Fix Linux WASM release builds

Move plugin actions and authentication onto PluginHost (#563 )
Add native OpenAPI importer (#486 )
2026-08-17 00:52:09 +02:00 · 2026-08-16 15:41:00 -07:00 · 2026-08-16 11:41:03 -07:00 · 2026-08-16 11:40:34 -07:00 · 2026-08-16 11:35:17 -07:00 · 2026-08-16 11:22:43 -07:00
70 changed files with 11408 additions and 4770 deletions
@@ -26,19 +26,19 @@ jobs:
            os: "macos"
            runtime: "wry"
            targets: "x86_64-apple-darwin"
-          - platform: "ubuntu-22.04"
+          - platform: "ubuntu-24.04"
            args: '--config ./tauri.release.conf.json --config ''{"build":{"features":["updater","license","wry"]}}'''
            yaak_arch: "x64"
            os: "ubuntu"
            runtime: "wry"
            targets: ""
-          - platform: "ubuntu-22.04-arm"
+          - platform: "ubuntu-24.04-arm"
            args: '--config ./tauri.release.conf.json --config ''{"build":{"features":["updater","license","wry"]}}'''
            yaak_arch: "arm64"
            os: "ubuntu"
            runtime: "wry"
            targets: ""
-          - platform: "ubuntu-22.04"
+          - platform: "ubuntu-24.04"
            args: >-
              --bundles deb
              --config ./tauri.release.conf.json
@@ -47,7 +47,7 @@ jobs:
            os: "ubuntu"
            runtime: "cef"
            targets: ""
-          - platform: "ubuntu-22.04-arm"
+          - platform: "ubuntu-24.04-arm"
            args: >-
              --bundles deb
              --config ./tauri.release.conf.json
@@ -249,7 +249,7 @@ dependencies = [
 "enumflags2",
 "futures-channel",
 "futures-util",
- "rand 0.8.5",
+ "rand 0.8.7",
 "serde",
 "serde_repr",
 "url",
@@ -265,7 +265,7 @@ dependencies = [
 "enumflags2",
 "futures-channel",
 "futures-util",
- "rand 0.9.1",
+ "rand 0.9.5",
 "raw-window-handle",
 "serde",
 "serde_repr",
@@ -585,9 +585,9 @@ checksum = "ace50bade8e6234aa140d9a2f552bbee1db4d353f69b8217bc503490fc1a9f26"

 [[package]]
 name = "aws-lc-rs"
-version = "1.16.1"
+version = "1.18.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "94bffc006df10ac2a68c83692d734a465f8ee6c5b384d8545a636f81d858f4bf"
+checksum = "ce2b2dcc879c3bae0d371e77c99f2238400ef24ec001394befa67b6e543add9e"
 dependencies = [
 "aws-lc-sys",
 "zeroize",
@@ -595,14 +595,15 @@ dependencies = [

 [[package]]
 name = "aws-lc-sys"
-version = "0.38.0"
+version = "0.44.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4321e568ed89bb5a7d291a7f37997c2c0df89809d7b6d12062c81ddb54aa782e"
+checksum = "f09fae7be8bb3174e05c6afdb34199e6dc0c7c04ba9fa237b1967adfbde27483"
 dependencies = [
 "cc",
 "cmake",
 "dunce",
 "fs_extra",
+ "pkg-config",
 ]

 [[package]]
@@ -4463,7 +4464,7 @@ version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3ffa00dec017b5b1a8b7cf5e2c008bfda1aa7e0697ac1508b491fdf2622fb4d8"
 dependencies = [
- "rand 0.8.5",
+ "rand 0.8.7",
 ]

 [[package]]
@@ -5023,15 +5024,14 @@ dependencies = [

 [[package]]
 name = "openssl"
-version = "0.10.73"
+version = "0.10.81"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8505734d46c8ab1e19a1dce3aef597ad87dcb4c37e7188231769bd6bd51cebf8"
+checksum = "77823a27f0babb03091cb9ed9ef80af3b39dbc82f97e8fa530374b7dafd87a45"
 dependencies = [
 "bitflags 2.11.0",
 "cfg-if",
 "foreign-types 0.3.2",
 "libc",
- "once_cell",
 "openssl-macros",
 "openssl-sys",
 ]
@@ -5055,18 +5055,18 @@ checksum = "d05e27ee213611ffe7d6348b942e8f942b37114c00cc03cec254295a4a17852e"

 [[package]]
 name = "openssl-src"
-version = "300.5.0+3.5.0"
+version = "300.6.1+3.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e8ce546f549326b0e6052b649198487d91320875da901e7bd11a06d1ee3f9c2f"
+checksum = "46eb8fb9fb3b61ce1c0f8a026c4c1a0714d3a9e138e7fbde78753ce2babc3846"
 dependencies = [
 "cc",
 ]

 [[package]]
 name = "openssl-sys"
-version = "0.9.109"
+version = "0.9.117"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "90096e2e47630d78b7d1c20952dc621f957103f8bc2c8359ec81290d75238571"
+checksum = "b47e7e6bb2c38cd930d25a23b40fa52e068c10e85f3e03a7f5ba5aaca5713695"
 dependencies = [
 "cc",
 "libc",
@@ -5880,7 +5880,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5d5285893bb5eb82e6aaf5d59ee909a06a16737a8970984dd7746ba9283498d6"
 dependencies = [
 "phf_shared 0.10.0",
- "rand 0.8.5",
+ "rand 0.8.7",
 ]

 [[package]]
@@ -5890,7 +5890,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3c80231409c20246a13fddb31776fb942c38553c51e871f8cbd687a4cfb5843d"
 dependencies = [
 "phf_shared 0.11.3",
- "rand 0.8.5",
+ "rand 0.8.7",
 ]

 [[package]]
@@ -6455,9 +6455,9 @@ dependencies = [

 [[package]]
 name = "rand"
-version = "0.8.5"
+version = "0.8.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
+checksum = "22f6172bdec972074665ed81ed53b71da00bfc44b65a753cfde883ec4c702a1a"
 dependencies = [
 "libc",
 "rand_chacha 0.3.1",
@@ -6466,9 +6466,9 @@ dependencies = [

 [[package]]
 name = "rand"
-version = "0.9.1"
+version = "0.9.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9fbfd9d094a40bf3ae768db9361049ace4c0e04a4fd6b359518bd7b73a73dd97"
+checksum = "b9ef1d0d795eb7d84685bca4f72f3649f064e6641543d3a8c415898726a57b41"
 dependencies = [
 "rand_chacha 0.9.0",
 "rand_core 0.9.3",
@@ -7348,7 +7348,7 @@ dependencies = [
 "borsh",
 "bytes",
 "num-traits",
- "rand 0.8.5",
+ "rand 0.8.7",
 "rkyv",
 "serde",
 "serde_json",
@@ -9509,7 +9509,7 @@ dependencies = [
 "indexmap 1.9.3",
 "pin-project",
 "pin-project-lite",
- "rand 0.8.5",
+ "rand 0.8.7",
 "slab",
 "tokio",
 "tokio-util",
@@ -9726,7 +9726,7 @@ dependencies = [
 "http",
 "httparse",
 "log 0.4.29",
- "rand 0.9.1",
+ "rand 0.9.5",
 "rustls",
 "rustls-pki-types",
 "sha1",
@@ -9996,7 +9996,7 @@ checksum = "3cf4199d1e5d15ddd86a694e4d0dffa9c323ce759fea589f00fef9d81cc1931d"
 dependencies = [
 "getrandom 0.3.3",
 "js-sys",
- "rand 0.9.1",
+ "rand 0.9.5",
 "serde",
 "wasm-bindgen",
 ]
@@ -11196,6 +11196,7 @@ name = "yaak"
 version = "0.1.0"
 dependencies = [
 "async-trait",
+ "base64 0.22.1",
 "log 0.4.29",
 "md5 0.8.0",
 "serde_json",
@@ -11240,7 +11241,7 @@ dependencies = [
 "pretty_graphql",
 "r2d2",
 "r2d2_sqlite",
- "rand 0.9.1",
+ "rand 0.9.5",
 "reqwest 0.12.20",
 "rlimit",
 "serde",
@@ -11325,7 +11326,7 @@ dependencies = [
 "log 0.4.29",
 "oxc_resolver",
 "predicates",
- "rand 0.8.5",
+ "rand 0.8.7",
 "reqwest 0.12.20",
 "rolldown",
 "schemars 0.8.22",
@@ -11351,7 +11352,6 @@ dependencies = [
 name = "yaak-commands"
 version = "0.0.0"
 dependencies = [
- "log 0.4.29",
 "serde_json",
 "tempfile",
 "thiserror 2.0.17",
@@ -11534,7 +11534,7 @@ dependencies = [
 "csscolorparser",
 "log 0.4.29",
 "objc",
- "rand 0.9.1",
+ "rand 0.9.5",
 "tauri",
 "tauri-plugin",
 ]
@@ -11576,7 +11576,7 @@ dependencies = [
 "log 0.4.29",
 "md5 0.7.0",
 "path-slash",
- "rand 0.9.1",
+ "rand 0.9.5",
 "reqwest 0.12.20",
 "serde",
 "serde_json",
@@ -11754,7 +11754,7 @@ version = "0.1.0"
 dependencies = [
 "log 0.4.29",
 "md5 0.8.0",
- "rand 0.9.1",
+ "rand 0.9.5",
 "serde",
 "serde_json",
 "tauri",
@@ -1,9 +1,29 @@
 import type { Diagnostic } from "@codemirror/lint";
 import type { EditorView } from "@codemirror/view";
-import { parse as jsonLintParse } from "@prantlf/jsonlint";
+import { type ParseError, parse, printParseErrorCode } from "jsonc-parser";

 const TEMPLATE_SYNTAX_REGEX = /\$\{\[[\s\S]*?]}/g;

+// jsonc-parser reports error codes, so these are the words the editor shows for them
+const MESSAGES: Record<string, string> = {
+  InvalidSymbol: "Invalid symbol",
+  InvalidNumberFormat: "Invalid number format",
+  PropertyNameExpected: "Property name expected",
+  ValueExpected: "Value expected",
+  ColonExpected: "Colon expected",
+  CommaExpected: "Comma expected",
+  CloseBraceExpected: "Closing brace expected",
+  CloseBracketExpected: "Closing bracket expected",
+  EndOfFileExpected: "End of file expected",
+  InvalidCommentToken: "Comments are not allowed",
+  UnexpectedEndOfComment: "Unexpected end of comment",
+  UnexpectedEndOfString: "Unexpected end of string",
+  UnexpectedEndOfNumber: "Unexpected end of number",
+  InvalidUnicode: "Invalid unicode sequence",
+  InvalidEscapeCharacter: "Invalid escape character",
+  InvalidCharacter: "Invalid character",
+};
+
 interface JsonLintOptions {
  allowComments?: boolean;
  allowTrailingCommas?: boolean;
@@ -11,34 +31,28 @@ interface JsonLintOptions {

 export function jsonParseLinter(options?: JsonLintOptions) {
  return (view: EditorView): Diagnostic[] => {
-    try {
-      const doc = view.state.doc.toString();
-      // We need lint to not break on stuff like {"foo:" ${[ ... ]}} so we'll replace all template
-      // syntax with repeating `1` characters, so it's valid JSON and the position is still correct.
-      const escapedDoc = doc.replace(TEMPLATE_SYNTAX_REGEX, (m) => "1".repeat(m.length));
-      jsonLintParse(escapedDoc, {
-        mode: (options?.allowComments ?? true) ? "cjson" : "json",
-        ignoreTrailingCommas: options?.allowTrailingCommas ?? false,
-      });
-      // oxlint-disable-next-line no-explicit-any
-    } catch (err: any) {
-      if (!("location" in err)) {
-        return [];
-      }
+    const doc = view.state.doc.toString();
+    // We need lint to not break on stuff like {"foo:" ${[ ... ]}} so we'll replace all template
+    // syntax with repeating `1` characters, so it's valid JSON and the position is still correct.
+    const escapedDoc = doc.replace(TEMPLATE_SYNTAX_REGEX, (m) => "1".repeat(m.length));

-      // const line = location?.start?.line;
-      // const column = location?.start?.column;
-      if (err.location.start.offset) {
-        return [
-          {
-            from: err.location.start.offset,
-            to: err.location.start.offset,
-            severity: "error",
-            message: err.message,
-          },
-        ];
-      }
-    }
-    return [];
+    const errors: ParseError[] = [];
+    parse(escapedDoc, errors, {
+      allowTrailingComma: options?.allowTrailingCommas ?? false,
+      disallowComments: !(options?.allowComments ?? true),
+    });
+
+    // Later errors are mostly consequences of the first one, so only that one is shown
+    const error = errors[0];
+    if (error == null) return [];
+
+    return [
+      {
+        from: error.offset,
+        to: error.offset + error.length,
+        severity: "error",
+        message: MESSAGES[printParseErrorCode(error.error)] ?? "Invalid JSON",
+      },
+    ];
  };
 }
@@ -23,7 +23,6 @@
    "@lezer/highlight": "^1.1.3",
    "@lezer/lr": "^1.3.3",
    "@mjackson/multipart-parser": "^0.10.1",
-    "@prantlf/jsonlint": "^16.0.0",
    "@replit/codemirror-emacs": "^6.1.0",
    "@replit/codemirror-vim": "^6.3.0",
    "@replit/codemirror-vscode-keymap": "^6.0.2",
@@ -54,6 +53,7 @@
    "jotai": "^2.18.0",
    "jotai-family": "^1.0.1",
    "js-md5": "^0.8.3",
+    "jsonc-parser": "^3.3.1",
    "lucide-react": "^0.525.0",
    "mime": "^4.0.4",
    "motion": "^12.4.7",
@@ -93,14 +93,12 @@
    "@yaakapp-internal/theme": "^1.0.0",
    "@yaakapp-internal/ui": "^1.0.0",
    "babel-plugin-react-compiler": "^1.0.0",
-    "decompress": "^4.2.1",
    "internal-ip": "^8.0.0",
    "rollup": "^4.60.3",
-    "vite": "npm:@voidzero-dev/vite-plus-core@^0.2.1",
+    "vite": "npm:@voidzero-dev/vite-plus-core@^0.2.9",
    "vite-plugin-static-copy": "^3.3.0",
    "vite-plugin-svgr": "^4.5.0",
-    "vite-plugin-top-level-await": "^1.5.0",
    "vite-plugin-wasm": "^3.5.0",
-    "vite-plus": "^0.2.1"
+    "vite-plus": "^0.2.9"
  }
 }
@@ -46,9 +46,9 @@ const WorkspacesWorkspaceIdRequestsRequestIdRoute =

