",
+      "trailingCommas": "all",
+      "semicolons": "always"
+    }
+  },
+  "files": {
+    "includes": [
+      "**",
+      "!**/node_modules",
+      "!**/dist",
+      "!**/build",
+      "!scripts",
+      "!packages/plugin-runtime",
+      "!packages/plugin-runtime-types",
+      "!src-tauri",
+      "!src-web/tailwind.config.cjs",
+      "!src-web/postcss.config.cjs",
+      "!src-web/vite.config.ts",
+      "!src-web/routeTree.gen.ts"
+    ]
+  }
+}

eslint.config.cjs

@@ -1,89 +0,0 @@
-const { defineConfig, globalIgnores } = require('eslint/config');
-
-const { fixupConfigRules } = require('@eslint/compat');
-
-const reactRefresh = require('eslint-plugin-react-refresh');
-const tsParser = require('@typescript-eslint/parser');
-const js = require('@eslint/js');
-
-const { FlatCompat } = require('@eslint/eslintrc');
-
-const compat = new FlatCompat({
-  baseDirectory: __dirname,
-  recommendedConfig: js.configs.recommended,
-  allConfig: js.configs.all,
-});
-
-module.exports = defineConfig([
-  {
-    extends: fixupConfigRules(
-      compat.extends(
-        'eslint:recommended',
-        'plugin:react/recommended',
-        'plugin:react-hooks/recommended',
-        'plugin:import/recommended',
-        'plugin:jsx-a11y/recommended',
-        'plugin:@typescript-eslint/recommended',
-        'eslint-config-prettier',
-      ),
-    ),
-
-    plugins: {
-      'react-refresh': reactRefresh,
-    },
-
-    languageOptions: {
-      parser: tsParser,
-
-      parserOptions: {
-        project: ['./tsconfig.json'],
-      },
-    },
-
-    settings: {
-      react: {
-        version: 'detect',
-      },
-
-      'import/resolver': {
-        node: {
-          paths: ['src-web'],
-          extensions: ['.ts', '.tsx'],
-        },
-      },
-    },
-
-    rules: {
-      'react-refresh/only-export-components': 'error',
-      'jsx-a11y/no-autofocus': 'off',
-      'react/react-in-jsx-scope': 'off',
-      'import/no-unresolved': 'off',
-
-      '@typescript-eslint/consistent-type-imports': [
-        'error',
-        {
-          prefer: 'type-imports',
-          disallowTypeAnnotations: true,
-          fixStyle: 'separate-type-imports',
-        },
-      ],
-    },
-  },
-  globalIgnores([
-    'scripts/**/*',
-    'packages/plugin-runtime/**/*',
-    'packages/plugin-runtime-types/**/*',
-    'src-tauri/**/*',
-    'src-web/tailwind.config.cjs',
-    'src-web/vite.config.ts',
-  ]),
-  globalIgnores([
-    '**/node_modules/',
-    '**/dist/',
-    '**/build/',
-    '**/.eslintrc.cjs',
-    '**/.prettierrc.cjs',
-    'src-web/postcss.config.cjs',
-    'src-web/vite.config.ts',
-  ]),
-]);

package.json

@@ -10,6 +10,8 @@
     "packages/common-lib",
     "packages/plugin-runtime",
     "packages/plugin-runtime-types",
+    "plugins-external/mcp-server",
+    "plugins-external/template-function-faker",
     "plugins/action-copy-curl",
     "plugins/action-copy-grpcurl",
     "plugins/auth-apikey",
@@ -17,7 +19,9 @@
     "plugins/auth-basic",
     "plugins/auth-bearer",
     "plugins/auth-jwt",
+    "plugins/auth-ntlm",
     "plugins/auth-oauth2",
+    "plugins/auth-oauth1",
     "plugins/filter-jsonpath",
     "plugins/filter-xpath",
     "plugins/importer-curl",
@@ -26,18 +30,21 @@
     "plugins/importer-postman",
     "plugins/importer-postman-environment",
     "plugins/importer-yaak",
+    "plugins/template-function-1password",
     "plugins/template-function-cookie",
+    "plugins/template-function-ctx",
     "plugins/template-function-encode",
     "plugins/template-function-fs",
     "plugins/template-function-hash",
     "plugins/template-function-json",
     "plugins/template-function-prompt",
+    "plugins/template-function-random",
     "plugins/template-function-regex",
-    "plugins/template-function-request",
-    "plugins/template-function-response",
     "plugins/template-function-timestamp",
     "plugins/template-function-uuid",
     "plugins/template-function-xml",
+    "plugins/template-function-request",
+    "plugins/template-function-response",
     "plugins/themes-yaak",
     "src-tauri",
     "src-tauri/yaak-crypto",
@@ -64,36 +71,29 @@
     "icons": "run-p icons:*",
     "icons:dev": "tauri icon src-tauri/icons/icon-dev.png --output src-tauri/icons/dev",
     "icons:release": "tauri icon src-tauri/icons/icon.png --output src-tauri/icons/release",
-    "bootstrap": "run-p bootstrap:* && npm run --workspaces --if-present bootstrap",
-    "bootstrap:vendor-node": "node scripts/vendor-node.cjs",
-    "bootstrap:vendor-plugins": "node scripts/vendor-plugins.cjs",
-    "bootstrap:vendor-protoc": "node scripts/vendor-protoc.cjs",
-    "lint": "npm run --workspaces --if-present lint",
+    "bootstrap": "run-s bootstrap:*",
+    "bootstrap:install-wasm-pack": "node scripts/install-wasm-pack.cjs",
+    "bootstrap:build": "npm run build",
+    "bootstrap:vendor": "npm run vendor",
+    "vendor": "run-p vendor:*",
+    "vendor:vendor-plugins": "node scripts/vendor-plugins.cjs",
+    "vendor:vendor-protoc": "node scripts/vendor-protoc.cjs",
+    "vendor:vendor-node": "node scripts/vendor-node.cjs",
+    "lint": "run-p lint:*",
+    "lint:biome": "biome lint",
+    "lint:extra": "npm run --workspaces --if-present lint",
+    "format": "biome format --write .",
     "replace-version": "node scripts/replace-version.cjs",
     "tauri": "tauri",
-    "tauri-before-build": "npm run bootstrap && npm run --workspaces --if-present build",
+    "tauri-before-build": "npm run bootstrap",
     "tauri-before-dev": "workspaces-run --parallel -- npm run --workspaces --if-present dev"
   },
-  "dependencies": {
-    "jotai": "^2.12.2"
-  },
   "devDependencies": {
-    "@eslint/compat": "^1.3.0",
-    "@eslint/eslintrc": "^3.3.1",
-    "@eslint/js": "^9.29.0",
-    "@tauri-apps/cli": "^2.8.4",
-    "@typescript-eslint/eslint-plugin": "^8.27.0",
-    "@typescript-eslint/parser": "^8.27.0",
-    "@yaakapp/cli": "^0.2.7",
-    "eslint": "^9.29.0",
-    "eslint-config-prettier": "^10.1.5",
-    "eslint-plugin-import": "^2.32.0",
-    "eslint-plugin-jsx-a11y": "^6.10.2",
-    "eslint-plugin-react": "^7.37.5",
-    "eslint-plugin-react-hooks": "^5.2.0",
+    "@biomejs/biome": "^2.3.7",
+    "@tauri-apps/cli": "^2.9.6",
+    "@yaakapp/cli": "^0.3.4",
     "nodejs-file-downloader": "^4.13.0",
     "npm-run-all": "^4.1.5",
-    "prettier": "^3.4.2",
     "typescript": "^5.8.3",
     "vitest": "^3.2.4",
     "workspaces-run": "^1.0.2"

packages/common-lib/debounce.ts

@@ -1,12 +1,12 @@
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
+// biome-ignore lint/suspicious/noExplicitAny: none
 export function debounce(fn: (...args: any[]) => void, delay = 500) {
   let timer: ReturnType<typeof setTimeout>;
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
-  const result = function (...args: any[]) {
+  // biome-ignore lint/suspicious/noExplicitAny: none
+  const result = (...args: any[]) => {
     clearTimeout(timer);
     timer = setTimeout(() => fn(...args), delay);
   };
-  result.cancel = function () {
+  result.cancel = () => {
     clearTimeout(timer);
   };
   return result;

packages/common-lib/formatSize.ts

@@ -1,20 +1,20 @@
 export function formatSize(bytes: number): string {
-    let num;
-    let unit;
+  let num: number;
+  let unit: string;
 
-    if (bytes > 1000 * 1000 * 1000) {
-        num = bytes / 1000 / 1000 / 1000;
-        unit = 'GB';
-    } else if (bytes > 1000 * 1000) {
-        num = bytes / 1000 / 1000;
-        unit = 'MB';
-    } else if (bytes > 1000) {
-        num = bytes / 1000;
-        unit = 'KB';
-    } else {
-        num = bytes;
-        unit = 'B';
-    }
+  if (bytes > 1000 * 1000 * 1000) {
+    num = bytes / 1000 / 1000 / 1000;
+    unit = 'GB';
+  } else if (bytes > 1000 * 1000) {
+    num = bytes / 1000 / 1000;
+    unit = 'MB';
+  } else if (bytes > 1000) {
+    num = bytes / 1000;
+    unit = 'KB';
+  } else {
+    num = bytes;
+    unit = 'B';
+  }
 
-    return `${Math.round(num * 10) / 10} ${unit}`;
+  return `${Math.round(num * 10) / 10} ${unit}`;
 }

packages/common-lib/index.ts

@@ -1 +1,3 @@
 export * from './debounce';
+export * from './formatSize';
+export * from './templateFunction';

packages/common-lib/templateFunction.ts

@@ -0,0 +1,49 @@
+import type {
+  CallTemplateFunctionArgs,
+  JsonPrimitive,
+  TemplateFunctionArg,
+} from '@yaakapp-internal/plugins';
+
+export function validateTemplateFunctionArgs(
+  fnName: string,
+  args: TemplateFunctionArg[],
+  values: CallTemplateFunctionArgs['values'],
+): string | null {
+  for (const arg of args) {
+    if ('inputs' in arg && arg.inputs) {
+      // Recurse down
+      const err = validateTemplateFunctionArgs(fnName, arg.inputs, values);
+      if (err) return err;
+    }
+    if (!('name' in arg)) continue;
+    if (arg.optional) continue;
+    if (arg.defaultValue != null) continue;
+    if (arg.hidden) continue;
+    if (values[arg.name] != null) continue;
+
+    return `Missing required argument "${arg.label || arg.name}" for template function ${fnName}()`;
+  }
+
+  return null;
+}
+
+/** Recursively apply form input defaults to a set of values */
+export function applyFormInputDefaults(
+  inputs: TemplateFunctionArg[],
+  values: { [p: string]: JsonPrimitive | undefined },
+) {
+  let newValues: { [p: string]: JsonPrimitive | undefined } = { ...values };
+  for (const input of inputs) {
+    if ('defaultValue' in input && values[input.name] === undefined) {
+      newValues[input.name] = input.defaultValue;
+    }
+    if (input.type === 'checkbox' && values[input.name] === undefined) {
+      newValues[input.name] = false;
+    }
+    // Recurse down to all child inputs
+    if ('inputs' in input) {
+      newValues = applyFormInputDefaults(input.inputs ?? [], newValues);
+    }
+  }
+  return newValues;
+}

packages/plugin-runtime-types/package-lock.json

@@ -1,47 +0,0 @@
-{
-  "name": "@yaakapp/api",
-  "version": "0.1.17",
-  "lockfileVersion": 3,
-  "requires": true,
-  "packages": {
-    "": {
-      "name": "@yaakapp/api",
-      "version": "0.1.17",
-      "dependencies": {
-        "@types/node": "^22.5.4"
-      },
-      "devDependencies": {
-        "typescript": "^5.6.2"
-      }
-    },
-    "node_modules/@types/node": {
-      "version": "22.5.4",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-22.5.4.tgz",
-      "integrity": "sha512-FDuKUJQm/ju9fT/SeX/6+gBzoPzlVCzfzmGkwKvRHQVxi4BntVbyIwf6a4Xn62mrvndLiml6z/UBXIdEVjQLXg==",
-      "license": "MIT",
-      "dependencies": {
-        "undici-types": "~6.19.2"
-      }
-    },
-    "node_modules/typescript": {
-      "version": "5.6.2",
-      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.6.2.tgz",
-      "integrity": "sha512-NW8ByodCSNCwZeghjN3o+JX5OFH0Ojg6sadjEKY4huZ52TqbJTJnDo5+Tw98lSy63NZvi4n+ez5m2u5d4PkZyw==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "bin": {
-        "tsc": "bin/tsc",
-        "tsserver": "bin/tsserver"
-      },
-      "engines": {
-        "node": ">=14.17"
-      }
-    },
-    "node_modules/undici-types": {
-      "version": "6.19.8",
-      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.19.8.tgz",
-      "integrity": "sha512-ve2KP6f/JnbPBFyobGHuerC9g1FYGn/F8n1LWTwNxCEzd6IfqTwUQcNXgEtmmQ6DlRrC1hrSrBnCZPokRrDHjw==",
-      "license": "MIT"
-    }
-  }
-}

packages/plugin-runtime-types/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yaakapp/api",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "keywords": [
     "api-client",
     "insomnia-alternative",

packages/plugin-runtime-types/src/bindings/gen_api.ts

@@ -1,5 +1,5 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { PluginVersion } from "./gen_search.js";
+import type { PluginVersion } from "./gen_search";
 
 export type PluginNameVersion = { name: string, version: string, };
 

packages/plugin-runtime-types/src/bindings/gen_models.ts

@@ -1,18 +1,53 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
 
-export type Environment = { model: "environment", id: string, workspaceId: string, createdAt: string, updatedAt: string, name: string, public: boolean, parentModel: string, parentId: string | null, variables: Array<EnvironmentVariable>, color: string | null, };
+export type AnyModel = CookieJar | Environment | Folder | GraphQlIntrospection | GrpcConnection | GrpcEvent | GrpcRequest | HttpRequest | HttpResponse | HttpResponseEvent | KeyValue | Plugin | Settings | SyncState | WebsocketConnection | WebsocketEvent | WebsocketRequest | Workspace | WorkspaceMeta;
+
+export type ClientCertificate = { host: string, port: number | null, crtFile: string | null, keyFile: string | null, pfxFile: string | null, passphrase: string | null, enabled?: boolean, };
+
+export type Cookie = { raw_cookie: string, domain: CookieDomain, expires: CookieExpires, path: [string, boolean], };
+
+export type CookieDomain = { "HostOnly": string } | { "Suffix": string } | "NotPresent" | "Empty";
+
+export type CookieExpires = { "AtUtc": string } | "SessionEnd";
+
+export type CookieJar = { model: "cookie_jar", id: string, createdAt: string, updatedAt: string, workspaceId: string, cookies: Array<Cookie>, name: string, };
+
+export type EditorKeymap = "default" | "vim" | "vscode" | "emacs";
+
+export type EncryptedKey = { encryptedKey: string, };
+
+export type Environment = { model: "environment", id: string, workspaceId: string, createdAt: string, updatedAt: string, name: string, public: boolean, parentModel: string, parentId: string | null, variables: Array<EnvironmentVariable>, color: string | null, sortPriority: number, };
 
 export type EnvironmentVariable = { enabled?: boolean, name: string, value: string, id?: string, };
 
 export type Folder = { model: "folder", id: string, createdAt: string, updatedAt: string, workspaceId: string, folderId: string | null, authentication: Record<string, any>, authenticationType: string | null, description: string, headers: Array<HttpRequestHeader>, name: string, sortPriority: number, };
 
+export type GraphQlIntrospection = { model: "graphql_introspection", id: string, createdAt: string, updatedAt: string, workspaceId: string, requestId: string, content: string | null, };
+
+export type GrpcConnection = { model: "grpc_connection", id: string, createdAt: string, updatedAt: string, workspaceId: string, requestId: string, elapsed: number, error: string | null, method: string, service: string, status: number, state: GrpcConnectionState, trailers: { [key in string]?: string }, url: string, };
+
+export type GrpcConnectionState = "initialized" | "connected" | "closed";
+
+export type GrpcEvent = { model: "grpc_event", id: string, createdAt: string, updatedAt: string, workspaceId: string, requestId: string, connectionId: string, content: string, error: string | null, eventType: GrpcEventType, metadata: { [key in string]?: string }, status: number | null, };
+
+export type GrpcEventType = "info" | "error" | "client_message" | "server_message" | "connection_start" | "connection_end";
+
 export type GrpcRequest = { model: "grpc_request", id: string, createdAt: string, updatedAt: string, workspaceId: string, folderId: string | null, authenticationType: string | null, authentication: Record<string, any>, description: string, message: string, metadata: Array<HttpRequestHeader>, method: string | null, name: string, service: string | null, sortPriority: number, url: string, };
 
 export type HttpRequest = { model: "http_request", id: string, createdAt: string, updatedAt: string, workspaceId: string, folderId: string | null, authentication: Record<string, any>, authenticationType: string | null, body: Record<string, any>, bodyType: string | null, description: string, headers: Array<HttpRequestHeader>, method: string, name: string, sortPriority: number, url: string, urlParameters: Array<HttpUrlParameter>, };
 
 export type HttpRequestHeader = { enabled?: boolean, name: string, value: string, id?: string, };
 
-export type HttpResponse = { model: "http_response", id: string, createdAt: string, updatedAt: string, workspaceId: string, requestId: string, bodyPath: string | null, contentLength: number | null, elapsed: number, elapsedHeaders: number, error: string | null, headers: Array<HttpResponseHeader>, remoteAddr: string | null, status: number, statusReason: string | null, state: HttpResponseState, url: string, version: string | null, };
+export type HttpResponse = { model: "http_response", id: string, createdAt: string, updatedAt: string, workspaceId: string, requestId: string, bodyPath: string | null, contentLength: number | null, contentLengthCompressed: number | null, elapsed: number, elapsedHeaders: number, error: string | null, headers: Array<HttpResponseHeader>, remoteAddr: string | null, requestContentLength: number | null, requestHeaders: Array<HttpResponseHeader>, status: number, statusReason: string | null, state: HttpResponseState, url: string, version: string | null, };
+
+export type HttpResponseEvent = { model: "http_response_event", id: string, createdAt: string, updatedAt: string, workspaceId: string, responseId: string, event: HttpResponseEventData, };
+
+/**
+ * Serializable representation of HTTP response events for DB storage.
+ * This mirrors `yaak_http::sender::HttpResponseEvent` but with serde support.
+ * The `From` impl is in yaak-http to avoid circular dependencies.
+ */
+export type HttpResponseEventData = { "type": "setting", name: string, value: string, } | { "type": "info", message: string, } | { "type": "redirect", url: string, status: number, behavior: string, } | { "type": "send_url", method: string, path: string, } | { "type": "receive_url", version: string, status: string, } | { "type": "header_up", name: string, value: string, } | { "type": "header_down", name: string, value: string, } | { "type": "chunk_sent", bytes: number, } | { "type": "chunk_received", bytes: number, };
 
 export type HttpResponseHeader = { name: string, value: string, };
 
@@ -20,6 +55,28 @@ export type HttpResponseState = "initialized" | "connected" | "closed";
 
 export type HttpUrlParameter = { enabled?: boolean, name: string, value: string, id?: string, };
 
+export type KeyValue = { model: "key_value", id: string, createdAt: string, updatedAt: string, key: string, namespace: string, value: string, };
+
+export type Plugin = { model: "plugin", id: string, createdAt: string, updatedAt: string, checkedAt: string | null, directory: string, enabled: boolean, url: string | null, };
+
+export type ProxySetting = { "type": "enabled", http: string, https: string, auth: ProxySettingAuth | null, bypass: string, disabled: boolean, } | { "type": "disabled" };
+
+export type ProxySettingAuth = { user: string, password: string, };
+
+export type Settings = { model: "settings", id: string, createdAt: string, updatedAt: string, appearance: string, clientCertificates: Array<ClientCertificate>, coloredMethods: boolean, editorFont: string | null, editorFontSize: number, editorKeymap: EditorKeymap, editorSoftWrap: boolean, hideWindowControls: boolean, useNativeTitlebar: boolean, interfaceFont: string | null, interfaceFontSize: number, interfaceScale: number, openWorkspaceNewWindow: boolean | null, proxy: ProxySetting | null, themeDark: string, themeLight: string, updateChannel: string, hideLicenseBadge: boolean, autoupdate: boolean, autoDownloadUpdates: boolean, checkNotifications: boolean, };
+
+export type SyncState = { model: "sync_state", id: string, workspaceId: string, createdAt: string, updatedAt: string, flushedAt: string, modelId: string, checksum: string, relPath: string, syncDir: string, };
+
+export type WebsocketConnection = { model: "websocket_connection", id: string, createdAt: string, updatedAt: string, workspaceId: string, requestId: string, elapsed: number, error: string | null, headers: Array<HttpResponseHeader>, state: WebsocketConnectionState, status: number, url: string, };
+
+export type WebsocketConnectionState = "initialized" | "connected" | "closing" | "closed";
+
+export type WebsocketEvent = { model: "websocket_event", id: string, createdAt: string, updatedAt: string, workspaceId: string, requestId: string, connectionId: string, isServer: boolean, message: Array<number>, messageType: WebsocketEventType, };
+
+export type WebsocketEventType = "binary" | "close" | "frame" | "open" | "ping" | "pong" | "text";
+
 export type WebsocketRequest = { model: "websocket_request", id: string, createdAt: string, updatedAt: string, workspaceId: string, folderId: string | null, authentication: Record<string, any>, authenticationType: string | null, description: string, headers: Array<HttpRequestHeader>, message: string, name: string, sortPriority: number, url: string, urlParameters: Array<HttpUrlParameter>, };
 
 export type Workspace = { model: "workspace", id: string, createdAt: string, updatedAt: string, authentication: Record<string, any>, authenticationType: string | null, description: string, headers: Array<HttpRequestHeader>, name: string, encryptionKeyChallenge: string | null, settingValidateCertificates: boolean, settingFollowRedirects: boolean, settingRequestTimeout: number, };
+
+export type WorkspaceMeta = { model: "workspace_meta", id: string, workspaceId: string, createdAt: string, updatedAt: string, encryptionKey: EncryptedKey | null, settingSyncDir: string | null, };

packages/plugin-runtime-types/src/plugins/AuthenticationPlugin.ts

@@ -3,22 +3,37 @@ import {
   CallHttpAuthenticationRequest,
   CallHttpAuthenticationResponse,
   FormInput,
-  GetHttpAuthenticationConfigRequest,
   GetHttpAuthenticationSummaryResponse,
   HttpAuthenticationAction,
 } from '../bindings/gen_events';
 import { MaybePromise } from '../helpers';
 import { Context } from './Context';
 
