Move local plugin install command into plugins_ext

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

.claude/commands/release/check-out-pr.md

@@ -1,62 +0,0 @@
----
-description: Review a PR in a new worktree
-allowed-tools: Bash(git worktree:*), Bash(gh pr:*), Bash(git branch:*)
----
-
-Check out a GitHub pull request for review.
-
-## Usage
-
-```
-/check-out-pr <PR_NUMBER>
-```
-
-## What to do
-
-1. If no PR number is provided, list all open pull requests and ask the user to select one
-2. Get PR information using `gh pr view <PR_NUMBER> --json number,headRefName`
-3. **Ask the user** whether they want to:
-   - **A) Check out in current directory** — simple `gh pr checkout <PR_NUMBER>`
-   - **B) Create a new worktree** — isolated copy at `../yaak-worktrees/pr-<PR_NUMBER>`
-4. Follow the appropriate path below
-
-## Option A: Check out in current directory
-
-1. Run `gh pr checkout <PR_NUMBER>`
-2. Inform the user which branch they're now on
-
-## Option B: Create a new worktree
-
-1. Create a new worktree at `../yaak-worktrees/pr-<PR_NUMBER>` using `git worktree add` with a timeout of at least 300000ms (5 minutes) since the post-checkout hook runs a bootstrap script
-2. Checkout the PR branch in the new worktree using `gh pr checkout <PR_NUMBER>`
-3. The post-checkout hook will automatically:
-   - Create `.env.local` with unique ports
-   - Copy editor config folders
-   - Run `npm install && npm run bootstrap`
-4. Inform the user:
-   - Where the worktree was created
-   - What ports were assigned
-   - How to access it (cd command)
-   - How to run the dev server
-   - How to remove the worktree when done
-
-### Example worktree output
-
-```
-Created worktree for PR #123 at ../yaak-worktrees/pr-123
-Branch: feature-auth
-Ports: Vite (1421), MCP (64344)
-
-To start working:
-  cd ../yaak-worktrees/pr-123
-  npm run app-dev
-
-To remove when done:
-  git worktree remove ../yaak-worktrees/pr-123
-```
-
-## Error Handling
-
-- If the PR doesn't exist, show a helpful error
-- If the worktree already exists, inform the user and ask if they want to remove and recreate it
-- If `gh` CLI is not available, inform the user to install it

.claude/skills/worktree.md

@@ -1,35 +0,0 @@
-# Worktree Management Skill
-
-## Creating Worktrees
-
-When creating git worktrees for this project, ALWAYS use the path format:
-```
-../yaak-worktrees/<NAME>
-```
-
-For example:
-- `git worktree add ../yaak-worktrees/feature-auth`
-- `git worktree add ../yaak-worktrees/bugfix-login`
-- `git worktree add ../yaak-worktrees/refactor-api`
-
-## What Happens Automatically
-
-The post-checkout hook will automatically:
-1. Create `.env.local` with unique ports (YAAK_DEV_PORT and YAAK_PLUGIN_MCP_SERVER_PORT)
-2. Copy gitignored editor config folders (.zed, .idea, etc.)
-3. Run `npm install && npm run bootstrap`
-
-## Deleting Worktrees
-
-```bash
-git worktree remove ../yaak-worktrees/<NAME>
-```
-
-## Port Assignments
-
-- Main worktree: 1420 (Vite), 64343 (MCP)
-- First worktree: 1421, 64344
-- Second worktree: 1422, 64345
-- etc.
-
-Each worktree can run `npm run app-dev` simultaneously without conflicts.

.codex/skills/release-check-out-pr/SKILL.md

@@ -1,46 +0,0 @@
----
-name: release-check-out-pr
-description: Check out a GitHub pull request for review in this repo, either in the current directory or in a new isolated worktree at ../yaak-worktrees/pr-<PR_NUMBER>. Use when asked to run or replace the old Claude check-out-pr command.
----
-
-# Check Out PR
-
-Check out a PR by number and let the user choose between current-directory checkout and isolated worktree checkout.
-
-## Workflow
-
-1. Confirm `gh` CLI is available.
-2. If no PR number is provided, list open PRs (`gh pr list`) and ask the user to choose one.
-3. Read PR metadata:
-   - `gh pr view <PR_NUMBER> --json number,headRefName`
-4. Ask the user to choose:
-   - Option A: check out in the current directory
-   - Option B: create a new worktree at `../yaak-worktrees/pr-<PR_NUMBER>`
-
-## Option A: Current Directory
-
-1. Run:
-   - `gh pr checkout <PR_NUMBER>`
-2. Report the checked-out branch.
-
-## Option B: New Worktree
-
-1. Use path:
-   - `../yaak-worktrees/pr-<PR_NUMBER>`
-2. Create the worktree with a timeout of at least 5 minutes because checkout hooks run bootstrap.
-3. In the new worktree, run:
-   - `gh pr checkout <PR_NUMBER>`
-4. Report:
-   - Worktree path
-   - Assigned ports from `.env.local` if present
-   - How to start work:
-     - `cd ../yaak-worktrees/pr-<PR_NUMBER>`
-     - `npm run app-dev`
-   - How to remove when done:
-     - `git worktree remove ../yaak-worktrees/pr-<PR_NUMBER>`
-
-## Error Handling
-
-- If PR does not exist, show a clear error.
-- If worktree already exists, ask whether to reuse it or remove/recreate it.
-- If `gh` is missing, instruct the user to install/authenticate it.

.codex/skills/worktree-management/SKILL.md

@@ -1,37 +0,0 @@
----
-name: worktree-management
-description: Manage Yaak git worktrees using the standard ../yaak-worktrees/<NAME> layout, including creation, removal, and expected automatic setup behavior and port assignments.
----
-
-# Worktree Management
-
-Use the Yaak-standard worktree path layout and lifecycle commands.
-
-## Path Convention
-
-Always create worktrees under:
-
-`../yaak-worktrees/<NAME>`
-
-Examples:
-- `git worktree add ../yaak-worktrees/feature-auth`
-- `git worktree add ../yaak-worktrees/bugfix-login`
-- `git worktree add ../yaak-worktrees/refactor-api`
-
-## Automatic Setup After Checkout
-
-Project git hooks automatically:
-1. Create `.env.local` with unique `YAAK_DEV_PORT` and `YAAK_PLUGIN_MCP_SERVER_PORT`
-2. Copy gitignored editor config folders
-3. Run `npm install && npm run bootstrap`
-
-## Remove Worktree
-
-`git worktree remove ../yaak-worktrees/<NAME>`
-
-## Port Pattern
-
-- Main worktree: Vite `1420`, MCP `64343`
-- First extra worktree: `1421`, `64344`
-- Second extra worktree: `1422`, `64345`
-- Continue incrementally for additional worktrees

AGENTS.md

@@ -1 +1,2 @@
 - Tag safety: app releases use `v*` tags and CLI releases use `yaak-cli-*` tags; always confirm which one is requested before retagging.
+- Do not commit, push, or tag without explicit approval

crates-tauri/yaak-app/src/lib.rs

@@ -37,8 +37,8 @@ use yaak_grpc::{Code, ServiceDefinition, serialize_message};
 use yaak_mac_window::AppHandleMacWindowExt;
 use yaak_models::models::{
     AnyModel, CookieJar, Environment, GrpcConnection, GrpcConnectionState, GrpcEvent,
-    GrpcEventType, HttpRequest, HttpResponse, HttpResponseEvent, HttpResponseState, Plugin,
-    Workspace, WorkspaceMeta,
+    GrpcEventType, HttpRequest, HttpResponse, HttpResponseEvent, HttpResponseState, Workspace,
+    WorkspaceMeta,
 };
 use yaak_models::util::{BatchUpsertResult, UpdateSource, get_workspace_export_resources};
 use yaak_plugins::events::{
@@ -1345,29 +1345,6 @@ async fn cmd_send_http_request<R: Runtime>(
     Ok(r)
 }
 