 export interface FileRoutesByFullPath {
  '/': typeof IndexRoute
-  '/workspaces': typeof WorkspacesIndexRoute
+  '/workspaces/': typeof WorkspacesIndexRoute
  '/workspaces/$workspaceId/settings': typeof WorkspacesWorkspaceIdSettingsRoute
-  '/workspaces/$workspaceId': typeof WorkspacesWorkspaceIdIndexRoute
+  '/workspaces/$workspaceId/': typeof WorkspacesWorkspaceIdIndexRoute
  '/workspaces/$workspaceId/requests/$requestId': typeof WorkspacesWorkspaceIdRequestsRequestIdRoute
 }
 export interface FileRoutesByTo {
@@ -70,9 +70,9 @@ export interface FileRouteTypes {
  fileRoutesByFullPath: FileRoutesByFullPath
  fullPaths:
    | '/'
-    | '/workspaces'
+    | '/workspaces/'
    | '/workspaces/$workspaceId/settings'
-    | '/workspaces/$workspaceId'
+    | '/workspaces/$workspaceId/'
    | '/workspaces/$workspaceId/requests/$requestId'
  fileRoutesByTo: FileRoutesByTo
  to:
@@ -110,14 +110,14 @@ declare module '@tanstack/react-router' {
    '/workspaces/': {
      id: '/workspaces/'
      path: '/workspaces'
-      fullPath: '/workspaces'
+      fullPath: '/workspaces/'
      preLoaderRoute: typeof WorkspacesIndexRouteImport
      parentRoute: typeof rootRouteImport
    }
    '/workspaces/$workspaceId/': {
      id: '/workspaces/$workspaceId/'
      path: '/workspaces/$workspaceId'
-      fullPath: '/workspaces/$workspaceId'
+      fullPath: '/workspaces/$workspaceId/'
      preLoaderRoute: typeof WorkspacesWorkspaceIdIndexRouteImport
      parentRoute: typeof rootRouteImport
    }
@@ -6,7 +6,6 @@ import path from "node:path";
 import { defineConfig, normalizePath } from "vite-plus";
 import { viteStaticCopy } from "vite-plugin-static-copy";
 import svgr from "vite-plugin-svgr";
-import topLevelAwait from "vite-plugin-top-level-await";
 import wasm from "vite-plugin-wasm";

 const require = createRequire(import.meta.url);
@@ -43,10 +42,11 @@ export default defineConfig(async () => {
          : {},
    },
    // The browser host runs the model layer in a worker; that bundle needs the
-    // same wasm and top-level-await handling as the main one.
+    // same wasm handling as the main one. Top-level await needs no transform
+    // because the build targets esnext.
    worker: {
      format: "es" as const,
-      plugins: () => [wasm(), topLevelAwait()],
+      plugins: () => [wasm()],
    },
    plugins: [
      wasm(),
@@ -58,7 +58,6 @@ export default defineConfig(async () => {
      }),
      svgr(),
      react(),
-      topLevelAwait(),
      viteStaticCopy({
        targets: [
          { src: cMapsDir, dest: "" },
@@ -31,7 +31,7 @@
    "@vitejs/plugin-react": "^6.0.1",
    "babel-plugin-react-compiler": "^1.0.0",
    "typescript": "^5.8.3",
-    "vite": "npm:@voidzero-dev/vite-plus-core@^0.2.1",
-    "vite-plus": "^0.2.1"
+    "vite": "npm:@voidzero-dev/vite-plus-core@^0.2.9",
+    "vite-plus": "^0.2.9"
  }
 }
@@ -181,7 +181,11 @@ async fn dev(args: PluginPathArg) -> CommandResult {
                    ui::info(&format!("Rebuilding plugin {display_path}"));
                }
                WatcherEvent::Event(BundleEvent::BundleEnd(_)) => {
-                    match generate_plugin_metadata(&watch_root) {
+                    // Assets are staged on every rebuild, so a changed asset or
+                    // declaration is picked up without restarting.
+                    let result = copy_build_assets(&watch_root)
+                        .and_then(|()| generate_plugin_metadata(&watch_root));
+                    match result {
                        Ok(()) => ui::success(&format!(
                            "Generated plugin metadata at {}",
                            watch_root.join("build/metadata.json").display()
@@ -408,6 +412,7 @@ struct PublishResponse {

 async fn build_plugin_bundle(plugin_dir: &Path) -> CommandResult<Vec<String>> {
    prepare_build_output_dir(plugin_dir)?;
+    copy_build_assets(plugin_dir)?;
    let mut bundler = Bundler::new(bundler_options(plugin_dir, false))
        .map_err(|err| format!("Failed to initialize Rolldown: {err}"))?;
    let output = bundler.write().await.map_err(|err| format!("Plugin build failed:\n{err}"))?;
@@ -498,6 +503,63 @@ fn prepare_build_output_dir(plugin_dir: &Path) -> CommandResult {
        .map_err(|e| format!("Failed to create build directory {}: {e}", build_dir.display()))
 }

+#[derive(Deserialize, Default)]
+struct PluginManifest {
+    #[serde(default)]
+    yaak: PluginManifestConfig,
+}
+
+#[derive(Deserialize, Default)]
+struct PluginManifestConfig {
+    /// Files to place beside the bundle, as paths relative to the plugin
+    /// directory. Publishing ships everything in `build/`, so these travel with
+    /// the plugin.
+    #[serde(default, rename = "buildAssets")]
+    build_assets: Vec<String>,
+}
+
+/// Copy the plugin's declared assets into `build/`.
+///
+/// This runs after the directory is cleared and before the bundle is written,
+/// because a bundle may read an asset from its own directory at import time and
+/// metadata generation imports the bundle.
+fn copy_build_assets(plugin_dir: &Path) -> CommandResult {
+    let manifest_path = plugin_dir.join("package.json");
+    let manifest: PluginManifest = serde_json::from_str(
+        &fs::read_to_string(&manifest_path)
+            .map_err(|e| format!("Failed to read {}: {e}", manifest_path.display()))?,
+    )
+    .map_err(|e| format!("Failed to parse {}: {e}", manifest_path.display()))?;
+
+    let build_dir = plugin_dir.join("build");
+    let mut names = HashSet::new();
+    for asset in manifest.yaak.build_assets {
+        let src = plugin_dir.join(&asset);
+        let name = src
+            .file_name()
+            .ok_or_else(|| format!("yaak.buildAssets entry is not a file path: {asset}"))?;
+        // A copy that later gets overwritten would pass the build and fail on
+        // load, so anything the build itself writes, or a second asset with
+        // the same name, is rejected up front. Names are compared without
+        // case, because a plugin is installed on case-insensitive filesystems
+        // wherever it was built.
+        let key = name.to_string_lossy().to_lowercase();
+        if key == "index.js" || key == "metadata.json" {
+            return Err(format!("Build asset {asset} would be overwritten by the build output"));
+        }
+        if !names.insert(key) {
+            return Err(format!("Two build assets share the name {}", name.display()));
+        }
+        if !src.is_file() {
+            return Err(format!("Build asset does not exist: {}", src.display()));
+        }
+        fs::copy(&src, build_dir.join(name))
+            .map_err(|e| format!("Failed to copy build asset {}: {e}", src.display()))?;
+    }
+
+    Ok(())
+}
+
 fn bundler_options(plugin_dir: &Path, watch: bool) -> BundlerOptions {
    BundlerOptions {
        input: Some(vec![InputItem { import: "./src/index.ts".to_string(), ..Default::default() }]),
@@ -750,7 +812,10 @@ describe("Example Plugin", () => {

 #[cfg(test)]
 mod tests {
-    use super::{create_publish_archive, generate_plugin_metadata};
+    use super::{
+        copy_build_assets, create_publish_archive, generate_plugin_metadata,
+        prepare_build_output_dir,
+    };
    use serde_json::Value;
    use std::collections::HashSet;
    use std::fs;
@@ -795,6 +860,100 @@ mod tests {
        assert!(!names.contains("ignored/secret.txt"));
    }

+    #[test]
+    fn prepare_build_output_dir_clears_stale_output() {
+        let dir = TempDir::new().expect("temp dir");
+        let root = dir.path();
+        let build = root.join("build");
+        fs::create_dir_all(&build).expect("create build");
+        fs::write(build.join("index.js"), "stale").expect("write index.js");
+        fs::write(build.join("left-behind.js"), "stale").expect("write extra");
+
+        prepare_build_output_dir(root).expect("prepare build dir");
+
+        // Publishing ships everything under build/, so nothing may survive.
+        assert!(build.is_dir());
+        assert_eq!(fs::read_dir(&build).expect("read build").count(), 0);
+    }
+
+    #[test]
+    fn copy_build_assets_places_declared_files_beside_the_bundle() {
+        let dir = TempDir::new().expect("temp dir");
+        let root = dir.path();
+        fs::create_dir_all(root.join("build")).expect("create build");
+        fs::create_dir_all(root.join("vendor")).expect("create vendor");
+        fs::write(root.join("vendor/core_bg.wasm"), "asset").expect("write asset");
+        fs::write(
+            root.join("package.json"),
+            r#"{"yaak":{"buildAssets":["vendor/core_bg.wasm"]}}"#,
+        )
+        .expect("write package.json");
+
+        copy_build_assets(root).expect("copy assets");
+
+        assert_eq!(
+            fs::read_to_string(root.join("build/core_bg.wasm")).expect("read copied asset"),
+            "asset"
+        );
+    }
+
+    #[test]
+    fn copy_build_assets_is_a_noop_without_declarations() {
+        let dir = TempDir::new().expect("temp dir");
+        let root = dir.path();
+        fs::create_dir_all(root.join("build")).expect("create build");
+        fs::write(root.join("package.json"), r#"{"name":"demo"}"#).expect("write package.json");
+
+        copy_build_assets(root).expect("copy assets");
+
+        assert_eq!(fs::read_dir(root.join("build")).expect("read build").count(), 0);
+    }
+
+    #[test]
+    fn copy_build_assets_rejects_names_the_build_writes() {
+        let dir = TempDir::new().expect("temp dir");
+        let root = dir.path();
+        fs::create_dir_all(root.join("build")).expect("create build");
+        fs::write(root.join("index.js"), "asset").expect("write asset");
+        fs::write(root.join("package.json"), r#"{"yaak":{"buildAssets":["index.js"]}}"#)
+            .expect("write package.json");
+
+        let err = copy_build_assets(root).expect_err("reserved name should fail");
+        assert!(err.contains("overwritten by the build output"), "unexpected error: {err}");
+    }
+
+    #[test]
+    fn copy_build_assets_rejects_duplicate_names() {
+        let dir = TempDir::new().expect("temp dir");
+        let root = dir.path();
+        fs::create_dir_all(root.join("build")).expect("create build");
+        fs::create_dir_all(root.join("a")).expect("create a");
+        fs::create_dir_all(root.join("b")).expect("create b");
+        // Differ only by case: one file on macOS and Windows.
+        fs::write(root.join("a/core.wasm"), "one").expect("write a");
+        fs::write(root.join("b/Core.wasm"), "two").expect("write b");
+        fs::write(
+            root.join("package.json"),
+            r#"{"yaak":{"buildAssets":["a/core.wasm","b/Core.wasm"]}}"#,
+        )
+        .expect("write package.json");
+
+        let err = copy_build_assets(root).expect_err("duplicate name should fail");
+        assert!(err.contains("share the name"), "unexpected error: {err}");
+    }
+
+    #[test]
+    fn copy_build_assets_fails_on_a_missing_asset() {
+        let dir = TempDir::new().expect("temp dir");
+        let root = dir.path();
+        fs::create_dir_all(root.join("build")).expect("create build");
+        fs::write(root.join("package.json"), r#"{"yaak":{"buildAssets":["nope.wasm"]}}"#)
+            .expect("write package.json");
+
+        let err = copy_build_assets(root).expect_err("missing asset should fail");
+        assert!(err.contains("Build asset does not exist"), "unexpected error: {err}");
+    }
+
    #[test]
    fn generate_plugin_metadata_detects_api_types() {
        let dir = TempDir::new().expect("temp dir");
@@ -1,5 +1,7 @@
 use crate::context::CliExecutionContext;
 use arboard::Clipboard;
+use base64::Engine;
+use base64::prelude::BASE64_STANDARD;
 use console::Term;
 use inquire::{Confirm, Editor, Password, PasswordDisplayMode, Select, Text};
 use serde_json::Value;
@@ -12,6 +14,7 @@ use yaak::plugin_events::{
    GroupedPluginEvent, HostRequest, SharedPluginEventContext, handle_shared_plugin_event,
 };
 use yaak::render::{render_grpc_request, render_http_request};
+use yaak::response_body::FileResponseBodyStore;
 use yaak::send::{SendHttpRequestWithPluginsParams, send_http_request_with_plugins};
 use yaak_crypto::manager::EncryptionManager;
 use yaak_http::cookies::get_cookie_value_from_jar;
@@ -131,6 +134,7 @@ async fn build_plugin_reply(

    match handle_shared_plugin_event(
        &host_context.query_manager,
+        &FileResponseBodyStore::new(&host_context.query_manager),
        &event.payload,
        SharedPluginEventContext { plugin_name, workspace_id: shared_workspace_id },
    ) {
@@ -223,7 +227,15 @@ async fn build_plugin_reply(
                .await
                {
                    Ok(result) => Some(InternalEventPayload::SendHttpRequestResponse(
-                        SendHttpRequestResponse { http_response: result.response },
+                        SendHttpRequestResponse {
+                            http_response: result.response,
+                            // Nothing saved this body, so the reply is the only
+                            // place the plugin can get it.
+                            body: result
+                                .response_body
+                                .returned_bytes()
+                                .map(|b| BASE64_STANDARD.encode(b)),
+                        },
                    )),
                    Err(err) => Some(InternalEventPayload::ErrorResponse(ErrorResponse {
                        error: format!("Failed to send HTTP request in CLI: {err}"),
@@ -1,12 +0,0 @@
-use crate::PluginContextExt;
-use crate::error::Result;
-use tauri::{Runtime, State, WebviewWindow};
-use yaak_plugins::events::GetThemesResponse;
-use yaak_plugins::manager::PluginManager;
-
-pub(crate) async fn cmd_get_themes<R: Runtime>(
-    window: WebviewWindow<R>,
-    plugin_manager: State<'_, PluginManager>,
-) -> Result<Vec<GetThemesResponse>> {
-    Ok(plugin_manager.get_themes(&window.plugin_context()).await?)
-}
@@ -2,7 +2,6 @@ use std::collections::BTreeMap;

 use crate::PluginContextExt;
 use crate::error::Result;
-use crate::models_ext::QueryManagerExt;
 use KeyAndValueRef::{Ascii, Binary};
 use tauri::{Manager, Runtime, WebviewWindow};
 use yaak_grpc::{KeyAndValueRef, MetadataMap};
@@ -21,22 +20,6 @@ pub(crate) fn metadata_to_map(metadata: MetadataMap) -> BTreeMap<String, String>
    entries
 }