-type DynamicFormInput = FormInput & {
-  dynamic(
+type AddDynamicMethod<T> = {
+  dynamic?: (
     ctx: Context,
-    args: GetHttpAuthenticationConfigRequest,
-  ): MaybePromise<Partial<FormInput> | undefined | null>;
+    args: CallHttpAuthenticationActionArgs,
+  ) => MaybePromise<Partial<T> | null | undefined>;
 };
 
+type AddDynamic<T> = T extends any
+  ? T extends { inputs?: FormInput[] }
+    ? Omit<T, 'inputs'> & {
+        inputs: Array<AddDynamic<FormInput>>;
+        dynamic?: (
+          ctx: Context,
+          args: CallHttpAuthenticationActionArgs,
+        ) => MaybePromise<
+          Partial<Omit<T, 'inputs'> & { inputs: Array<AddDynamic<FormInput>> }> | null | undefined
+        >;
+      }
+    : T & AddDynamicMethod<T>
+  : never;
+
+export type DynamicAuthenticationArg = AddDynamic<FormInput>;
+
 export type AuthenticationPlugin = GetHttpAuthenticationSummaryResponse & {
-  args: (FormInput | DynamicFormInput)[];
+  args: DynamicAuthenticationArg[];
   onApply(
     ctx: Context,
     args: CallHttpAuthenticationRequest,

packages/plugin-runtime-types/src/plugins/Context.ts

@@ -1,24 +1,32 @@
 import type {
-  FindHttpResponsesRequest,
-  FindHttpResponsesResponse,
-  GetCookieValueRequest,
-  GetCookieValueResponse,
-  GetHttpRequestByIdRequest,
-  GetHttpRequestByIdResponse,
-  ListCookieNamesResponse,
-  OpenWindowRequest,
-  PromptTextRequest,
-  PromptTextResponse,
-  RenderGrpcRequestRequest,
-  RenderGrpcRequestResponse,
-  RenderHttpRequestRequest,
-  RenderHttpRequestResponse,
-  SendHttpRequestRequest,
-  SendHttpRequestResponse,
-  ShowToastRequest,
-  TemplateRenderRequest,
+    FindHttpResponsesRequest,
+    FindHttpResponsesResponse,
+    GetCookieValueRequest,
+    GetCookieValueResponse,
+    GetHttpRequestByIdRequest,
+    GetHttpRequestByIdResponse,
+    ListCookieNamesResponse,
+    ListFoldersRequest,
+    ListFoldersResponse,
+    ListHttpRequestsRequest,
+    ListHttpRequestsResponse,
+    OpenWindowRequest,
+    PromptTextRequest,
+    PromptTextResponse,
+    RenderGrpcRequestRequest,
+    RenderGrpcRequestResponse,
+    RenderHttpRequestRequest,
+    RenderHttpRequestResponse,
+    SendHttpRequestRequest,
+    SendHttpRequestResponse,
+    ShowToastRequest,
+    TemplateRenderRequest,
+    WorkspaceInfo,
 } from '../bindings/gen_events.ts';
-import { JsonValue } from '../bindings/serde_json/JsonValue';
+import type { HttpRequest } from '../bindings/gen_models.ts';
+import type { JsonValue } from '../bindings/serde_json/JsonValue';
+
+export type WorkspaceHandle = Pick<WorkspaceInfo, 'id' | 'name'>;
 
 export interface Context {
   clipboard: {
@@ -36,6 +44,9 @@ export interface Context {
     delete(key: string): Promise<boolean>;
   };
   window: {
+    requestId(): Promise<string | null>;
+    workspaceId(): Promise<string | null>;
+    environmentId(): Promise<string | null>;
     openUrl(
       args: OpenWindowRequest & {
         onNavigate?: (args: { url: string }) => void;
@@ -54,6 +65,19 @@ export interface Context {
     send(args: SendHttpRequestRequest): Promise<SendHttpRequestResponse['httpResponse']>;
     getById(args: GetHttpRequestByIdRequest): Promise<GetHttpRequestByIdResponse['httpRequest']>;
     render(args: RenderHttpRequestRequest): Promise<RenderHttpRequestResponse['httpRequest']>;
+    list(args?: ListHttpRequestsRequest): Promise<ListHttpRequestsResponse['httpRequests']>;
+    create(
+      args: Omit<Partial<HttpRequest>, 'id' | 'model' | 'createdAt' | 'updatedAt'> &
+        Pick<HttpRequest, 'workspaceId' | 'url'>,
+    ): Promise<HttpRequest>;
+    update(
+      args: Omit<Partial<HttpRequest>, 'model' | 'createdAt' | 'updatedAt'> &
+        Pick<HttpRequest, 'id'>,
+    ): Promise<HttpRequest>;
+    delete(args: { id: string }): Promise<HttpRequest>;
+  };
+  folder: {
+    list(args?: ListFoldersRequest): Promise<ListFoldersResponse['folders']>;
   };
   httpResponse: {
     find(args: FindHttpResponsesRequest): Promise<FindHttpResponsesResponse['httpResponses']>;
@@ -64,4 +88,8 @@ export interface Context {
   plugin: {
     reload(): void;
   };
+  workspace: {
+    list(): Promise<WorkspaceHandle[]>;
+    withContext(handle: WorkspaceHandle): Context;
+  };
 }

packages/plugin-runtime-types/src/plugins/FolderActionPlugin.ts

@@ -0,0 +1,6 @@
+import type { CallFolderActionArgs, FolderAction } from '../bindings/gen_events';
+import type { Context } from './Context';
+
+export type FolderActionPlugin = FolderAction & {
+  onSelect(ctx: Context, args: CallFolderActionArgs): Promise<void> | void;
+};

packages/plugin-runtime-types/src/plugins/TemplateFunctionPlugin.ts

@@ -1,21 +1,31 @@
-import {
-  CallTemplateFunctionArgs,
-  FormInput,
-  GetHttpAuthenticationConfigRequest,
-  TemplateFunction,
-  TemplateFunctionArg,
-} from '../bindings/gen_events';
+import { CallTemplateFunctionArgs, FormInput, TemplateFunction } from '../bindings/gen_events';
 import { MaybePromise } from '../helpers';
 import { Context } from './Context';
 
-export type DynamicTemplateFunctionArg = FormInput & {
-  dynamic(
+type AddDynamicMethod<T> = {
+  dynamic?: (
     ctx: Context,
-    args: GetHttpAuthenticationConfigRequest,
-  ): MaybePromise<Partial<FormInput> | undefined | null>;
+    args: CallTemplateFunctionArgs,
+  ) => MaybePromise<Partial<T> | null | undefined>;
 };
 
-export type TemplateFunctionPlugin = TemplateFunction & {
-  args: (TemplateFunctionArg | DynamicTemplateFunctionArg)[];
+type AddDynamic<T> = T extends any
+  ? T extends { inputs?: FormInput[] }
+    ? Omit<T, 'inputs'> & {
+        inputs: Array<AddDynamic<FormInput>>;
+        dynamic?: (
+          ctx: Context,
+          args: CallTemplateFunctionArgs,
+        ) => MaybePromise<
+          Partial<Omit<T, 'inputs'> & { inputs: Array<AddDynamic<FormInput>> }> | null | undefined
+        >;
+      }
+    : T & AddDynamicMethod<T>
+  : never;
+
+export type DynamicTemplateFunctionArg = AddDynamic<FormInput>;
+
+export type TemplateFunctionPlugin = Omit<TemplateFunction, 'args'> & {
+  args: DynamicTemplateFunctionArg[];
   onRender(ctx: Context, args: CallTemplateFunctionArgs): Promise<string | null>;
 };

packages/plugin-runtime-types/src/plugins/WebSocketRequestActionPlugin.ts

@@ -0,0 +1,6 @@
+import type { CallWebsocketRequestActionArgs, WebsocketRequestAction } from '../bindings/gen_events';
+import type { Context } from './Context';
+
+export type WebsocketRequestActionPlugin = WebsocketRequestAction & {
+  onSelect(ctx: Context, args: CallWebsocketRequestActionArgs): Promise<void> | void;
+};

packages/plugin-runtime-types/src/plugins/WorkspaceActionPlugin.ts

@@ -0,0 +1,6 @@
+import type { CallWorkspaceActionArgs, WorkspaceAction } from '../bindings/gen_events';
+import type { Context } from './Context';
+
+export type WorkspaceActionPlugin = WorkspaceAction & {
+  onSelect(ctx: Context, args: CallWorkspaceActionArgs): Promise<void> | void;
+};

packages/plugin-runtime-types/src/plugins/index.ts

@@ -1,14 +1,22 @@
 import { AuthenticationPlugin } from './AuthenticationPlugin';
+
+import type { Context } from './Context';
 import type { FilterPlugin } from './FilterPlugin';
 import { GrpcRequestActionPlugin } from './GrpcRequestActionPlugin';
 import type { HttpRequestActionPlugin } from './HttpRequestActionPlugin';
+import type { WebsocketRequestActionPlugin } from './WebsocketRequestActionPlugin';
+import type { WorkspaceActionPlugin } from './WorkspaceActionPlugin';
+import type { FolderActionPlugin } from './FolderActionPlugin';
 import type { ImporterPlugin } from './ImporterPlugin';
 import type { TemplateFunctionPlugin } from './TemplateFunctionPlugin';
 import type { ThemePlugin } from './ThemePlugin';
 
-import type { Context } from './Context';
-
 export type { Context };
+export type { DynamicTemplateFunctionArg } from './TemplateFunctionPlugin';
+export type { DynamicAuthenticationArg } from './AuthenticationPlugin';
+export type { TemplateFunctionPlugin };
+export type { WorkspaceActionPlugin } from './WorkspaceActionPlugin';
+export type { FolderActionPlugin } from './FolderActionPlugin';
 
 /**
  * The global structure of a Yaak plugin
@@ -21,6 +29,9 @@ export type PluginDefinition = {
   filter?: FilterPlugin;
   authentication?: AuthenticationPlugin;
   httpRequestActions?: HttpRequestActionPlugin[];
+  websocketRequestActions?: WebsocketRequestActionPlugin[];
+  workspaceActions?: WorkspaceActionPlugin[];
+  folderActions?: FolderActionPlugin[];
   grpcRequestActions?: GrpcRequestActionPlugin[];
   templateFunctions?: TemplateFunctionPlugin[];
 };

packages/plugin-runtime/package-lock.json

@@ -1,10 +0,0 @@
-{
-  "name": "@yaakapp-internal/plugin-runtime",
-  "lockfileVersion": 3,
-  "requires": true,
-  "packages": {
-    "": {
-      "name": "@yaakapp-internal/plugin-runtime"
-    }
-  }
-}

packages/plugin-runtime/src/PluginHandle.ts

@@ -1,3 +1,4 @@
+import { PluginContext } from '@yaakapp-internal/plugins';
 import type { BootRequest, InternalEvent } from '@yaakapp/api';
 import type { EventChannel } from './EventChannel';
 import { PluginInstance, PluginWorkerData } from './PluginInstance';
@@ -6,14 +7,12 @@ export class PluginHandle {
   #instance: PluginInstance;
 
   constructor(
-    readonly pluginRefId: string,
-    readonly bootRequest: BootRequest,
-    readonly pluginToAppEvents: EventChannel,
+    pluginRefId: string,
+    context: PluginContext,
+    bootRequest: BootRequest,
+    pluginToAppEvents: EventChannel,
   ) {
-    const workerData: PluginWorkerData = {
-      pluginRefId: this.pluginRefId,
-      bootRequest: this.bootRequest,
-    };
+    const workerData: PluginWorkerData = { pluginRefId, context, bootRequest };
     this.#instance = new PluginInstance(workerData, pluginToAppEvents);
   }
 

packages/plugin-runtime/src/PluginInstance.ts

@@ -1,44 +1,48 @@
+import { applyFormInputDefaults, validateTemplateFunctionArgs } from '@yaakapp-internal/lib/templateFunction';
 import {
   BootRequest,
   DeleteKeyValueResponse,
+  DeleteModelResponse,
   FindHttpResponsesResponse,
-  FormInput,
   GetCookieValueRequest,
   GetCookieValueResponse,
   GetHttpRequestByIdResponse,
   GetKeyValueResponse,
   GrpcRequestAction,
   HttpAuthenticationAction,
+  HttpRequest,
   HttpRequestAction,
   InternalEvent,
   InternalEventPayload,
   ListCookieNamesResponse,
-  PluginWindowContext,
+  ListWorkspacesResponse,
+  PluginContext,
   PromptTextResponse,
   RenderGrpcRequestResponse,
   RenderHttpRequestResponse,
   SendHttpRequestResponse,
   TemplateFunction,
-  TemplateFunctionArg,
   TemplateRenderResponse,
+  UpsertModelResponse,
+  WindowInfoResponse,
 } from '@yaakapp-internal/plugins';
 import { Context, PluginDefinition } from '@yaakapp/api';
-import { JsonValue } from '@yaakapp/api/lib/bindings/serde_json/JsonValue';
 import console from 'node:console';
-import { readFileSync, type Stats, statSync, watch } from 'node:fs';
+import { type Stats, statSync, watch } from 'node:fs';
 import path from 'node:path';
+import { applyDynamicFormInput } from './common';
 import { EventChannel } from './EventChannel';
 import { migrateTemplateFunctionSelectOptions } from './migrations';
 
 export interface PluginWorkerData {
   bootRequest: BootRequest;
   pluginRefId: string;
+  context: PluginContext;
 }
 
 export class PluginInstance {
   #workerData: PluginWorkerData;
   #mod: PluginDefinition;
-  #pkg: { name?: string; version?: string };
   #pluginToAppEvents: EventChannel;
   #appToPluginEvents: EventChannel;
 
@@ -52,18 +56,14 @@ export class PluginInstance {
       await this.#onMessage(event);
     });
 
-    // Reload plugin if the JS or package.json changes
-    const windowContextNone: PluginWindowContext = { type: 'none' };
-
     this.#mod = {} as any;
-    this.#pkg = JSON.parse(readFileSync(this.#pathPkg(), 'utf8'));
 
     const fileChangeCallback = async () => {
       await this.#mod?.dispose?.();
       this.#importModule();
-      await this.#mod?.init?.(this.#newCtx({ type: 'none' }));
+      await this.#mod?.init?.(this.#newCtx(workerData.context));
       return this.#sendPayload(
-        windowContextNone,
+        workerData.context,
         {
           type: 'reload_response',
           silent: false,
@@ -90,14 +90,14 @@ export class PluginInstance {
   }
 
   async #onMessage(event: InternalEvent) {
-    const ctx = this.#newCtx(event.windowContext);
+    const ctx = this.#newCtx(event.context);
 
-    const { windowContext, payload, id: replyId } = event;
+    const { context, payload, id: replyId } = event;
 
     try {
       if (payload.type === 'boot_request') {
         await this.#mod?.init?.(ctx);
-        this.#sendPayload(windowContext, { type: 'boot_response' }, replyId);
+        this.#sendPayload(context, { type: 'boot_response' }, replyId);
         return;
       }
 
@@ -106,7 +106,7 @@ export class PluginInstance {
           type: 'terminate_response',
         };
         await this.terminate();
-        this.#sendPayload(windowContext, payload, replyId);
+        this.#sendPayload(context, payload, replyId);
         return;
       }
 
@@ -123,10 +123,10 @@ export class PluginInstance {
             // deno-lint-ignore no-explicit-any
             resources: reply.resources as any,
           };
-          this.#sendPayload(windowContext, replyPayload, replyId);
+          this.#sendPayload(context, replyPayload, replyId);
           return;
         } else {
-          // Continue, to send back an empty reply
+          // Send back an empty reply (below)
         }
       }
 
@@ -136,7 +136,7 @@ export class PluginInstance {
           payload: payload.content,
           mimeType: payload.type,
         });
-        this.#sendPayload(windowContext, { type: 'filter_response', ...reply }, replyId);
+        this.#sendPayload(context, { type: 'filter_response', ...reply }, replyId);
         return;
       }
 
@@ -154,7 +154,7 @@ export class PluginInstance {
           pluginRefId: this.#workerData.pluginRefId,
           actions: reply,
         };
-        this.#sendPayload(windowContext, replyPayload, replyId);
+        this.#sendPayload(context, replyPayload, replyId);
         return;
       }
 
@@ -172,7 +172,58 @@ export class PluginInstance {
           pluginRefId: this.#workerData.pluginRefId,
           actions: reply,
         };
-        this.#sendPayload(windowContext, replyPayload, replyId);
+        this.#sendPayload(context, replyPayload, replyId);
+        return;
+      }
+
+      if (
+        payload.type === 'get_websocket_request_actions_request' &&
+        Array.isArray(this.#mod?.websocketRequestActions)
+      ) {
+        const reply = this.#mod.websocketRequestActions.map((a) => ({
+          ...a,
+          onSelect: undefined,
+        }));
+        const replyPayload: InternalEventPayload = {
+          type: 'get_websocket_request_actions_response',
+          pluginRefId: this.#workerData.pluginRefId,
+          actions: reply,
+        };
+        this.#sendPayload(context, replyPayload, replyId);
+        return;
+      }
+
+      if (
+        payload.type === 'get_workspace_actions_request' &&
+        Array.isArray(this.#mod?.workspaceActions)
+      ) {
+        const reply = this.#mod.workspaceActions.map((a) => ({
+          ...a,
+          onSelect: undefined,
+        }));
+        const replyPayload: InternalEventPayload = {
+          type: 'get_workspace_actions_response',
+          pluginRefId: this.#workerData.pluginRefId,
+          actions: reply,
+        };
+        this.#sendPayload(context, replyPayload, replyId);
+        return;
+      }
+
+      if (
+        payload.type === 'get_folder_actions_request' &&
+        Array.isArray(this.#mod?.folderActions)
+      ) {
+        const reply = this.#mod.folderActions.map((a) => ({
+          ...a,
+          onSelect: undefined,
+        }));
+        const replyPayload: InternalEventPayload = {
+          type: 'get_folder_actions_response',
+          pluginRefId: this.#workerData.pluginRefId,
+          actions: reply,
+        };
+        this.#sendPayload(context, replyPayload, replyId);
         return;
       }
 
@@ -181,7 +232,7 @@ export class PluginInstance {
           type: 'get_themes_response',
           themes: this.#mod.themes,
         };
-        this.#sendPayload(windowContext, replyPayload, replyId);
+        this.#sendPayload(context, replyPayload, replyId);
         return;
       }
 
@@ -203,7 +254,7 @@ export class PluginInstance {
           pluginRefId: this.#workerData.pluginRefId,
           functions,
         };
-        this.#sendPayload(windowContext, replyPayload, replyId);
+        this.#sendPayload(context, replyPayload, replyId);
         return;
       }
 
@@ -213,58 +264,42 @@ export class PluginInstance {
       ) {
         let templateFunction = this.#mod.templateFunctions.find((f) => f.name === payload.name);
         if (templateFunction == null) {
-          this.#sendEmpty(windowContext, replyId);
+          this.#sendEmpty(context, replyId);
           return;
         }
 
-        templateFunction = migrateTemplateFunctionSelectOptions(templateFunction);
-        // @ts-ignore
-        delete templateFunction.onRender;
-        const resolvedArgs: TemplateFunctionArg[] = [];
-        for (const arg of templateFunction.args) {
-          if (arg && 'dynamic' in arg) {
-            const dynamicAttrs = await arg.dynamic(ctx, payload);
-            const { dynamic, ...other } = arg;
-            resolvedArgs.push({ ...other, ...dynamicAttrs } as TemplateFunctionArg);
-          } else if (arg) {
-            resolvedArgs.push(arg);
-          }
-          templateFunction.args = resolvedArgs;
-        }
+        const fn = {
+          ...migrateTemplateFunctionSelectOptions(templateFunction),
+          onRender: undefined,
+        };
+
+        payload.values = applyFormInputDefaults(fn.args, payload.values);
+        const p = { ...payload, purpose: 'preview' } as const;
+        const resolvedArgs = await applyDynamicFormInput(ctx, fn.args, p);
+
         const replyPayload: InternalEventPayload = {
           type: 'get_template_function_config_response',
           pluginRefId: this.#workerData.pluginRefId,
-          function: templateFunction,
+          function: { ...fn, args: resolvedArgs },
         };
-        this.#sendPayload(windowContext, replyPayload, replyId);
+        this.#sendPayload(context, replyPayload, replyId);
         return;
       }
 
       if (payload.type === 'get_http_authentication_summary_request' && this.#mod?.authentication) {
-        const { name, shortLabel, label } = this.#mod.authentication;
         const replyPayload: InternalEventPayload = {
           type: 'get_http_authentication_summary_response',
-          name,
-          label,
-          shortLabel,
+          ...this.#mod.authentication,
         };
 