-#[tauri::command]
-async fn cmd_install_plugin<R: Runtime>(
-    directory: &str,
-    url: Option<String>,
-    plugin_manager: State<'_, PluginManager>,
-    app_handle: AppHandle<R>,
-    window: WebviewWindow<R>,
-) -> YaakResult<Plugin> {
-    let plugin = app_handle.db().upsert_plugin(
-        &Plugin { directory: directory.into(), url, enabled: true, ..Default::default() },
-        &UpdateSource::from_window_label(window.label()),
-    )?;
-
-    plugin_manager
-        .add_plugin(
-            &PluginContext::new(Some(window.label().to_string()), window.workspace_id()),
-            &plugin,
-        )
-        .await?;
-
-    Ok(plugin)
-}
-
 #[tauri::command]
 async fn cmd_reload_plugins<R: Runtime>(
     app_handle: AppHandle<R>,
@@ -1652,7 +1629,6 @@ pub fn run() {
             cmd_workspace_actions,
             cmd_folder_actions,
             cmd_import_data,
-            cmd_install_plugin,
             cmd_metadata,
             cmd_new_child_window,
             cmd_new_main_window,
@@ -1721,6 +1697,7 @@ pub fn run() {
             git_ext::cmd_git_rm_remote,
             //
             // Plugin commands
+            plugins_ext::cmd_plugins_install_from_directory,
             plugins_ext::cmd_plugins_search,
             plugins_ext::cmd_plugins_install,
             plugins_ext::cmd_plugins_uninstall,

crates-tauri/yaak-app/src/models_ext.rs

@@ -15,6 +15,7 @@ use yaak_models::error::Result;
 use yaak_models::models::{AnyModel, GraphQlIntrospection, GrpcEvent, Settings, WebsocketEvent};
 use yaak_models::query_manager::QueryManager;
 use yaak_models::util::UpdateSource;
+use yaak_plugins::manager::PluginManager;
 
 const MODEL_CHANGES_RETENTION_HOURS: i64 = 1;
 const MODEL_CHANGES_POLL_INTERVAL_MS: u64 = 1000;
@@ -255,23 +256,32 @@ pub(crate) fn models_upsert_graphql_introspection<R: Runtime>(
 }
 
 #[tauri::command]
-pub(crate) fn models_workspace_models<R: Runtime>(
+pub(crate) async fn models_workspace_models<R: Runtime>(
     window: WebviewWindow<R>,
     workspace_id: Option<&str>,
+    plugin_manager: State<'_, PluginManager>,
 ) -> Result<String> {
-    let db = window.db();
     let mut l: Vec<AnyModel> = Vec::new();
 
-    // Add the settings
-    l.push(db.get_settings().into());
+    // Add the global models
+    {
+        let db = window.db();
+        l.push(db.get_settings().into());
+        l.append(&mut db.list_workspaces()?.into_iter().map(Into::into).collect());
+        l.append(&mut db.list_key_values()?.into_iter().map(Into::into).collect());
+    }
 
-    // Add global models
-    l.append(&mut db.list_workspaces()?.into_iter().map(Into::into).collect());
-    l.append(&mut db.list_key_values()?.into_iter().map(Into::into).collect());
-    l.append(&mut db.list_plugins()?.into_iter().map(Into::into).collect());
+    let plugins = {
+        let db = window.db();
+        db.list_plugins()?
+    };
+
+    let plugins = plugin_manager.resolve_plugins_for_runtime_from_db(plugins).await;
+    l.append(&mut plugins.into_iter().map(Into::into).collect());
 
     // Add the workspace children
     if let Some(wid) = workspace_id {
+        let db = window.db();
         l.append(&mut db.list_cookie_jars(wid)?.into_iter().map(Into::into).collect());
         l.append(&mut db.list_environments_ensure_base(wid)?.into_iter().map(Into::into).collect());
         l.append(&mut db.list_folders(wid)?.into_iter().map(Into::into).collect());

crates-tauri/yaak-app/src/plugin_events.rs

@@ -19,13 +19,13 @@ use yaak::plugin_events::{
     GroupedPluginEvent, HostRequest, SharedPluginEventContext, handle_shared_plugin_event,
 };
 use yaak_crypto::manager::EncryptionManager;
-use yaak_models::models::{AnyModel, HttpResponse, Plugin};
+use yaak_models::models::{HttpResponse, Plugin};
 use yaak_models::queries::any_request::AnyRequest;
 use yaak_models::util::UpdateSource;
 use yaak_plugins::error::Error::PluginErr;
 use yaak_plugins::events::{
-    Color, EmptyPayload, ErrorResponse, FindHttpResponsesResponse, GetCookieValueResponse, Icon,
-    InternalEvent, InternalEventPayload, ListCookieNamesResponse, ListOpenWorkspacesResponse,
+    Color, EmptyPayload, ErrorResponse, GetCookieValueResponse, Icon, InternalEvent,
+    InternalEventPayload, ListCookieNamesResponse, ListOpenWorkspacesResponse,
     RenderGrpcRequestResponse, RenderHttpRequestResponse, SendHttpRequestResponse,
     ShowToastRequest, TemplateRenderResponse, WindowInfoResponse, WindowNavigateEvent,
     WorkspaceInfo,
@@ -190,71 +190,6 @@ async fn handle_host_plugin_request<R: Runtime>(
                 Ok(None)
             }
         }
-        HostRequest::FindHttpResponses(req) => {
-            let http_responses = app_handle
-                .db()
-                .list_http_responses_for_request(&req.request_id, req.limit.map(|l| l as u64))
-                .unwrap_or_default();
-            Ok(Some(InternalEventPayload::FindHttpResponsesResponse(FindHttpResponsesResponse {
-                http_responses,
-            })))
-        }
-        HostRequest::UpsertModel(req) => {
-            use AnyModel::*;
-            let model = match &req.model {
-                HttpRequest(m) => {
-                    HttpRequest(app_handle.db().upsert_http_request(m, &UpdateSource::Plugin)?)
-                }
-                GrpcRequest(m) => {
-                    GrpcRequest(app_handle.db().upsert_grpc_request(m, &UpdateSource::Plugin)?)
-                }
-                WebsocketRequest(m) => WebsocketRequest(
-                    app_handle.db().upsert_websocket_request(m, &UpdateSource::Plugin)?,
-                ),
-                Folder(m) => Folder(app_handle.db().upsert_folder(m, &UpdateSource::Plugin)?),
-                Environment(m) => {
-                    Environment(app_handle.db().upsert_environment(m, &UpdateSource::Plugin)?)
-                }
-                Workspace(m) => {
-                    Workspace(app_handle.db().upsert_workspace(m, &UpdateSource::Plugin)?)
-                }
-                _ => {
-                    return Err(PluginErr("Upsert not supported for this model type".into()).into());
-                }
-            };
-
-            Ok(Some(InternalEventPayload::UpsertModelResponse(
-                yaak_plugins::events::UpsertModelResponse { model },
-            )))
-        }
-        HostRequest::DeleteModel(req) => {
-            let model = match req.model.as_str() {
-                "http_request" => AnyModel::HttpRequest(
-                    app_handle.db().delete_http_request_by_id(&req.id, &UpdateSource::Plugin)?,
-                ),
-                "grpc_request" => AnyModel::GrpcRequest(
-                    app_handle.db().delete_grpc_request_by_id(&req.id, &UpdateSource::Plugin)?,
-                ),
-                "websocket_request" => AnyModel::WebsocketRequest(
-                    app_handle
-                        .db()
-                        .delete_websocket_request_by_id(&req.id, &UpdateSource::Plugin)?,
-                ),
-                "folder" => AnyModel::Folder(
-                    app_handle.db().delete_folder_by_id(&req.id, &UpdateSource::Plugin)?,
-                ),
-                "environment" => AnyModel::Environment(
-                    app_handle.db().delete_environment_by_id(&req.id, &UpdateSource::Plugin)?,
-                ),
-                _ => {
-                    return Err(PluginErr("Delete not supported for this model type".into()).into());
-                }
-            };
-
-            Ok(Some(InternalEventPayload::DeleteModelResponse(
-                yaak_plugins::events::DeleteModelResponse { model },
-            )))
-        }
         HostRequest::RenderGrpcRequest(req) => {
             let window = get_window_from_plugin_context(app_handle, plugin_context)?;
 

crates-tauri/yaak-app/src/plugins_ext.rs

@@ -22,7 +22,8 @@ use tauri::{
 use tokio::sync::Mutex;
 use ts_rs::TS;
 use yaak_api::yaak_api_client;
-use yaak_models::models::Plugin;
+use yaak_models::models::{Plugin, PluginSource};
+use yaak_models::util::UpdateSource;
 use yaak_plugins::api::{
     PluginNameVersion, PluginSearchResponse, PluginUpdatesResponse, check_plugin_updates,
     search_plugins,
@@ -164,6 +165,28 @@ pub async fn cmd_plugins_install<R: Runtime>(
     Ok(())
 }
 