-pub(crate) fn resolve_grpc_request<R: Runtime>(
-    window: &WebviewWindow<R>,
-    request: &GrpcRequest,
-) -> Result<(GrpcRequest, String)> {
-    let mut new_request = request.clone();
-
-    let (authentication_type, authentication, authentication_context_id) =
-        window.db().resolve_auth_for_grpc_request(request)?;
-    new_request.authentication_type = authentication_type;
-    new_request.authentication = authentication;
-
-    let metadata = window.db().resolve_metadata_for_grpc_request(request)?;
-    new_request.metadata = metadata;
-
-    Ok((new_request, authentication_context_id))
-}

 pub(crate) async fn build_metadata<R: Runtime>(
    window: &WebviewWindow<R>,
@@ -179,19 +179,3 @@ async fn send_http_request_inner<R: Runtime>(
    Ok(SentHttpRequest { response: result.response, body: result.response_body })
 }

-pub fn resolve_http_request<R: Runtime>(
-    window: &WebviewWindow<R>,
-    request: &HttpRequest,
-) -> Result<(HttpRequest, String)> {
-    let mut new_request = request.clone();
-
-    let (authentication_type, authentication, authentication_context_id) =
-        window.db().resolve_auth_for_http_request(request)?;
-    new_request.authentication_type = authentication_type;
-    new_request.authentication = authentication;
-
-    let headers = window.db().resolve_headers_for_http_request(request)?;
-    new_request.headers = headers;
-
-    Ok((new_request, authentication_context_id))
-}
@@ -2,18 +2,17 @@ extern crate core;
 use crate::encoding::read_response_body;
 use crate::error::Error::GenericError;
 use crate::error::Result;
-use crate::grpc::{build_metadata, metadata_to_map, resolve_grpc_request};
-use crate::http_request::{resolve_http_request, send_http_request};
+use crate::grpc::{build_metadata, metadata_to_map};
+use crate::http_request::send_http_request;
 use crate::import::{import_data, import_url};
 use crate::models_ext::{BlobManagerExt, QueryManagerExt};
 use crate::notifications::YaakNotifier;
-use crate::render::{render_grpc_request, render_json_value, render_template};
+use crate::render::{render_grpc_request, render_template};
 use crate::updates::{UpdateMode, UpdateTrigger, YaakUpdater};
 use crate::uri_scheme::handle_deep_link;
 use error::Result as YaakResult;
 use eventsource_client::{EventParser, SSE};
 use log::{debug, error, info, warn};
-use std::collections::HashMap;
 use std::path::PathBuf;
 use std::str::FromStr;
 use std::sync::Arc;
@@ -31,26 +30,20 @@ use tokio::task::block_in_place;
 use tokio::time;
 use yaak::send::ResponseBody;
 use yaak_commands::responses::locate_response_body;
+use yaak_commands::resolve::resolve_grpc_request;
 use yaak_common::command::new_checked_command;
 use yaak_crypto::manager::EncryptionManager;
 use yaak_grpc::manager::{GrpcConfig, GrpcHandle};
 use yaak_grpc::{Code, ServiceDefinition};
 use yaak_mac_window::AppHandleMacWindowExt;
 use yaak_models::models::{
-    AnyModel, CookieJar, Environment, GrpcConnection, GrpcConnectionState, GrpcEvent,
+    CookieJar, Environment, GrpcConnection, GrpcConnectionState, GrpcEvent,
    GrpcEventType, HttpRequest, HttpResponse, HttpResponseState, Workspace,
 };
 use yaak_models::util::{BatchUpsertResult, UpdateSource};
 use yaak_plugins::events::{
-    CallFolderActionArgs, CallFolderActionRequest, CallGrpcRequestActionArgs,
-    CallGrpcRequestActionRequest, CallHttpRequestActionArgs, CallHttpRequestActionRequest,
-    CallWebsocketRequestActionArgs, CallWebsocketRequestActionRequest, CallWorkspaceActionArgs,
-    CallWorkspaceActionRequest, Color, FilterResponse, GetFolderActionsResponse,
-    GetGrpcRequestActionsResponse, GetHttpAuthenticationConfigResponse,
-    GetHttpAuthenticationSummaryResponse, GetHttpRequestActionsResponse,
-    GetTemplateFunctionConfigResponse, GetTemplateFunctionSummaryResponse,
-    GetWebsocketRequestActionsResponse, GetWorkspaceActionsResponse, InternalEvent,
-    InternalEventPayload, JsonPrimitive, PluginContext, RenderPurpose, ShowToastRequest,
+    Color, ErrorResponse, FilterResponse, InternalEvent, InternalEventPayload, PluginContext,
+    RenderPurpose, ShowToastRequest,
 };
 use yaak_plugins::manager::PluginManager;
 use yaak_plugins::template_callback::PluginTemplateCallback;
@@ -58,10 +51,9 @@ use yaak_rpc_schema::{AppMetaData, EphemeralHttpResponse};
 use yaak_sse::sse::ServerSentEvent;
 use yaak_tauri_utils::window::WorkspaceWindowTrait;
 use yaak_templates::strip_json_comments::strip_json_comments;
-use yaak_templates::{RenderErrorBehavior, RenderOptions, Tokens, transform_args};
+use yaak_templates::{RenderErrorBehavior, RenderOptions};
 use yaak_tls::find_client_certificate;

-mod commands;
 mod encoding;
 mod error;
 mod feedback;
@@ -220,56 +212,6 @@ async fn detect_cli_version_for_binary(program: &str) -> Option<String> {
    Some(parts.next().unwrap_or(line).to_string())
 }

-async fn cmd_template_tokens_to_string<R: Runtime>(
-    window: WebviewWindow<R>,
-    app_handle: AppHandle<R>,
-    tokens: Tokens,
-) -> YaakResult<String> {
-    let plugin_manager = Arc::new((*app_handle.state::<PluginManager>()).clone());
-    let encryption_manager = Arc::new((*app_handle.state::<EncryptionManager>()).clone());
-    let cb = PluginTemplateCallback::new(
-        plugin_manager,
-        encryption_manager,
-        &PluginContext::new(Some(window.label().to_string()), window.workspace_id()),
-        RenderPurpose::Preview,
-    );
-    let new_tokens = transform_args(tokens, &cb)?;
-    Ok(new_tokens.to_string())
-}
-
-async fn cmd_render_template<R: Runtime>(
-    window: WebviewWindow<R>,
-    app_handle: AppHandle<R>,
-    template: &str,
-    workspace_id: &str,
-    environment_id: Option<&str>,
-    purpose: Option<RenderPurpose>,
-    ignore_error: Option<bool>,
-) -> YaakResult<String> {
-    let environment_chain =
-        app_handle.db().resolve_environments(workspace_id, None, environment_id)?;
-    let plugin_manager = Arc::new((*app_handle.state::<PluginManager>()).clone());
-    let encryption_manager = Arc::new((*app_handle.state::<EncryptionManager>()).clone());
-    let result = render_template(
-        template,
-        environment_chain,
-        &PluginTemplateCallback::new(
-            plugin_manager,
-            encryption_manager,
-            &PluginContext::new(Some(window.label().to_string()), window.workspace_id()),
-            purpose.unwrap_or(RenderPurpose::Preview),
-        ),
-        &RenderOptions {
-            error_behavior: match ignore_error {
-                Some(true) => RenderErrorBehavior::ReturnEmpty,
-                _ => RenderErrorBehavior::Throw,
-            },
-        },
-    )
-    .await?;
-    Ok(result)
-}
-
 async fn cmd_send_feedback<R: Runtime>(
    app_handle: AppHandle<R>,
    feature: String,
@@ -296,7 +238,8 @@ async fn cmd_grpc_reflect<R: Runtime>(
    grpc_handle: State<'_, Mutex<GrpcHandle>>,
 ) -> YaakResult<Vec<ServiceDefinition>> {
    let unrendered_request = app_handle.db().get_grpc_request(request_id)?;
-    let (resolved_request, auth_context_id) = resolve_grpc_request(&window, &unrendered_request)?;
+    let (resolved_request, auth_context_id) =
+        resolve_grpc_request(&window.db(), &unrendered_request)?;

    let environment_chain = app_handle.db().resolve_environments(
        &unrendered_request.workspace_id,
@@ -356,7 +299,8 @@ async fn cmd_grpc_go<R: Runtime>(
    grpc_handle: State<'_, Mutex<GrpcHandle>>,
 ) -> YaakResult<String> {
    let unrendered_request = app_handle.db().get_grpc_request(request_id)?;
-    let (resolved_request, auth_context_id) = resolve_grpc_request(&window, &unrendered_request)?;
+    let (resolved_request, auth_context_id) =
+        resolve_grpc_request(&window.db(), &unrendered_request)?;
    let environment_chain = app_handle.db().resolve_environments(
        &unrendered_request.workspace_id,
        unrendered_request.folder_id.as_deref(),
@@ -1080,283 +1024,19 @@ async fn cmd_import_url<R: Runtime>(
    import_url(&window, url).await
 }

-async fn cmd_http_request_actions<R: Runtime>(
-    window: WebviewWindow<R>,
-    plugin_manager: State<'_, PluginManager>,
-) -> YaakResult<Vec<GetHttpRequestActionsResponse>> {
-    Ok(plugin_manager.get_http_request_actions(&window.plugin_context()).await?)
-}

-async fn cmd_websocket_request_actions<R: Runtime>(
-    window: WebviewWindow<R>,
-    plugin_manager: State<'_, PluginManager>,
-) -> YaakResult<Vec<GetWebsocketRequestActionsResponse>> {
-    Ok(plugin_manager.get_websocket_request_actions(&window.plugin_context()).await?)
-}

-async fn cmd_call_websocket_request_action<R: Runtime>(
-    window: WebviewWindow<R>,
-    req: CallWebsocketRequestActionRequest,
-    plugin_manager: State<'_, PluginManager>,
-) -> YaakResult<()> {
-    let websocket_request = window.db().get_websocket_request(&req.args.websocket_request.id)?;
-    Ok(plugin_manager
-        .call_websocket_request_action(
-            &window.plugin_context(),
-            CallWebsocketRequestActionRequest {
-                args: CallWebsocketRequestActionArgs { websocket_request },
-                ..req
-            },
-        )
-        .await?)
-}

-async fn cmd_workspace_actions<R: Runtime>(
-    window: WebviewWindow<R>,
-    plugin_manager: State<'_, PluginManager>,
-) -> YaakResult<Vec<GetWorkspaceActionsResponse>> {
-    Ok(plugin_manager.get_workspace_actions(&window.plugin_context()).await?)
-}

-async fn cmd_call_workspace_action<R: Runtime>(
-    window: WebviewWindow<R>,
-    req: CallWorkspaceActionRequest,
-    plugin_manager: State<'_, PluginManager>,
-) -> YaakResult<()> {
-    let workspace = window.db().get_workspace(&req.args.workspace.id)?;
-    Ok(plugin_manager
-        .call_workspace_action(
-            &window.plugin_context(),
-            CallWorkspaceActionRequest { args: CallWorkspaceActionArgs { workspace }, ..req },
-        )
-        .await?)
-}

-async fn cmd_folder_actions<R: Runtime>(
-    window: WebviewWindow<R>,
-    plugin_manager: State<'_, PluginManager>,
-) -> YaakResult<Vec<GetFolderActionsResponse>> {
-    Ok(plugin_manager.get_folder_actions(&window.plugin_context()).await?)
-}

-async fn cmd_call_folder_action<R: Runtime>(
-    window: WebviewWindow<R>,
-    req: CallFolderActionRequest,
-    plugin_manager: State<'_, PluginManager>,
-) -> YaakResult<()> {
-    let folder = window.db().get_folder(&req.args.folder.id)?;
-    Ok(plugin_manager
-        .call_folder_action(
-            &window.plugin_context(),
-            CallFolderActionRequest { args: CallFolderActionArgs { folder }, ..req },
-        )
-        .await?)
-}

-async fn cmd_grpc_request_actions<R: Runtime>(
-    window: WebviewWindow<R>,
-    plugin_manager: State<'_, PluginManager>,
-) -> YaakResult<Vec<GetGrpcRequestActionsResponse>> {
-    Ok(plugin_manager.get_grpc_request_actions(&window.plugin_context()).await?)
-}

-async fn cmd_template_function_summaries<R: Runtime>(
-    window: WebviewWindow<R>,
-    plugin_manager: State<'_, PluginManager>,
-) -> YaakResult<Vec<GetTemplateFunctionSummaryResponse>> {
-    let results = plugin_manager.get_template_function_summaries(&window.plugin_context()).await?;
-    Ok(results)
-}

-async fn cmd_template_function_config<R: Runtime>(
-    window: WebviewWindow<R>,
-    plugin_manager: State<'_, PluginManager>,
-    function_name: &str,
-    values: HashMap<String, JsonPrimitive>,
-    model: AnyModel,
-    _environment_id: Option<&str>,
-) -> YaakResult<GetTemplateFunctionConfigResponse> {
-    Ok(plugin_manager
-        .get_template_function_config(&window.plugin_context(), function_name, values, model.id())
-        .await?)
-}

-async fn cmd_get_http_authentication_summaries<R: Runtime>(
-    window: WebviewWindow<R>,
-    plugin_manager: State<'_, PluginManager>,
-) -> YaakResult<Vec<GetHttpAuthenticationSummaryResponse>> {
-    let results =
-        plugin_manager.get_http_authentication_summaries(&window.plugin_context()).await?;
-    Ok(results.into_iter().map(|(_, a)| a).collect())
-}

-async fn cmd_get_http_authentication_config<R: Runtime>(
-    window: WebviewWindow<R>,
-    app_handle: AppHandle<R>,
-    plugin_manager: State<'_, PluginManager>,
-    encryption_manager: State<'_, EncryptionManager>,
-    auth_name: &str,
-    values: HashMap<String, JsonPrimitive>,
-    model: AnyModel,
-    environment_id: Option<&str>,
-) -> YaakResult<GetHttpAuthenticationConfigResponse> {
-    // Extract workspace_id and folder_id from the model to resolve the environment chain
-    let (workspace_id, folder_id) = match &model {
-        AnyModel::HttpRequest(r) => (r.workspace_id.clone(), r.folder_id.clone()),
-        AnyModel::GrpcRequest(r) => (r.workspace_id.clone(), r.folder_id.clone()),
-        AnyModel::WebsocketRequest(r) => (r.workspace_id.clone(), r.folder_id.clone()),
-        AnyModel::Folder(f) => (f.workspace_id.clone(), f.folder_id.clone()),
-        AnyModel::Workspace(w) => (w.id.clone(), None),
-        _ => return Err(GenericError("Unsupported model type for authentication config".into())),
-    };