-        this.#sendPayload(windowContext, replyPayload, replyId);
+        this.#sendPayload(context, replyPayload, replyId);
         return;
       }
 
       if (payload.type === 'get_http_authentication_config_request' && this.#mod?.authentication) {
         const { args, actions } = this.#mod.authentication;
-        const resolvedArgs: FormInput[] = [];
-        for (const v of args) {
-          if (v && 'dynamic' in v) {
-            const dynamicAttrs = await v.dynamic(ctx, payload);
-            const { dynamic, ...other } = v;
-            resolvedArgs.push({ ...other, ...dynamicAttrs } as FormInput);
-          } else if (v) {
-            resolvedArgs.push(v);
-          }
-        }
+        payload.values = applyFormInputDefaults(args, payload.values);
+        const resolvedArgs = await applyDynamicFormInput(ctx, args, payload);
         const resolvedActions: HttpAuthenticationAction[] = [];
         for (const { onSelect, ...action } of actions ?? []) {
           resolvedActions.push(action);
@@ -277,16 +312,17 @@ export class PluginInstance {
           pluginRefId: this.#workerData.pluginRefId,
         };
 
-        this.#sendPayload(windowContext, replyPayload, replyId);
+        this.#sendPayload(context, replyPayload, replyId);
         return;
       }
 
       if (payload.type === 'call_http_authentication_request' && this.#mod?.authentication) {
         const auth = this.#mod.authentication;
         if (typeof auth?.onApply === 'function') {
-          applyFormInputDefaults(auth.args, payload.values);
+          auth.args = await applyDynamicFormInput(ctx, auth.args, payload);
+          payload.values = applyFormInputDefaults(auth.args, payload.values);
           this.#sendPayload(
-            windowContext,
+            context,
             {
               type: 'call_http_authentication_response',
               ...(await auth.onApply(ctx, payload)),
@@ -304,7 +340,7 @@ export class PluginInstance {
         const action = this.#mod.authentication.actions?.[payload.index];
         if (typeof action?.onSelect === 'function') {
           await action.onSelect(ctx, payload.args);
-          this.#sendEmpty(windowContext, replyId);
+          this.#sendEmpty(context, replyId);
           return;
         }
       }
@@ -316,7 +352,43 @@ export class PluginInstance {
         const action = this.#mod.httpRequestActions[payload.index];
         if (typeof action?.onSelect === 'function') {
           await action.onSelect(ctx, payload.args);
-          this.#sendEmpty(windowContext, replyId);
+          this.#sendEmpty(context, replyId);
+          return;
+        }
+      }
+
+      if (
+        payload.type === 'call_websocket_request_action_request' &&
+        Array.isArray(this.#mod.websocketRequestActions)
+      ) {
+        const action = this.#mod.websocketRequestActions[payload.index];
+        if (typeof action?.onSelect === 'function') {
+          await action.onSelect(ctx, payload.args);
+          this.#sendEmpty(context, replyId);
+          return;
+        }
+      }
+
+      if (
+        payload.type === 'call_workspace_action_request' &&
+        Array.isArray(this.#mod.workspaceActions)
+      ) {
+        const action = this.#mod.workspaceActions[payload.index];
+        if (typeof action?.onSelect === 'function') {
+          await action.onSelect(ctx, payload.args);
+          this.#sendEmpty(context, replyId);
+          return;
+        }
+      }
+
+      if (
+        payload.type === 'call_folder_action_request' &&
+        Array.isArray(this.#mod.folderActions)
+      ) {
+        const action = this.#mod.folderActions[payload.index];
+        if (typeof action?.onSelect === 'function') {
+          await action.onSelect(ctx, payload.args);
+          this.#sendEmpty(context, replyId);
           return;
         }
       }
@@ -328,7 +400,7 @@ export class PluginInstance {
         const action = this.#mod.grpcRequestActions[payload.index];
         if (typeof action?.onSelect === 'function') {
           await action.onSelect(ctx, payload.args);
-          this.#sendEmpty(windowContext, replyId);
+          this.#sendEmpty(context, replyId);
           return;
         }
       }
@@ -338,21 +410,43 @@ export class PluginInstance {
         Array.isArray(this.#mod?.templateFunctions)
       ) {
         const fn = this.#mod.templateFunctions.find((a) => a.name === payload.name);
-        if (typeof fn?.onRender === 'function') {
-          applyFormInputDefaults(fn.args, payload.args.values);
-          try {
-            const result = await fn.onRender(ctx, payload.args);
+        if (
+          payload.args.purpose === 'preview' &&
+          (fn?.previewType === 'click' || fn?.previewType === 'none')
+        ) {
+          // Send empty render response
+          this.#sendPayload(
+            context,
+            {
+              type: 'call_template_function_response',
+              value: null,
+              error: 'Live preview disabled for this function',
+            },
+            replyId,
+          );
+        } else if (typeof fn?.onRender === 'function') {
+          const resolvedArgs = await applyDynamicFormInput(ctx, fn.args, payload.args);
+          const values = applyFormInputDefaults(resolvedArgs, payload.args.values);
+          const error = validateTemplateFunctionArgs(fn.name, resolvedArgs, values);
+          if (error && payload.args.purpose !== 'preview') {
             this.#sendPayload(
-              windowContext,
-              {
-                type: 'call_template_function_response',
-                value: result ?? null,
-              },
+              context,
+              { type: 'call_template_function_response', value: null, error },
+              replyId,
+            );
+            return;
+          }
+
+          try {
+            const result = await fn.onRender(ctx, { ...payload.args, values });
+            this.#sendPayload(
+              context,
+              { type: 'call_template_function_response', value: result ?? null },
               replyId,
             );
           } catch (err) {
             this.#sendPayload(
-              windowContext,
+              context,
               {
                 type: 'call_template_function_response',
                 value: null,
@@ -367,12 +461,12 @@ export class PluginInstance {
     } catch (err) {
       const error = `${err}`.replace(/^Error:\s*/g, '');
       console.log('Plugin call threw exception', payload.type, '→', error);
-      this.#sendPayload(windowContext, { type: 'error_response', error }, replyId);
+      this.#sendPayload(context, { type: 'error_response', error }, replyId);
       return;
     }
 
     // No matches, so send back an empty response so the caller doesn't block forever
-    this.#sendEmpty(windowContext, replyId);
+    this.#sendEmpty(context, replyId);
   }
 
   #pathMod() {
@@ -395,7 +489,7 @@ export class PluginInstance {
   }
 
   #buildEventToSend(
-    windowContext: PluginWindowContext,
+    context: PluginContext,
     payload: InternalEventPayload,
     replyId: string | null = null,
   ): InternalEvent {
@@ -405,16 +499,16 @@ export class PluginInstance {
       id: genId(),
       replyId,
       payload,
-      windowContext,
+      context,
     };
   }
 
   #sendPayload(
-    windowContext: PluginWindowContext,
+    context: PluginContext,
     payload: InternalEventPayload,
     replyId: string | null,
   ): string {
-    const event = this.#buildEventToSend(windowContext, payload, replyId);
+    const event = this.#buildEventToSend(context, payload, replyId);
     this.#sendEvent(event);
     return event.id;
   }
@@ -426,16 +520,16 @@ export class PluginInstance {
     this.#pluginToAppEvents.emit(event);
   }
 
-  #sendEmpty(windowContext: PluginWindowContext, replyId: string | null = null): string {
-    return this.#sendPayload(windowContext, { type: 'empty_response' }, replyId);
+  #sendEmpty(context: PluginContext, replyId: string | null = null): string {
+    return this.#sendPayload(context, { type: 'empty_response' }, replyId);
   }
 
-  #sendAndWaitForReply<T extends Omit<InternalEventPayload, 'type'>>(
-    windowContext: PluginWindowContext,
+  #sendForReply<T extends Omit<InternalEventPayload, 'type'>>(
+    context: PluginContext,
     payload: InternalEventPayload,
   ): Promise<T> {
     // 1. Build event to send
-    const eventToSend = this.#buildEventToSend(windowContext, payload, null);
+    const eventToSend = this.#buildEventToSend(context, payload, null);
 
     // 2. Spawn listener in background
     const promise = new Promise<T>((resolve) => {
@@ -457,12 +551,12 @@ export class PluginInstance {
   }
 
   #sendAndListenForEvents(
-    windowContext: PluginWindowContext,
+    context: PluginContext,
     payload: InternalEventPayload,
     onEvent: (event: InternalEventPayload) => void,
   ): void {
     // 1. Build event to send
-    const eventToSend = this.#buildEventToSend(windowContext, payload, null);
+    const eventToSend = this.#buildEventToSend(context, payload, null);
 
     // 2. Listen for replies in the background
     this.#appToPluginEvents.listen((event: InternalEvent) => {
@@ -475,11 +569,23 @@ export class PluginInstance {
     this.#sendEvent(eventToSend);
   }
 
-  #newCtx(windowContext: PluginWindowContext): Context {
+  #newCtx(context: PluginContext): Context {
+    const _windowInfo = async () => {
+      if (context.label == null) {
+        throw new Error("Can't get window context without an active window");
+      }
+      const payload: InternalEventPayload = {
+        type: 'window_info_request',
+        label: context.label,
+      };
+
+      return this.#sendForReply<WindowInfoResponse>(context, payload);
+    };
+
     return {
       clipboard: {
         copyText: async (text) => {
-          await this.#sendAndWaitForReply(windowContext, {
+          await this.#sendForReply(context, {
             type: 'copy_text_request',
             text,
           });
@@ -487,7 +593,7 @@ export class PluginInstance {
       },
       toast: {
         show: async (args) => {
-          await this.#sendAndWaitForReply(windowContext, {
+          await this.#sendForReply(context, {
             type: 'show_toast_request',
             // Handle default here because null/undefined both convert to None in Rust translation
             timeout: args.timeout === undefined ? 5000 : args.timeout,
@@ -496,6 +602,15 @@ export class PluginInstance {
         },
       },
       window: {
+        requestId: async () => {
+          return (await _windowInfo()).requestId;
+        },
+        async workspaceId(): Promise<string | null> {
+          return (await _windowInfo()).workspaceId;
+        },
+        async environmentId(): Promise<string | null> {
+          return (await _windowInfo()).environmentId;
+        },
         openUrl: async ({ onNavigate, onClose, ...args }) => {
           args.label = args.label || `${Math.random()}`;
           const payload: InternalEventPayload = { type: 'open_window_request', ...args };
@@ -506,21 +621,21 @@ export class PluginInstance {
               onClose?.();
             }
           };
-          this.#sendAndListenForEvents(windowContext, payload, onEvent);
+          this.#sendAndListenForEvents(context, payload, onEvent);
           return {
             close: () => {
               const closePayload: InternalEventPayload = {
                 type: 'close_window_request',
                 label: args.label,
               };
-              this.#sendPayload(windowContext, closePayload, null);
+              this.#sendPayload(context, closePayload, null);
             },
           };
         },
       },
       prompt: {
         text: async (args) => {
-          const reply: PromptTextResponse = await this.#sendAndWaitForReply(windowContext, {
+          const reply: PromptTextResponse = await this.#sendForReply(context, {
             type: 'prompt_text_request',
             ...args,
           });
@@ -533,8 +648,8 @@ export class PluginInstance {
             type: 'find_http_responses_request',
             ...args,
           } as const;
-          const { httpResponses } = await this.#sendAndWaitForReply<FindHttpResponsesResponse>(
-            windowContext,
+          const { httpResponses } = await this.#sendForReply<FindHttpResponsesResponse>(
+            context,
             payload,
           );
           return httpResponses;
@@ -546,8 +661,8 @@ export class PluginInstance {
             type: 'render_grpc_request_request',
             ...args,
           } as const;
-          const { grpcRequest } = await this.#sendAndWaitForReply<RenderGrpcRequestResponse>(
-            windowContext,
+          const { grpcRequest } = await this.#sendForReply<RenderGrpcRequestResponse>(
+            context,
             payload,
           );
           return grpcRequest;
@@ -559,8 +674,8 @@ export class PluginInstance {
             type: 'get_http_request_by_id_request',
             ...args,
           } as const;
-          const { httpRequest } = await this.#sendAndWaitForReply<GetHttpRequestByIdResponse>(
-            windowContext,
+          const { httpRequest } = await this.#sendForReply<GetHttpRequestByIdResponse>(
+            context,
             payload,
           );
           return httpRequest;
@@ -570,8 +685,8 @@ export class PluginInstance {
             type: 'send_http_request_request',
             ...args,
           } as const;
-          const { httpResponse } = await this.#sendAndWaitForReply<SendHttpRequestResponse>(
-            windowContext,
+          const { httpResponse } = await this.#sendForReply<SendHttpRequestResponse>(
+            context,
             payload,
           );
           return httpResponse;
@@ -581,12 +696,63 @@ export class PluginInstance {
             type: 'render_http_request_request',
             ...args,
           } as const;
-          const { httpRequest } = await this.#sendAndWaitForReply<RenderHttpRequestResponse>(
-            windowContext,
+          const { httpRequest } = await this.#sendForReply<RenderHttpRequestResponse>(
+            context,
             payload,
           );
           return httpRequest;
         },
+        list: async (args?: { folderId?: string }) => {
+          const payload = {
+            type: 'list_http_requests_request',
+            folderId: args?.folderId,
+          } as any;
+          const { httpRequests } = await this.#sendForReply<any>(context, payload);
+          return httpRequests as any[];
+        },
+        create: async (args) => {
+          const payload = {
+            type: 'upsert_model_request',
+            model: {
+              name: '',
+              method: 'GET',
+              ...args,
+              id: '',
+              model: 'http_request',
+            },
+          } as InternalEventPayload;
+          const response = await this.#sendForReply<UpsertModelResponse>(context, payload);
+          return response.model as HttpRequest;
+        },
+        update: async (args) => {
+          const payload = {
+            type: 'upsert_model_request',
+            model: {
+              model: 'http_request',
+              ...args,
+            },
+          } as InternalEventPayload;
+          const response = await this.#sendForReply<UpsertModelResponse>(context, payload);
+          return response.model as HttpRequest;
+        },
+        delete: async (args) => {
+          const payload = {
+            type: 'delete_model_request',
+            model: 'http_request',
+            id: args.id,
+          } as InternalEventPayload;
+          const response = await this.#sendForReply<DeleteModelResponse>(context, payload);
+          return response.model as HttpRequest;
+        },
+      },
+      folder: {
+        list: async () => {
+          const payload = {
+            type: 'list_folders_request',
+          } as any;
+          const { folders } = await this.#sendForReply<any>(context, payload);
+          return folders as any[];
+        },
       },
       cookies: {
         getValue: async (args: GetCookieValueRequest) => {
@@ -594,18 +760,12 @@ export class PluginInstance {
             type: 'get_cookie_value_request',
             ...args,
           } as const;
-          const { value } = await this.#sendAndWaitForReply<GetCookieValueResponse>(
-            windowContext,
-            payload,
-          );
+          const { value } = await this.#sendForReply<GetCookieValueResponse>(context, payload);
           return value;
         },
         listNames: async () => {
           const payload = { type: 'list_cookie_names_request' } as const;
-          const { names } = await this.#sendAndWaitForReply<ListCookieNamesResponse>(
-            windowContext,
-            payload,
-          );
+          const { names } = await this.#sendForReply<ListCookieNamesResponse>(context, payload);
           return names;
         },
       },
@@ -616,20 +776,14 @@ export class PluginInstance {
          */
         render: async (args) => {
           const payload = { type: 'template_render_request', ...args } as const;
-          const result = await this.#sendAndWaitForReply<TemplateRenderResponse>(
-            windowContext,
-            payload,
-          );
+          const result = await this.#sendForReply<TemplateRenderResponse>(context, payload);
           return result.data as any;
         },
       },
       store: {
         get: async <T>(key: string) => {
           const payload = { type: 'get_key_value_request', key } as const;
-          const result = await this.#sendAndWaitForReply<GetKeyValueResponse>(
-            windowContext,
-            payload,
-          );
+          const result = await this.#sendForReply<GetKeyValueResponse>(context, payload);
           return result.value ? (JSON.parse(result.value) as T) : undefined;
         },
         set: async <T>(key: string, value: T) => {
@@ -639,20 +793,40 @@ export class PluginInstance {
             key,
             value: valueStr,
           };
-          await this.#sendAndWaitForReply<GetKeyValueResponse>(windowContext, payload);
+          await this.#sendForReply<GetKeyValueResponse>(context, payload);
         },
         delete: async (key: string) => {
           const payload = { type: 'delete_key_value_request', key } as const;
-          const result = await this.#sendAndWaitForReply<DeleteKeyValueResponse>(
-            windowContext,
-            payload,
-          );
+          const result = await this.#sendForReply<DeleteKeyValueResponse>(context, payload);
           return result.deleted;
         },
       },
       plugin: {
         reload: () => {
-          this.#sendPayload({ type: 'none' }, { type: 'reload_response', silent: true }, null);
+          this.#sendPayload(context, { type: 'reload_response', silent: true }, null);
+        },
+      },
+      workspace: {
+        list: async () => {
+          const payload = {
+            type: 'list_workspaces_request'
+          } as InternalEventPayload;
+          const response = await this.#sendForReply<ListWorkspacesResponse>(context, payload);
+          return response.workspaces.map((w) => ({
+            id: w.id,
+            name: w.name,
+            // Hide label from plugin authors, but keep it for internal routing
+            _label: (w as any).label as string,
+          }));
+        },
+        withContext: (workspaceHandle: { id: string; name: string; _label?: string }) => {
+          // Create a new context with the workspace's window label
+          const newContext: PluginContext = {
+            ...context,
+            label: workspaceHandle._label || null,
+            workspaceId: workspaceHandle.id,
+          };
+          return this.#newCtx(newContext);
         },
       },
     };
@@ -668,20 +842,6 @@ function genId(len = 5): string {
   return id;
 }
 
-/** Recursively apply form input defaults to a set of values */
-function applyFormInputDefaults(
-  inputs: TemplateFunctionArg[],
-  values: { [p: string]: JsonValue | undefined },
-) {
-  for (const input of inputs) {
-    if ('inputs' in input) {
-      applyFormInputDefaults(input.inputs ?? [], values);
-    } else if ('defaultValue' in input && values[input.name] === undefined) {
-      values[input.name] = input.defaultValue;
-    }
-  }
-}
-
 const watchedFiles: Record<string, Stats | null> = {};
 
 /**

packages/plugin-runtime/src/common.ts

@@ -0,0 +1,37 @@
+import { CallHttpAuthenticationActionArgs, CallTemplateFunctionArgs } from '@yaakapp-internal/plugins';
+import { Context, DynamicAuthenticationArg, DynamicTemplateFunctionArg } from '@yaakapp/api';
+
+export async function applyDynamicFormInput(
+  ctx: Context,
+  args: DynamicTemplateFunctionArg[],
+  callArgs: CallTemplateFunctionArgs,
+): Promise<DynamicTemplateFunctionArg[]>;
+
+export async function applyDynamicFormInput(
+  ctx: Context,
+  args: DynamicAuthenticationArg[],
+  callArgs: CallHttpAuthenticationActionArgs,
+): Promise<DynamicAuthenticationArg[]>;
+
+export async function applyDynamicFormInput(
+  ctx: Context,
+  args: (DynamicTemplateFunctionArg | DynamicAuthenticationArg)[],
+  callArgs: CallTemplateFunctionArgs | CallHttpAuthenticationActionArgs,
+): Promise<(DynamicTemplateFunctionArg | DynamicAuthenticationArg)[]> {
+  const resolvedArgs: any[] = [];
+  for (const { dynamic, ...arg } of args) {
+    const newArg: any = {
+      ...arg,
+      ...(typeof dynamic === 'function' ? await dynamic(ctx, callArgs as any) : undefined),
+    };
+    if ('inputs' in newArg && Array.isArray(newArg.inputs)) {
+      try {
+        newArg.inputs = await applyDynamicFormInput(ctx, newArg.inputs, callArgs as any);
+      } catch (e) {
+        console.error('Failed to apply dynamic form input', e);
+      }
+    }
+    resolvedArgs.push(newArg);
+  }
+  return resolvedArgs;
+}

packages/plugin-runtime/src/index.ts

@@ -8,10 +8,15 @@ if (!port) {
   throw new Error('Plugin runtime missing PORT')
 }
 
+const host = process.env.HOST;
+if (!host) {
+  throw new Error('Plugin runtime missing HOST')
+}
+
 const pluginToAppEvents = new EventChannel();
 const plugins: Record<string, PluginHandle> = {};
 