+#[command]
+pub async fn cmd_plugins_install_from_directory<R: Runtime>(
+    window: WebviewWindow<R>,
+    directory: &str,
+) -> Result<Plugin> {
+    let plugin = window.db().upsert_plugin(
+        &Plugin {
+            directory: directory.into(),
+            url: None,
+            enabled: true,
+            source: PluginSource::Filesystem,
+            ..Default::default()
+        },
+        &UpdateSource::from_window_label(window.label()),
+    )?;
+
+    let plugin_manager = Arc::new((*window.state::<PluginManager>()).clone());
+    plugin_manager.add_plugin(&window.plugin_context(), &plugin).await?;
+
+    Ok(plugin)
+}
+
 #[command]
 pub async fn cmd_plugins_uninstall<R: Runtime>(
     plugin_id: &str,

crates/yaak-http/src/manager.rs

@@ -1,7 +1,6 @@
 use crate::client::HttpConnectionOptions;
 use crate::dns::LocalhostResolver;
 use crate::error::Result;
-use log::info;
 use reqwest::Client;
 use std::collections::BTreeMap;
 use std::sync::Arc;

crates/yaak-models/bindings/gen_models.ts

@@ -67,7 +67,9 @@ export type ParentAuthentication = { authentication: Record<string, any>, authen
 
 export type ParentHeaders = { headers: Array<HttpRequestHeader>, };
 
-export type Plugin = { model: "plugin", id: string, createdAt: string, updatedAt: string, checkedAt: string | null, directory: string, enabled: boolean, url: string | null, };
+export type Plugin = { model: "plugin", id: string, createdAt: string, updatedAt: string, checkedAt: string | null, directory: string, enabled: boolean, url: string | null, source: PluginSource, };
+
+export type PluginSource = "bundled" | "filesystem" | "registry";
 
 export type PluginKeyValue = { model: "plugin_key_value", createdAt: string, updatedAt: string, pluginName: string, key: string, value: string, };
 

crates/yaak-models/migrations/20260301000000_plugin-source-and-unique-directory.sql

@@ -0,0 +1,33 @@
+ALTER TABLE plugins
+    ADD COLUMN source TEXT DEFAULT 'filesystem' NOT NULL;
+
+-- Existing registry installs have a URL; classify them first.
+UPDATE plugins
+SET source = 'registry'
+WHERE url IS NOT NULL;
+
+-- Best-effort bundled backfill for legacy rows.
+UPDATE plugins
+SET source = 'bundled'
+WHERE source = 'filesystem'
+  AND (
+    -- Normalize separators so this also works for Windows paths.
+    replace(directory, '\', '/') LIKE '%/vendored/plugins/%'
+        OR replace(directory, '\', '/') LIKE '%/vendored-plugins/%'
+    );
+
+-- Keep one row per exact directory before adding uniqueness.
+-- Tie-break by recency.
+WITH ranked AS (SELECT id,
+                       ROW_NUMBER() OVER (
+                           PARTITION BY directory
+                           ORDER BY updated_at DESC,
+                               created_at DESC
+                           ) AS row_num
+                FROM plugins)
+DELETE
+FROM plugins
+WHERE id IN (SELECT id FROM ranked WHERE row_num > 1);
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_plugins_directory_unique
+    ON plugins (directory);

crates/yaak-models/src/models.rs

@@ -2074,6 +2074,46 @@ pub struct Plugin {
     pub directory: String,
     pub enabled: bool,
     pub url: Option<String>,
+    pub source: PluginSource,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, TS)]
+#[serde(rename_all = "snake_case")]
+#[ts(export, export_to = "gen_models.ts")]
+pub enum PluginSource {
+    Bundled,
+    Filesystem,
+    Registry,
+}
+
+impl FromStr for PluginSource {
+    type Err = crate::error::Error;
+
+    fn from_str(s: &str) -> Result<Self> {
+        match s {
+            "bundled" => Ok(Self::Bundled),
+            "filesystem" => Ok(Self::Filesystem),
+            "registry" => Ok(Self::Registry),
+            _ => Ok(Self::default()),
+        }
+    }
+}
+
+impl Display for PluginSource {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        let str = match self {
+            PluginSource::Bundled => "bundled".to_string(),
+            PluginSource::Filesystem => "filesystem".to_string(),
+            PluginSource::Registry => "registry".to_string(),
+        };
+        write!(f, "{}", str)
+    }
+}
+
+impl Default for PluginSource {
+    fn default() -> Self {
+        Self::Filesystem
+    }
 }
 
 impl UpsertModelInfo for Plugin {
@@ -2109,6 +2149,7 @@ impl UpsertModelInfo for Plugin {
             (Directory, self.directory.into()),
             (Url, self.url.into()),
             (Enabled, self.enabled.into()),
+            (Source, self.source.to_string().into()),
         ])
     }
 
@@ -2119,6 +2160,7 @@ impl UpsertModelInfo for Plugin {
             PluginIden::Directory,
             PluginIden::Url,
             PluginIden::Enabled,
+            PluginIden::Source,
         ]
     }
 
@@ -2135,6 +2177,7 @@ impl UpsertModelInfo for Plugin {
             url: row.get("url")?,
             directory: row.get("directory")?,
             enabled: row.get("enabled")?,
+            source: PluginSource::from_str(row.get::<_, String>("source")?.as_str()).unwrap(),
         })
     }
 }

crates/yaak-models/src/queries/plugins.rs

@@ -26,6 +26,10 @@ impl<'a> DbContext<'a> {
     }
 
     pub fn upsert_plugin(&self, plugin: &Plugin, source: &UpdateSource) -> Result<Plugin> {
-        self.upsert(plugin, source)
+        let mut plugin_to_upsert = plugin.clone();
+        if let Some(existing) = self.get_plugin_by_directory(&plugin.directory) {
+            plugin_to_upsert.id = existing.id;
+        }
+        self.upsert(&plugin_to_upsert, source)
     }
 }

crates/yaak-plugins/index.ts

@@ -24,3 +24,7 @@ export async function checkPluginUpdates() {
 export async function updateAllPlugins() {
   return invoke<PluginNameVersion[]>('cmd_plugins_update_all', {});
 }
+
+export async function installPluginFromDirectory(directory: string) {
+  return invoke<void>('cmd_plugins_install_from_directory', { directory });
+}

crates/yaak-plugins/src/api.rs

@@ -7,7 +7,7 @@ use serde::{Deserialize, Serialize};
 use std::path::Path;
 use std::str::FromStr;
 use ts_rs::TS;
-use yaak_models::models::Plugin;
+use yaak_models::models::{Plugin, PluginSource};
 