-    // Resolve environment chain and render the values for token lookup
-    let environment_chain = app_handle.db().resolve_environments(
-        &workspace_id,
-        folder_id.as_deref(),
-        environment_id,
-    )?;
-    let plugin_manager_arc = Arc::new((*plugin_manager).clone());
-    let encryption_manager_arc = Arc::new((*encryption_manager).clone());
-    let cb = PluginTemplateCallback::new(
-        plugin_manager_arc,
-        encryption_manager_arc,
-        &window.plugin_context(),
-        RenderPurpose::Preview,
-    );

-    // Convert HashMap<String, JsonPrimitive> to serde_json::Value for rendering
-    let values_json: serde_json::Value = serde_json::to_value(&values)?;
-    let rendered_json =
-        render_json_value(values_json, environment_chain, &cb, &RenderOptions::return_empty())
-            .await?;
-
-    // Convert back to HashMap<String, JsonPrimitive>
-    let rendered_values: HashMap<String, JsonPrimitive> = serde_json::from_value(rendered_json)?;
-
-    Ok(plugin_manager
-        .get_http_authentication_config(
-            &window.plugin_context(),
-            auth_name,
-            rendered_values,
-            model.id(),
-        )
-        .await?)
-}
-
-async fn cmd_call_http_request_action<R: Runtime>(
-    window: WebviewWindow<R>,
-    req: CallHttpRequestActionRequest,
-    plugin_manager: State<'_, PluginManager>,
-) -> YaakResult<()> {
-    Ok(plugin_manager
-        .call_http_request_action(
-            &window.plugin_context(),
-            CallHttpRequestActionRequest {
-                args: CallHttpRequestActionArgs {
-                    http_request: resolve_http_request(&window, &req.args.http_request)?.0,
-                    ..req.args
-                },
-                ..req
-            },
-        )
-        .await?)
-}
-
-async fn cmd_call_grpc_request_action<R: Runtime>(
-    window: WebviewWindow<R>,
-    req: CallGrpcRequestActionRequest,
-    plugin_manager: State<'_, PluginManager>,
-) -> YaakResult<()> {
-    Ok(plugin_manager
-        .call_grpc_request_action(
-            &window.plugin_context(),
-            CallGrpcRequestActionRequest {
-                args: CallGrpcRequestActionArgs {
-                    grpc_request: resolve_grpc_request(&window, &req.args.grpc_request)?.0,
-                    ..req.args
-                },
-                ..req
-            },
-        )
-        .await?)
-}
-
-async fn cmd_call_http_authentication_action<R: Runtime>(
-    window: WebviewWindow<R>,
-    app_handle: AppHandle<R>,
-    plugin_manager: State<'_, PluginManager>,
-    encryption_manager: State<'_, EncryptionManager>,
-    auth_name: &str,
-    action_index: i32,
-    values: HashMap<String, JsonPrimitive>,
-    model: AnyModel,
-    environment_id: Option<&str>,
-) -> YaakResult<()> {
-    // Extract workspace_id and folder_id from the model to resolve the environment chain
-    let (workspace_id, folder_id) = match &model {
-        AnyModel::HttpRequest(r) => (r.workspace_id.clone(), r.folder_id.clone()),
-        AnyModel::GrpcRequest(r) => (r.workspace_id.clone(), r.folder_id.clone()),
-        AnyModel::WebsocketRequest(r) => (r.workspace_id.clone(), r.folder_id.clone()),
-        AnyModel::Folder(f) => (f.workspace_id.clone(), f.folder_id.clone()),
-        AnyModel::Workspace(w) => (w.id.clone(), None),
-        _ => return Err(GenericError("Unsupported model type for authentication action".into())),
-    };
-
-    // Resolve environment chain and render the values
-    let environment_chain = app_handle.db().resolve_environments(
-        &workspace_id,
-        folder_id.as_deref(),
-        environment_id,
-    )?;
-    let plugin_manager_arc = Arc::new((*plugin_manager).clone());
-    let encryption_manager_arc = Arc::new((*encryption_manager).clone());
-    let cb = PluginTemplateCallback::new(
-        plugin_manager_arc,
-        encryption_manager_arc,
-        &window.plugin_context(),
-        RenderPurpose::Send,
-    );
-
-    // Convert HashMap<String, JsonPrimitive> to serde_json::Value for rendering
-    let values_json: serde_json::Value = serde_json::to_value(&values)?;
-    let rendered_json =
-        render_json_value(values_json, environment_chain, &cb, &RenderOptions::throw()).await?;
-
-    // Convert back to HashMap<String, JsonPrimitive>
-    let rendered_values: HashMap<String, JsonPrimitive> = serde_json::from_value(rendered_json)?;
-
-    Ok(plugin_manager
-        .call_http_authentication_action(
-            &window.plugin_context(),
-            auth_name,
-            action_index,
-            rendered_values,
-            &model.id(),
-        )
-        .await?)
-}
-
-async fn cmd_curl_to_request<R: Runtime>(
-    window: WebviewWindow<R>,
-    command: &str,
-    plugin_manager: State<'_, PluginManager>,
-    workspace_id: &str,
-) -> YaakResult<HttpRequest> {
-    let import_result = plugin_manager.import_data(&window.plugin_context(), command).await?;
-
-    Ok(import_result
-        .resources
-        .http_requests
-        .get(0)
-        .ok_or(GenericError("No curl command found".to_string()))
-        .map(|r| {
-            let mut request = r.clone();
-            request.workspace_id = workspace_id.into();
-            request.id = "".to_string();
-            request
-        })?)
-}

 /// Decodes base64 and writes the bytes to a file the user picked.
 ///
@@ -1452,17 +1132,6 @@ async fn cmd_send_http_request<R: Runtime>(
    Ok(r)
 }

-async fn cmd_reload_plugins<R: Runtime>(
-    app_handle: AppHandle<R>,
-    window: WebviewWindow<R>,
-    plugin_manager: State<'_, PluginManager>,
-) -> YaakResult<Vec<(String, String)>> {
-    let plugins = app_handle.db().list_plugins()?;
-    let plugin_context =
-        PluginContext::new(Some(window.label().to_string()), window.workspace_id());
-    let errors = plugin_manager.initialize_all_plugins(plugins, &plugin_context).await;
-    Ok(errors)
-}

 async fn cmd_new_child_window<R: Runtime>(
    parent_window: WebviewWindow<R>,
@@ -1782,6 +1451,7 @@ fn monitor_plugin_events<R: Runtime>(app_handle: &AppHandle<R>) {

                let ev = match ev {
                    Ok(Some(ev)) => ev,
+                    // Nothing to say, or the reply comes later from somewhere else.
                    Ok(None) => return,
                    Err(e) => {
                        warn!("Failed to handle plugin event: {e:?}");
@@ -1794,7 +1464,10 @@ fn monitor_plugin_events<R: Runtime>(app_handle: &AppHandle<R>) {
                                timeout: Some(30000),
                            }),
                        );
-                        return;
+                        // Tell the plugin as well as the user. It is awaiting a
+                        // reply, and a toast it cannot see would leave it
+                        // waiting for one that never comes.
+                        InternalEventPayload::ErrorResponse(ErrorResponse { error: e.to_string() })
                    }
                };

@@ -7,6 +7,8 @@ use crate::{
    call_frontend, cookie_jar_from_window, environment_from_window, get_window_from_plugin_context,
    workspace_from_window,
 };
+use base64::Engine;
+use base64::prelude::BASE64_STANDARD;
 use chrono::Utc;
 use log::error;
 use std::sync::Arc;
@@ -16,6 +18,7 @@ use tauri_plugin_opener::OpenerExt;
 use yaak::plugin_events::{
    GroupedPluginEvent, HostRequest, SharedPluginEventContext, handle_shared_plugin_event,
 };
+use yaak::response_body::FileResponseBodyStore;
 use yaak_crypto::manager::EncryptionManager;
 use yaak_http::cookies::get_cookie_value_from_jar;
 use yaak_models::models::{HttpResponse, Plugin};
@@ -54,6 +57,7 @@ pub(crate) async fn handle_plugin_event<R: Runtime>(

    match handle_shared_plugin_event(
        app_handle.db_manager().inner(),
+        &FileResponseBodyStore::new(app_handle.db_manager().inner()),
        &event.payload,
        SharedPluginEventContext {
            plugin_name: &plugin_name,
@@ -313,8 +317,13 @@ async fn handle_host_plugin_request<R: Runtime>(
            )
            .await?;

+            // An ad-hoc request saves nothing, so the engine hands the body
+            // back and this reply is the only place the plugin can get it.
+            let body = http_response.body.returned_bytes().map(|b| BASE64_STANDARD.encode(b));
+
            Ok(Some(InternalEventPayload::SendHttpRequestResponse(SendHttpRequestResponse {
                http_response: http_response.response,
+                body,
            })))
        }
        HostRequest::OpenWindow(req) => {
@@ -1,25 +1,8 @@
-use serde_json::Value;
+//! One import path for rendering, wherever the pieces actually live.
+//!
+//! The request renderers are engine code; the template renderers moved to
+//! `yaak-commands` when the template commands did. Callers in this crate do not
+//! need to track which is which.
+
 pub use yaak::render::{render_grpc_request, render_http_request};
-use yaak_models::models::Environment;
-use yaak_models::render::make_vars_hashmap;
-use yaak_templates::{RenderOptions, TemplateCallback, parse_and_render, render_json_value_raw};
-
-pub async fn render_template<T: TemplateCallback>(
-    template: &str,
-    environment_chain: Vec<Environment>,
-    cb: &T,
-    opt: &RenderOptions,
-) -> yaak_templates::error::Result<String> {
-    let vars = &make_vars_hashmap(environment_chain);
-    parse_and_render(template, vars, cb, &opt).await
-}
-
-pub async fn render_json_value<T: TemplateCallback>(
-    value: Value,
-    environment_chain: Vec<Environment>,
-    cb: &T,
-    opt: &RenderOptions,
-) -> yaak_templates::error::Result<Value> {
-    let vars = &make_vars_hashmap(environment_chain);
-    render_json_value_raw(value, vars, cb, opt).await
-}
+pub use yaak_commands::render::{render_json_value, render_template};
@@ -22,6 +22,7 @@ use crate::updates::YaakUpdater;
 use log::warn;
 use serde::Serialize;
 use tauri::{Manager, Runtime, State, WebviewWindow};
+use std::collections::HashMap;
 use std::sync::Arc;
 use tokio::sync::Mutex;
 use yaak_commands::{Host, PluginHost};
@@ -41,7 +42,9 @@ use yaak_models::models::{
 use yaak_models::query_manager::QueryManager;
 use yaak_models::util::BatchUpsertResult;
 use yaak_plugins::events::{
-    FilterResponse, GetFolderActionsResponse, GetGrpcRequestActionsResponse,
+    CallFolderActionRequest, CallGrpcRequestActionRequest, CallHttpRequestActionRequest,
+    CallWebsocketRequestActionRequest, CallWorkspaceActionRequest, FilterResponse, ImportResponse,
+    JsonPrimitive, RenderPurpose, GetFolderActionsResponse, GetGrpcRequestActionsResponse,
    GetHttpAuthenticationConfigResponse, GetHttpAuthenticationSummaryResponse,
    GetHttpRequestActionsResponse, GetTemplateFunctionConfigResponse,
    GetTemplateFunctionSummaryResponse, GetThemesResponse, GetWebsocketRequestActionsResponse,
@@ -50,11 +53,13 @@ use yaak_plugins::events::{
 use yaak_plugins::api::{PluginNameVersion, PluginSearchResponse, PluginUpdatesResponse};
 use yaak_plugins::manager::PluginManager;
 use yaak_plugins::native_template_functions::encrypt_secure_template_function;
+use yaak_plugins::template_callback::PluginTemplateCallback;
 use yaak_plugins::plugin_meta::PluginMetadata;
 use yaak_rpc::RpcRouter;
 use yaak_rpc_schema::*;
 use yaak_sse::sse::ServerSentEvent;
 use yaak_sync::sync::SyncOp;
+use yaak_templates::TemplateCallback;
 use yaak_tauri_utils::window::WorkspaceWindowTrait;
 use yaak_ws::WebsocketManager;