-const ws = new WebSocket(`ws://localhost:${port}`);
+const ws = new WebSocket(`ws://${host}:${port}`);
 
 ws.on('message', async (e: Buffer) => {
   try {
@@ -34,7 +39,7 @@ async function handleIncoming(msg: string) {
   const pluginEvent: InternalEvent = JSON.parse(msg);
   // Handle special event to bootstrap plugin
   if (pluginEvent.payload.type === 'boot_request') {
-    const plugin = new PluginHandle(pluginEvent.pluginRefId, pluginEvent.payload, pluginToAppEvents);
+    const plugin = new PluginHandle(pluginEvent.pluginRefId, pluginEvent.context, pluginEvent.payload, pluginToAppEvents);
     plugins[pluginEvent.pluginRefId] = plugin;
   }
 

packages/plugin-runtime/src/migrations.ts

@@ -1,4 +1,4 @@
-import { TemplateFunctionPlugin } from '@yaakapp/api/lib/plugins/TemplateFunctionPlugin';
+import type { TemplateFunctionPlugin } from '@yaakapp/api';
 
 export function migrateTemplateFunctionSelectOptions(
   f: TemplateFunctionPlugin,
@@ -13,8 +13,5 @@ export function migrateTemplateFunctionSelectOptions(
     return a;
   });
 
-  return {
-    ...f,
-    args: migratedArgs,
-  };
+  return { ...f, args: migratedArgs };
 }

packages/plugin-runtime/tests/common.test.ts

@@ -0,0 +1,151 @@
+import { applyFormInputDefaults } from '@yaakapp-internal/lib/templateFunction';
+import { CallTemplateFunctionArgs } from '@yaakapp-internal/plugins';
+import { Context, DynamicTemplateFunctionArg } from '@yaakapp/api';
+import { describe, expect, test } from 'vitest';
+import { applyDynamicFormInput } from '../src/common';
+
+describe('applyFormInputDefaults', () => {
+  test('Works with top-level select', () => {
+    const args: DynamicTemplateFunctionArg[] = [
+      {
+        type: 'select',
+        name: 'test',
+        options: [{ label: 'Option 1', value: 'one' }],
+        defaultValue: 'one',
+      },
+    ];
+    expect(applyFormInputDefaults(args, {})).toEqual({
+      test: 'one',
+    });
+  });
+
+  test('Works with existing value', () => {
+    const args: DynamicTemplateFunctionArg[] = [
+      {
+        type: 'select',
+        name: 'test',
+        options: [{ label: 'Option 1', value: 'one' }],
+        defaultValue: 'one',
+      },
+    ];
+    expect(applyFormInputDefaults(args, { test: 'explicit' })).toEqual({
+      test: 'explicit',
+    });
+  });
+
+  test('Works with recursive select', () => {
+    const args: DynamicTemplateFunctionArg[] = [
+      { type: 'text', name: 'dummy', defaultValue: 'top' },
+      {
+        type: 'accordion',
+        label: 'Test',
+        inputs: [
+          { type: 'text', name: 'name', defaultValue: 'hello' },
+          {
+            type: 'select',
+            name: 'test',
+            options: [{ label: 'Option 1', value: 'one' }],
+            defaultValue: 'one',
+          },
+        ],
+      },
+    ];
+    expect(applyFormInputDefaults(args, {})).toEqual({
+      dummy: 'top',
+      test: 'one',
+      name: 'hello',
+    });
+  });
+
+  test('Works with dynamic options', () => {
+    const args: DynamicTemplateFunctionArg[] = [
+      {
+        type: 'select',
+        name: 'test',
+        defaultValue: 'one',
+        options: [],
+        dynamic() {
+          return { options: [{ label: 'Option 1', value: 'one' }] };
+        },
+      },
+    ];
+    expect(applyFormInputDefaults(args, {})).toEqual({
+      test: 'one',
+    });
+    expect(applyFormInputDefaults(args, {})).toEqual({
+      test: 'one',
+    });
+  });
+});
+
+describe('applyDynamicFormInput', () => {
+  test('Works with plain input', async () => {
+    const ctx = {} as Context;
+    const args: DynamicTemplateFunctionArg[] = [
+      { type: 'text', name: 'name' },
+      { type: 'checkbox', name: 'checked' },
+    ];
+    const callArgs: CallTemplateFunctionArgs = {
+      values: {},
+      purpose: 'preview',
+    };
+    expect(await applyDynamicFormInput(ctx, args, callArgs)).toEqual([
+      { type: 'text', name: 'name' },
+      { type: 'checkbox', name: 'checked' },
+    ]);
+  });
+
+  test('Works with dynamic input', async () => {
+    const ctx = {} as Context;
+    const args: DynamicTemplateFunctionArg[] = [
+      {
+        type: 'text',
+        name: 'name',
+        async dynamic(_ctx, _args) {
+          return { hidden: true };
+        },
+      },
+    ];
+    const callArgs: CallTemplateFunctionArgs = {
+      values: {},
+      purpose: 'preview',
+    };
+    expect(await applyDynamicFormInput(ctx, args, callArgs)).toEqual([
+      { type: 'text', name: 'name', hidden: true },
+    ]);
+  });
+
+  test('Works with recursive dynamic input', async () => {
+    const ctx = {} as Context;
+    const callArgs: CallTemplateFunctionArgs = {
+      values: { hello: 'world' },
+      purpose: 'preview',
+    };
+    const args: DynamicTemplateFunctionArg[] = [
+      {
+        type: 'banner',
+        inputs: [
+          {
+            type: 'text',
+            name: 'name',
+            async dynamic(_ctx, args) {
+              return { hidden: args.values.hello === 'world' };
+            },
+          },
+        ],
+      },
+    ];
+    expect(await applyDynamicFormInput(ctx, args, callArgs)).toEqual([
+      {
+        type: 'banner',
+        inputs: [
+          {
+            type: 'text',
+            name: 'name',
+            hidden: true,
+          },
+        ],
+      },
+    ]);
+  });
+});

plugins-external/faker/README.md

@@ -0,0 +1,76 @@
+# Yaak Faker Plugin
+
+This is a template function that generates realistic fake data
+for testing and development using [FakerJS](https://fakerjs.dev).
+
+![CleanShot 2024-09-19 at 13 56 33@2x](https://github.com/user-attachments/assets/2f935110-4af2-4236-a50d-18db5454176d)
+
+## Example JSON Body
+
+Here's an example JSON body that uses fake data:
+
+```json
+{
+  "id": "${[ faker.string.uuid() ]}",
+  "name": "${[ faker.person.fullName() ]}",
+  "email": "${[ faker.internet.email() ]}",
+  "phone": "${[ faker.phone.number() ]}",
+  "address": {
+    "street": "${[ faker.location.streetAddress() ]}",
+    "city": "${[ faker.location.city() ]}",
+    "country": "${[ faker.location.country() ]}",
+    "zipCode": "${[ faker.location.zipCode() ]}"
+  },
+  "company": "${[ faker.company.name() ]}",
+  "website": "${[ faker.internet.url() ]}"
+}
+```
+
+This will generate a random JSON body on every request:
+
+```json
+{
+  "id": "589f0aec-7310-4bf2-81c4-0b1bb7f1c3c1",
+  "name": "Lucy Gottlieb-Weissnat",
+  "email": "Destiny_Herzog@gmail.com",
+  "phone": "411.805.2871 x699",
+  "address": {
+    "street": "846 Christ Mills",
+    "city": "Spencerfurt",
+    "country": "United Kingdom",
+    "zipCode": "20354"
+  },
+  "company": "Emard, Kohler and Rutherford",
+  "website": "https://watery-detective.org"
+}
+```
+
+## Available Categories
+
+The plugin provides access to all FakerJS modules and their methods:
+
+| Category   | Description               | Example Methods                            |
+|------------|---------------------------|--------------------------------------------|
+| `airline`  | Airline-related data      | `aircraftType`, `airline`, `airplane`      |
+| `animal`   | Animal names and types    | `bear`, `bird`, `cat`, `dog`, `fish`       |
+| `color`    | Colors in various formats | `human`, `rgb`, `hex`, `hsl`               |
+| `commerce` | E-commerce data           | `department`, `product`, `price`           |
+| `company`  | Company information       | `name`, `catchPhrase`, `bs`                |
+| `database` | Database-related data     | `column`, `type`, `collation`              |
+| `date`     | Date and time values      | `recent`, `future`, `past`, `between`      |
+| `finance`  | Financial data            | `account`, `amount`, `currency`            |
+| `git`      | Git-related data          | `branch`, `commitEntry`, `commitSha`       |
+| `hacker`   | Tech/hacker terminology   | `abbreviation`, `noun`, `phrase`           |
+| `image`    | Image URLs and data       | `avatar`, `url`, `dataUri`                 |
+| `internet` | Internet-related data     | `email`, `url`, `ip`, `userAgent`          |
+| `location` | Geographic data           | `city`, `country`, `latitude`, `longitude` |
+| `lorem`    | Lorem ipsum text          | `word`, `sentence`, `paragraph`            |
+| `person`   | Personal information      | `firstName`, `lastName`, `fullName`        |
+| `music`    | Music-related data        | `genre`, `songName`, `artist`              |
+| `number`   | Numeric data              | `int`, `float`, `binary`, `hex`            |
+| `phone`    | Phone numbers             | `number`, `imei`                           |
+| `science`  | Scientific data           | `chemicalElement`, `unit`                  |
+| `string`   | String utilities          | `uuid`, `alpha`, `alphanumeric`            |
+| `system`   | System-related data       | `fileName`, `mimeType`, `fileExt`          |
+| `vehicle`  | Vehicle information       | `vehicle`, `manufacturer`, `model`         |
+| `word`     | Word generation           | `adjective`, `adverb`, `conjunction`       |

plugins-external/faker/package.json

@@ -0,0 +1,23 @@
+{
+  "name": "@yaakapp/faker",
+  "private": true,
+  "version": "0.1.0",
+  "displayName": "Faker",
+  "description": "Template functions for generating fake data using FakerJS",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/mountain-loop/yaak.git",
+    "directory": "plugins-external/faker"
+  },
+  "scripts": {
+    "build": "yaakcli build",
+    "dev": "yaakcli dev"
+  },
+  "dependencies": {
+    "@faker-js/faker": "^10.1.0"
+  },
+  "devDependencies": {
+    "@types/node": "^25.0.3",
+    "typescript": "^5.9.3"
+  }
+}

plugins-external/faker/src/index.ts

@@ -0,0 +1,106 @@
+import { faker } from '@faker-js/faker';
+import type { PluginDefinition, TemplateFunctionArg } from '@yaakapp/api';
+
+const modules = [
+  'airline',
+  'animal',
+  'color',
+  'commerce',
+  'company',
+  'database',
+  'date',
+  'finance',
+  'git',
+  'hacker',
+  'image',
+  'internet',
+  'location',
+  'lorem',
+  'person',
+  'music',
+  'number',
+  'phone',
+  'science',
+  'string',
+  'system',
+  'vehicle',
+  'word',
+];
+
+function normalizeResult(result: unknown): string {
+  if (typeof result === 'string') return result;
+  return JSON.stringify(result);
+}
+
+// Whatever Yaak’s arg type shape is – rough example
+function args(modName: string, fnName: string): TemplateFunctionArg[] {
+  return [
+    {
+      type: 'banner',
+      color: 'info',
+      inputs: [
+        {
+          type: 'markdown',
+          content: `Need help? View documentation for [\`${modName}.${fnName}(…)\`](https://fakerjs.dev/api/${encodeURIComponent(modName)}.html#${encodeURIComponent(fnName)})`,
+        },
+      ],
+    },
+    {
+      name: 'options',
+      label: 'Arguments',
+      type: 'editor',
+      language: 'json',
+      optional: true,
+      placeholder: 'e.g. { "min": 1, "max": 10 } or 10 or ["en","US"]',
+    },
+  ];
+}
+
+export const plugin: PluginDefinition = {
+  templateFunctions: modules.flatMap((modName) => {
+    // @ts-expect-error - Dynamic access to faker modules
+    const mod = faker[modName];
+    return Object.keys(mod)
+      .filter((n) => n !== 'faker')
+      .map((fnName) => ({
+        name: ['faker', modName, fnName].join('.'),
+        args: args(modName, fnName),
+        async onRender(_ctx, args) {
+          const fn = mod[fnName] as (...a: unknown[]) => unknown;
+          const options = args.values.options;
+
+          // No options supplied
+          if (options == null || options === '') {
+            return normalizeResult(fn());
+          }
+
+          // Try JSON first
+          let parsed: unknown = options;
+          if (typeof options === 'string') {
+            try {
+              parsed = JSON.parse(options);
+            } catch {
+              // Not valid JSON – maybe just a scalar
+              const n = Number(options);
+              if (!Number.isNaN(n)) {
+                parsed = n;
+              } else {
+                parsed = options;
+              }
+            }
+          }
+
+          let result: unknown;
+          if (Array.isArray(parsed)) {
+            // Treat as positional arguments
+            result = fn(...parsed);
+          } else {
+            // Treat as a single argument (option object or scalar)
+            result = fn(parsed);
+          }
+
+          return normalizeResult(result);
+        },
+      }));
+  }),
+};

plugins-external/faker/tsconfig.json

@@ -0,0 +1,3 @@
+{
+  "extends": "../../tsconfig.json"
+}

plugins-external/mcp-server/README.md

@@ -0,0 +1,54 @@
+# Yaak MCP Server Plugin
+
+A Yaak plugin that exposes Yaak's functionality via the [Model Context Protocol (MCP)](https://modelcontextprotocol.io/), allowing AI assistants and other tools to interact with Yaak programmatically.
+
+## Features
+
+This plugin starts an MCP server on `http://127.0.0.1:64343/mcp` that provides tools for:
+
+### HTTP Requests
+- `list_http_requests` - List all HTTP requests in a workspace
+- `get_http_request` - Get details of a specific HTTP request
+- `send_http_request` - Send an HTTP request and get the response
+- `create_http_request` - Create a new HTTP request
+- `update_http_request` - Update an existing HTTP request
+- `delete_http_request` - Delete an HTTP request
+
+### Folders
+- `list_folders` - List all folders in a workspace
+
+### Workspaces
+- `list_workspaces` - List all open workspaces in Yaak
+
+### Clipboard
+- `copy_to_clipboard` - Copy text to the system clipboard
+
+### Window
+- `get_workspace_id` - Get the current workspace ID
+- `get_environment_id` - Get the current environment ID
+
+### Toast Notifications
+- `show_toast` - Show a toast notification in Yaak
+
+## Usage
+
+Once the plugin is installed and Yaak is running, the MCP server will be available at:
+
+```
+http://127.0.0.1:64343/mcp
+```
+
+Configure your MCP client to connect to this endpoint to start interacting with Yaak.
+
+## Development
+
+```bash
+# Install dependencies
+npm install
+
+# Build the plugin
+npm run build
+
+# Development mode with auto-rebuild
+npm run dev
+```

plugins-external/mcp-server/package.json

@@ -0,0 +1,27 @@
+{
+  "name": "@yaakapp/mcp-server",
+  "private": true,
+  "version": "0.1.0",
+  "displayName": "MCP Server",
+  "description": "Expose Yaak functionality via Model Context Protocol",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/mountain-loop/yaak.git",
+    "directory": "plugins-external/mcp-server"
+  },
+  "scripts": {
+    "build": "yaakcli build",
+    "dev": "yaakcli dev"
+  },
+  "dependencies": {
+    "@hono/mcp": "^0.2.3",
+    "@hono/node-server": "^1.19.7",
+    "@modelcontextprotocol/sdk": "^1.25.1",
+    "hono": "^4.11.3",
+    "zod": "^3.25.76"
+  },
+  "devDependencies": {
+    "@types/node": "^25.0.3",
+    "typescript": "^5.9.3"
+  }
+}

plugins-external/mcp-server/src/index.ts

@@ -0,0 +1,23 @@
+import type { Context, PluginDefinition } from '@yaakapp/api';
+import { createMcpServer } from './server.js';
+
+const serverPort = 64343;
+
+let mcpServer: Awaited<ReturnType<typeof createMcpServer>> | null = null;
+
+export const plugin: PluginDefinition = {
+  async init(ctx: Context) {
+    console.log('Initializing MCP Server plugin');
+
+    mcpServer = createMcpServer({ yaak: ctx }, serverPort);
+  },
+
+  async dispose() {
+    console.log('Disposing MCP Server plugin');
+
+    if (mcpServer) {
+      await mcpServer.close();
+      mcpServer = null;
+    }
+  },
+};

plugins-external/mcp-server/src/server.ts

@@ -0,0 +1,55 @@
+import { serve } from '@hono/node-server';
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { WebStandardStreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js';
+import { Hono } from 'hono';
+import { registerClipboardTools } from './tools/clipboard.js';
+import { registerFolderTools } from './tools/folder.js';
+import { registerHttpRequestTools } from './tools/httpRequest.js';
+import { registerToastTools } from './tools/toast.js';
+import { registerWindowTools } from './tools/window.js';
+import { registerWorkspaceTools } from './tools/workspace.js';
+import type { McpServerContext } from './types.js';
+
+export function createMcpServer(ctx: McpServerContext, port: number) {
+  const server = new McpServer({
+    name: 'yaak-mcp-server',
+    version: '0.1.0',
+  });
+
+  // Register all tools
+  registerToastTools(server, ctx);
+  registerClipboardTools(server, ctx);
+  registerHttpRequestTools(server, ctx);
+  registerFolderTools(server, ctx);
+  registerWindowTools(server, ctx);
+  registerWorkspaceTools(server, ctx);
+
+  // Create a stateless transport
+  const transport = new WebStandardStreamableHTTPServerTransport();
+
+  // Create Hono app
+  const app = new Hono();
+
+  // MCP endpoint - reuse the same transport for all requests
+  app.all('/mcp', (c) => transport.handleRequest(c.req.raw));
+
+  // Connect server to transport
+  server.connect(transport).then(() => {
+    console.log(`MCP Server running at http://127.0.0.1:${port}/mcp`);
+  });
+
+  // Start the HTTP server
+  const honoServer = serve({
+    fetch: app.fetch,
+    port,
+    hostname: '127.0.0.1',
+  });
+
+  return {
+    server,
+    close: async () => {
+      honoServer.close();
+      await server.close();
+    },
+  };
+}

plugins-external/mcp-server/src/tools/clipboard.ts

@@ -0,0 +1,28 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import * as z from 'zod/v4';
+import type { McpServerContext } from '../types.js';
+
+export function registerClipboardTools(server: McpServer, ctx: McpServerContext) {
+  server.registerTool(
+    'copy_to_clipboard',
+    {
+      title: 'Copy to Clipboard',
+      description: 'Copy text to the system clipboard',
+      inputSchema: z.object({
+        text: z.string().describe('The text to copy'),
+      }),
+    },
+    async ({ text }) => {
+      await ctx.yaak.clipboard.copyText(text);
+
+      return {
+        content: [
+          {
+            type: 'text' as const,
+            text: `✓ Copied to clipboard: "${text.substring(0, 100)}${text.length > 100 ? '...' : ''}"`,
+          },
+        ],
+      };
+    },
+  );
+}

plugins-external/mcp-server/src/tools/folder.ts

@@ -0,0 +1,33 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import * as z from 'zod/v4';
+import type { McpServerContext } from '../types.js';
+import { getWorkspaceContext } from './helpers.js';
+
+export function registerFolderTools(server: McpServer, ctx: McpServerContext) {
+  server.registerTool(
+    'list_folders',
+    {
+      title: 'List Folders',
+      description: 'List all folders in a workspace',
+      inputSchema: z.object({
+        workspaceId: z
+          .string()
+          .optional()
+          .describe('Workspace ID (required if multiple workspaces are open)'),
+      }),
+    },
+    async ({ workspaceId }) => {
+      const workspaceCtx = await getWorkspaceContext(ctx, workspaceId);
+      const folders = await workspaceCtx.yaak.folder.list();
+
+      return {
+        content: [
+          {
+            type: 'text' as const,
+            text: JSON.stringify(folders, null, 2),
+          },
+        ],
+      };
+    },
+  );
+}

plugins-external/mcp-server/src/tools/helpers.ts

@@ -0,0 +1,32 @@
+import type { McpServerContext } from '../types.js';
+
+export async function getWorkspaceContext(
+  ctx: McpServerContext,
+  workspaceId?: string,
+): Promise<McpServerContext> {
+  const workspaces = await ctx.yaak.workspace.list();
+
+  if (!workspaceId && workspaces.length > 1) {
+    const workspaceList = workspaces.map((w, i) => `${i + 1}. ${w.name} (ID: ${w.id})`).join('\n');
+    throw new Error(
+      `Multiple workspaces are open. Please specify which workspace to use.\n\n` +
+        `Currently open workspaces:\n${workspaceList}\n\n` +
+        `You can use the list_workspaces tool to get workspace IDs, then use other tools ` +
+        `with the workspace context. For example, ask the user which workspace they want ` +
+        `to work with by presenting them with the numbered list above.`,
+    );
+  }
+
+  const workspace = workspaceId ? workspaces.find((w) => w.id === workspaceId) : workspaces[0];
+  if (!workspace) {
+    const workspaceList = workspaces.map((w) => `- ${w.name} (ID: ${w.id})`).join('\n');
+    throw new Error(
+      `Workspace with ID "${workspaceId}" not found.\n\n` +
+        `Available workspaces:\n${workspaceList}`,
+    );
+  }
+
+  return {
+    yaak: ctx.yaak.workspace.withContext(workspace),
+  };
+}