 /// Get plugin info from the registry.
 pub async fn get_plugin(
@@ -58,7 +58,7 @@ pub async fn check_plugin_updates(
 ) -> Result<PluginUpdatesResponse> {
     let name_versions: Vec<PluginNameVersion> = plugins
         .into_iter()
-        .filter(|p| p.url.is_some()) // Only check plugins with URLs (from registry)
+        .filter(|p| matches!(p.source, PluginSource::Registry)) // Only check registry-installed plugins
         .filter_map(|p| match get_plugin_meta(&Path::new(&p.directory)) {
             Ok(m) => Some(PluginNameVersion { name: m.name, version: m.version }),
             Err(e) => {

crates/yaak-plugins/src/install.rs

@@ -9,7 +9,7 @@ use log::info;
 use std::fs::{create_dir_all, remove_dir_all};
 use std::io::Cursor;
 use std::sync::Arc;
-use yaak_models::models::Plugin;
+use yaak_models::models::{Plugin, PluginSource};
 use yaak_models::query_manager::QueryManager;
 use yaak_models::util::UpdateSource;
 
@@ -78,6 +78,7 @@ pub async fn download_and_install(
                 directory: plugin_dir_str.clone(),
                 enabled: true,
                 url: Some(plugin_version.url.clone()),
+                source: PluginSource::Registry,
                 ..Default::default()
             },
             &UpdateSource::Background,

crates/yaak-plugins/src/manager.rs

@@ -21,9 +21,10 @@ use crate::events::{
 use crate::native_template_functions::{template_function_keyring, template_function_secure};
 use crate::nodejs::start_nodejs_plugin_runtime;
 use crate::plugin_handle::PluginHandle;
+use crate::plugin_meta::get_plugin_meta;
 use crate::server_ws::PluginRuntimeServerWebsocket;
 use log::{error, info, warn};
-use std::collections::HashMap;
+use std::collections::{HashMap, HashSet};
 use std::env;
 use std::path::{Path, PathBuf};
 use std::sync::Arc;
@@ -33,7 +34,7 @@ use tokio::net::TcpListener;
 use tokio::sync::mpsc::error::TrySendError;
 use tokio::sync::{Mutex, mpsc, oneshot};
 use tokio::time::{Instant, timeout};
-use yaak_models::models::Plugin;
+use yaak_models::models::{Plugin, PluginSource};
 use yaak_models::query_manager::QueryManager;
 use yaak_models::util::{UpdateSource, generate_id};
 use yaak_templates::error::Error::RenderError;
@@ -162,13 +163,14 @@ impl PluginManager {
 
         let bundled_dirs = plugin_manager.list_bundled_plugin_dirs().await?;
         let db = query_manager.connect();
-        for dir in bundled_dirs {
-            if db.get_plugin_by_directory(&dir).is_none() {
+        for dir in &bundled_dirs {
+            if db.get_plugin_by_directory(dir).is_none() {
                 db.upsert_plugin(
                     &Plugin {
-                        directory: dir,
+                        directory: dir.clone(),
                         enabled: true,
                         url: None,
+                        source: PluginSource::Bundled,
                         ..Default::default()
                     },
                     &UpdateSource::Background,
@@ -213,6 +215,57 @@ impl PluginManager {
         read_plugins_dir(&plugins_dir).await
     }
 
+    pub async fn resolve_plugins_for_runtime_from_db(&self, plugins: Vec<Plugin>) -> Vec<Plugin> {
+        let bundled_dirs = match self.list_bundled_plugin_dirs().await {
+            Ok(dirs) => dirs,
+            Err(err) => {
+                warn!("Failed to read bundled plugin dirs for resolution: {err:?}");
+                Vec::new()
+            }
+        };
+        self.resolve_plugins_for_runtime(plugins, bundled_dirs)
+    }
+
+    /// Resolve the plugin set for the current runtime instance.
+    ///
+    /// Rules:
+    /// - Drop bundled rows that are not present in this instance's bundled directory list.
+    /// - Deduplicate by plugin metadata name (fallback to directory key when metadata is unreadable).
+    /// - Prefer sources in this order: filesystem > registry > bundled.
+    /// - For same-source conflicts, prefer the most recently installed row (`created_at`).
+    fn resolve_plugins_for_runtime(
+        &self,
+        plugins: Vec<Plugin>,
+        bundled_dirs: Vec<String>,
+    ) -> Vec<Plugin> {
+        let bundled_dir_set: HashSet<String> = bundled_dirs.into_iter().collect();
+        let mut selected: HashMap<String, Plugin> = HashMap::new();
+
+        for plugin in plugins {
+            if matches!(plugin.source, PluginSource::Bundled)
+                && !bundled_dir_set.contains(&plugin.directory)
+            {
+                continue;
+            }
+
+            let key = match get_plugin_meta(Path::new(&plugin.directory)) {
+                Ok(meta) => meta.name,
+                Err(_) => format!("__dir__{}", plugin.directory),
+            };
+
+            match selected.get(&key) {
+                Some(existing) if !prefer_plugin(&plugin, existing) => {}
+                _ => {
+                    selected.insert(key, plugin);
+                }
+            }
+        }
+
+        let mut resolved = selected.into_values().collect::<Vec<_>>();
+        resolved.sort_by(|a, b| b.created_at.cmp(&a.created_at));
+        resolved
+    }
+
     pub async fn uninstall(&self, plugin_context: &PluginContext, dir: &str) -> Result<()> {
         let plugin = self.get_plugin_by_dir(dir).await.ok_or(PluginNotFoundErr(dir.to_string()))?;
         self.remove_plugin(plugin_context, &plugin).await
@@ -287,7 +340,8 @@ impl PluginManager {
         Ok(())
     }
 
-    /// Initialize all plugins from the provided list.
+    /// Initialize all plugins from the provided DB list.
+    /// Plugin candidates are resolved for this runtime instance before initialization.
     /// Returns a list of (plugin_directory, error_message) for any plugins that failed to initialize.
     pub async fn initialize_all_plugins(
         &self,
@@ -297,15 +351,18 @@ impl PluginManager {
         info!("Initializing all plugins");
         let start = Instant::now();
         let mut errors = Vec::new();
+        let plugins = self.resolve_plugins_for_runtime_from_db(plugins).await;
+
+        // Rebuild runtime handles from scratch to avoid stale/duplicate handles.
+        let existing_handles = { self.plugin_handles.lock().await.clone() };
+        for plugin_handle in existing_handles {
+            if let Err(e) = self.remove_plugin(plugin_context, &plugin_handle).await {
+                error!("Failed to remove plugin {} {e:?}", plugin_handle.dir);
+                errors.push((plugin_handle.dir.clone(), e.to_string()));
+            }
+        }
 
         for plugin in plugins {
-            // First remove the plugin if it exists and is enabled
-            if let Some(plugin_handle) = self.get_plugin_by_dir(&plugin.directory).await {
-                if let Err(e) = self.remove_plugin(plugin_context, &plugin_handle).await {
-                    error!("Failed to remove plugin {} {e:?}", plugin.directory);
-                    continue;
-                }
-            }
             if let Err(e) = self.add_plugin(plugin_context, &plugin).await {
                 warn!("Failed to add plugin {} {e:?}", plugin.directory);
                 errors.push((plugin.directory.clone(), e.to_string()));
@@ -1063,6 +1120,24 @@ impl PluginManager {
     }
 }
 