@@ -103,27 +108,177 @@ impl<R: Runtime> Host for ClientCtx<R> {
    }
 }

+impl<R: Runtime> ClientCtx<R> {
+    /// The plugin runtime this window talks to. Only the `PluginHost` impl
+    /// below uses it; everything else goes through the trait.
+    fn pm(&self) -> State<'_, PluginManager> {
+        self.window.state::<PluginManager>()
+    }
+}
+
 /// The desktop answers all of these out of the `PluginManager` it already
 /// runs — the Node sidecar. Each is a delegation, which is the point: the
 /// operations are what the handlers need, and this is one host's way of
 /// providing them.
 impl<R: Runtime> PluginHost for ClientCtx<R> {
    async fn loaded_plugin_metadata(&self, directory: &str) -> Option<PluginMetadata> {
-        let manager = self.window.state::<PluginManager>();
-        let handle = manager.get_plugin_by_dir(directory).await?;
+        let handle = self.pm().get_plugin_by_dir(directory).await?;
        Some(handle.info())
    }

    async fn take_plugin_init_errors(&self) -> Vec<(String, String)> {
-        self.window.state::<PluginManager>().take_init_errors().await
+        self.pm().take_init_errors().await
    }

    async fn resolve_plugins(&self, plugins: Vec<Plugin>) -> Vec<Plugin> {
-        self.window.state::<PluginManager>().resolve_plugins_for_runtime_from_db(plugins).await
+        self.pm().resolve_plugins_for_runtime_from_db(plugins).await
+    }
+
+    fn template_callback(&self, purpose: RenderPurpose) -> impl TemplateCallback {
+        PluginTemplateCallback::new(
+            Arc::new((*self.pm()).clone()),
+            Arc::new(self.encryption_manager().clone()),
+            &self.plugin_context(),
+            purpose,
+        )
+    }
+
+    async fn template_function_summaries(
+        &self,
+    ) -> yaak_commands::Result<Vec<GetTemplateFunctionSummaryResponse>> {
+        Ok(self
+            .window
+            .state::<PluginManager>()
+            .get_template_function_summaries(&self.plugin_context())
+            .await?)
+    }
+
+    async fn template_function_config(
+        &self,
+        function_name: &str,
+        values: HashMap<String, JsonPrimitive>,
+        model_id: &str,
+    ) -> yaak_commands::Result<GetTemplateFunctionConfigResponse> {
+        Ok(self
+            .window
+            .state::<PluginManager>()
+            .get_template_function_config(&self.plugin_context(), function_name, values, model_id)
+            .await?)
+    }
+
+    async fn themes(&self) -> yaak_commands::Result<Vec<GetThemesResponse>> {
+        Ok(self.pm().get_themes(&self.plugin_context()).await?)
+    }
+
+    async fn http_request_actions(
+        &self,
+    ) -> yaak_commands::Result<Vec<GetHttpRequestActionsResponse>> {
+        Ok(self.pm().get_http_request_actions(&self.plugin_context()).await?)
+    }
+
+    async fn websocket_request_actions(
+        &self,
+    ) -> yaak_commands::Result<Vec<GetWebsocketRequestActionsResponse>> {
+        Ok(self.pm().get_websocket_request_actions(&self.plugin_context()).await?)
+    }
+
+    async fn grpc_request_actions(
+        &self,
+    ) -> yaak_commands::Result<Vec<GetGrpcRequestActionsResponse>> {
+        Ok(self.pm().get_grpc_request_actions(&self.plugin_context()).await?)
+    }
+
+    async fn workspace_actions(&self) -> yaak_commands::Result<Vec<GetWorkspaceActionsResponse>> {
+        Ok(self.pm().get_workspace_actions(&self.plugin_context()).await?)
+    }
+
+    async fn folder_actions(&self) -> yaak_commands::Result<Vec<GetFolderActionsResponse>> {
+        Ok(self.pm().get_folder_actions(&self.plugin_context()).await?)
+    }
+
+    async fn call_http_request_action(
+        &self,
+        req: CallHttpRequestActionRequest,
+    ) -> yaak_commands::Result<()> {
+        Ok(self.pm().call_http_request_action(&self.plugin_context(), req).await?)
+    }
+
+    async fn call_grpc_request_action(
+        &self,
+        req: CallGrpcRequestActionRequest,
+    ) -> yaak_commands::Result<()> {
+        Ok(self.pm().call_grpc_request_action(&self.plugin_context(), req).await?)
+    }
+
+    async fn call_websocket_request_action(
+        &self,
+        req: CallWebsocketRequestActionRequest,
+    ) -> yaak_commands::Result<()> {
+        Ok(self.pm().call_websocket_request_action(&self.plugin_context(), req).await?)
+    }
+
+    async fn call_workspace_action(
+        &self,
+        req: CallWorkspaceActionRequest,
+    ) -> yaak_commands::Result<()> {
+        Ok(self.pm().call_workspace_action(&self.plugin_context(), req).await?)
+    }
+
+    async fn call_folder_action(
+        &self,
+        req: CallFolderActionRequest,
+    ) -> yaak_commands::Result<()> {
+        Ok(self.pm().call_folder_action(&self.plugin_context(), req).await?)
+    }
+
+    async fn http_authentication_summaries(
+        &self,
+    ) -> yaak_commands::Result<Vec<GetHttpAuthenticationSummaryResponse>> {
+        let results = self.pm().get_http_authentication_summaries(&self.plugin_context()).await?;
+        Ok(results.into_iter().map(|(_, a)| a).collect())
+    }
+
+    async fn http_authentication_config(
+        &self,
+        auth_name: &str,
+        values: HashMap<String, JsonPrimitive>,
+        model_id: &str,
+    ) -> yaak_commands::Result<GetHttpAuthenticationConfigResponse> {
+        Ok(self
+            .pm()
+            .get_http_authentication_config(&self.plugin_context(), auth_name, values, model_id)
+            .await?)
+    }
+
+    async fn call_http_authentication_action(
+        &self,
+        auth_name: &str,
+        action_index: i32,
+        values: HashMap<String, JsonPrimitive>,
+        model_id: &str,
+    ) -> yaak_commands::Result<()> {
+        Ok(self
+            .pm()
+            .call_http_authentication_action(
+                &self.plugin_context(),
+                auth_name,
+                action_index,
+                values,
+                model_id,
+            )
+            .await?)
+    }
+
+    async fn import_data(&self, content: &str) -> yaak_commands::Result<ImportResponse> {
+        Ok(self.pm().import_data(&self.plugin_context(), content).await?)
+    }
+
+    async fn reload_plugins(&self, plugins: Vec<Plugin>) -> Vec<(String, String)> {
+        self.pm().initialize_all_plugins(plugins, &self.plugin_context()).await
    }

    async fn encrypt_secure_template(&self, template: &str) -> yaak_commands::Result<String> {
-        let plugin_manager = Arc::new((*self.window.state::<PluginManager>()).clone());
+        let plugin_manager = Arc::new((*self.pm()).clone());
        let encryption_manager = Arc::new(self.encryption_manager().clone());
        Ok(encrypt_secure_template_function(
            plugin_manager,
@@ -227,11 +382,11 @@ async fn cmd_metadata<R: Runtime>(ctx: ClientCtx<R>, _req: CmdMetadataReq) -> Re
 }

 async fn cmd_template_tokens_to_string<R: Runtime>(ctx: ClientCtx<R>, req: CmdTemplateTokensToStringReq) -> Result<String> {
-    Ok(crate::cmd_template_tokens_to_string(ctx.window.clone(), ctx.window.app_handle().clone(), req.tokens).await?)
+    Ok(yaak_commands::templates::cmd_template_tokens_to_string(ctx, req).await?)
 }

 async fn cmd_render_template<R: Runtime>(ctx: ClientCtx<R>, req: CmdRenderTemplateReq) -> Result<String> {
-    Ok(crate::cmd_render_template(ctx.window.clone(), ctx.window.app_handle().clone(), &req.template, &req.workspace_id, req.environment_id.as_deref(), req.purpose, req.ignore_error).await?)
+    Ok(yaak_commands::templates::cmd_render_template(ctx, req).await?)
 }

 async fn cmd_send_feedback<R: Runtime>(ctx: ClientCtx<R>, req: CmdSendFeedbackReq) -> Result<()> {
@@ -294,68 +449,68 @@ async fn cmd_import_url<R: Runtime>(ctx: ClientCtx<R>, req: CmdImportUrlReq) ->
    Ok(crate::cmd_import_url(ctx.window.clone(), &req.url).await?)
 }

-async fn cmd_http_request_actions<R: Runtime>(ctx: ClientCtx<R>, _req: CmdHttpRequestActionsReq) -> Result<Vec<GetHttpRequestActionsResponse>> {
-    Ok(crate::cmd_http_request_actions(ctx.window.clone(), ctx.window.app_handle().state::<PluginManager>()).await?)
+async fn cmd_http_request_actions<R: Runtime>(ctx: ClientCtx<R>, req: CmdHttpRequestActionsReq) -> Result<Vec<GetHttpRequestActionsResponse>> {
+    Ok(yaak_commands::actions::cmd_http_request_actions(ctx, req).await?)
 }

-async fn cmd_websocket_request_actions<R: Runtime>(ctx: ClientCtx<R>, _req: CmdWebsocketRequestActionsReq) -> Result<Vec<GetWebsocketRequestActionsResponse>> {
-    Ok(crate::cmd_websocket_request_actions(ctx.window.clone(), ctx.window.app_handle().state::<PluginManager>()).await?)
+async fn cmd_websocket_request_actions<R: Runtime>(ctx: ClientCtx<R>, req: CmdWebsocketRequestActionsReq) -> Result<Vec<GetWebsocketRequestActionsResponse>> {
+    Ok(yaak_commands::actions::cmd_websocket_request_actions(ctx, req).await?)
 }

 async fn cmd_call_websocket_request_action<R: Runtime>(ctx: ClientCtx<R>, req: CmdCallWebsocketRequestActionReq) -> Result<()> {
-    Ok(crate::cmd_call_websocket_request_action(ctx.window.clone(), req.req, ctx.window.app_handle().state::<PluginManager>()).await?)
+    Ok(yaak_commands::actions::cmd_call_websocket_request_action(ctx, req).await?)
 }

-async fn cmd_workspace_actions<R: Runtime>(ctx: ClientCtx<R>, _req: CmdWorkspaceActionsReq) -> Result<Vec<GetWorkspaceActionsResponse>> {
-    Ok(crate::cmd_workspace_actions(ctx.window.clone(), ctx.window.app_handle().state::<PluginManager>()).await?)
+async fn cmd_workspace_actions<R: Runtime>(ctx: ClientCtx<R>, req: CmdWorkspaceActionsReq) -> Result<Vec<GetWorkspaceActionsResponse>> {
+    Ok(yaak_commands::actions::cmd_workspace_actions(ctx, req).await?)
 }

 async fn cmd_call_workspace_action<R: Runtime>(ctx: ClientCtx<R>, req: CmdCallWorkspaceActionReq) -> Result<()> {
-    Ok(crate::cmd_call_workspace_action(ctx.window.clone(), req.req, ctx.window.app_handle().state::<PluginManager>()).await?)
+    Ok(yaak_commands::actions::cmd_call_workspace_action(ctx, req).await?)
 }

-async fn cmd_folder_actions<R: Runtime>(ctx: ClientCtx<R>, _req: CmdFolderActionsReq) -> Result<Vec<GetFolderActionsResponse>> {
-    Ok(crate::cmd_folder_actions(ctx.window.clone(), ctx.window.app_handle().state::<PluginManager>()).await?)
+async fn cmd_folder_actions<R: Runtime>(ctx: ClientCtx<R>, req: CmdFolderActionsReq) -> Result<Vec<GetFolderActionsResponse>> {
+    Ok(yaak_commands::actions::cmd_folder_actions(ctx, req).await?)
 }

 async fn cmd_call_folder_action<R: Runtime>(ctx: ClientCtx<R>, req: CmdCallFolderActionReq) -> Result<()> {
-    Ok(crate::cmd_call_folder_action(ctx.window.clone(), req.req, ctx.window.app_handle().state::<PluginManager>()).await?)
+    Ok(yaak_commands::actions::cmd_call_folder_action(ctx, req).await?)
 }

-async fn cmd_grpc_request_actions<R: Runtime>(ctx: ClientCtx<R>, _req: CmdGrpcRequestActionsReq) -> Result<Vec<GetGrpcRequestActionsResponse>> {
-    Ok(crate::cmd_grpc_request_actions(ctx.window.clone(), ctx.window.app_handle().state::<PluginManager>()).await?)
+async fn cmd_grpc_request_actions<R: Runtime>(ctx: ClientCtx<R>, req: CmdGrpcRequestActionsReq) -> Result<Vec<GetGrpcRequestActionsResponse>> {
+    Ok(yaak_commands::actions::cmd_grpc_request_actions(ctx, req).await?)
 }

-async fn cmd_template_function_summaries<R: Runtime>(ctx: ClientCtx<R>, _req: CmdTemplateFunctionSummariesReq) -> Result<Vec<GetTemplateFunctionSummaryResponse>> {
-    Ok(crate::cmd_template_function_summaries(ctx.window.clone(), ctx.window.app_handle().state::<PluginManager>()).await?)
+async fn cmd_template_function_summaries<R: Runtime>(ctx: ClientCtx<R>, req: CmdTemplateFunctionSummariesReq) -> Result<Vec<GetTemplateFunctionSummaryResponse>> {
+    Ok(yaak_commands::templates::cmd_template_function_summaries(ctx, req).await?)
 }

 async fn cmd_template_function_config<R: Runtime>(ctx: ClientCtx<R>, req: CmdTemplateFunctionConfigReq) -> Result<GetTemplateFunctionConfigResponse> {
-    Ok(crate::cmd_template_function_config(ctx.window.clone(), ctx.window.app_handle().state::<PluginManager>(), &req.function_name, req.values, req.model, req.environment_id.as_deref()).await?)
+    Ok(yaak_commands::templates::cmd_template_function_config(ctx, req).await?)
 }

-async fn cmd_get_http_authentication_summaries<R: Runtime>(ctx: ClientCtx<R>, _req: CmdGetHttpAuthenticationSummariesReq) -> Result<Vec<GetHttpAuthenticationSummaryResponse>> {
-    Ok(crate::cmd_get_http_authentication_summaries(ctx.window.clone(), ctx.window.app_handle().state::<PluginManager>()).await?)
+async fn cmd_get_http_authentication_summaries<R: Runtime>(ctx: ClientCtx<R>, req: CmdGetHttpAuthenticationSummariesReq) -> Result<Vec<GetHttpAuthenticationSummaryResponse>> {
+    Ok(yaak_commands::auth::cmd_get_http_authentication_summaries(ctx, req).await?)
 }

 async fn cmd_get_http_authentication_config<R: Runtime>(ctx: ClientCtx<R>, req: CmdGetHttpAuthenticationConfigReq) -> Result<GetHttpAuthenticationConfigResponse> {
-    Ok(crate::cmd_get_http_authentication_config(ctx.window.clone(), ctx.window.app_handle().clone(), ctx.window.app_handle().state::<PluginManager>(), ctx.window.app_handle().state::<EncryptionManager>(), &req.auth_name, req.values, req.model, req.environment_id.as_deref()).await?)
+    Ok(yaak_commands::auth::cmd_get_http_authentication_config(ctx, req).await?)
 }

 async fn cmd_call_http_request_action<R: Runtime>(ctx: ClientCtx<R>, req: CmdCallHttpRequestActionReq) -> Result<()> {
-    Ok(crate::cmd_call_http_request_action(ctx.window.clone(), req.req, ctx.window.app_handle().state::<PluginManager>()).await?)
+    Ok(yaak_commands::actions::cmd_call_http_request_action(ctx, req).await?)
 }

 async fn cmd_call_grpc_request_action<R: Runtime>(ctx: ClientCtx<R>, req: CmdCallGrpcRequestActionReq) -> Result<()> {
-    Ok(crate::cmd_call_grpc_request_action(ctx.window.clone(), req.req, ctx.window.app_handle().state::<PluginManager>()).await?)
+    Ok(yaak_commands::actions::cmd_call_grpc_request_action(ctx, req).await?)
 }

 async fn cmd_call_http_authentication_action<R: Runtime>(ctx: ClientCtx<R>, req: CmdCallHttpAuthenticationActionReq) -> Result<()> {
-    Ok(crate::cmd_call_http_authentication_action(ctx.window.clone(), ctx.window.app_handle().clone(), ctx.window.app_handle().state::<PluginManager>(), ctx.window.app_handle().state::<EncryptionManager>(), &req.auth_name, req.action_index, req.values, req.model, req.environment_id.as_deref()).await?)
+    Ok(yaak_commands::auth::cmd_call_http_authentication_action(ctx, req).await?)
 }

 async fn cmd_curl_to_request<R: Runtime>(ctx: ClientCtx<R>, req: CmdCurlToRequestReq) -> Result<HttpRequest> {
-    Ok(crate::cmd_curl_to_request(ctx.window.clone(), &req.command, ctx.window.app_handle().state::<PluginManager>(), &req.workspace_id).await?)
+    Ok(yaak_commands::actions::cmd_curl_to_request(ctx, req).await?)
 }

 async fn cmd_export_data<R: Runtime>(ctx: ClientCtx<R>, req: CmdExportDataReq) -> Result<()> {
@@ -374,8 +529,8 @@ async fn cmd_send_http_request<R: Runtime>(ctx: ClientCtx<R>, req: CmdSendHttpRe
    Ok(crate::cmd_send_http_request(ctx.window.app_handle().clone(), ctx.window.clone(), req.environment_id.as_deref(), req.cookie_jar_id.as_deref(), req.request_id).await?)
 }