plugins-external/mcp-server/src/tools/httpRequest.ts

@@ -0,0 +1,219 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import * as z from 'zod/v4';
+import type { McpServerContext } from '../types.js';
+import { getWorkspaceContext } from './helpers.js';
+
+export function registerHttpRequestTools(server: McpServer, ctx: McpServerContext) {
+  server.registerTool(
+    'list_http_requests',
+    {
+      title: 'List HTTP Requests',
+      description: 'List all HTTP requests in a workspace',
+      inputSchema: z.object({
+        workspaceId: z
+          .string()
+          .optional()
+          .describe('Workspace ID (required if multiple workspaces are open)'),
+      }),
+    },
+    async ({ workspaceId }) => {
+      const workspaceCtx = await getWorkspaceContext(ctx, workspaceId);
+      const requests = await workspaceCtx.yaak.httpRequest.list();
+
+      return {
+        content: [
+          {
+            type: 'text' as const,
+            text: JSON.stringify(requests, null, 2),
+          },
+        ],
+      };
+    },
+  );
+
+  server.registerTool(
+    'get_http_request',
+    {
+      title: 'Get HTTP Request',
+      description: 'Get details of a specific HTTP request by ID',
+      inputSchema: z.object({
+        id: z.string().describe('The HTTP request ID'),
+        workspaceId: z
+          .string()
+          .optional()
+          .describe('Workspace ID (required if multiple workspaces are open)'),
+      }),
+    },
+    async ({ id, workspaceId }) => {
+      const workspaceCtx = await getWorkspaceContext(ctx, workspaceId);
+      const request = await workspaceCtx.yaak.httpRequest.getById({ id });
+
+      return {
+        content: [
+          {
+            type: 'text' as const,
+            text: JSON.stringify(request, null, 2),
+          },
+        ],
+      };
+    },
+  );
+
+  server.registerTool(
+    'send_http_request',
+    {
+      title: 'Send HTTP Request',
+      description: 'Send an HTTP request and get the response',
+      inputSchema: z.object({
+        id: z.string().describe('The HTTP request ID to send'),
+        environmentId: z.string().optional().describe('Optional environment ID to use'),
+        workspaceId: z
+          .string()
+          .optional()
+          .describe('Workspace ID (required if multiple workspaces are open)'),
+      }),
+    },
+    async ({ id, workspaceId }) => {
+      const workspaceCtx = await getWorkspaceContext(ctx, workspaceId);
+      const httpRequest = await workspaceCtx.yaak.httpRequest.getById({ id });
+      if (httpRequest == null) {
+        throw new Error(`HTTP request with ID ${id} not found`);
+      }
+
+      const response = await workspaceCtx.yaak.httpRequest.send({ httpRequest });
+
+      return {
+        content: [
+          {
+            type: 'text' as const,
+            text: JSON.stringify(response, null, 2),
+          },
+        ],
+      };
+    },
+  );
+
+  server.registerTool(
+    'create_http_request',
+    {
+      title: 'Create HTTP Request',
+      description: 'Create a new HTTP request',
+      inputSchema: z.object({
+        workspaceId: z
+          .string()
+          .optional()
+          .describe('Workspace ID (required if multiple workspaces are open)'),
+        name: z
+          .string()
+          .optional()
+          .describe('Request name (empty string to auto-generate from URL)'),
+        url: z.string().describe('Request URL'),
+        method: z.string().optional().describe('HTTP method (defaults to GET)'),
+        folderId: z.string().optional().describe('Parent folder ID'),
+        description: z.string().optional().describe('Request description'),
+        headers: z
+          .array(
+            z.object({
+              name: z.string(),
+              value: z.string(),
+              enabled: z.boolean().default(true),
+            }),
+          )
+          .optional()
+          .describe('Request headers'),
+        urlParameters: z
+          .array(
+            z.object({
+              name: z.string(),
+              value: z.string(),
+              enabled: z.boolean().default(true),
+            }),
+          )
+          .optional()
+          .describe('URL query parameters'),
+      }),
+    },
+    async ({ workspaceId: ogWorkspaceId, ...args }) => {
+      const workspaceCtx = await getWorkspaceContext(ctx, ogWorkspaceId);
+      const workspaceId = await workspaceCtx.yaak.window.workspaceId();
+      if (!workspaceId) {
+        throw new Error('No workspace is open');
+      }
+
+      const httpRequest = await workspaceCtx.yaak.httpRequest.create({
+        workspaceId: workspaceId,
+        ...args,
+      });
+
+      return {
+        content: [{ type: 'text' as const, text: JSON.stringify(httpRequest, null, 2) }],
+      };
+    },
+  );
+
+  server.registerTool(
+    'update_http_request',
+    {
+      title: 'Update HTTP Request',
+      description: 'Update an existing HTTP request',
+      inputSchema: z.object({
+        id: z.string().describe('HTTP request ID to update'),
+        workspaceId: z
+          .string()
+          .optional()
+          .describe('Workspace ID (required if multiple workspaces are open)'),
+        name: z.string().optional().describe('Request name'),
+        url: z.string().optional().describe('Request URL'),
+        method: z.string().optional().describe('HTTP method'),
+        folderId: z.string().optional().describe('Parent folder ID'),
+        description: z.string().optional().describe('Request description'),
+        headers: z
+          .array(
+            z.object({
+              name: z.string(),
+              value: z.string(),
+              enabled: z.boolean().default(true),
+            }),
+          )
+          .optional()
+          .describe('Request headers'),
+        urlParameters: z
+          .array(
+            z.object({
+              name: z.string(),
+              value: z.string(),
+              enabled: z.boolean().default(true),
+            }),
+          )
+          .optional()
+          .describe('URL query parameters'),
+      }),
+    },
+    async ({ id, workspaceId, ...updates }) => {
+      const workspaceCtx = await getWorkspaceContext(ctx, workspaceId);
+      const httpRequest = await workspaceCtx.yaak.httpRequest.update({ id, ...updates });
+      return {
+        content: [{ type: 'text' as const, text: JSON.stringify(httpRequest, null, 2) }],
+      };
+    },
+  );
+
+  server.registerTool(
+    'delete_http_request',
+    {
+      title: 'Delete HTTP Request',
+      description: 'Delete an HTTP request by ID',
+      inputSchema: z.object({
+        id: z.string().describe('HTTP request ID to delete'),
+      }),
+    },
+    async ({ id }) => {
+      const httpRequest = await ctx.yaak.httpRequest.delete({ id });
+      return {
+        content: [
+          { type: 'text' as const, text: `Deleted: ${httpRequest.name} (${httpRequest.id})` },
+        ],
+      };
+    },
+  );
+}

plugins-external/mcp-server/src/tools/toast.ts

@@ -0,0 +1,59 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { Color, Icon } from '@yaakapp/api';
+import * as z from 'zod/v4';
+import type { McpServerContext } from '../types.js';
+
+const ICON_VALUES = [
+  'alert_triangle',
+  'check',
+  'check_circle',
+  'chevron_down',
+  'copy',
+  'info',
+  'pin',
+  'search',
+  'trash',
+] as const satisfies readonly Icon[];
+
+const COLOR_VALUES = [
+  'primary',
+  'secondary',
+  'info',
+  'success',
+  'notice',
+  'warning',
+  'danger',
+] as const satisfies readonly Color[];
+
+export function registerToastTools(server: McpServer, ctx: McpServerContext) {
+  server.registerTool(
+    'show_toast',
+    {
+      title: 'Show Toast',
+      description: 'Show a toast notification in Yaak',
+      inputSchema: z.object({
+        message: z.string().describe('The message to display'),
+        icon: z.enum(ICON_VALUES).optional().describe('Icon name'),
+        color: z.enum(COLOR_VALUES).optional().describe('Toast color'),
+        timeout: z.number().optional().describe('Timeout in milliseconds'),
+      }),
+    },
+    async ({ message, icon, color, timeout }) => {
+      await ctx.yaak.toast.show({
+        message,
+        icon,
+        color,
+        timeout,
+      });
+
+      return {
+        content: [
+          {
+            type: 'text' as const,
+            text: `✓ Toast shown: "${message}"`,
+          },
+        ],
+      };
+    },
+  );
+}

plugins-external/mcp-server/src/tools/window.ts

@@ -0,0 +1,50 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import * as z from 'zod/v4';
+import type { McpServerContext } from '../types.js';
+import { getWorkspaceContext } from './helpers.js';
+
+export function registerWindowTools(server: McpServer, ctx: McpServerContext) {
+  server.registerTool(
+    'get_workspace_id',
+    {
+      title: 'Get Workspace ID',
+      description: 'Get the current workspace ID',
+      inputSchema: z.object({}),
+    },
+    async () => {
+      const workspaceCtx = await getWorkspaceContext(ctx);
+      const workspaceId = await workspaceCtx.yaak.window.workspaceId();
+
+      return {
+        content: [
+          {
+            type: 'text' as const,
+            text: workspaceId || 'No workspace open',
+          },
+        ],
+      };
+    },
+  );
+
+  server.registerTool(
+    'get_environment_id',
+    {
+      title: 'Get Environment ID',
+      description: 'Get the current environment ID',
+      inputSchema: z.object({}),
+    },
+    async () => {
+      const workspaceCtx = await getWorkspaceContext(ctx);
+      const environmentId = await workspaceCtx.yaak.window.environmentId();
+
+      return {
+        content: [
+          {
+            type: 'text' as const,
+            text: environmentId || 'No environment selected',
+          },
+        ],
+      };
+    },
+  );
+}

plugins-external/mcp-server/src/tools/workspace.ts

@@ -0,0 +1,26 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import * as z from 'zod/v4';
+import type { McpServerContext } from '../types.js';
+
+export function registerWorkspaceTools(server: McpServer, ctx: McpServerContext) {
+  server.registerTool(
+    'list_workspaces',
+    {
+      title: 'List Workspaces',
+      description: 'List all open workspaces in Yaak',
+      inputSchema: z.object({}),
+    },
+    async () => {
+      const workspaces = await ctx.yaak.workspace.list();
+
+      return {
+        content: [
+          {
+            type: 'text' as const,
+            text: JSON.stringify(workspaces, null, 2),
+          },
+        ],
+      };
+    },
+  );
+}

plugins-external/mcp-server/src/types.ts

@@ -0,0 +1,5 @@
+import type { Context } from '@yaakapp/api';
+
+export interface McpServerContext {
+  yaak: Context;
+}

plugins-external/mcp-server/tsconfig.json

@@ -0,0 +1,3 @@
+{
+  "extends": "../../tsconfig.json"
+}

plugins/action-copy-curl/package.json

@@ -12,7 +12,6 @@
   "scripts": {
     "build": "yaakcli build",
     "dev": "yaakcli dev",
-    "lint": "tsc --noEmit && eslint . --ext .ts,.tsx",
     "test": "vitest --run tests"
   }
 }

plugins/action-copy-curl/src/index.ts

@@ -36,13 +36,33 @@ export async function convertToCurl(request: Partial<HttpRequest>) {
   if (urlParams.length > 0) {
     // Build url
     const [base, hash] = finalUrl.split('#');
-    const separator = base!.includes('?') ? '&' : '?';
+    const separator = base?.includes('?') ? '&' : '?';
     const queryString = urlParams
       .map((p) => `${encodeURIComponent(p.name)}=${encodeURIComponent(p.value)}`)
       .join('&');
     finalUrl = base + separator + queryString + (hash ? `#${hash}` : '');
   }
 
+  // Add API key authentication
+  if (request.authenticationType === 'apikey') {
+    if (request.authentication?.location === 'query') {
+      const sep = finalUrl.includes('?') ? '&' : '?';
+      finalUrl = [
+        finalUrl,
+        sep,
+        encodeURIComponent(request.authentication?.key ?? 'token'),
+        '=',
+        encodeURIComponent(request.authentication?.value ?? ''),
+      ].join('');
+    } else {
+      request.headers = request.headers ?? [];
+      request.headers.push({
+        name: request.authentication?.key ?? 'X-Api-Key',
+        value: request.authentication?.value ?? '',
+      });
+    }
+  }
+
   xs.push(quote(finalUrl));
   xs.push(NEWLINE);
 
@@ -82,21 +102,49 @@ export async function convertToCurl(request: Partial<HttpRequest>) {
   }
 
   // Add basic/digest authentication
-  if (request.authenticationType === 'basic' || request.authenticationType === 'digest') {
-    if (request.authenticationType === 'digest') xs.push('--digest');
-    xs.push(
-      '--user',
-      quote(`${request.authentication?.username ?? ''}:${request.authentication?.password ?? ''}`),
-    );
-    xs.push(NEWLINE);
-  }
+  if (request.authentication?.disabled !== true) {
+    if (request.authenticationType === 'basic' || request.authenticationType === 'digest') {
+      if (request.authenticationType === 'digest') xs.push('--digest');
+      xs.push(
+        '--user',
+        quote(
+          `${request.authentication?.username ?? ''}:${request.authentication?.password ?? ''}`,
+        ),
+      );
+      xs.push(NEWLINE);
+    }
 
-  // Add bearer authentication
-  if (request.authenticationType === 'bearer') {
-    const value =
-      `${request.authentication?.prefix ?? 'Bearer'} ${request.authentication?.token ?? ''}`.trim();
-    xs.push('--header', quote(`Authorization: ${value}`));
-    xs.push(NEWLINE);
+    // Add bearer authentication
+    if (request.authenticationType === 'bearer') {
+      const value =
+        `${request.authentication?.prefix ?? 'Bearer'} ${request.authentication?.token ?? ''}`.trim();
+      xs.push('--header', quote(`Authorization: ${value}`));
+      xs.push(NEWLINE);
+    }
+
+    if (request.authenticationType === 'auth-aws-sig-v4') {
+      xs.push(
+        '--aws-sigv4',
+        [
+          'aws',
+          'amz',
+          request.authentication?.region ?? '',
+          request.authentication?.service ?? '',
+        ].join(':'),
+      );
+      xs.push(NEWLINE);
+      xs.push(
+        '--user',
+        quote(
+          `${request.authentication?.accessKeyId ?? ''}:${request.authentication?.secretAccessKey ?? ''}`,
+        ),
+      );
+      if (request.authentication?.sessionToken) {
+        xs.push(NEWLINE);
+        xs.push('--header', quote(`X-Amz-Security-Token: ${request.authentication.sessionToken}`));
+      }
+      xs.push(NEWLINE);
+    }
   }
 
   // Remove trailing newline

plugins/action-copy-curl/tests/index.test.ts

@@ -12,7 +12,7 @@ describe('exporter-curl', () => {
           { name: 'c', value: 'ccc', enabled: false },
         ],
       }),
-    ).toEqual([`curl 'https://yaak.app?a=aaa&b=bbb'`].join(` \\n  `));
+    ).toEqual([`curl 'https://yaak.app?a=aaa&b=bbb'`].join(' \\n  '));
   });
 
   test('Exports GET with params and hash', async () => {
@@ -25,8 +25,9 @@ describe('exporter-curl', () => {
           { name: 'c', value: 'ccc', enabled: false },
         ],
       }),
-    ).toEqual([`curl 'https://yaak.app/path?a=aaa&b=bbb#section'`].join(` \\n  `));
+    ).toEqual([`curl 'https://yaak.app/path?a=aaa&b=bbb#section'`].join(' \\n  '));
   });
+
   test('Exports POST with url form data', async () => {
     expect(
       await convertToCurl({
@@ -42,7 +43,7 @@ describe('exporter-curl', () => {
         },
       }),
     ).toEqual(
-      [`curl -X POST 'https://yaak.app'`, `--data 'a=aaa'`, `--data 'b=bbb'`].join(` \\\n  `),
+      [`curl -X POST 'https://yaak.app'`, `--data 'a=aaa'`, `--data 'b=bbb'`].join(' \\\n  '),
     );
   });
 
@@ -61,7 +62,7 @@ describe('exporter-curl', () => {
       [
         `curl -X POST 'https://yaak.app'`,
         `--data '{"query":"{foo,bar}","variables":{"a":"aaa","b":"bbb"}}'`,
-      ].join(` \\\n  `),
+      ].join(' \\\n  '),
     );
   });
 
@@ -76,7 +77,7 @@ describe('exporter-curl', () => {
         },
       }),
     ).toEqual(
-      [`curl -X POST 'https://yaak.app'`, `--data '{"query":"{foo,bar}"}'`].join(` \\\n  `),
+      [`curl -X POST 'https://yaak.app'`, `--data '{"query":"{foo,bar}"}'`].join(' \\\n  '),
     );
   });
 
@@ -100,8 +101,8 @@ describe('exporter-curl', () => {
         `curl -X PUT 'https://yaak.app'`,
         `--form 'a=aaa'`,
         `--form 'b=bbb'`,
-        `--form f=@/foo/bar.png;type=image/png`,
-      ].join(` \\\n  `),
+        '--form f=@/foo/bar.png;type=image/png',
+      ].join(' \\\n  '),
     );
   });
 
@@ -121,7 +122,7 @@ describe('exporter-curl', () => {
         `curl -X POST 'https://yaak.app'`,
         `--header 'Content-Type: application/json'`,
         `--data '{"foo":"bar\\'s"}'`,
-      ].join(` \\\n  `),
+      ].join(' \\\n  '),
     );
   });
 
@@ -141,7 +142,7 @@ describe('exporter-curl', () => {
         `curl -X POST 'https://yaak.app'`,
         `--header 'Content-Type: application/json'`,
         `--data '{"foo":"bar",\n"baz":"qux"}'`,
-      ].join(` \\\n  `),
+      ].join(' \\\n  '),
     );
   });
 
@@ -154,7 +155,7 @@ describe('exporter-curl', () => {
           { name: 'c', value: 'ccc', enabled: false },
         ],
       }),
-    ).toEqual([`curl ''`, `--header 'a: aaa'`, `--header 'b: bbb'`].join(` \\\n  `));
+    ).toEqual([`curl ''`, `--header 'a: aaa'`, `--header 'b: bbb'`].join(' \\\n  '));
   });
 
   test('Basic auth', async () => {
@@ -167,7 +168,21 @@ describe('exporter-curl', () => {
           password: 'pass',
         },
       }),
-    ).toEqual([`curl 'https://yaak.app'`, `--user 'user:pass'`].join(` \\\n  `));
+    ).toEqual([`curl 'https://yaak.app'`, `--user 'user:pass'`].join(' \\\n  '));
+  });
+
+  test('Basic auth disabled', async () => {
+    expect(
+      await convertToCurl({
+        url: 'https://yaak.app',
+        authenticationType: 'basic',
+        authentication: {
+          disabled: true,
+          username: 'user',
+          password: 'pass',
+        },
+      }),
+    ).toEqual([`curl 'https://yaak.app'`].join(' \\\n  '));
   });
 
   test('Broken basic auth', async () => {
@@ -177,7 +192,7 @@ describe('exporter-curl', () => {
         authenticationType: 'basic',
         authentication: {},
       }),
-    ).toEqual([`curl 'https://yaak.app'`, `--user ':'`].join(` \\\n  `));
+    ).toEqual([`curl 'https://yaak.app'`, `--user ':'`].join(' \\\n  '));
   });
 
   test('Digest auth', async () => {
@@ -190,7 +205,7 @@ describe('exporter-curl', () => {
           password: 'pass',
         },
       }),
-    ).toEqual([`curl 'https://yaak.app'`, `--digest --user 'user:pass'`].join(` \\\n  `));
+    ).toEqual([`curl 'https://yaak.app'`, `--digest --user 'user:pass'`].join(' \\\n  '));
   });
 
   test('Bearer auth', async () => {
@@ -202,7 +217,7 @@ describe('exporter-curl', () => {
           token: 'tok',
         },
       }),
-    ).toEqual([`curl 'https://yaak.app'`, `--header 'Authorization: Bearer tok'`].join(` \\\n  `));
+    ).toEqual([`curl 'https://yaak.app'`, `--header 'Authorization: Bearer tok'`].join(' \\\n  '));
   });
 
   test('Bearer auth with custom prefix', async () => {
@@ -216,7 +231,7 @@ describe('exporter-curl', () => {
         },
       }),
     ).toEqual(
-      [`curl 'https://yaak.app'`, `--header 'Authorization: Token abc123'`].join(` \\\n  `),
+      [`curl 'https://yaak.app'`, `--header 'Authorization: Token abc123'`].join(' \\\n  '),
     );
   });
 