+fn source_priority(source: &PluginSource) -> i32 {
+    match source {
+        PluginSource::Filesystem => 3,
+        PluginSource::Registry => 2,
+        PluginSource::Bundled => 1,
+    }
+}
+
+fn prefer_plugin(candidate: &Plugin, existing: &Plugin) -> bool {
+    let candidate_priority = source_priority(&candidate.source);
+    let existing_priority = source_priority(&existing.source);
+    if candidate_priority != existing_priority {
+        return candidate_priority > existing_priority;
+    }
+
+    candidate.created_at > existing.created_at
+}
+
 async fn read_plugins_dir(dir: &PathBuf) -> Result<Vec<String>> {
     let mut result = read_dir(dir).await?;
     let mut dirs: Vec<String> = vec![];

crates/yaak/src/plugin_events.rs

@@ -1,14 +1,16 @@
+use yaak_models::models::AnyModel;
 use yaak_models::query_manager::QueryManager;
+use yaak_models::util::UpdateSource;
 use yaak_plugins::events::{
     CloseWindowRequest, CopyTextRequest, DeleteKeyValueRequest, DeleteKeyValueResponse,
-    DeleteModelRequest, ErrorResponse, FindHttpResponsesRequest, GetCookieValueRequest,
-    GetHttpRequestByIdRequest, GetHttpRequestByIdResponse, GetKeyValueRequest, GetKeyValueResponse,
-    InternalEventPayload, ListCookieNamesRequest, ListFoldersRequest, ListFoldersResponse,
-    ListHttpRequestsRequest, ListHttpRequestsResponse, ListOpenWorkspacesRequest,
-    OpenExternalUrlRequest, OpenWindowRequest, PromptFormRequest, PromptTextRequest,
-    ReloadResponse, RenderGrpcRequestRequest, RenderHttpRequestRequest, SendHttpRequestRequest,
-    SetKeyValueRequest, ShowToastRequest, TemplateRenderRequest, UpsertModelRequest,
-    WindowInfoRequest,
+    DeleteModelRequest, DeleteModelResponse, ErrorResponse, FindHttpResponsesRequest,
+    FindHttpResponsesResponse, GetCookieValueRequest, GetHttpRequestByIdRequest,
+    GetHttpRequestByIdResponse, GetKeyValueRequest, GetKeyValueResponse, InternalEventPayload,
+    ListCookieNamesRequest, ListFoldersRequest, ListFoldersResponse, ListHttpRequestsRequest,
+    ListHttpRequestsResponse, ListOpenWorkspacesRequest, OpenExternalUrlRequest, OpenWindowRequest,
+    PromptFormRequest, PromptTextRequest, ReloadResponse, RenderGrpcRequestRequest,
+    RenderHttpRequestRequest, SendHttpRequestRequest, SetKeyValueRequest, ShowToastRequest,
+    TemplateRenderRequest, UpsertModelRequest, UpsertModelResponse, WindowInfoRequest,
 };
 
 pub struct SharedPluginEventContext<'a> {
@@ -37,6 +39,9 @@ pub enum SharedRequest<'a> {
     GetHttpRequestById(&'a GetHttpRequestByIdRequest),
     ListFolders(&'a ListFoldersRequest),
     ListHttpRequests(&'a ListHttpRequestsRequest),
+    FindHttpResponses(&'a FindHttpResponsesRequest),
+    UpsertModel(&'a UpsertModelRequest),
+    DeleteModel(&'a DeleteModelRequest),
 }
 
 #[derive(Debug)]
@@ -45,9 +50,6 @@ pub enum HostRequest<'a> {
     CopyText(&'a CopyTextRequest),
     PromptText(&'a PromptTextRequest),
     PromptForm(&'a PromptFormRequest),
-    FindHttpResponses(&'a FindHttpResponsesRequest),
-    UpsertModel(&'a UpsertModelRequest),
-    DeleteModel(&'a DeleteModelRequest),
     RenderGrpcRequest(&'a RenderGrpcRequestRequest),
     RenderHttpRequest(&'a RenderHttpRequestRequest),
     TemplateRender(&'a TemplateRenderRequest),
@@ -71,9 +73,6 @@ impl HostRequest<'_> {
             HostRequest::CopyText(_) => "copy_text_request".to_string(),
             HostRequest::PromptText(_) => "prompt_text_request".to_string(),
             HostRequest::PromptForm(_) => "prompt_form_request".to_string(),
-            HostRequest::FindHttpResponses(_) => "find_http_responses_request".to_string(),
-            HostRequest::UpsertModel(_) => "upsert_model_request".to_string(),
-            HostRequest::DeleteModel(_) => "delete_model_request".to_string(),
             HostRequest::RenderGrpcRequest(_) => "render_grpc_request_request".to_string(),
             HostRequest::RenderHttpRequest(_) => "render_http_request_request".to_string(),
             HostRequest::TemplateRender(_) => "template_render_request".to_string(),
@@ -135,13 +134,13 @@ impl<'a> From<&'a InternalEventPayload> for GroupedPluginRequest<'a> {
                 GroupedPluginRequest::Host(HostRequest::PromptForm(req))
             }
             InternalEventPayload::FindHttpResponsesRequest(req) => {
-                GroupedPluginRequest::Host(HostRequest::FindHttpResponses(req))
+                GroupedPluginRequest::Shared(SharedRequest::FindHttpResponses(req))
             }
             InternalEventPayload::UpsertModelRequest(req) => {
-                GroupedPluginRequest::Host(HostRequest::UpsertModel(req))
+                GroupedPluginRequest::Shared(SharedRequest::UpsertModel(req))
             }
             InternalEventPayload::DeleteModelRequest(req) => {
-                GroupedPluginRequest::Host(HostRequest::DeleteModel(req))
+                GroupedPluginRequest::Shared(SharedRequest::DeleteModel(req))
             }
             InternalEventPayload::RenderGrpcRequestRequest(req) => {
                 GroupedPluginRequest::Host(HostRequest::RenderGrpcRequest(req))
@@ -275,17 +274,175 @@ fn build_shared_reply(
                 http_requests,
             })
         }
+        SharedRequest::FindHttpResponses(req) => {
+            let http_responses = query_manager
+                .connect()
+                .list_http_responses_for_request(&req.request_id, req.limit.map(|l| l as u64))
+                .unwrap_or_default();
+            InternalEventPayload::FindHttpResponsesResponse(FindHttpResponsesResponse {
+                http_responses,
+            })
+        }
+        SharedRequest::UpsertModel(req) => {
+            use AnyModel::*;
+
+            let model = match &req.model {
+                HttpRequest(m) => {
+                    match query_manager.connect().upsert_http_request(m, &UpdateSource::Plugin) {
+                        Ok(model) => HttpRequest(model),
+                        Err(err) => {
+                            return InternalEventPayload::ErrorResponse(ErrorResponse {
+                                error: format!("Failed to upsert HTTP request: {err}"),
+                            });
+                        }
+                    }
+                }
+                GrpcRequest(m) => {
+                    match query_manager.connect().upsert_grpc_request(m, &UpdateSource::Plugin) {
+                        Ok(model) => GrpcRequest(model),
+                        Err(err) => {
+                            return InternalEventPayload::ErrorResponse(ErrorResponse {
+                                error: format!("Failed to upsert gRPC request: {err}"),
+                            });
+                        }
+                    }
+                }
+                WebsocketRequest(m) => {
+                    match query_manager.connect().upsert_websocket_request(m, &UpdateSource::Plugin)
+                    {
+                        Ok(model) => WebsocketRequest(model),
+                        Err(err) => {
+                            return InternalEventPayload::ErrorResponse(ErrorResponse {
+                                error: format!("Failed to upsert WebSocket request: {err}"),
+                            });
+                        }
+                    }
+                }
+                Folder(m) => {
+                    match query_manager.connect().upsert_folder(m, &UpdateSource::Plugin) {
+                        Ok(model) => Folder(model),
+                        Err(err) => {
+                            return InternalEventPayload::ErrorResponse(ErrorResponse {
+                                error: format!("Failed to upsert folder: {err}"),
+                            });
+                        }
+                    }
+                }
+                Environment(m) => {
+                    match query_manager.connect().upsert_environment(m, &UpdateSource::Plugin) {
+                        Ok(model) => Environment(model),
+                        Err(err) => {
+                            return InternalEventPayload::ErrorResponse(ErrorResponse {
+                                error: format!("Failed to upsert environment: {err}"),
+                            });
+                        }
+                    }
+                }
+                Workspace(m) => {
+                    match query_manager.connect().upsert_workspace(m, &UpdateSource::Plugin) {
+                        Ok(model) => Workspace(model),
+                        Err(err) => {
+                            return InternalEventPayload::ErrorResponse(ErrorResponse {
+                                error: format!("Failed to upsert workspace: {err}"),
+                            });
+                        }
+                    }
+                }
+                _ => {
+                    return InternalEventPayload::ErrorResponse(ErrorResponse {
+                        error: "Upsert not supported for this model type".to_string(),
+                    });
+                }
+            };
+
+            InternalEventPayload::UpsertModelResponse(UpsertModelResponse { model })
+        }
+        SharedRequest::DeleteModel(req) => {
+            let model = match req.model.as_str() {
+                "http_request" => {
+                    match query_manager
+                        .connect()
+                        .delete_http_request_by_id(&req.id, &UpdateSource::Plugin)
+                    {
+                        Ok(model) => AnyModel::HttpRequest(model),
+                        Err(err) => {
+                            return InternalEventPayload::ErrorResponse(ErrorResponse {
+                                error: format!("Failed to delete HTTP request: {err}"),
+                            });
+                        }
+                    }
+                }
+                "grpc_request" => {
+                    match query_manager
+                        .connect()
+                        .delete_grpc_request_by_id(&req.id, &UpdateSource::Plugin)
+                    {
+                        Ok(model) => AnyModel::GrpcRequest(model),
+                        Err(err) => {
+                            return InternalEventPayload::ErrorResponse(ErrorResponse {
+                                error: format!("Failed to delete gRPC request: {err}"),
+                            });
+                        }
+                    }
+                }
+                "websocket_request" => {
+                    match query_manager
+                        .connect()
+                        .delete_websocket_request_by_id(&req.id, &UpdateSource::Plugin)
+                    {
+                        Ok(model) => AnyModel::WebsocketRequest(model),
+                        Err(err) => {
+                            return InternalEventPayload::ErrorResponse(ErrorResponse {
+                                error: format!("Failed to delete WebSocket request: {err}"),
+                            });
+                        }
+                    }
+                }
+                "folder" => match query_manager
+                    .connect()
+                    .delete_folder_by_id(&req.id, &UpdateSource::Plugin)
+                {
+                    Ok(model) => AnyModel::Folder(model),
+                    Err(err) => {
+                        return InternalEventPayload::ErrorResponse(ErrorResponse {
+                            error: format!("Failed to delete folder: {err}"),
+                        });
+                    }
+                },
+                "environment" => {
+                    match query_manager
+                        .connect()
+                        .delete_environment_by_id(&req.id, &UpdateSource::Plugin)
+                    {
+                        Ok(model) => AnyModel::Environment(model),
+                        Err(err) => {
+                            return InternalEventPayload::ErrorResponse(ErrorResponse {
+                                error: format!("Failed to delete environment: {err}"),
+                            });
+                        }
+                    }
+                }
+                _ => {
+                    return InternalEventPayload::ErrorResponse(ErrorResponse {
+                        error: "Delete not supported for this model type".to_string(),
+                    });
+                }
+            };
+
+            InternalEventPayload::DeleteModelResponse(DeleteModelResponse { model })
+        }
     }
 }
 