-async fn cmd_reload_plugins<R: Runtime>(ctx: ClientCtx<R>, _req: CmdReloadPluginsReq) -> Result<Vec<(String, String)>> {
-    Ok(crate::cmd_reload_plugins(ctx.window.app_handle().clone(), ctx.window.clone(), ctx.window.app_handle().state::<PluginManager>()).await?)
+async fn cmd_reload_plugins<R: Runtime>(ctx: ClientCtx<R>, req: CmdReloadPluginsReq) -> Result<Vec<(String, String)>> {
+    Ok(yaak_commands::actions::cmd_reload_plugins(ctx, req).await?)
 }

 async fn cmd_plugin_info<R: Runtime>(ctx: ClientCtx<R>, req: CmdPluginInfoReq) -> Result<PluginMetadata> {
@@ -418,8 +573,8 @@ async fn cmd_secure_template<R: Runtime>(ctx: ClientCtx<R>, req: CmdSecureTempla
    Ok(yaak_commands::encryption::cmd_secure_template(ctx, req).await?)
 }

-async fn cmd_get_themes<R: Runtime>(ctx: ClientCtx<R>, _req: CmdGetThemesReq) -> Result<Vec<GetThemesResponse>> {
-    Ok(crate::commands::cmd_get_themes(ctx.window.clone(), ctx.window.app_handle().state::<PluginManager>()).await?)
+async fn cmd_get_themes<R: Runtime>(ctx: ClientCtx<R>, req: CmdGetThemesReq) -> Result<Vec<GetThemesResponse>> {
+    Ok(yaak_commands::templates::cmd_get_themes(ctx, req).await?)
 }

 async fn cmd_enable_encryption<R: Runtime>(ctx: ClientCtx<R>, req: CmdEnableEncryptionReq) -> Result<()> {
@@ -18,7 +18,7 @@ use yaak_http::cookies::CookieStore;
 use yaak_http::path_placeholders::apply_path_placeholders;
 use yaak_models::models::{
    HttpResponseHeader, WebsocketConnection, WebsocketConnectionState, WebsocketEvent,
-    WebsocketEventType, WebsocketRequest,
+    WebsocketEventType,
 };
 use yaak_models::util::UpdateSource;
 use yaak_plugins::events::{CallHttpAuthenticationRequest, HttpHeader, RenderPurpose};
@@ -27,6 +27,7 @@ use yaak_plugins::template_callback::PluginTemplateCallback;
 use yaak_templates::strip_json_comments::maybe_strip_json_comments;
 use yaak_templates::{RenderErrorBehavior, RenderOptions};
 use yaak_tls::find_client_certificate;
+use yaak_commands::resolve::resolve_websocket_request;
 use yaak_ws::{WebsocketManager, render_websocket_request};

 pub async fn cmd_ws_send<R: Runtime>(
@@ -75,7 +76,7 @@ async fn send_websocket_message<R: Runtime>(
        environment_id,
    )?;
    let (resolved_request, _auth_context_id) =
-        resolve_websocket_request(&window, &unrendered_request)?;
+        resolve_websocket_request(&window.db(), &unrendered_request)?;
    let plugin_manager = Arc::new((*app_handle.state::<PluginManager>()).clone());
    let encryption_manager = Arc::new((*app_handle.state::<EncryptionManager>()).clone());
    let request = render_websocket_request(
@@ -154,7 +155,7 @@ pub async fn cmd_ws_connect<R: Runtime>(
        app_handle.db().resolve_settings_for_websocket_request(&unrendered_request)?;
    let settings = app_handle.db().get_settings();
    let (resolved_request, auth_context_id) =
-        resolve_websocket_request(&window, &unrendered_request)?;
+        resolve_websocket_request(&window.db(), &unrendered_request)?;
    let plugin_manager = Arc::new((*app_handle.state::<PluginManager>()).clone());
    let encryption_manager = Arc::new((*app_handle.state::<EncryptionManager>()).clone());
    let request = render_websocket_request(
@@ -454,23 +455,6 @@ pub async fn cmd_ws_connect<R: Runtime>(
    Ok(connection)
 }

-/// Resolve inherited authentication and headers for a websocket request
-fn resolve_websocket_request<R: Runtime>(
-    window: &WebviewWindow<R>,
-    request: &WebsocketRequest,
-) -> Result<(WebsocketRequest, String)> {
-    let mut new_request = request.clone();
-
-    let (authentication_type, authentication, authentication_context_id) =
-        window.db().resolve_auth_for_websocket_request(request)?;
-    new_request.authentication_type = authentication_type;
-    new_request.authentication = authentication;
-
-    let headers = window.db().resolve_headers_for_websocket_request(request)?;
-    new_request.headers = headers;
-
-    Ok((new_request, authentication_context_id))
-}

 /// Convert WS URL to HTTP URL for cookie filtering
 /// WebSocket upgrade requests are HTTP requests initially, so HttpOnly cookies should apply
@@ -55,7 +55,7 @@ urlParameters: Array<HttpUrlParameter>, settingSendCookies: InheritedBoolSetting

 export type HttpRequestHeader = { enabled?: boolean, name: string, value: string, id?: string, };

-export type HttpResponse = { model: "http_response", id: string, createdAt: string, updatedAt: string, workspaceId: string, requestId: string, bodyPath: string | null, contentLength: number | null, contentLengthCompressed: number | null, elapsed: number, elapsedHeaders: number, elapsedDns: number, error: string | null, headers: Array<HttpResponseHeader>, remoteAddr: string | null, requestContentLength: number | null, requestHeaders: Array<HttpResponseHeader>, status: number, statusReason: string | null, state: HttpResponseState, url: string, version: string | null, };
+export type HttpResponse = { model: "http_response", id: string, createdAt: string, updatedAt: string, workspaceId: string, requestId: string, contentLength: number | null, contentLengthCompressed: number | null, elapsed: number, elapsedHeaders: number, elapsedDns: number, error: string | null, headers: Array<HttpResponseHeader>, remoteAddr: string | null, requestContentLength: number | null, requestHeaders: Array<HttpResponseHeader>, status: number, statusReason: string | null, state: HttpResponseState, url: string, version: string | null, };

 export type HttpResponseEvent = { model: "http_response_event", id: string, createdAt: string, updatedAt: string, workspaceId: string, responseId: string, event: HttpResponseEventData, };

@@ -6,10 +6,8 @@ authors = ["Gregory Schier"]
 publish = false

 [dependencies]
-log = { workspace = true }
 serde_json = { workspace = true }
 thiserror = { workspace = true }
-tokio = { workspace = true, features = ["rt"] }
 yaak = { workspace = true }
 yaak-core = { workspace = true }
 yaak-crypto = { workspace = true }
@@ -0,0 +1,157 @@
+//! The actions plugins contribute to the UI, and the calls that run them.
+//!
+//! Listing is a plain question for the plugin runtime. Calling is not: the
+//! frontend sends back the model it was showing, and a plugin must act on what
+//! that model *actually is* — re-read from the database, with inheritance
+//! resolved — not on a snapshot the UI has been holding. That re-reading is the
+//! work these handlers do.
+
+use crate::error::{Error, Result};
+use crate::host::PluginHost;
+use crate::resolve::{resolve_grpc_request, resolve_http_request};
+use yaak_models::models::HttpRequest;
+use yaak_plugins::events::{
+    CallFolderActionArgs, CallFolderActionRequest, CallGrpcRequestActionArgs,
+    CallGrpcRequestActionRequest, CallHttpRequestActionArgs, CallHttpRequestActionRequest,
+    CallWebsocketRequestActionArgs, CallWebsocketRequestActionRequest, CallWorkspaceActionArgs,
+    CallWorkspaceActionRequest, GetFolderActionsResponse, GetGrpcRequestActionsResponse,
+    GetHttpRequestActionsResponse, GetWebsocketRequestActionsResponse, GetWorkspaceActionsResponse,
+};
+use yaak_rpc_schema::*;
+
+// -- Listing --
+
+pub async fn cmd_http_request_actions<H: PluginHost>(
+    host: H,
+    _req: CmdHttpRequestActionsReq,
+) -> Result<Vec<GetHttpRequestActionsResponse>> {
+    host.http_request_actions().await
+}
+
+pub async fn cmd_websocket_request_actions<H: PluginHost>(
+    host: H,
+    _req: CmdWebsocketRequestActionsReq,
+) -> Result<Vec<GetWebsocketRequestActionsResponse>> {
+    host.websocket_request_actions().await
+}
+
+pub async fn cmd_grpc_request_actions<H: PluginHost>(
+    host: H,
+    _req: CmdGrpcRequestActionsReq,
+) -> Result<Vec<GetGrpcRequestActionsResponse>> {
+    host.grpc_request_actions().await
+}
+
+pub async fn cmd_workspace_actions<H: PluginHost>(
+    host: H,
+    _req: CmdWorkspaceActionsReq,
+) -> Result<Vec<GetWorkspaceActionsResponse>> {
+    host.workspace_actions().await
+}
+
+pub async fn cmd_folder_actions<H: PluginHost>(
+    host: H,
+    _req: CmdFolderActionsReq,
+) -> Result<Vec<GetFolderActionsResponse>> {
+    host.folder_actions().await
+}
+
+// -- Calling --
+
+pub async fn cmd_call_http_request_action<H: PluginHost>(
+    host: H,
+    req: CmdCallHttpRequestActionReq,
+) -> Result<()> {
+    let inner = req.req;
+    let http_request = resolve_http_request(&host.db(), &inner.args.http_request)?.0;
+    host.call_http_request_action(CallHttpRequestActionRequest {
+        args: CallHttpRequestActionArgs { http_request },
+        ..inner
+    })
+    .await
+}
+
+pub async fn cmd_call_grpc_request_action<H: PluginHost>(
+    host: H,
+    req: CmdCallGrpcRequestActionReq,
+) -> Result<()> {
+    let inner = req.req;
+    let grpc_request = resolve_grpc_request(&host.db(), &inner.args.grpc_request)?.0;
+    host.call_grpc_request_action(CallGrpcRequestActionRequest {
+        args: CallGrpcRequestActionArgs { grpc_request, ..inner.args },
+        ..inner
+    })
+    .await
+}
+
+pub async fn cmd_call_websocket_request_action<H: PluginHost>(
+    host: H,
+    req: CmdCallWebsocketRequestActionReq,
+) -> Result<()> {
+    let inner = req.req;
+    let websocket_request = host.db().get_websocket_request(&inner.args.websocket_request.id)?;
+    host.call_websocket_request_action(CallWebsocketRequestActionRequest {
+        args: CallWebsocketRequestActionArgs { websocket_request },
+        ..inner
+    })
+    .await
+}
+
+pub async fn cmd_call_workspace_action<H: PluginHost>(
+    host: H,
+    req: CmdCallWorkspaceActionReq,
+) -> Result<()> {
+    let inner = req.req;
+    let workspace = host.db().get_workspace(&inner.args.workspace.id)?;
+    host.call_workspace_action(CallWorkspaceActionRequest {
+        args: CallWorkspaceActionArgs { workspace },
+        ..inner
+    })
+    .await
+}
+
+pub async fn cmd_call_folder_action<H: PluginHost>(
+    host: H,
+    req: CmdCallFolderActionReq,
+) -> Result<()> {
+    let inner = req.req;
+    let folder = host.db().get_folder(&inner.args.folder.id)?;
+    host.call_folder_action(CallFolderActionRequest {
+        args: CallFolderActionArgs { folder },
+        ..inner
+    })
+    .await
+}
+
+// -- Other things the plugin runtime does --
+
+/// Turn a `curl` command line into an unsaved request, by handing it to the
+/// same importer plugins that read files.
+pub async fn cmd_curl_to_request<H: PluginHost>(
+    host: H,
+    req: CmdCurlToRequestReq,
+) -> Result<HttpRequest> {
+    let imported = host.import_data(&req.command).await?;
+
+    let request = imported
+        .resources
+        .http_requests
+        .first()
+        .ok_or_else(|| Error::Generic("No curl command found".to_string()))?;
+
+    // Belongs to the workspace the user is importing into, and is not saved
+    // until they say so — hence the blank id.
+    let mut request = request.clone();
+    request.workspace_id = req.workspace_id;
+    request.id = String::new();
+    Ok(request)
+}
+
+/// Restart every plugin, returning whatever failed to come back up.
+pub async fn cmd_reload_plugins<H: PluginHost>(
+    host: H,
+    _req: CmdReloadPluginsReq,
+) -> Result<Vec<(String, String)>> {
+    let plugins = host.db().list_plugins()?;
+    Ok(host.reload_plugins(plugins).await)
+}
@@ -0,0 +1,102 @@
+//! Authentication config forms and their actions.
+//!
+//! Both commands here do the same preparation: the frontend sends the model
+//! whose auth is being edited plus the values currently in the form, and those
+//! values may contain templates. They have to be rendered against the model's
+//! own environment chain before a plugin sees them, or an auth plugin receives
+//! `${[ api_key ]}` where it expected a key.
+
+use crate::error::{Error, Result};
+use crate::host::PluginHost;
+use crate::render::render_json_value;
+use std::collections::HashMap;
+use yaak_models::models::AnyModel;
+use yaak_plugins::events::{
+    GetHttpAuthenticationConfigResponse, GetHttpAuthenticationSummaryResponse, JsonPrimitive,
+    RenderPurpose,
+};
+use yaak_rpc_schema::*;
+use yaak_templates::RenderOptions;
+
+pub async fn cmd_get_http_authentication_summaries<H: PluginHost>(
+    host: H,
+    _req: CmdGetHttpAuthenticationSummariesReq,
+) -> Result<Vec<GetHttpAuthenticationSummaryResponse>> {
+    host.http_authentication_summaries().await
+}
+
+pub async fn cmd_get_http_authentication_config<H: PluginHost>(
+    host: H,
+    req: CmdGetHttpAuthenticationConfigReq,
+) -> Result<GetHttpAuthenticationConfigResponse> {
+    // A config form is being displayed, so a template that cannot resolve
+    // should show as blank rather than refuse to open the form.
+    let values = render_auth_values(
+        &host,
+        &req.model,
+        req.environment_id.as_deref(),
+        req.values,
+        RenderPurpose::Preview,
+        &RenderOptions::return_empty(),
+    )
+    .await?;
+
+    host.http_authentication_config(&req.auth_name, values, req.model.id()).await
+}
+
+pub async fn cmd_call_http_authentication_action<H: PluginHost>(
+    host: H,
+    req: CmdCallHttpAuthenticationActionReq,
+) -> Result<()> {
+    // An action actually uses these values, so an unresolvable template is an
+    // error rather than an empty string that would silently authenticate wrong.
+    let values = render_auth_values(
+        &host,
+        &req.model,
+        req.environment_id.as_deref(),
+        req.values,
+        RenderPurpose::Send,
+        &RenderOptions::throw(),
+    )
+    .await?;
+
+    host.call_http_authentication_action(&req.auth_name, req.action_index, values, req.model.id())
+        .await
+}
+
+/// Render the form's values against the environment chain the model sits in.
+///
+/// The chain depends on where the model lives — a request inherits through its
+/// folder, a workspace has only its own — so the model is what decides which
+/// variables are in scope.
+async fn render_auth_values<H: PluginHost>(
+    host: &H,
+    model: &AnyModel,
+    environment_id: Option<&str>,
+    values: HashMap<String, JsonPrimitive>,
+    purpose: RenderPurpose,
+    options: &RenderOptions,
+) -> Result<HashMap<String, JsonPrimitive>> {
+    let (workspace_id, folder_id) = match model {
+        AnyModel::HttpRequest(r) => (r.workspace_id.clone(), r.folder_id.clone()),
+        AnyModel::GrpcRequest(r) => (r.workspace_id.clone(), r.folder_id.clone()),
+        AnyModel::WebsocketRequest(r) => (r.workspace_id.clone(), r.folder_id.clone()),
+        AnyModel::Folder(f) => (f.workspace_id.clone(), f.folder_id.clone()),
+        AnyModel::Workspace(w) => (w.id.clone(), None),
+        other => {
+            return Err(Error::Generic(format!(
+                "Cannot resolve authentication for a {}",
+                other.model()
+            )));
+        }
+    };
+
+    let environment_chain =
+        host.db().resolve_environments(&workspace_id, folder_id.as_deref(), environment_id)?;
+
+    let cb = host.template_callback(purpose);
+    let rendered =
+        render_json_value(serde_json::to_value(&values)?, environment_chain, &cb, options).await?;
+
+    Ok(serde_json::from_value(rendered)?)
+}
@@ -13,6 +13,7 @@
 //! is anything only a desktop can do — open a native window, run the updater,
 //! show a native dialog — those handlers stay with the desktop.