@@ -230,7 +245,7 @@ describe('exporter-curl', () => {
           prefix: '',
         },
       }),
-    ).toEqual([`curl 'https://yaak.app'`, `--header 'Authorization: xyz789'`].join(` \\\n  `));
+    ).toEqual([`curl 'https://yaak.app'`, `--header 'Authorization: xyz789'`].join(' \\\n  '));
   });
 
   test('Broken bearer auth', async () => {
@@ -243,7 +258,146 @@ describe('exporter-curl', () => {
           password: 'pass',
         },
       }),
-    ).toEqual([`curl 'https://yaak.app'`, `--header 'Authorization: Bearer'`].join(` \\\n  `));
+    ).toEqual([`curl 'https://yaak.app'`, `--header 'Authorization: Bearer'`].join(' \\\n  '));
+  });
+
+  test('AWS v4 auth', async () => {
+    expect(
+      await convertToCurl({
+        url: 'https://yaak.app',
+        authenticationType: 'auth-aws-sig-v4',
+        authentication: {
+          accessKeyId: 'ak',
+          secretAccessKey: 'sk',
+          sessionToken: '',
+          region: 'us-east-1',
+          service: 's3',
+        },
+      }),
+    ).toEqual(
+      [`curl 'https://yaak.app'`, '--aws-sigv4 aws:amz:us-east-1:s3', `--user 'ak:sk'`].join(
+        ' \\\n  ',
+      ),
+    );
+  });
+
+  test('AWS v4 auth with session', async () => {
+    expect(
+      await convertToCurl({
+        url: 'https://yaak.app',
+        authenticationType: 'auth-aws-sig-v4',
+        authentication: {
+          accessKeyId: 'ak',
+          secretAccessKey: 'sk',
+          sessionToken: 'st',
+          region: 'us-east-1',
+          service: 's3',
+        },
+      }),
+    ).toEqual(
+      [
+        `curl 'https://yaak.app'`,
+        '--aws-sigv4 aws:amz:us-east-1:s3',
+        `--user 'ak:sk'`,
+        `--header 'X-Amz-Security-Token: st'`,
+      ].join(' \\\n  '),
+    );
+  });
+
+  test('API key auth header', async () => {
+    expect(
+      await convertToCurl({
+        url: 'https://yaak.app',
+        authenticationType: 'apikey',
+        authentication: {
+          location: 'header',
+          key: 'X-Header',
+          value: 'my-token',
+        },
+      }),
+    ).toEqual([`curl 'https://yaak.app'`, `--header 'X-Header: my-token'`].join(' \\\n  '));
+  });
+
+  test('API key auth header query', async () => {
+    expect(
+      await convertToCurl({
+        url: 'https://yaak.app?hi=there',
+        urlParameters: [{ name: 'param', value: 'hi' }],
+        authenticationType: 'apikey',
+        authentication: {
+          location: 'query',
+          key: 'foo',
+          value: 'bar',
+        },
+      }),
+    ).toEqual([`curl 'https://yaak.app?hi=there&param=hi&foo=bar'`].join(' \\\n  '));
+  });
+
+  test('API key auth header query with params', async () => {
+    expect(
+      await convertToCurl({
+        url: 'https://yaak.app',
+        urlParameters: [{ name: 'param', value: 'hi' }],
+        authenticationType: 'apikey',
+        authentication: {
+          location: 'query',
+          key: 'foo',
+          value: 'bar',
+        },
+      }),
+    ).toEqual([`curl 'https://yaak.app?param=hi&foo=bar'`].join(' \\\n  '));
+  });
+
+  test('API key auth header default', async () => {
+    expect(
+      await convertToCurl({
+        url: 'https://yaak.app',
+        authenticationType: 'apikey',
+        authentication: {
+          location: 'header',
+        },
+      }),
+    ).toEqual([`curl 'https://yaak.app'`, `--header 'X-Api-Key: '`].join(' \\\n  '));
+  });
+
+  test('API key auth query', async () => {
+    expect(
+      await convertToCurl({
+        url: 'https://yaak.app',
+        authenticationType: 'apikey',
+        authentication: {
+          location: 'query',
+          key: 'foo',
+          value: 'bar-baz',
+        },
+      }),
+    ).toEqual([`curl 'https://yaak.app?foo=bar-baz'`].join(' \\\n  '));
+  });
+
+  test('API key auth query with existing', async () => {
+    expect(
+      await convertToCurl({
+        url: 'https://yaak.app?foo=bar&baz=qux',
+        authenticationType: 'apikey',
+        authentication: {
+          location: 'query',
+          key: 'hi',
+          value: 'there',
+        },
+      }),
+    ).toEqual([`curl 'https://yaak.app?foo=bar&baz=qux&hi=there'`].join(' \\\n  '));
+  });
+
+  test('API key auth query default', async () => {
+    expect(
+      await convertToCurl({
+        url: 'https://yaak.app?foo=bar&baz=qux',
+        authenticationType: 'apikey',
+        authentication: {
+          location: 'query',
+        },
+      }),
+    ).toEqual([`curl 'https://yaak.app?foo=bar&baz=qux&token='`].join(' \\\n  '));
   });
 
   test('Stale body data', async () => {
@@ -255,6 +409,6 @@ describe('exporter-curl', () => {
           text: 'ignore me',
         },
       }),
-    ).toEqual([`curl 'https://yaak.app'`].join(` \\\n  `));
+    ).toEqual([`curl 'https://yaak.app'`].join(' \\\n  '));
   });
 });

plugins/action-copy-grpcurl/package.json

@@ -12,7 +12,6 @@
   "scripts": {
     "build": "yaakcli build",
     "dev": "yaakcli dev",
-    "lint":"tsc --noEmit && eslint . --ext .ts,.tsx",
     "test": "vitest --run tests"
   }
 }

plugins/action-copy-grpcurl/src/index.ts

@@ -1,5 +1,5 @@
-import type { GrpcRequest, PluginDefinition } from '@yaakapp/api';
 import path from 'node:path';
+import type { GrpcRequest, PluginDefinition } from '@yaakapp/api';
 
 const NEWLINE = '\\\n ';
 
@@ -68,16 +68,37 @@ export async function convert(request: Partial<GrpcRequest>, allProtoFiles: stri
   }
 
   // Add basic authentication
-  if (request.authenticationType === 'basic') {
-    const user = request.authentication?.username ?? '';
-    const pass = request.authentication?.password ?? '';
-    const encoded = btoa(`${user}:${pass}`);
-    xs.push('-H', quote(`Authorization: Basic ${encoded}`));
-    xs.push(NEWLINE);
-  } else if (request.authenticationType === 'bearer') {
-    // Add bearer authentication
-    xs.push('-H', quote(`Authorization: Bearer ${request.authentication?.token ?? ''}`));
-    xs.push(NEWLINE);
+  if (request.authentication?.disabled !== true) {
+    if (request.authenticationType === 'basic') {
+      const user = request.authentication?.username ?? '';
+      const pass = request.authentication?.password ?? '';
+      const encoded = btoa(`${user}:${pass}`);
+      xs.push('-H', quote(`Authorization: Basic ${encoded}`));
+      xs.push(NEWLINE);
+    } else if (request.authenticationType === 'bearer') {
+      // Add bearer authentication
+      xs.push('-H', quote(`Authorization: Bearer ${request.authentication?.token ?? ''}`));
+      xs.push(NEWLINE);
+    } else if (request.authenticationType === 'apikey') {
+      if (request.authentication?.location === 'query') {
+        const sep = request.url?.includes('?') ? '&' : '?';
+        request.url = [
+          request.url,
+          sep,
+          encodeURIComponent(request.authentication?.key ?? 'token'),
+          '=',
+          encodeURIComponent(request.authentication?.value ?? ''),
+        ].join('');
+      } else {
+        xs.push(
+          '-H',
+          quote(
+            `${request.authentication?.key ?? 'X-Api-Key'}: ${request.authentication?.value ?? ''}`,
+          ),
+        );
+      }
+      xs.push(NEWLINE);
+    }
   }
 
   // Add form params

plugins/action-copy-grpcurl/tests/index.test.ts

@@ -10,7 +10,7 @@ describe('exporter-curl', () => {
         },
         [],
       ),
-    ).toEqual([`grpcurl yaak.app`].join(` \\\n  `));
+    ).toEqual(['grpcurl yaak.app'].join(' \\\n  '));
   });
   test('Basic metadata', async () => {
     expect(
@@ -25,16 +25,65 @@ describe('exporter-curl', () => {
         },
         [],
       ),
-    ).toEqual([`grpcurl -H 'aaa: AAA'`, `-H 'bbb: BBB'`, `yaak.app`].join(` \\\n  `));
+    ).toEqual([`grpcurl -H 'aaa: AAA'`, `-H 'bbb: BBB'`, 'yaak.app'].join(' \\\n  '));
   });
+  test('Basic auth', async () => {
+    expect(
+      await convert(
+        {
+          url: 'https://yaak.app',
+          authenticationType: 'basic',
+          authentication: {
+            username: 'user',
+            password: 'pass',
+          },
+        },
+        [],
+      ),
+    ).toEqual([`grpcurl -H 'Authorization: Basic dXNlcjpwYXNz'`, 'yaak.app'].join(' \\\n  '));
+  });
+
+  test('API key auth', async () => {
+    expect(
+      await convert(
+        {
+          url: 'https://yaak.app',
+          authenticationType: 'apikey',
+          authentication: {
+            key: 'X-Token',
+            value: 'tok',
+          },
+        },
+        [],
+      ),
+    ).toEqual([`grpcurl -H 'X-Token: tok'`, 'yaak.app'].join(' \\\n  '));
+  });
+
+  test('API key auth', async () => {
+    expect(
+      await convert(
+        {
+          url: 'https://yaak.app',
+          authenticationType: 'apikey',
+          authentication: {
+            location: 'query',
+            key: 'token',
+            value: 'tok 1',
+          },
+        },
+        [],
+      ),
+    ).toEqual(['grpcurl', 'yaak.app?token=tok%201'].join(' \\\n  '));
+  });
+
   test('Single proto file', async () => {
     expect(await convert({ url: 'https://yaak.app' }, ['/foo/bar/baz.proto'])).toEqual(
       [
         `grpcurl -import-path '/foo/bar'`,
         `-import-path '/foo'`,
         `-proto '/foo/bar/baz.proto'`,
-        `yaak.app`,
-      ].join(` \\\n  `),
+        'yaak.app',
+      ].join(' \\\n  '),
     );
   });
   test('Multiple proto files, same dir', async () => {
@@ -46,8 +95,8 @@ describe('exporter-curl', () => {
         `-import-path '/foo'`,
         `-proto '/foo/bar/aaa.proto'`,
         `-proto '/foo/bar/bbb.proto'`,
-        `yaak.app`,
-      ].join(` \\\n  `),
+        'yaak.app',
+      ].join(' \\\n  '),
     );
   });
   test('Multiple proto files, different dir', async () => {
@@ -61,18 +110,18 @@ describe('exporter-curl', () => {
         `-import-path '/xxx'`,
         `-proto '/aaa/bbb/ccc.proto'`,
         `-proto '/xxx/yyy/zzz.proto'`,
-        `yaak.app`,
-      ].join(` \\\n  `),
+        'yaak.app',
+      ].join(' \\\n  '),
     );
   });
   test('Single include dir', async () => {
     expect(await convert({ url: 'https://yaak.app' }, ['/aaa/bbb'])).toEqual(
-      [`grpcurl -import-path '/aaa/bbb'`, `yaak.app`].join(` \\\n  `),
+      [`grpcurl -import-path '/aaa/bbb'`, 'yaak.app'].join(' \\\n  '),
     );
   });
   test('Multiple include dir', async () => {
     expect(await convert({ url: 'https://yaak.app' }, ['/aaa/bbb', '/xxx/yyy'])).toEqual(
-      [`grpcurl -import-path '/aaa/bbb'`, `-import-path '/xxx/yyy'`, `yaak.app`].join(` \\\n  `),
+      [`grpcurl -import-path '/aaa/bbb'`, `-import-path '/xxx/yyy'`, 'yaak.app'].join(' \\\n  '),
     );
   });
   test('Mixed proto and dirs', async () => {
@@ -85,8 +134,8 @@ describe('exporter-curl', () => {
         `-import-path '/foo'`,
         `-import-path '/'`,
         `-proto '/foo/bar.proto'`,
-        `yaak.app`,
-      ].join(` \\\n  `),
+        'yaak.app',
+      ].join(' \\\n  '),
     );
   });
   test('Sends data', async () => {
@@ -103,8 +152,8 @@ describe('exporter-curl', () => {
         `grpcurl -import-path '/'`,
         `-proto '/foo.proto'`,
         `-d '{"foo":"bar","baz":1}'`,
-        `yaak.app`,
-      ].join(` \\\n  `),
+        'yaak.app',
+      ].join(' \\\n  '),
     );
   });
 });

plugins/auth-apikey/package.json

@@ -11,7 +11,6 @@
   "version": "0.1.0",
   "scripts": {
     "build": "yaakcli build",
-    "dev": "yaakcli dev",
-    "lint":"tsc --noEmit && eslint . --ext .ts,.tsx"
+    "dev": "yaakcli dev"
   }
 }

plugins/auth-apikey/src/index.ts

@@ -21,13 +21,15 @@ export const plugin: PluginDefinition = {
         name: 'key',
         label: 'Key',
         dynamic: (_ctx, { values }) => {
-          return values.location === 'query' ? {
-            label: 'Parameter Name',
-            description: 'The name of the query parameter to add to the request',
-          } : {
-            label: 'Header Name',
-            description: 'The name of the header to add to the request',
-          };
+          return values.location === 'query'
+            ? {
+                label: 'Parameter Name',
+                description: 'The name of the query parameter to add to the request',
+              }
+            : {
+                label: 'Header Name',
+                description: 'The name of the header to add to the request',
+              };
         },
       },
       {
@@ -45,9 +47,8 @@ export const plugin: PluginDefinition = {
 
       if (location === 'query') {
         return { setQueryParameters: [{ name: key, value }] };
-      } else {
-        return { setHeaders: [{ name: key, value }] };
       }
+      return { setHeaders: [{ name: key, value }] };
     },
   },
 };

plugins/auth-aws/package.json

@@ -11,8 +11,7 @@
   "version": "0.1.0",
   "scripts": {
     "build": "yaakcli build",
-    "dev": "yaakcli dev",
-    "lint": "tsc --noEmit && eslint . --ext .ts,.tsx"
+    "dev": "yaakcli dev"
   },
   "dependencies": {
     "aws4": "^1.13.2"

plugins/auth-aws/src/index.ts

@@ -1,12 +1,12 @@
-import type { CallHttpAuthenticationResponse } from '@yaakapp-internal/plugins';
-import type { PluginDefinition } from '@yaakapp/api';
-import aws4 from 'aws4';
-import type { Request } from 'aws4';
 import { URL } from 'node:url';
+import type { PluginDefinition } from '@yaakapp/api';
+import type { CallHttpAuthenticationResponse } from '@yaakapp-internal/plugins';
+import type { Request } from 'aws4';
+import aws4 from 'aws4';
 
 export const plugin: PluginDefinition = {
   authentication: {
-    name: 'auth-aws-sig-v4',
+    name: 'awsv4',
     label: 'AWS Signature',
     shortLabel: 'AWS v4',
     args: [
@@ -57,17 +57,15 @@ export const plugin: PluginDefinition = {
         }
       }
 
-      // TODO: Support body signing here
-      headers['x-amz-content-sha256'] = 'UNSIGNED-PAYLOAD';
-
       const signature = aws4.sign(
         {
           host: url.host,
           method: args.method,
-          path: url.pathname + (url.search || '') || undefined,
-          service: String(values.service || 'sts') || undefined,
-          region: String(values.region || 'us-east-1') || undefined,
+          path: url.pathname + (url.search || ''),
+          service: String(values.service || 'sts'),
+          region: values.region ? String(values.region) : undefined,
           headers,
+          doNotEncodePath: true,
         },
         {
           accessKeyId,
@@ -76,13 +74,6 @@ export const plugin: PluginDefinition = {
         },
       );
 
-      // After signing, aws4 will set:
-      //  - opts.headers["Authorization"]
-      //  - opts.headers["X-Amz-Date"]
-      //  - optionally content sha256 header etc
-
-      console.log('ADDING STUFF', signature);
-
       if (signature.headers == null) {
         return {};
       }

plugins/auth-basic/package.json

@@ -11,7 +11,6 @@
   "version": "0.1.0",
   "scripts": {
     "build": "yaakcli build",
-    "dev": "yaakcli dev",
-    "lint":"tsc --noEmit && eslint . --ext .ts,.tsx"
+    "dev": "yaakcli dev"
   }
 }

plugins/auth-basic/src/index.ts

@@ -5,21 +5,24 @@ export const plugin: PluginDefinition = {
     name: 'basic',
     label: 'Basic Auth',
     shortLabel: 'Basic',
-    args: [{
-      type: 'text',
-      name: 'username',
-      label: 'Username',
-      optional: true,
-    }, {
-      type: 'text',
-      name: 'password',
-      label: 'Password',
-      optional: true,
-      password: true,
-    }],
+    args: [
+      {
+        type: 'text',
+        name: 'username',
+        label: 'Username',
+        optional: true,
+      },
+      {
+        type: 'text',
+        name: 'password',
+        label: 'Password',
+        optional: true,
+        password: true,
+      },
+    ],
     async onApply(_ctx, { values }) {
       const { username, password } = values;
-      const value = 'Basic ' + Buffer.from(`${username}:${password}`).toString('base64');
+      const value = `Basic ${Buffer.from(`${username}:${password}`).toString('base64')}`;
       return { setHeaders: [{ name: 'Authorization', value }] };
     },
   },

plugins/auth-bearer/package.json

@@ -12,7 +12,6 @@
   "scripts": {
     "build": "yaakcli build",
     "dev": "yaakcli dev",
-    "lint":"tsc --noEmit && eslint . --ext .ts,.tsx",
     "test": "vitest --run tests"
   }
 }

plugins/auth-bearer/src/index.ts

@@ -1,5 +1,5 @@
-import type { CallHttpAuthenticationRequest } from '@yaakapp-internal/plugins';
 import type { PluginDefinition } from '@yaakapp/api';
+import type { CallHttpAuthenticationRequest } from '@yaakapp-internal/plugins';
 
 export const plugin: PluginDefinition = {
   authentication: {

plugins/auth-bearer/tests/index.test.ts

@@ -7,7 +7,7 @@ const ctx = {} as Context;
 describe('auth-bearer', () => {
   test('No values', async () => {
     expect(
-      await plugin.authentication!.onApply(ctx, {
+      await plugin.authentication?.onApply(ctx, {
         values: {},
         headers: [],
         url: 'https://yaak.app',
@@ -19,7 +19,7 @@ describe('auth-bearer', () => {
 
   test('Only token', async () => {
     expect(
-      await plugin.authentication!.onApply(ctx, {
+      await plugin.authentication?.onApply(ctx, {
         values: { token: 'my-token' },
         headers: [],
         url: 'https://yaak.app',
@@ -31,7 +31,7 @@ describe('auth-bearer', () => {
 
   test('Only prefix', async () => {
     expect(
-      await plugin.authentication!.onApply(ctx, {
+      await plugin.authentication?.onApply(ctx, {
         values: { prefix: 'Hello' },
         headers: [],
         url: 'https://yaak.app',
@@ -43,7 +43,7 @@ describe('auth-bearer', () => {
 
   test('Prefix and token', async () => {
     expect(
-      await plugin.authentication!.onApply(ctx, {
+      await plugin.authentication?.onApply(ctx, {
         values: { prefix: 'Hello', token: 'my-token' },
         headers: [],
         url: 'https://yaak.app',
@@ -55,7 +55,7 @@ describe('auth-bearer', () => {
 
   test('Extra spaces', async () => {
     expect(
-      await plugin.authentication!.onApply(ctx, {
+      await plugin.authentication?.onApply(ctx, {
         values: { prefix: '\t Hello  ', token: ' \nmy-token  ' },
         headers: [],
         url: 'https://yaak.app',

plugins/auth-jwt/package.json

@@ -11,8 +11,7 @@
   "version": "0.1.0",
   "scripts": {
     "build": "yaakcli build",
-    "dev": "yaakcli dev",
-    "lint":"tsc --noEmit && eslint . --ext .ts,.tsx"
+    "dev": "yaakcli dev"
   },
   "dependencies": {
     "jsonwebtoken": "^9.0.2"

plugins/auth-jwt/src/index.ts

@@ -46,6 +46,49 @@ export const plugin: PluginDefinition = {
         name: 'secretBase64',
         label: 'Secret is base64 encoded',
       },
+      {
+        type: 'select',
+        name: 'location',
+        label: 'Behavior',
+        defaultValue: 'header',
+        options: [
+          { label: 'Insert Header', value: 'header' },
+          { label: 'Append Query Parameter', value: 'query' },
+        ],
+      },
+      {
+        type: 'text',
+        name: 'name',
+        label: 'Header Name',
+        defaultValue: 'Authorization',
+        optional: true,
+        dynamic(_ctx, args) {
+          if (args.values.location === 'query') {
+            return {
+              label: 'Parameter Name',
+              description: 'The name of the query parameter to add to the request',
+            };
+          }
+          return {
+            label: 'Header Name',
+            description: 'The name of the header to add to the request',
+          };
+        },
+      },
+      {
+        type: 'text',
+        name: 'headerPrefix',
+        label: 'Header Prefix',
+        optional: true,
+        defaultValue: 'Bearer',
+        dynamic(_ctx, args) {
+          if (args.values.location === 'query') {
+            return {
+              hidden: true,
+            };
+          }
+        },
+      },
       {
         type: 'editor',
         name: 'payload',
@@ -61,8 +104,16 @@ export const plugin: PluginDefinition = {
       const token = jwt.sign(`${payload}`, secret, {
         algorithm: algorithm as (typeof algorithms)[number],
       });
-      const value = `Bearer ${token}`;
-      return { setHeaders: [{ name: 'Authorization', value }] };
+
+      if (values.location === 'query') {
+        const paramName = String(values.name || 'token');
+        const paramValue = String(values.value || '');
+        return { setQueryParameters: [{ name: paramName, value: paramValue }] };
+      }
+      const headerPrefix = values.headerPrefix != null ? values.headerPrefix : 'Bearer';
+      const headerName = String(values.name || 'Authorization');
+      const headerValue = `${headerPrefix} ${token}`.trim();
+      return { setHeaders: [{ name: headerName, value: headerValue }] };
     },
   },
 };