 #[cfg(test)]
 mod tests {
     use super::*;
-    use yaak_models::models::{Folder, HttpRequest, Workspace};
+    use tempfile::TempDir;
+    use yaak_models::models::{AnyModel, Folder, HttpRequest, Workspace};
     use yaak_models::util::UpdateSource;
 
-    fn seed_query_manager() -> QueryManager {
-        let temp_dir = tempfile::TempDir::new().expect("Failed to create temp dir");
+    fn seed_query_manager() -> (QueryManager, TempDir) {
+        let temp_dir = TempDir::new().expect("Failed to create temp dir");
         let db_path = temp_dir.path().join("db.sqlite");
         let blob_path = temp_dir.path().join("blobs.sqlite");
         let (query_manager, _blob_manager, _rx) =
@@ -332,12 +489,12 @@ mod tests {
             )
             .expect("Failed to seed request");
 
-        query_manager
+        (query_manager, temp_dir)
     }
 
     #[test]
     fn list_requests_requires_workspace_when_folder_missing() {
-        let query_manager = seed_query_manager();
+        let (query_manager, _temp_dir) = seed_query_manager();
         let payload = InternalEventPayload::ListHttpRequestsRequest(
             yaak_plugins::events::ListHttpRequestsRequest { folder_id: None },
         );
@@ -355,7 +512,7 @@ mod tests {
 
     #[test]
     fn list_requests_by_workspace_and_folder() {
-        let query_manager = seed_query_manager();
+        let (query_manager, _temp_dir) = seed_query_manager();
 
         let by_workspace_payload = InternalEventPayload::ListHttpRequestsRequest(
             yaak_plugins::events::ListHttpRequestsRequest { folder_id: None },
@@ -394,9 +551,83 @@ mod tests {
         }
     }
 
+    #[test]
+    fn find_http_responses_is_shared_handled() {
+        let (query_manager, _temp_dir) = seed_query_manager();
+        let payload = InternalEventPayload::FindHttpResponsesRequest(FindHttpResponsesRequest {
+            request_id: "rq_test".to_string(),
+            limit: Some(1),
+        });
+
+        let result = handle_shared_plugin_event(
+            &query_manager,
+            &payload,
+            SharedPluginEventContext { plugin_name: "@yaak/test", workspace_id: Some("wk_test") },
+        );
+
+        match result {
+            GroupedPluginEvent::Handled(Some(InternalEventPayload::FindHttpResponsesResponse(
+                resp,
+            ))) => {
+                assert!(resp.http_responses.is_empty());
+            }
+            other => panic!("unexpected find responses result: {other:?}"),
+        }
+    }
+
+    #[test]
+    fn upsert_and_delete_model_are_shared_handled() {
+        let (query_manager, _temp_dir) = seed_query_manager();
+
+        let existing = query_manager
+            .connect()
+            .get_http_request("rq_test")
+            .expect("Failed to load seeded request");
+        let upsert_payload = InternalEventPayload::UpsertModelRequest(UpsertModelRequest {
+            model: AnyModel::HttpRequest(HttpRequest {
+                name: "Request Updated".to_string(),
+                ..existing
+            }),
+        });
+
+        let upsert_result = handle_shared_plugin_event(
+            &query_manager,
+            &upsert_payload,
+            SharedPluginEventContext { plugin_name: "@yaak/test", workspace_id: Some("wk_test") },
+        );
+        match upsert_result {
+            GroupedPluginEvent::Handled(Some(InternalEventPayload::UpsertModelResponse(resp))) => {
+                match resp.model {
+                    AnyModel::HttpRequest(r) => assert_eq!(r.name, "Request Updated"),
+                    other => panic!("unexpected upsert model type: {other:?}"),
+                }
+            }
+            other => panic!("unexpected upsert result: {other:?}"),
+        }
+
+        let delete_payload = InternalEventPayload::DeleteModelRequest(DeleteModelRequest {
+            model: "http_request".to_string(),
+            id: "rq_test".to_string(),
+        });
+        let delete_result = handle_shared_plugin_event(
+            &query_manager,
+            &delete_payload,
+            SharedPluginEventContext { plugin_name: "@yaak/test", workspace_id: Some("wk_test") },
+        );
+        match delete_result {
+            GroupedPluginEvent::Handled(Some(InternalEventPayload::DeleteModelResponse(resp))) => {
+                match resp.model {
+                    AnyModel::HttpRequest(r) => assert_eq!(r.id, "rq_test"),
+                    other => panic!("unexpected delete model type: {other:?}"),
+                }
+            }
+            other => panic!("unexpected delete result: {other:?}"),
+        }
+    }
+
     #[test]
     fn host_request_classification_works() {
-        let query_manager = seed_query_manager();
+        let (query_manager, _temp_dir) = seed_query_manager();
         let payload = InternalEventPayload::WindowInfoRequest(WindowInfoRequest {
             label: "main".to_string(),
         });