+use std::collections::HashMap;
 use std::future::Future;
 use yaak_core::WorkspaceContext;
 use yaak_crypto::manager::EncryptionManager;
@@ -21,8 +22,17 @@ use yaak_models::client_db::ClientDb;
 use yaak_models::models::Plugin;
 use yaak_models::query_manager::QueryManager;
 use yaak_models::util::UpdateSource;
-use yaak_plugins::events::PluginContext;
+use yaak_plugins::events::{
+    CallFolderActionRequest, CallGrpcRequestActionRequest, CallHttpRequestActionRequest,
+    CallWebsocketRequestActionRequest, CallWorkspaceActionRequest, GetFolderActionsResponse,
+    GetGrpcRequestActionsResponse, GetHttpAuthenticationConfigResponse,
+    GetHttpAuthenticationSummaryResponse, GetHttpRequestActionsResponse,
+    GetTemplateFunctionConfigResponse, GetTemplateFunctionSummaryResponse, GetThemesResponse,
+    GetWebsocketRequestActionsResponse, GetWorkspaceActionsResponse, ImportResponse, JsonPrimitive,
+    PluginContext, RenderPurpose,
+};
 use yaak_plugins::plugin_meta::PluginMetadata;
+use yaak_templates::TemplateCallback;

 /// Only `Clone` is required here. `Send`/`Sync`/`'static` are deliberately
 /// *not*: a browser host is single-threaded and its connection pool is an
@@ -106,6 +116,101 @@ pub trait PluginHost: Host {
    /// loaded. A host without a runtime can return them untouched.
    fn resolve_plugins(&self, plugins: Vec<Plugin>) -> impl Future<Output = Vec<Plugin>>;

+    /// The template functions this host can run, as a callback the renderer
+    /// drives. This is the *only* thing the plugin runtime uniquely provides to
+    /// a render — the variables come from the environment chain, which is an
+    /// ordinary database read — so handing back the callback keeps the rest of
+    /// rendering shared instead of pushing whole commands behind this trait.
+    fn template_callback(&self, purpose: RenderPurpose) -> impl TemplateCallback;
+
+    /// Every template function the installed plugins expose, for the
+    /// autocomplete menu.
+    fn template_function_summaries(
+        &self,
+    ) -> impl Future<Output = crate::Result<Vec<GetTemplateFunctionSummaryResponse>>>;
+
+    /// The form a template function wants to show for the given values.
+    fn template_function_config(
+        &self,
+        function_name: &str,
+        values: HashMap<String, JsonPrimitive>,
+        model_id: &str,
+    ) -> impl Future<Output = crate::Result<GetTemplateFunctionConfigResponse>>;
+
+    /// Themes contributed by plugins.
+    fn themes(&self) -> impl Future<Output = crate::Result<Vec<GetThemesResponse>>>;
+
+    // -- Actions plugins contribute to the UI --
+
+    fn http_request_actions(
+        &self,
+    ) -> impl Future<Output = crate::Result<Vec<GetHttpRequestActionsResponse>>>;
+    fn websocket_request_actions(
+        &self,
+    ) -> impl Future<Output = crate::Result<Vec<GetWebsocketRequestActionsResponse>>>;
+    fn grpc_request_actions(
+        &self,
+    ) -> impl Future<Output = crate::Result<Vec<GetGrpcRequestActionsResponse>>>;
+    fn workspace_actions(
+        &self,
+    ) -> impl Future<Output = crate::Result<Vec<GetWorkspaceActionsResponse>>>;
+    fn folder_actions(&self) -> impl Future<Output = crate::Result<Vec<GetFolderActionsResponse>>>;
+
+    /// Running an action. The request in each of these has already been
+    /// re-read and had its inheritance resolved by the handler; a host must
+    /// pass it through untouched.
+    fn call_http_request_action(
+        &self,
+        req: CallHttpRequestActionRequest,
+    ) -> impl Future<Output = crate::Result<()>>;
+    fn call_grpc_request_action(
+        &self,
+        req: CallGrpcRequestActionRequest,
+    ) -> impl Future<Output = crate::Result<()>>;
+    fn call_websocket_request_action(
+        &self,
+        req: CallWebsocketRequestActionRequest,
+    ) -> impl Future<Output = crate::Result<()>>;
+    fn call_workspace_action(
+        &self,
+        req: CallWorkspaceActionRequest,
+    ) -> impl Future<Output = crate::Result<()>>;
+    fn call_folder_action(
+        &self,
+        req: CallFolderActionRequest,
+    ) -> impl Future<Output = crate::Result<()>>;
+
+    // -- Authentication --
+
+    fn http_authentication_summaries(
+        &self,
+    ) -> impl Future<Output = crate::Result<Vec<GetHttpAuthenticationSummaryResponse>>>;
+
+    /// The form an auth plugin wants to show. `values` arrive already rendered.
+    fn http_authentication_config(
+        &self,
+        auth_name: &str,
+        values: HashMap<String, JsonPrimitive>,
+        model_id: &str,
+    ) -> impl Future<Output = crate::Result<GetHttpAuthenticationConfigResponse>>;
+
+    fn call_http_authentication_action(
+        &self,
+        auth_name: &str,
+        action_index: i32,
+        values: HashMap<String, JsonPrimitive>,
+        model_id: &str,
+    ) -> impl Future<Output = crate::Result<()>>;
+
+    // -- The importers, and the runtime itself --
+
+    /// Hand arbitrary text to the importer plugins and take what they make of
+    /// it. Used for files, URLs and pasted `curl` commands alike.
+    fn import_data(&self, content: &str) -> impl Future<Output = crate::Result<ImportResponse>>;
+
+    /// Restart every plugin, returning `(plugin, error)` for those that failed.
+    fn reload_plugins(&self, plugins: Vec<Plugin>) -> impl Future<Output = Vec<(String, String)>>;
+
    /// Re-encrypt the `secure(...)` values in a template.
    ///
    /// Whole operation rather than its pieces because the encryption is only
@@ -11,13 +11,18 @@
 //! host-specific types; the ones that stay behind are the ones only a desktop
 //! can serve (native windows, the updater, dialogs) or that still lean on it.

+pub mod actions;
+pub mod auth;
 pub mod data;
 pub mod encryption;
 pub mod error;
 pub mod host;
 pub mod models;
 pub mod plugins;
+pub mod render;
+pub mod resolve;
 pub mod responses;
+pub mod templates;

 pub use error::{Error, Result};
 pub use host::{Host, PluginHost};
@@ -0,0 +1,30 @@
+//! Rendering a template against an environment chain.
+//!
+//! The variables come from the chain, the functions come from the host's
+//! template callback. Neither of these knows which host it is running under —
+//! that is the whole point of taking the callback as a parameter.
+
+use serde_json::Value;
+use yaak_models::models::Environment;
+use yaak_models::render::make_vars_hashmap;
+use yaak_templates::{RenderOptions, TemplateCallback, parse_and_render, render_json_value_raw};
+
+pub async fn render_template<T: TemplateCallback>(
+    template: &str,
+    environment_chain: Vec<Environment>,
+    cb: &T,
+    opt: &RenderOptions,
+) -> yaak_templates::error::Result<String> {
+    let vars = &make_vars_hashmap(environment_chain);
+    parse_and_render(template, vars, cb, opt).await
+}
+
+pub async fn render_json_value<T: TemplateCallback>(
+    value: Value,
+    environment_chain: Vec<Environment>,
+    cb: &T,
+    opt: &RenderOptions,
+) -> yaak_templates::error::Result<Value> {
+    let vars = &make_vars_hashmap(environment_chain);
+    render_json_value_raw(value, vars, cb, opt).await
+}
@@ -0,0 +1,56 @@
+//! Filling in what a request inherits from its folders and workspace.
+//!
+//! A request stored in the database records only what is set *on it*;
+//! authentication and headers can come from any ancestor. Anything that acts on
+//! a request as the user sees it — sending it, handing it to a plugin — has to
+//! resolve that chain first, which is why this is shared rather than living
+//! next to any one caller.
+
+use crate::error::Result;
+use yaak_models::client_db::ClientDb;
+use yaak_models::models::{GrpcRequest, HttpRequest, WebsocketRequest};
+
+/// The request with inherited auth and headers filled in, plus the id of the
+/// model the authentication was inherited *from* — plugins key their token
+/// caches on it, so it must be the ancestor's id and not the request's.
+pub fn resolve_http_request(db: &ClientDb, request: &HttpRequest) -> Result<(HttpRequest, String)> {
+    let mut new_request = request.clone();
+
+    let (authentication_type, authentication, authentication_context_id) =
+        db.resolve_auth_for_http_request(request)?;
+    new_request.authentication_type = authentication_type;
+    new_request.authentication = authentication;
+
+    new_request.headers = db.resolve_headers_for_http_request(request)?;
+
+    Ok((new_request, authentication_context_id))
+}
+
+pub fn resolve_grpc_request(db: &ClientDb, request: &GrpcRequest) -> Result<(GrpcRequest, String)> {
+    let mut new_request = request.clone();
+
+    let (authentication_type, authentication, authentication_context_id) =
+        db.resolve_auth_for_grpc_request(request)?;
+    new_request.authentication_type = authentication_type;
+    new_request.authentication = authentication;
+
+    new_request.metadata = db.resolve_metadata_for_grpc_request(request)?;
+
+    Ok((new_request, authentication_context_id))
+}
+
+pub fn resolve_websocket_request(
+    db: &ClientDb,
+    request: &WebsocketRequest,
+) -> Result<(WebsocketRequest, String)> {
+    let mut new_request = request.clone();
+
+    let (authentication_type, authentication, authentication_context_id) =
+        db.resolve_auth_for_websocket_request(request)?;
+    new_request.authentication_type = authentication_type;
+    new_request.authentication = authentication;
+
+    new_request.headers = db.resolve_headers_for_websocket_request(request)?;
+
+    Ok((new_request, authentication_context_id))
+}
@@ -0,0 +1,67 @@
+//! Templates, the functions plugins put in them, and themes.
+//!
+//! Everything here needs the plugin runtime, but only for the one thing it
+//! uniquely provides: running a template function. Resolving the environment
+//! chain and deciding what a render should do about errors are ordinary work
+//! and stay here, where every host gets them the same.
+
+use crate::error::Result;
+use crate::host::PluginHost;
+use crate::render::render_template;
+use yaak_plugins::events::{
+    GetTemplateFunctionConfigResponse, GetTemplateFunctionSummaryResponse, GetThemesResponse,
+    RenderPurpose,
+};
+use yaak_rpc_schema::*;
+use yaak_templates::{RenderErrorBehavior, RenderOptions, transform_args};
+
+pub async fn cmd_render_template<H: PluginHost>(
+    host: H,
+    req: CmdRenderTemplateReq,
+) -> Result<String> {
+    let environment_chain =
+        host.db().resolve_environments(&req.workspace_id, None, req.environment_id.as_deref())?;
+    let cb = host.template_callback(req.purpose.unwrap_or(RenderPurpose::Preview));
+    let options = RenderOptions {
+        // A preview that throws would show the user an error where they expect
+        // to see the value so far, so callers rendering *into the UI* ask for
+        // empties instead.
+        error_behavior: match req.ignore_error {
+            Some(true) => RenderErrorBehavior::ReturnEmpty,
+            _ => RenderErrorBehavior::Throw,
+        },
+    };
+    Ok(render_template(&req.template, environment_chain, &cb, &options).await?)
+}
+
+/// Render only the *arguments* of a template's function calls, leaving the
+/// calls themselves intact. This is what turns a parsed template back into
+/// something displayable without evaluating it.
+pub async fn cmd_template_tokens_to_string<H: PluginHost>(
+    host: H,
+    req: CmdTemplateTokensToStringReq,
+) -> Result<String> {
+    let cb = host.template_callback(RenderPurpose::Preview);
+    Ok(transform_args(req.tokens, &cb)?.to_string())
+}
+
+pub async fn cmd_template_function_summaries<H: PluginHost>(
+    host: H,
+    _req: CmdTemplateFunctionSummariesReq,
+) -> Result<Vec<GetTemplateFunctionSummaryResponse>> {
+    host.template_function_summaries().await
+}
+
+pub async fn cmd_template_function_config<H: PluginHost>(
+    host: H,
+    req: CmdTemplateFunctionConfigReq,
+) -> Result<GetTemplateFunctionConfigResponse> {
+    host.template_function_config(&req.function_name, req.values, req.model.id()).await
+}
+
+pub async fn cmd_get_themes<H: PluginHost>(
+    host: H,
+    _req: CmdGetThemesReq,
+) -> Result<Vec<GetThemesResponse>> {
+    host.themes().await
+}
@@ -8,25 +8,39 @@
 //! `PluginHost` too, without one, which is only possible because that trait
 //! names operations rather than handing back a manager.