plugins/auth-ntlm/package.json

@@ -0,0 +1,19 @@
+{
+  "name": "@yaak/auth-ntlm",
+  "displayName": "NTLM Authentication",
+  "description": "Authenticate requests using NTLM authentication",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/mountain-loop/yaak.git",
+    "directory": "plugins/auth-ntlm"
+  },
+  "private": true,
+  "version": "0.1.0",
+  "scripts": {
+    "build": "yaakcli build",
+    "dev": "yaakcli dev"
+  },
+  "dependencies": {
+    "httpntlm": "^1.8.13"
+  }
+}

plugins/auth-ntlm/src/index.ts

@@ -0,0 +1,87 @@
+import type { PluginDefinition } from '@yaakapp/api';
+
+import { ntlm } from 'httpntlm';
+
+export const plugin: PluginDefinition = {
+  authentication: {
+    name: 'windows',
+    label: 'NTLM Auth',
+    shortLabel: 'NTLM',
+    args: [
+      {
+        type: 'banner',
+        color: 'info',
+        inputs: [
+          {
+            type: 'markdown',
+            content:
+              'NTLM is still in beta. Please submit any issues to [Feedback](https://yaak.app/feedback).',
+          },
+        ],
+      },
+      {
+        type: 'text',
+        name: 'username',
+        label: 'Username',
+        optional: true,
+      },
+      {
+        type: 'text',
+        name: 'password',
+        label: 'Password',
+        optional: true,
+        password: true,
+      },
+      {
+        type: 'accordion',
+        label: 'Advanced',
+        inputs: [
+          { name: 'domain', label: 'Domain', type: 'text', optional: true },
+          { name: 'workstation', label: 'Workstation', type: 'text', optional: true },
+        ],
+      },
+    ],
+    async onApply(ctx, { values, method, url }) {
+      const username = values.username ? String(values.username) : undefined;
+      const password = values.password ? String(values.password) : undefined;
+      const domain = values.domain ? String(values.domain) : undefined;
+      const workstation = values.workstation ? String(values.workstation) : undefined;
+
+      const options = {
+        url,
+        username,
+        password,
+        workstation,
+        domain,
+      };
+
+      const type1 = ntlm.createType1Message(options);
+
+      const negotiateResponse = await ctx.httpRequest.send({
+        httpRequest: {
+          method,
+          url,
+          headers: [
+            { name: 'Authorization', value: type1 },
+            { name: 'Connection', value: 'keep-alive' },
+          ],
+        },
+      });
+
+      const wwwAuthenticateHeader = negotiateResponse.headers.find(
+        (h) => h.name.toLowerCase() === 'www-authenticate',
+      );
+
+      if (!wwwAuthenticateHeader?.value) {
+        throw new Error('Unable to find www-authenticate response header for NTLM');
+      }
+
+      const type2 = ntlm.parseType2Message(wwwAuthenticateHeader.value, (err: Error | null) => {
+        if (err != null) throw err;
+      });
+      const type3 = ntlm.createType3Message(type2, options);
+
+      return { setHeaders: [{ name: 'Authorization', value: type3 }] };
+    },
+  },
+};

plugins/auth-ntlm/src/modules.d.ts

@@ -0,0 +1 @@
+declare module 'httpntlm';

plugins/auth-ntlm/tsconfig.json

@@ -0,0 +1,3 @@
+{
+  "extends": "../../tsconfig.json"
+}

plugins/auth-oauth1/package.json

@@ -0,0 +1,19 @@
+{
+  "name": "@yaak/auth-oauth1",
+  "displayName": "OAuth 1.0",
+  "description": "Authenticate requests using OAuth 1.0a",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/mountain-loop/yaak.git",
+    "directory": "plugins/auth-oauth1"
+  },
+  "private": true,
+  "version": "0.1.0",
+  "scripts": {
+    "build": "yaakcli build",
+    "dev": "yaakcli dev"
+  },
+  "dependencies": {
+    "oauth-1.0a": "^2.2.6"
+  }
+}

plugins/auth-oauth1/src/index.ts

@@ -0,0 +1,210 @@
+import crypto from 'node:crypto';
+import type { Context, GetHttpAuthenticationConfigRequest, PluginDefinition } from '@yaakapp/api';
+import OAuth from 'oauth-1.0a';
+
+const signatures = {
+  HMAC_SHA1: 'HMAC-SHA1',
+  HMAC_SHA256: 'HMAC-SHA256',
+  HMAC_SHA512: 'HMAC-SHA512',
+  RSA_SHA1: 'RSA-SHA1',
+  RSA_SHA256: 'RSA-SHA256',
+  RSA_SHA512: 'RSA-SHA512',
+  PLAINTEXT: 'PLAINTEXT',
+} as const;
+const defaultSig = signatures.HMAC_SHA1;
+
+const pkSigs = Object.values(signatures).filter((k) => k.startsWith('RSA-'));
+const nonPkSigs = Object.values(signatures).filter((k) => !pkSigs.includes(k));
+
+type SigMethod = (typeof signatures)[keyof typeof signatures];
+
+function hiddenIfNot(
+  sigMethod: SigMethod[],
+  ...other: ((values: GetHttpAuthenticationConfigRequest['values']) => boolean)[]
+) {
+  return (_ctx: Context, { values }: GetHttpAuthenticationConfigRequest) => {
+    const hasGrantType = sigMethod.find((t) => t === String(values.signatureMethod ?? defaultSig));
+    const hasOtherBools = other.every((t) => t(values));
+    const show = hasGrantType && hasOtherBools;
+    return { hidden: !show };
+  };
+}
+
+export const plugin: PluginDefinition = {
+  authentication: {
+    name: 'oauth1',
+    label: 'OAuth 1.0',
+    shortLabel: 'OAuth 1',
+    args: [
+      {
+        type: 'banner',
+        color: 'info',
+        inputs: [
+          {
+            type: 'markdown',
+            content:
+              'OAuth 1.0 is still in beta. Please submit any issues to [Feedback](https://yaak.app/feedback).',
+          },
+        ],
+      },
+      {
+        name: 'signatureMethod',
+        label: 'Signature Method',
+        type: 'select',
+        defaultValue: defaultSig,
+        options: Object.values(signatures).map((v) => ({ label: v, value: v })),
+      },
+      { name: 'consumerKey', label: 'Consumer Key', type: 'text', password: true, optional: true },
+      {
+        name: 'consumerSecret',
+        label: 'Consumer Secret',
+        type: 'text',
+        password: true,
+        optional: true,
+      },
+      {
+        name: 'tokenKey',
+        label: 'Access Token',
+        type: 'text',
+        password: true,
+        optional: true,
+      },
+      {
+        name: 'tokenSecret',
+        label: 'Token Secret',
+        type: 'text',
+        password: true,
+        optional: true,
+        dynamic: hiddenIfNot(nonPkSigs),
+      },
+      {
+        name: 'privateKey',
+        label: 'Private Key (RSA-SHA1)',
+        type: 'text',
+        multiLine: true,
+        optional: true,
+        password: true,
+        placeholder:
+          '-----BEGIN RSA PRIVATE KEY-----\nPrivate key in PEM format\n-----END RSA PRIVATE KEY-----',
+        dynamic: hiddenIfNot(pkSigs),
+      },
+      {
+        type: 'accordion',
+        label: 'Advanced',
+        inputs: [
+          { name: 'callback', label: 'Callback Url', type: 'text', optional: true },
+          { name: 'verifier', label: 'Verifier', type: 'text', optional: true, password: true },
+          { name: 'timestamp', label: 'Timestamp', type: 'text', optional: true },
+          { name: 'nonce', label: 'Nonce', type: 'text', optional: true },
+          {
+            name: 'version',
+            label: 'OAuth Version',
+            type: 'text',
+            optional: true,
+            defaultValue: '1.0',
+          },
+          { name: 'realm', label: 'Realm', type: 'text', optional: true },
+        ],
+      },
+    ],
+
+    onApply(
+      _ctx,
+      { values, method, url },
+    ): {
+      setHeaders?: { name: string; value: string }[];
+      setQueryParameters?: { name: string; value: string }[];
+    } {
+      const consumerKey = String(values.consumerKey || '');
+      const consumerSecret = String(values.consumerSecret || '');
+
+      const signatureMethod = String(values.signatureMethod || signatures.HMAC_SHA1) as SigMethod;
+      const version = String(values.version || '1.0');
+      const realm = String(values.realm || '') || undefined;
+
+      const oauth = new OAuth({
+        consumer: { key: consumerKey, secret: consumerSecret },
+        signature_method: signatureMethod,
+        version,
+        hash_function: hashFunction(signatureMethod),
+        realm,
+      });
+
+      if (pkSigs.includes(signatureMethod)) {
+        oauth.getSigningKey = (tokenSecret?: string) => tokenSecret || '';
+      }
+
+      const requestUrl = new URL(url);
+
+      // Base request options passed to oauth-1.0a
+      const requestData: Omit<OAuth.RequestOptions, 'data'> & {
+        data: Record<string, string | string[]>;
+      } = {
+        method,
+        url: requestUrl.toString(),
+        includeBodyHash: false,
+        data: {},
+      };
+
+      // (1) Include existing query params in signature base string
+      for (const key of requestUrl.searchParams.keys()) {
+        if (key.startsWith('oauth_')) continue;
+        const all = requestUrl.searchParams.getAll(key);
+        const first = all[0];
+        if (first == null) continue;
+        requestData.data[key] = all.length > 1 ? all : first;
+      }
+
+      // (2) Manual oauth_* overrides
+      if (values.callback) requestData.data.oauth_callback = String(values.callback);
+      if (values.nonce) requestData.data.oauth_nonce = String(values.nonce);
+      if (values.timestamp) requestData.data.oauth_timestamp = String(values.timestamp);
+      if (values.verifier) requestData.data.oauth_verifier = String(values.verifier);
+
+      let token: OAuth.Token | { key: string } | undefined;
+
+      if (pkSigs.includes(signatureMethod)) {
+        token = {
+          key: String(values.tokenKey || ''),
+          secret: String(values.privateKey || ''),
+        };
+      } else if (values.tokenKey && values.tokenSecret) {
+        token = { key: String(values.tokenKey), secret: String(values.tokenSecret) };
+      } else if (values.tokenKey) {
+        token = { key: String(values.tokenKey) };
+      }
+
+      const authParams = oauth.authorize(requestData, token as OAuth.Token | undefined);
+      const { Authorization } = oauth.toHeader(authParams);
+      return { setHeaders: [{ name: 'Authorization', value: Authorization }] };
+    },
+  },
+};
+
+function hashFunction(signatureMethod: SigMethod) {
+  switch (signatureMethod) {
+    case signatures.HMAC_SHA1:
+      return (base: string, key: string) =>
+        crypto.createHmac('sha1', key).update(base).digest('base64');
+    case signatures.HMAC_SHA256:
+      return (base: string, key: string) =>
+        crypto.createHmac('sha256', key).update(base).digest('base64');
+    case signatures.HMAC_SHA512:
+      return (base: string, key: string) =>
+        crypto.createHmac('sha512', key).update(base).digest('base64');
+    case signatures.RSA_SHA1:
+      return (base: string, privateKey: string) =>
+        crypto.createSign('RSA-SHA1').update(base).sign(privateKey, 'base64');
+    case signatures.RSA_SHA256:
+      return (base: string, privateKey: string) =>
+        crypto.createSign('RSA-SHA256').update(base).sign(privateKey, 'base64');
+    case signatures.RSA_SHA512:
+      return (base: string, privateKey: string) =>
+        crypto.createSign('RSA-SHA512').update(base).sign(privateKey, 'base64');
+    case signatures.PLAINTEXT:
+      return (base: string) => base;
+    default:
+      return (base: string, key: string) =>
+        crypto.createHmac('sha1', key).update(base).digest('base64');
+  }
+}

plugins/auth-oauth1/tsconfig.json

@@ -0,0 +1,3 @@
+{
+  "extends": "../../tsconfig.json"
+}

plugins/auth-oauth2/package.json

@@ -12,7 +12,6 @@
   "scripts": {
     "build": "yaakcli build",
     "dev": "yaakcli dev",
-    "lint":"tsc --noEmit && eslint . --ext .ts,.tsx",
     "test": "vitest --run tests"
   }
 }

plugins/auth-oauth2/src/fetchAccessToken.ts

@@ -1,5 +1,5 @@
-import type { Context, HttpRequest, HttpUrlParameter } from '@yaakapp/api';
 import { readFileSync } from 'node:fs';
+import type { Context, HttpRequest, HttpUrlParameter } from '@yaakapp/api';
 import type { AccessTokenRawResponse } from './store';
 
 export async function fetchAccessToken(
@@ -39,15 +39,15 @@ export async function fetchAccessToken(
     ],
   };
 
-  if (scope) httpRequest.body!.form.push({ name: 'scope', value: scope });
-  if (audience) httpRequest.body!.form.push({ name: 'audience', value: audience });
+  if (scope) httpRequest.body?.form.push({ name: 'scope', value: scope });
+  if (audience) httpRequest.body?.form.push({ name: 'audience', value: audience });
 
   if (credentialsInBody) {
-    httpRequest.body!.form.push({ name: 'client_id', value: clientId });
-    httpRequest.body!.form.push({ name: 'client_secret', value: clientSecret });
+    httpRequest.body?.form.push({ name: 'client_id', value: clientId });
+    httpRequest.body?.form.push({ name: 'client_secret', value: clientSecret });
   } else {
-    const value = 'Basic ' + Buffer.from(`${clientId}:${clientSecret}`).toString('base64');
-    httpRequest.headers!.push({ name: 'Authorization', value });
+    const value = `Basic ${Buffer.from(`${clientId}:${clientSecret}`).toString('base64')}`;
+    httpRequest.headers?.push({ name: 'Authorization', value });
   }
 
   httpRequest.authenticationType = 'none'; // Don't inherit workspace auth
@@ -58,12 +58,11 @@ export async function fetchAccessToken(
   const body = resp.bodyPath ? readFileSync(resp.bodyPath, 'utf8') : '';
 
   if (resp.status < 200 || resp.status >= 300) {
-    throw new Error(
-      'Failed to fetch access token with status=' + resp.status + ' and body=' + body,
-    );
+    throw new Error(`Failed to fetch access token with status=${resp.status} and body=${body}`);
   }
 
-  let response;
+  // biome-ignore lint/suspicious/noExplicitAny: none
+  let response: any;
   try {
     response = JSON.parse(body);
   } catch {
@@ -71,7 +70,7 @@ export async function fetchAccessToken(
   }
 
   if (response.error) {
-    throw new Error('Failed to fetch access token with ' + response.error);
+    throw new Error(`Failed to fetch access token with ${response.error}`);
   }
 
   return response;

plugins/auth-oauth2/src/getOrRefreshAccessToken.ts

@@ -1,5 +1,5 @@
-import type { Context, HttpRequest } from '@yaakapp/api';
 import { readFileSync } from 'node:fs';
+import type { Context, HttpRequest } from '@yaakapp/api';
 import type { AccessToken, AccessTokenRawResponse, TokenStoreArgs } from './store';
 import { deleteToken, getToken, storeToken } from './store';
 import { isTokenExpired } from './util';
@@ -58,23 +58,23 @@ export async function getOrRefreshAccessToken(
     ],
   };
 
-  if (scope) httpRequest.body!.form.push({ name: 'scope', value: scope });
+  if (scope) httpRequest.body?.form.push({ name: 'scope', value: scope });
 
   if (credentialsInBody) {
-    httpRequest.body!.form.push({ name: 'client_id', value: clientId });
-    httpRequest.body!.form.push({ name: 'client_secret', value: clientSecret });
+    httpRequest.body?.form.push({ name: 'client_id', value: clientId });
+    httpRequest.body?.form.push({ name: 'client_secret', value: clientSecret });
   } else {
-    const value = 'Basic ' + Buffer.from(`${clientId}:${clientSecret}`).toString('base64');
-    httpRequest.headers!.push({ name: 'Authorization', value });
+    const value = `Basic ${Buffer.from(`${clientId}:${clientSecret}`).toString('base64')}`;
+    httpRequest.headers?.push({ name: 'Authorization', value });
   }
 
   httpRequest.authenticationType = 'none'; // Don't inherit workspace auth
   const resp = await ctx.httpRequest.send({ httpRequest });
 
-  if (resp.status === 401) {
-    // Bad refresh token, so we'll force it to fetch a fresh access token by deleting
-    // and returning null;
-    console.log('[oauth2] Unauthorized refresh_token request');
+  if (resp.status >= 400 && resp.status < 500) {
+    // Client errors (4xx) indicate the refresh token is invalid, expired, or revoked
+    // Delete the token and return null to trigger a fresh authorization flow
+    console.log('[oauth2] Refresh token request failed with client error, deleting token');
     await deleteToken(ctx, tokenArgs);
     return null;
   }
@@ -84,12 +84,11 @@ export async function getOrRefreshAccessToken(
   console.log('[oauth2] Got refresh token response', resp.status);
 
   if (resp.status < 200 || resp.status >= 300) {
-    throw new Error(
-      'Failed to refresh access token with status=' + resp.status + ' and body=' + body,
-    );
+    throw new Error(`Failed to refresh access token with status=${resp.status} and body=${body}`);
   }
 
-  let response;
+  // biome-ignore lint/suspicious/noExplicitAny: none
+  let response: any;
   try {
     response = JSON.parse(body);
   } catch {

plugins/auth-oauth2/src/grants/authorizationCode.ts

@@ -1,5 +1,5 @@
-import type { Context } from '@yaakapp/api';
 import { createHash, randomBytes } from 'node:crypto';
+import type { Context } from '@yaakapp/api';
 import { fetchAccessToken } from '../fetchAccessToken';
 import { getOrRefreshAccessToken } from '../getOrRefreshAccessToken';
 import type { AccessToken, TokenStoreArgs } from '../store';
@@ -84,7 +84,7 @@ export async function getAuthorizationCode(
   const authorizationUrlStr = authorizationUrl.toString();
   console.log('[oauth2] Authorizing', authorizationUrlStr);
 
-  // eslint-disable-next-line no-async-promise-executor
+  // biome-ignore lint/suspicious/noAsyncPromiseExecutor: none
   const code = await new Promise<string>(async (resolve, reject) => {
     let foundCode = false;
     const { close } = await ctx.window.openUrl({
@@ -97,7 +97,7 @@ export async function getAuthorizationCode(
         }
       },
       async onNavigate({ url: urlStr }) {
-        let code;
+        let code: string | null;
         try {
           code = extractCode(urlStr, redirectUri);
         } catch (err) {

plugins/auth-oauth2/src/grants/implicit.ts

@@ -1,6 +1,6 @@
 import type { Context } from '@yaakapp/api';
-import type { AccessToken, AccessTokenRawResponse} from '../store';
-import  { getDataDirKey , getToken, storeToken } from '../store';
+import type { AccessToken, AccessTokenRawResponse } from '../store';
+import { getDataDirKey, getToken, storeToken } from '../store';
 import { isTokenExpired } from '../util';
 
 export async function getImplicit(
@@ -56,7 +56,7 @@ export async function getImplicit(
     );
   }
 
-  // eslint-disable-next-line no-async-promise-executor
+  // biome-ignore lint/suspicious/noAsyncPromiseExecutor: none
   const newToken = await new Promise<AccessToken>(async (resolve, reject) => {
     let foundAccessToken = false;
     const authorizationUrlStr = authorizationUrl.toString();

plugins/auth-oauth2/src/index.ts

@@ -27,7 +27,7 @@ const grantTypes: FormInputSelectOption[] = [
   { label: 'Client Credentials', value: 'client_credentials' },
 ];
 
-const defaultGrantType = grantTypes[0]!.value;
+const defaultGrantType = grantTypes[0]?.value;
 
 function hiddenIfNot(
   grantTypes: GrantType[],
@@ -131,7 +131,6 @@ export const plugin: PluginDefinition = {
         type: 'select',
         name: 'grantType',
         label: 'Grant Type',
-        hideLabel: true,
         defaultValue: defaultGrantType,
         options: grantTypes,
       },
@@ -288,6 +287,7 @@ export const plugin: PluginDefinition = {
       {
         type: 'accordion',
         label: 'Access Token Response',
+        inputs: [],
         async dynamic(ctx, { contextId, values }) {
           const tokenArgs: TokenStoreArgs = {
             contextId,
@@ -304,6 +304,7 @@ export const plugin: PluginDefinition = {
             inputs: [
               {
                 type: 'editor',
+                name: 'response',
                 defaultValue: JSON.stringify(token.response, null, 2),
                 hideLabel: true,
                 readOnly: true,
@@ -389,7 +390,7 @@ export const plugin: PluginDefinition = {
           credentialsInBody,
         });
       } else {
-        throw new Error('Invalid grant type ' + grantType);
+        throw new Error(`Invalid grant type ${grantType}`);
       }
 
       const headerName = stringArg(values, 'headerName') || 'Authorization';
@@ -404,7 +405,7 @@ function stringArgOrNull(
   name: string,
 ): string | null {
   const arg = values[name];
-  if (arg == null || arg == '') return null;
+  if (arg == null || arg === '') return null;
   return `${arg}`;
 }
 

plugins/auth-oauth2/src/store.ts

@@ -1,5 +1,5 @@
-import type { Context } from '@yaakapp/api';
 import { createHash } from 'node:crypto';
+import type { Context } from '@yaakapp/api';
 
 export async function storeToken(
   ctx: Context,

plugins/auth-oauth2/src/util.ts

@@ -50,7 +50,7 @@ export function extractCode(urlStr: string, redirectUri: string | null): string
 export function urlMatchesRedirect(url: URL, redirectUrl: string | null): boolean {
   if (!redirectUrl) return true;
 