package-lock.json

@@ -1491,29 +1491,6 @@
         "hono": "^4"
       }
     },
-    "node_modules/@isaacs/balanced-match": {
-      "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/@isaacs/balanced-match/-/balanced-match-4.0.1.tgz",
-      "integrity": "sha512-yzMTt9lEb8Gv7zRioUilSglI0c0smZ9k5D65677DLWLtWJaXIS3CqcGyUFByYKlnUj6TkjLVs54fBl6+TiGQDQ==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": "20 || >=22"
-      }
-    },
-    "node_modules/@isaacs/brace-expansion": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/@isaacs/brace-expansion/-/brace-expansion-5.0.0.tgz",
-      "integrity": "sha512-ZT55BDLV0yv0RBm2czMiZ+SqCGO7AvmOM3G/w2xhVPH+te0aKgFjmBvGlL1dH+ql2tgGO3MVrbb3jCKyvpgnxA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@isaacs/balanced-match": "^4.0.1"
-      },
-      "engines": {
-        "node": "20 || >=22"
-      }
-    },
     "node_modules/@isaacs/cliui": {
       "version": "8.0.2",
       "resolved": "https://registry.npmjs.org/@isaacs/cliui/-/cliui-8.0.2.tgz",
@@ -5799,17 +5776,40 @@
         "npm": ">=10"
       }
     },
+    "node_modules/cpx2/node_modules/balanced-match": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
+      "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "18 || 20 || >=22"
+      }
+    },
+    "node_modules/cpx2/node_modules/brace-expansion": {
+      "version": "5.0.3",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.3.tgz",
+      "integrity": "sha512-fy6KJm2RawA5RcHkLa1z/ScpBeA762UF9KmZQxwIbDtRJrgLzM10depAiEQ+CXYcoiqW1/m96OAAoke2nE9EeA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^4.0.2"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
+      }
+    },
     "node_modules/cpx2/node_modules/minimatch": {
-      "version": "10.1.1",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.1.1.tgz",
-      "integrity": "sha512-enIvLvRAFZYXJzkCYG5RKmPfrFArdLv+R+lbQ53BmIMLIry74bjKzX6iHAm8WYamJkhSSEabrWN5D97XnKObjQ==",
+      "version": "10.2.4",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.4.tgz",
+      "integrity": "sha512-oRjTw/97aTBN0RHbYCdtF1MQfvusSIBQM0IZEgzl6426+8jSC0nF1a/GmnVLpfB9yyr6g6FTqWqiZVbxrtaCIg==",
       "dev": true,
       "license": "BlueOak-1.0.0",
       "dependencies": {
-        "@isaacs/brace-expansion": "^5.0.0"
+        "brace-expansion": "^5.0.2"
       },
       "engines": {
-        "node": "20 || >=22"
+        "node": "18 || 20 || >=22"
       },
       "funding": {
         "url": "https://github.com/sponsors/isaacs"
@@ -7636,17 +7636,40 @@
         "node": ">= 6"
       }
     },
+    "node_modules/glob/node_modules/balanced-match": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
+      "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "18 || 20 || >=22"
+      }
+    },
+    "node_modules/glob/node_modules/brace-expansion": {
+      "version": "5.0.3",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.3.tgz",
+      "integrity": "sha512-fy6KJm2RawA5RcHkLa1z/ScpBeA762UF9KmZQxwIbDtRJrgLzM10depAiEQ+CXYcoiqW1/m96OAAoke2nE9EeA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^4.0.2"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
+      }
+    },
     "node_modules/glob/node_modules/minimatch": {
-      "version": "10.1.1",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.1.1.tgz",
-      "integrity": "sha512-enIvLvRAFZYXJzkCYG5RKmPfrFArdLv+R+lbQ53BmIMLIry74bjKzX6iHAm8WYamJkhSSEabrWN5D97XnKObjQ==",
+      "version": "10.2.4",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.4.tgz",
+      "integrity": "sha512-oRjTw/97aTBN0RHbYCdtF1MQfvusSIBQM0IZEgzl6426+8jSC0nF1a/GmnVLpfB9yyr6g6FTqWqiZVbxrtaCIg==",
       "dev": true,
       "license": "BlueOak-1.0.0",
       "dependencies": {
-        "@isaacs/brace-expansion": "^5.0.0"
+        "brace-expansion": "^5.0.2"
       },
       "engines": {
-        "node": "20 || >=22"
+        "node": "18 || 20 || >=22"
       },
       "funding": {
         "url": "https://github.com/sponsors/isaacs"
@@ -10524,9 +10547,9 @@
       "license": "ISC"
     },
     "node_modules/minimatch": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
-      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -12951,6 +12974,29 @@
         "url": "https://github.com/sponsors/isaacs"
       }
     },
+    "node_modules/rimraf/node_modules/balanced-match": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
+      "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "18 || 20 || >=22"
+      }
+    },
+    "node_modules/rimraf/node_modules/brace-expansion": {
+      "version": "5.0.3",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.3.tgz",
+      "integrity": "sha512-fy6KJm2RawA5RcHkLa1z/ScpBeA762UF9KmZQxwIbDtRJrgLzM10depAiEQ+CXYcoiqW1/m96OAAoke2nE9EeA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^4.0.2"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
+      }
+    },
     "node_modules/rimraf/node_modules/glob": {
       "version": "13.0.0",
       "resolved": "https://registry.npmjs.org/glob/-/glob-13.0.0.tgz",
@@ -12970,16 +13016,16 @@
       }
     },
     "node_modules/rimraf/node_modules/minimatch": {
-      "version": "10.1.1",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.1.1.tgz",
-      "integrity": "sha512-enIvLvRAFZYXJzkCYG5RKmPfrFArdLv+R+lbQ53BmIMLIry74bjKzX6iHAm8WYamJkhSSEabrWN5D97XnKObjQ==",
+      "version": "10.2.4",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.4.tgz",
+      "integrity": "sha512-oRjTw/97aTBN0RHbYCdtF1MQfvusSIBQM0IZEgzl6426+8jSC0nF1a/GmnVLpfB9yyr6g6FTqWqiZVbxrtaCIg==",
       "dev": true,
       "license": "BlueOak-1.0.0",
       "dependencies": {
-        "@isaacs/brace-expansion": "^5.0.0"
+        "brace-expansion": "^5.0.2"
       },
       "engines": {
-        "node": "20 || >=22"
+        "node": "18 || 20 || >=22"
       },
       "funding": {
         "url": "https://github.com/sponsors/isaacs"

plugins/action-copy-grpcurl/src/index.ts

@@ -11,7 +11,7 @@ export const plugin: PluginDefinition = {
       async onSelect(ctx, args) {
         const rendered_request = await ctx.grpcRequest.render({
           grpcRequest: args.grpcRequest,
-          purpose: 'preview',
+          purpose: 'send',
         });
         const data = await convert(rendered_request, args.protoFiles);
         await ctx.clipboard.copyText(data);
@@ -103,7 +103,7 @@ export async function convert(request: Partial<GrpcRequest>, allProtoFiles: stri
 
   // Add form params
   if (request.message) {
-    xs.push('-d', `${quote(JSON.stringify(JSON.parse(request.message)))}`);
+    xs.push('-d', quote(request.message));
     xs.push(NEWLINE);
   }
 

plugins/action-copy-grpcurl/tests/index.test.ts

@@ -151,7 +151,26 @@ describe('exporter-curl', () => {
       [
         `grpcurl -import-path '/'`,
         `-proto '/foo.proto'`,
-        `-d '{"foo":"bar","baz":1}'`,
+        `-d '{\n  "foo": "bar",\n  "baz": 1\n}'`,
+        'yaak.app',
+      ].join(' \\\n  '),
+    );
+  });
+
+  test('Sends data with unresolved template tags', async () => {
+    expect(
+      await convert(
+        {
+          url: 'https://yaak.app',
+          message: '{"timestamp": ${[ faker "timestamp" ]}, "foo": "bar"}',
+        },
+        ['/foo.proto'],
+      ),
+    ).toEqual(
+      [
+        `grpcurl -import-path '/'`,
+        `-proto '/foo.proto'`,
+        `-d '{"timestamp": \${[ faker "timestamp" ]}, "foo": "bar"}'`,
         'yaak.app',
       ].join(' \\\n  '),
     );

plugins/importer-openapi/tests/index.test.ts

@@ -7,6 +7,29 @@ describe('importer-openapi', () => {
   const p = path.join(__dirname, 'fixtures');
   const fixtures = fs.readdirSync(p);
 