-  let redirect;
+  let redirect: URL;
   try {
     redirect = new URL(redirectUrl);
   } catch {

plugins/auth-oauth2/tests/util.test.ts

@@ -1,4 +1,4 @@
-import { describe, test, expect } from 'vitest';
+import { describe, expect, test } from 'vitest';
 import { extractCode } from '../src/util';
 
 describe('extractCode', () => {

plugins/filter-jsonpath/package.json

@@ -11,8 +11,7 @@
   "version": "0.1.0",
   "scripts": {
     "build": "yaakcli build",
-    "dev": "yaakcli dev",
-    "lint":"tsc --noEmit && eslint . --ext .ts,.tsx"
+    "dev": "yaakcli dev"
   },
   "dependencies": {
     "jsonpath-plus": "^10.3.0"

plugins/filter-xpath/package.json

@@ -6,8 +6,7 @@
   "version": "0.1.0",
   "scripts": {
     "build": "yaakcli build",
-    "dev": "yaakcli dev",
-    "lint":"tsc --noEmit && eslint . --ext .ts,.tsx"
+    "dev": "yaakcli dev"
   },
   "dependencies": {
     "@xmldom/xmldom": "^0.9.8",

plugins/filter-xpath/src/index.ts

@@ -7,16 +7,15 @@ export const plugin: PluginDefinition = {
     name: 'XPath',
     description: 'Filter XPath',
     onFilter(_ctx, args) {
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      // biome-ignore lint/suspicious/noExplicitAny: none
       const doc: any = new DOMParser().parseFromString(args.payload, 'text/xml');
       try {
         const result = xpath.select(args.filter, doc, false);
         if (Array.isArray(result)) {
           return { content: result.map((r) => String(r)).join('\n') };
-        } else {
-          // Not sure what cases this happens in (?)
-          return { content: String(result) };
         }
+        // Not sure what cases this happens in (?)
+        return { content: String(result) };
       } catch (err) {
         return { content: '', error: `Invalid filter: ${err}` };
       }

plugins/importer-curl/package.json

@@ -7,7 +7,6 @@
   "scripts": {
     "build": "yaakcli build",
     "dev": "yaakcli dev",
-    "lint": "tsc --noEmit && eslint . --ext .ts,.tsx",
     "test": "vitest --run tests"
   },
   "dependencies": {

plugins/importer-curl/src/index.ts

@@ -1,4 +1,12 @@
-import type { Context, Environment, Folder, HttpRequest, HttpUrlParameter, PluginDefinition, Workspace } from '@yaakapp/api';
+import type {
+  Context,
+  Environment,
+  Folder,
+  HttpRequest,
+  HttpUrlParameter,
+  PluginDefinition,
+  Workspace,
+} from '@yaakapp/api';
 import type { ControlOperator, ParseEntry } from 'shell-quote';
 import { parse } from 'shell-quote';
 
@@ -28,7 +36,7 @@ const SUPPORTED_FLAGS = [
   ['url-query'],
   ['user', 'u'], // Authentication
   DATA_FLAGS,
-].flatMap((v) => v);
+].flat();
 
 const BOOLEAN_FLAGS = ['G', 'get', 'digest'];
 
@@ -41,12 +49,40 @@ export const plugin: PluginDefinition = {
     name: 'cURL',
     description: 'Import cURL commands',
     onImport(_ctx: Context, args: { text: string }) {
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      // biome-ignore lint/suspicious/noExplicitAny: none
       return convertCurl(args.text) as any;
     },
   },
 };
 
+/**
+ * Decodes escape sequences in shell $'...' strings
+ * Handles Unicode escape sequences (\uXXXX) and common escape codes
+ */
+function decodeShellString(str: string): string {
+  return str
+    .replace(/\\u([0-9a-fA-F]{4})/g, (_, hex) => String.fromCharCode(parseInt(hex, 16)))
+    .replace(/\\x([0-9a-fA-F]{2})/g, (_, hex) => String.fromCharCode(parseInt(hex, 16)))
+    .replace(/\\n/g, '\n')
+    .replace(/\\r/g, '\r')
+    .replace(/\\t/g, '\t')
+    .replace(/\\'/g, "'")
+    .replace(/\\"/g, '"')
+    .replace(/\\\\/g, '\\');
+}
+
+/**
+ * Checks if a string might contain escape sequences that need decoding
+ * If so, decodes them; otherwise returns the string as-is
+ */
+function maybeDecodeEscapeSequences(str: string): string {
+  // Check if the string contains escape sequences that shell-quote might not handle
+  if (str.includes('\\u') || str.includes('\\x')) {
+    return decodeShellString(str);
+  }
+  return str;
+}
+
 export function convertCurl(rawData: string) {
   if (!rawData.match(/^\s*curl /)) {
     return null;
@@ -78,9 +114,11 @@ export function convertCurl(rawData: string) {
   for (const parseEntry of normalizedParseEntries) {
     if (typeof parseEntry === 'string') {
       if (parseEntry.startsWith('$')) {
-        currentCommand.push(parseEntry.slice(1));
+        // Handle $'...' strings from shell-quote - decode escape sequences
+        currentCommand.push(decodeShellString(parseEntry.slice(1)));
       } else {
-        currentCommand.push(parseEntry);
+        // Decode escape sequences that shell-quote might not handle
+        currentCommand.push(maybeDecodeEscapeSequences(parseEntry));
       }
       continue;
     }
@@ -100,7 +138,7 @@ export function convertCurl(rawData: string) {
 
     if (op?.startsWith('$')) {
       // Handle the case where literal like -H $'Header: \'Some Quoted Thing\''
-      const str = op.slice(2, op.length - 1).replace(/\\'/g, '\'');
+      const str = decodeShellString(op.slice(2, op.length - 1));
 
       currentCommand.push(str);
       continue;
@@ -153,14 +191,21 @@ function importCommand(parseEntries: ParseEntry[], workspaceId: string) {
         continue;
       }
 
-      let value;
+      let value: string | boolean;
       const nextEntry = parseEntries[i + 1];
       const hasValue = !BOOLEAN_FLAGS.includes(name);
+      // Check if nextEntry looks like a flag:
+      // - Single dash followed by a letter: -X, -H, -d
+      // - Double dash followed by a letter: --data-raw, --header
+      // This prevents mistaking data that starts with dashes (like multipart boundaries ------) as flags
+      const nextEntryIsFlag =
+        typeof nextEntry === 'string' &&
+        (nextEntry.match(/^-[a-zA-Z]/) || nextEntry.match(/^--[a-zA-Z]/));
       if (isSingleDash && name.length > 1) {
         // Handle squished arguments like -XPOST
         value = name.slice(1);
         name = name.slice(0, 1);
-      } else if (typeof nextEntry === 'string' && hasValue && !nextEntry.startsWith('-')) {
+      } else if (typeof nextEntry === 'string' && hasValue && !nextEntryIsFlag) {
         // Next arg is not a flag, so assign it as the value
         value = nextEntry;
         i++; // Skip next one
@@ -169,7 +214,7 @@ function importCommand(parseEntries: ParseEntry[], workspaceId: string) {
       }
 
       flagsByName[name] = flagsByName[name] || [];
-      flagsByName[name]!.push(value);
+      flagsByName[name]?.push(value);
     } else if (parseEntry) {
       singletons.push(parseEntry);
     }
@@ -184,7 +229,11 @@ function importCommand(parseEntries: ParseEntry[], workspaceId: string) {
   const urlParameters: HttpUrlParameter[] =
     search?.split('&').map((p) => {
       const v = splitOnce(p, '=');
-      return { name: decodeURIComponent(v[0] ?? ''), value: decodeURIComponent(v[1] ?? ''), enabled: true };
+      return {
+        name: decodeURIComponent(v[0] ?? ''),
+        value: decodeURIComponent(v[1] ?? ''),
+        enabled: true,
+      };
     }) ?? [];
 
   const url = baseUrl ?? urlArg;
@@ -209,15 +258,15 @@ function importCommand(parseEntries: ParseEntry[], workspaceId: string) {
   const authenticationType = username ? (isDigest ? 'digest' : 'basic') : null;
   const authentication = username
     ? {
-      username: username.trim(),
-      password: (password ?? '').trim(),
-    }
+        username: username.trim(),
+        password: (password ?? '').trim(),
+      }
     : {};
 
   // Headers
   const headers = [
-    ...((flagsByName['header'] as string[] | undefined) || []),
-    ...((flagsByName['H'] as string[] | undefined) || []),
+    ...((flagsByName.header as string[] | undefined) || []),
+    ...((flagsByName.H as string[] | undefined) || []),
   ].map((header) => {
     const [name, value] = header.split(/:(.*)$/);
     // remove final colon from header name if present
@@ -237,8 +286,8 @@ function importCommand(parseEntries: ParseEntry[], workspaceId: string) {
 
   // Cookies
   const cookieHeaderValue = [
-    ...((flagsByName['cookie'] as string[] | undefined) || []),
-    ...((flagsByName['b'] as string[] | undefined) || []),
+    ...((flagsByName.cookie as string[] | undefined) || []),
+    ...((flagsByName.b as string[] | undefined) || []),
   ]
     .map((str) => {
       const name = str.split('=', 1)[0];
@@ -263,14 +312,37 @@ function importCommand(parseEntries: ParseEntry[], workspaceId: string) {
   }
 
   // Body (Text or Blob)
-  const dataParameters = pairsToDataParameters(flagsByName);
   const contentTypeHeader = headers.find((header) => header.name.toLowerCase() === 'content-type');
-  const mimeType = contentTypeHeader ? contentTypeHeader.value.split(';')[0] : null;
+  const mimeType = contentTypeHeader ? contentTypeHeader.value.split(';')[0]?.trim() : null;
 
-  // Body (Multipart Form Data)
+  // Extract boundary from Content-Type header for multipart parsing
+  const boundaryMatch = contentTypeHeader?.value.match(/boundary=([^\s;]+)/i);
+  const boundary = boundaryMatch?.[1];
+
+  // Get raw data from --data-raw flags (before splitting by &)
+  const rawDataValues = [
+    ...((flagsByName['data-raw'] as string[] | undefined) || []),
+    ...((flagsByName.d as string[] | undefined) || []),
+    ...((flagsByName.data as string[] | undefined) || []),
+    ...((flagsByName['data-binary'] as string[] | undefined) || []),
+    ...((flagsByName['data-ascii'] as string[] | undefined) || []),
+  ];
+
+  // Check if this is multipart form data in --data-raw (Chrome DevTools format)
+  let multipartFormDataFromRaw:
+    | { name: string; value?: string; file?: string; enabled: boolean }[]
+    | null = null;
+  if (mimeType === 'multipart/form-data' && boundary && rawDataValues.length > 0) {
+    const rawBody = rawDataValues.join('');
+    multipartFormDataFromRaw = parseMultipartFormData(rawBody, boundary);
+  }
+
+  const dataParameters = pairsToDataParameters(flagsByName);
+
+  // Body (Multipart Form Data from -F flags)
   const formDataParams = [
-    ...((flagsByName['form'] as string[] | undefined) || []),
-    ...((flagsByName['F'] as string[] | undefined) || []),
+    ...((flagsByName.form as string[] | undefined) || []),
+    ...((flagsByName.F as string[] | undefined) || []),
   ].map((str) => {
     const parts = str.split('=');
     const name = parts[0] ?? '';
@@ -281,9 +353,9 @@ function importCommand(parseEntries: ParseEntry[], workspaceId: string) {
     };
 
     if (value.indexOf('@') === 0) {
-      item['file'] = value.slice(1);
+      item.file = value.slice(1);
     } else {
-      item['value'] = value;
+      item.value = value;
     }
 
     return item;
@@ -294,7 +366,13 @@ function importCommand(parseEntries: ParseEntry[], workspaceId: string) {
   let bodyType: string | null = null;
   const bodyAsGET = getPairValue(flagsByName, false, ['G', 'get']);
 
-  if (dataParameters.length > 0 && bodyAsGET) {
+  if (multipartFormDataFromRaw) {
+    // Handle multipart form data parsed from --data-raw (Chrome DevTools format)
+    bodyType = 'multipart/form-data';
+    body = {
+      form: multipartFormDataFromRaw,
+    };
+  } else if (dataParameters.length > 0 && bodyAsGET) {
     urlParameters.push(...dataParameters);
   } else if (
     dataParameters.length > 0 &&
@@ -384,7 +462,7 @@ function pairsToDataParameters(keyedPairs: FlagsByName): DataParameter[] {
 
     for (const p of pairs) {
       if (typeof p !== 'string') continue;
-      const params = p.split("&");
+      const params = p.split('&');
       for (const param of params) {
         const [name, value] = splitOnce(param, '=');
         if (param.startsWith('@')) {
@@ -398,7 +476,7 @@ function pairsToDataParameters(keyedPairs: FlagsByName): DataParameter[] {
         } else {
           dataParameters.push({
             name: name ?? '',
-            value: flagName === 'data-urlencode' ? encodeURIComponent(value ?? '') : value ?? '',
+            value: flagName === 'data-urlencode' ? encodeURIComponent(value ?? '') : (value ?? ''),
             enabled: true,
           });
         }
@@ -415,8 +493,8 @@ const getPairValue = <T extends string | boolean>(
   names: string[],
 ) => {
   for (const name of names) {
-    if (pairsByName[name] && pairsByName[name]!.length) {
-      return pairsByName[name]![0] as T;
+    if (pairsByName[name]?.length) {
+      return pairsByName[name]?.[0] as T;
     }
   }
 
@@ -431,6 +509,71 @@ function splitOnce(str: string, sep: string): string[] {
   return [str];
 }
 
+/**
+ * Parses multipart form data from a raw body string
+ * Used when Chrome DevTools exports a cURL with --data-raw containing multipart data
+ */
+function parseMultipartFormData(
+  rawBody: string,
+  boundary: string,
+): { name: string; value?: string; file?: string; enabled: boolean }[] | null {
+  const results: { name: string; value?: string; file?: string; enabled: boolean }[] = [];
+
+  // The boundary in the body typically has -- prefix
+  const boundaryMarker = `--${boundary}`;
+  const parts = rawBody.split(boundaryMarker);
+
+  for (const part of parts) {
+    // Skip empty parts and the closing boundary marker
+    if (!part || part.trim() === '--' || part.trim() === '--\r\n') {
+      continue;
+    }
+
+    // Each part has headers and content separated by \r\n\r\n
+    const headerContentSplit = part.indexOf('\r\n\r\n');
+    if (headerContentSplit === -1) {
+      continue;
+    }
+
+    const headerSection = part.slice(0, headerContentSplit);
+    let content = part.slice(headerContentSplit + 4); // Skip \r\n\r\n
+
+    // Remove trailing \r\n from content
+    if (content.endsWith('\r\n')) {
+      content = content.slice(0, -2);
+    }
+
+    // Parse Content-Disposition header to get name and filename
+    const contentDispositionMatch = headerSection.match(
+      /Content-Disposition:\s*form-data;\s*name="([^"]+)"(?:;\s*filename="([^"]+)")?/i,
+    );
+
+    if (!contentDispositionMatch) {
+      continue;
+    }
+
+    const name = contentDispositionMatch[1] ?? '';
+    const filename = contentDispositionMatch[2];
+
+    const item: { name: string; value?: string; file?: string; enabled: boolean } = {
+      name,
+      enabled: true,
+    };
+
+    if (filename) {
+      // This is a file upload field
+      item.file = filename;
+    } else {
+      // This is a regular text field
+      item.value = content;
+    }
+
+    results.push(item);
+  }
+
+  return results.length > 0 ? results : null;
+}
+
 const idCount: Partial<Record<string, number>> = {};
 
 function generateId(model: string): string {

plugins/importer-curl/tests/index.test.ts

@@ -374,7 +374,7 @@ describe('importer-curl', () => {
         httpRequests: [
           baseRequest({
             url: 'https://yaak.app',
-            method: "POST",
+            method: 'POST',
             bodyType: 'application/x-www-form-urlencoded',
             body: {
               form: [{ name: 'foo', value: 'bar=baz', enabled: true }],
@@ -391,6 +391,122 @@ describe('importer-curl', () => {
       },
     });
   });
+
+  test('Imports data with Unicode escape sequences', () => {
+    expect(
+      convertCurl(
+        `curl 'https://yaak.app' -H 'Content-Type: application/json' --data-raw $'{"query":"SearchQueryInput\\u0021"}' -X POST`,
+      ),
+    ).toEqual({
+      resources: {
+        workspaces: [baseWorkspace()],
+        httpRequests: [
+          baseRequest({
+            url: 'https://yaak.app',
+            method: 'POST',
+            headers: [{ name: 'Content-Type', value: 'application/json', enabled: true }],
+            bodyType: 'application/json',
+            body: { text: '{"query":"SearchQueryInput!"}' },
+          }),
+        ],
+      },
+    });
+  });
+
+  test('Imports data with multiple escape sequences', () => {
+    expect(
+      convertCurl(
+        `curl 'https://yaak.app' --data-raw $'Line1\\nLine2\\tTab\\u0021Exclamation' -X POST`,
+      ),
+    ).toEqual({
+      resources: {
+        workspaces: [baseWorkspace()],
+        httpRequests: [
+          baseRequest({
+            url: 'https://yaak.app',
+            method: 'POST',
+            bodyType: 'application/x-www-form-urlencoded',
+            body: {
+              form: [{ name: 'Line1\nLine2\tTab!Exclamation', value: '', enabled: true }],
+            },
+            headers: [
+              {
+                enabled: true,
+                name: 'Content-Type',
+                value: 'application/x-www-form-urlencoded',
+              },
+            ],
+          }),
+        ],
+      },
+    });
+  });
+
+  test('Imports multipart form data from --data-raw (Chrome DevTools format)', () => {
+    // This is the format Chrome DevTools uses when copying a multipart form submission as cURL
+    const curlCommand = `curl 'http://localhost:8080/system' \
+  -H 'Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryHwsXKi4rKA6P5VBd' \
+  --data-raw $'------WebKitFormBoundaryHwsXKi4rKA6P5VBd\r\nContent-Disposition: form-data; name="username"\r\n\r\njsgj\r\n------WebKitFormBoundaryHwsXKi4rKA6P5VBd\r\nContent-Disposition: form-data; name="password"\r\n\r\n654321\r\n------WebKitFormBoundaryHwsXKi4rKA6P5VBd\r\nContent-Disposition: form-data; name="captcha"; filename="test.xlsx"\r\nContent-Type: application/vnd.openxmlformats-officedocument.spreadsheetml.sheet\r\n\r\n\r\n------WebKitFormBoundaryHwsXKi4rKA6P5VBd--\r\n'`;
+
+    expect(convertCurl(curlCommand)).toEqual({
+      resources: {
+        workspaces: [baseWorkspace()],
+        httpRequests: [
+          baseRequest({
+            url: 'http://localhost:8080/system',
+            method: 'POST',
+            headers: [
+              {
+                name: 'Content-Type',
+                value: 'multipart/form-data; boundary=----WebKitFormBoundaryHwsXKi4rKA6P5VBd',
+                enabled: true,
+              },
+            ],
+            bodyType: 'multipart/form-data',
+            body: {
+              form: [
+                { name: 'username', value: 'jsgj', enabled: true },
+                { name: 'password', value: '654321', enabled: true },
+                { name: 'captcha', file: 'test.xlsx', enabled: true },
+              ],
+            },
+          }),
+        ],
+      },
+    });
+  });
+
+  test('Imports multipart form data with text-only fields from --data-raw', () => {
+    const curlCommand = `curl 'http://example.com/api' \
+  -H 'Content-Type: multipart/form-data; boundary=----FormBoundary123' \
+  --data-raw $'------FormBoundary123\r\nContent-Disposition: form-data; name="field1"\r\n\r\nvalue1\r\n------FormBoundary123\r\nContent-Disposition: form-data; name="field2"\r\n\r\nvalue2\r\n------FormBoundary123--\r\n'`;
+
+    expect(convertCurl(curlCommand)).toEqual({
+      resources: {
+        workspaces: [baseWorkspace()],
+        httpRequests: [
+          baseRequest({
+            url: 'http://example.com/api',
+            method: 'POST',
+            headers: [
+              {
+                name: 'Content-Type',
+                value: 'multipart/form-data; boundary=----FormBoundary123',
+                enabled: true,
+              },
+            ],
+            bodyType: 'multipart/form-data',
+            body: {
+              form: [
+                { name: 'field1', value: 'value1', enabled: true },
+                { name: 'field2', value: 'value2', enabled: true },
+              ],
+            },
+          }),
+        ],
+      },
+    });
+  });
 });
 
 const idCount: Partial<Record<string, number>> = {};