+  test('Maps operation description to request description', async () => {
+    const imported = await convertOpenApi(
+      JSON.stringify({
+        openapi: '3.0.0',
+        info: { title: 'Description Test', version: '1.0.0' },
+        paths: {
+          '/klanten': {
+            get: {
+              description: 'Lijst van klanten',
+              responses: { '200': { description: 'ok' } },
+            },
+          },
+        },
+      }),
+    );
+
+    expect(imported?.resources.httpRequests).toEqual([
+      expect.objectContaining({
+        description: 'Lijst van klanten',
+      }),
+    ]);
+  });
+
   test('Skips invalid file', async () => {
     const imported = await convertOpenApi('{}');
     expect(imported).toBeUndefined();

plugins/importer-postman/src/index.ts

@@ -55,19 +55,11 @@ export function convertPostman(contents: string): ImportPluginResponse | undefin
     folders: [],
   };
 
-  const rawDescription = info.description;
-  const description =
-    typeof rawDescription === 'object' && rawDescription != null && 'content' in rawDescription
-      ? String(rawDescription.content)
-      : rawDescription == null
-        ? undefined
-        : String(rawDescription);
-
   const workspace: ExportResources['workspaces'][0] = {
     model: 'workspace',
     id: generateId('workspace'),
     name: info.name ? String(info.name) : 'Postman Import',
-    description,
+    description: importDescription(info.description),
     ...globalAuth,
   };
   exportResources.workspaces.push(workspace);
@@ -139,7 +131,7 @@ export function convertPostman(contents: string): ImportPluginResponse | undefin
         workspaceId: workspace.id,
         folderId,
         name: v.name,
-        description: r.description ? String(r.description) : undefined,
+        description: importDescription(r.description),
         method: typeof r.method === 'string' ? r.method : 'GET',
         url,
         urlParameters,
@@ -509,6 +501,26 @@ function toArray<T>(value: unknown): T[] {
   return [];
 }
 
+function importDescription(rawDescription: unknown): string | undefined {
+  if (rawDescription == null) {
+    return undefined;
+  }
+
+  if (typeof rawDescription === 'string') {
+    return rawDescription;
+  }
+
+  if (typeof rawDescription === 'object' && !Array.isArray(rawDescription)) {
+    const description = toRecord(rawDescription);
+    if ('content' in description && description.content != null) {
+      return String(description.content);
+    }
+    return undefined;
+  }
+
+  return String(rawDescription);
+}
+
 /** Recursively render all nested object properties */
 function convertTemplateSyntax<T>(obj: T): T {
   if (typeof obj === 'string') {

plugins/importer-postman/tests/index.test.ts

@@ -22,4 +22,39 @@ describe('importer-postman', () => {
       );
     });
   }
+
+  test('Imports object descriptions without [object Object]', () => {
+    const result = convertPostman(
+      JSON.stringify({
+        info: {
+          name: 'Description Test',
+          schema: 'https://schema.getpostman.com/json/collection/v2.1.0/collection.json',
+        },
+        item: [
+          {
+            name: 'Request 1',
+            request: {
+              method: 'GET',
+              description: {
+                content: 'Lijst van klanten',
+                type: 'text/plain',
+              },
+            },
+          },
+        ],
+      }),
+    );
+
+    expect(result?.resources.workspaces).toEqual([
+      expect.objectContaining({
+        name: 'Description Test',
+      }),
+    ]);
+    expect(result?.resources.httpRequests).toEqual([
+      expect.objectContaining({
+        name: 'Request 1',
+        description: 'Lijst van klanten',
+      }),
+    ]);
+  });
 });

plugins/template-function-timestamp/package.json

@@ -1,5 +1,7 @@
 {
   "name": "@yaak/template-function-timestamp",
+  "displayName": "Timestamp Template Functions",
+  "description": "Template functions for dealing with timestamps",
   "private": true,
   "version": "0.1.0",
   "scripts": {

src-web/components/Settings/SettingsPlugins.tsx

@@ -15,7 +15,6 @@ import { useDebouncedValue } from '../../hooks/useDebouncedValue';
 import { useInstallPlugin } from '../../hooks/useInstallPlugin';
 import { usePluginInfo } from '../../hooks/usePluginInfo';
 import { usePluginsKey, useRefreshPlugins } from '../../hooks/usePlugins';
-import { appInfo } from '../../lib/appInfo';
 import { showConfirmDelete } from '../../lib/confirm';
 import { minPromiseMillis } from '../../lib/minPromiseMillis';
 import { Button } from '../core/Button';
@@ -33,16 +32,6 @@ import { TabContent, Tabs } from '../core/Tabs/Tabs';
 import { EmptyStateText } from '../EmptyStateText';
 import { SelectFile } from '../SelectFile';
 
-function isPluginBundled(plugin: Plugin, vendoredPluginDir: string): boolean {
-  const normalizedDir = plugin.directory.replace(/\\/g, '/');
-  const normalizedVendoredDir = vendoredPluginDir.replace(/\\/g, '/');
-  return (
-    normalizedDir.includes(normalizedVendoredDir) ||
-    normalizedDir.includes('vendored/plugins') ||
-    normalizedDir.includes('/plugins/')
-  );
-}
-
 interface SettingsPluginsProps {
   defaultSubtab?: string;
 }
@@ -50,8 +39,8 @@ interface SettingsPluginsProps {
 export function SettingsPlugins({ defaultSubtab }: SettingsPluginsProps) {
   const [directory, setDirectory] = useState<string | null>(null);
   const plugins = useAtomValue(pluginsAtom);
-  const bundledPlugins = plugins.filter((p) => isPluginBundled(p, appInfo.vendoredPluginDir));
-  const installedPlugins = plugins.filter((p) => !isPluginBundled(p, appInfo.vendoredPluginDir));
+  const bundledPlugins = plugins.filter((p) => p.source === 'bundled');
+  const installedPlugins = plugins.filter((p) => p.source !== 'bundled');
   const createPlugin = useInstallPlugin();
   const refreshPlugins = useRefreshPlugins();
   return (

src-web/components/core/Dropdown.tsx

@@ -896,9 +896,9 @@ function MenuItem({
   };
 
   const rightSlot = item.submenu ? (
-    <Icon icon="chevron_right" color='secondary' />
+    <Icon icon="chevron_right" color="secondary" />
   ) : (
-    (item.rightSlot ?? <Hotkey action={item.hotKeyAction ?? null} />)
+    (item.rightSlot ?? <Hotkey variant="text" action={item.hotKeyAction ?? null} />)
   );
 
   return (
@@ -937,7 +937,7 @@ function MenuItem({
       )}
       {...props}
     >
-      <div className={classNames('truncate')}>{item.label}</div>
+      <div className={classNames('truncate min-w-[5rem]')}>{item.label}</div>
     </Button>
   );
 }

src-web/hooks/useInstallPlugin.ts

@@ -1,11 +1,11 @@
-import { invokeCmd } from '../lib/tauri';
+import { installPluginFromDirectory } from '@yaakapp-internal/plugins';
 import { useFastMutation } from './useFastMutation';
 
 export function useInstallPlugin() {
   return useFastMutation<void, unknown, string>({
     mutationKey: ['install_plugin'],
     mutationFn: async (directory: string) => {
-      await invokeCmd('cmd_install_plugin', { directory });
+      await installPluginFromDirectory(directory);
     },
   });
 }

src-web/lib/tauri.ts

@@ -36,7 +36,6 @@ type TauriCmd =
   | 'cmd_http_request_body'
   | 'cmd_http_response_body'
   | 'cmd_import_data'
-  | 'cmd_install_plugin'
   | 'cmd_metadata'
   | 'cmd_restart'
   | 'cmd_new_child_window'