+use std::cell::RefCell;
+use std::collections::HashMap;
 use std::rc::Rc;
 use std::sync::{Arc, Mutex};
 use tempfile::TempDir;
+use yaak_commands::auth::cmd_get_http_authentication_config;
 use yaak_commands::models::{
    cmd_default_headers, cmd_get_workspace_meta, models_delete, models_upsert,
    models_workspace_models,
 };
+use yaak_commands::templates::cmd_render_template;
 use yaak_commands::{Host, PluginHost};
 use yaak_core::WorkspaceContext;
 use yaak_crypto::manager::EncryptionManager;
 use yaak_models::blob_manager::BlobManager;
-use yaak_models::models::{AnyModel, Plugin, Workspace};
+use yaak_models::models::{AnyModel, Environment, EnvironmentVariable, Plugin, Workspace};
 use yaak_models::query_manager::QueryManager;
 use yaak_models::util::{ModelPayload, UpdateSource};
+use yaak_plugins::events::{
+    CallFolderActionRequest, CallGrpcRequestActionRequest, CallHttpRequestActionRequest,
+    CallWebsocketRequestActionRequest, CallWorkspaceActionRequest, GetFolderActionsResponse,
+    GetGrpcRequestActionsResponse, GetHttpAuthenticationConfigResponse,
+    GetHttpAuthenticationSummaryResponse, GetHttpRequestActionsResponse,
+    GetTemplateFunctionConfigResponse, GetTemplateFunctionSummaryResponse, GetThemesResponse,
+    GetWebsocketRequestActionsResponse, GetWorkspaceActionsResponse, ImportResponse, JsonPrimitive,
+    RenderPurpose,
+};
 use yaak_plugins::plugin_meta::PluginMetadata;
 use yaak_rpc_schema::{
-    CmdDefaultHeadersReq, CmdGetWorkspaceMetaReq, ModelsDeleteReq, ModelsUpsertReq,
-    ModelsWorkspaceModelsReq,
+    CmdDefaultHeadersReq, CmdGetWorkspaceMetaReq, CmdRenderTemplateReq, ModelsDeleteReq,
+    ModelsUpsertReq, ModelsWorkspaceModelsReq,
 };
+use yaak_templates::TemplateCallback;

 #[derive(Clone)]
 struct TestHost {
@@ -155,6 +169,9 @@ async fn host_free_handlers_need_no_state() {
 #[derive(Clone)]
 struct SingleThreadedHost {
    inner: Rc<Inner>,
+    /// The values the last auth-config call arrived with, so a test can check
+    /// they were rendered before the host ever saw them.
+    auth_values: Rc<RefCell<Option<HashMap<String, JsonPrimitive>>>>,
 }

 impl Host for SingleThreadedHost {
@@ -183,6 +200,32 @@ impl Host for SingleThreadedHost {
    }
 }

+/// A template callback with no plugins behind it: variables still resolve,
+/// function calls have nothing to run them. A browser host would put a Worker
+/// round-trip where this returns an error.
+struct NoTemplateFunctions;
+
+impl TemplateCallback for NoTemplateFunctions {
+    async fn run(
+        &self,
+        fn_name: &str,
+        _args: HashMap<String, serde_json::Value>,
+    ) -> yaak_templates::error::Result<String> {
+        Err(yaak_templates::error::Error::RenderError(format!(
+            "no plugin runtime to run {fn_name}()"
+        )))
+    }
+
+    fn transform_arg(
+        &self,
+        _fn_name: &str,
+        _arg_name: &str,
+        arg_value: &str,
+    ) -> yaak_templates::error::Result<String> {
+        Ok(arg_value.to_string())
+    }
+}
+
 /// Answering plugin questions with no plugin runtime behind them. A browser
 /// host would put a `postMessage` round-trip to its Worker where these return
 /// constants; the shape of the trait is what makes either possible.
@@ -204,12 +247,136 @@ impl PluginHost for SingleThreadedHost {
    async fn encrypt_secure_template(&self, _template: &str) -> yaak_commands::Result<String> {
        Err(yaak_commands::Error::Generic("no plugin runtime on this host".into()))
    }
+
+    fn template_callback(&self, _purpose: RenderPurpose) -> impl TemplateCallback {
+        NoTemplateFunctions
+    }
+
+    async fn template_function_summaries(
+        &self,
+    ) -> yaak_commands::Result<Vec<GetTemplateFunctionSummaryResponse>> {
+        Ok(Vec::new())
+    }
+
+    async fn template_function_config(
+        &self,
+        function_name: &str,
+        _values: HashMap<String, JsonPrimitive>,
+        _model_id: &str,
+    ) -> yaak_commands::Result<GetTemplateFunctionConfigResponse> {
+        Err(yaak_commands::Error::Generic(format!("no plugin provides {function_name}()")))
+    }
+
+    async fn themes(&self) -> yaak_commands::Result<Vec<GetThemesResponse>> {
+        Ok(Vec::new())
+    }
+
+    // No plugins, so nothing contributes actions and nothing can run one.
+
+    async fn http_request_actions(
+        &self,
+    ) -> yaak_commands::Result<Vec<GetHttpRequestActionsResponse>> {
+        Ok(Vec::new())
+    }
+
+    async fn websocket_request_actions(
+        &self,
+    ) -> yaak_commands::Result<Vec<GetWebsocketRequestActionsResponse>> {
+        Ok(Vec::new())
+    }
+
+    async fn grpc_request_actions(
+        &self,
+    ) -> yaak_commands::Result<Vec<GetGrpcRequestActionsResponse>> {
+        Ok(Vec::new())
+    }
+
+    async fn workspace_actions(&self) -> yaak_commands::Result<Vec<GetWorkspaceActionsResponse>> {
+        Ok(Vec::new())
+    }
+
+    async fn folder_actions(&self) -> yaak_commands::Result<Vec<GetFolderActionsResponse>> {
+        Ok(Vec::new())
+    }
+
+    async fn call_http_request_action(
+        &self,
+        _req: CallHttpRequestActionRequest,
+    ) -> yaak_commands::Result<()> {
+        Err(no_plugins())
+    }
+
+    async fn call_grpc_request_action(
+        &self,
+        _req: CallGrpcRequestActionRequest,
+    ) -> yaak_commands::Result<()> {
+        Err(no_plugins())
+    }
+
+    async fn call_websocket_request_action(
+        &self,
+        _req: CallWebsocketRequestActionRequest,
+    ) -> yaak_commands::Result<()> {
+        Err(no_plugins())
+    }
+
+    async fn call_workspace_action(
+        &self,
+        _req: CallWorkspaceActionRequest,
+    ) -> yaak_commands::Result<()> {
+        Err(no_plugins())
+    }
+
+    async fn call_folder_action(&self, _req: CallFolderActionRequest) -> yaak_commands::Result<()> {
+        Err(no_plugins())
+    }
+
+    async fn http_authentication_summaries(
+        &self,
+    ) -> yaak_commands::Result<Vec<GetHttpAuthenticationSummaryResponse>> {
+        Ok(Vec::new())
+    }
+
+    async fn http_authentication_config(
+        &self,
+        _auth_name: &str,
+        values: HashMap<String, JsonPrimitive>,
+        _model_id: &str,
+    ) -> yaak_commands::Result<GetHttpAuthenticationConfigResponse> {
+        *self.auth_values.borrow_mut() = Some(values);
+        Err(no_plugins())
+    }
+
+    async fn call_http_authentication_action(
+        &self,
+        _auth_name: &str,
+        _action_index: i32,
+        _values: HashMap<String, JsonPrimitive>,
+        _model_id: &str,
+    ) -> yaak_commands::Result<()> {
+        Err(no_plugins())
+    }
+
+    async fn import_data(&self, _content: &str) -> yaak_commands::Result<ImportResponse> {
+        Err(no_plugins())
+    }
+
+    async fn reload_plugins(&self, _plugins: Vec<Plugin>) -> Vec<(String, String)> {
+        Vec::new()
+    }
+}
+
+fn no_plugins() -> yaak_commands::Error {
+    yaak_commands::Error::Generic("no plugin runtime on this host".into())
 }

 #[tokio::test]
 async fn a_single_threaded_host_can_implement_the_trait() {
    let TestHost { inner } = TestHost::new();
-    let host = SingleThreadedHost { inner: Rc::new(Arc::into_inner(inner).expect("sole owner")) };
+    let host = SingleThreadedHost {
+        inner: Rc::new(Arc::into_inner(inner).expect("sole owner")),
+        auth_values: Rc::new(RefCell::new(None)),
+    };

    let workspace = Workspace { name: "From one thread".to_string(), ..Default::default() };
    let id = models_upsert(host.clone(), ModelsUpsertReq { model: AnyModel::Workspace(workspace) })
@@ -227,6 +394,42 @@ async fn a_single_threaded_host_can_implement_the_trait() {
    .expect("workspace models");
    assert!(json.contains(&id), "the workspace should be in its own bootstrap payload");

+    // Rendering, on a host whose template callback has no plugins behind it.
+    // Resolving the environment chain is a database read and the render is
+    // shared code; only the callback came from the host. Rendering a real
+    // variable is what proves the chain was resolved rather than skipped.
+    let environment = host
+        .db()
+        .upsert_environment(
+            &Environment {
+                workspace_id: id.clone(),
+                name: "Test env".to_string(),
+                variables: vec![EnvironmentVariable {
+                    enabled: true,
+                    name: "greeting".to_string(),
+                    value: "hello".to_string(),
+                    id: None,
+                }],
+                ..Default::default()
+            },
+            &host.update_source(),
+        )
+        .expect("seed environment");
+
+    let rendered = cmd_render_template(
+        host.clone(),
+        CmdRenderTemplateReq {
+            template: "${[ greeting ]} world".to_string(),
+            workspace_id: id.clone(),
+            environment_id: Some(environment.id.clone()),
+            purpose: None,
+            ignore_error: None,
+        },
+    )
+    .await
+    .expect("render");
+    assert_eq!(rendered, "hello world", "the environment chain should have been resolved");
+
    // The delete path too, since it is the one that used to reach for a
    // blocking thread this host does not have.
    let workspace = host.db().get_workspace(&id).expect("get workspace");
@@ -235,3 +438,64 @@ async fn a_single_threaded_host_can_implement_the_trait() {
        .expect("delete");
    assert_eq!(deleted, id);
 }
+
+/// Auth form values may contain templates, and a plugin must never see one
+/// unrendered. The rendering happens in the shared handler, so this checks the
+/// host received a resolved value rather than `${[ ... ]}`.
+#[tokio::test]
+async fn auth_values_are_rendered_before_the_host_sees_them() {
+    let TestHost { inner } = TestHost::new();
+    let host = SingleThreadedHost {
+        inner: Rc::new(Arc::into_inner(inner).expect("sole owner")),
+        auth_values: Rc::new(RefCell::new(None)),
+    };
+
+    let workspace = host
+        .db()
+        .upsert_workspace(
+            &Workspace { name: "Auth".to_string(), ..Default::default() },
+            &host.update_source(),
+        )
+        .expect("workspace");
+    host.db()
+        .upsert_environment(
+            &Environment {
+                workspace_id: workspace.id.clone(),
+                name: "Env".to_string(),
+                variables: vec![EnvironmentVariable {
+                    enabled: true,
+                    name: "token".to_string(),
+                    value: "s3cret".to_string(),
+                    id: None,
+                }],
+                ..Default::default()
+            },
+            &host.update_source(),
+        )
+        .expect("environment");
+    let environment =
+        host.db().list_environments_ensure_base(&workspace.id).expect("list").remove(0);
+
+    let mut values = HashMap::new();
+    values.insert("password".to_string(), JsonPrimitive::String("${[ token ]}".to_string()));
+
+    // The host refuses the call itself — it has no plugins — but only after the
+    // handler has rendered and handed over the values, which is what matters.
+    let _ = cmd_get_http_authentication_config(
+        host.clone(),
+        yaak_rpc_schema::CmdGetHttpAuthenticationConfigReq {
+            auth_name: "basic".to_string(),
+            values,
+            model: AnyModel::Workspace(workspace),
+            environment_id: Some(environment.id),
+        },
+    )
+    .await;
+
+    let seen = host.auth_values.borrow().clone().expect("the host should have been called");
+    assert!(
+        matches!(seen.get("password"), Some(JsonPrimitive::String(v)) if v == "s3cret"),
+        "the template should have been rendered before reaching the host, got {:?}",
+        seen.get("password"),
+    );
+}
@@ -225,7 +225,6 @@ export type HttpResponse = {
  updatedAt: string;
  workspaceId: string;
  requestId: string;
-  bodyPath: string | null;
  contentLength: number | null;
  contentLengthCompressed: number | null;
  elapsed: number;
@@ -1677,6 +1677,13 @@ pub struct HttpResponse {
    pub workspace_id: String,
    pub request_id: String,

+    /// Where the engine put the body, when it puts it in a file.
+    ///
+    /// Not exported to TypeScript: a path is only meaningful to a host that
+    /// has the filesystem it names, and bodies are moving off it. Read a body
+    /// by response id instead — the frontend through
+    /// `cmd_http_response_body_path`, plugins through `ctx.httpResponse.body`.
+    #[ts(skip)]
    pub body_path: Option<String>,
    pub content_length: Option<i32>,
    pub content_length_compressed: Option<i32>,
@@ -224,7 +224,6 @@ export type HttpResponse = {
  updatedAt: string;
  workspaceId: string;
  requestId: string;
-  bodyPath: string | null;
  contentLength: number | null;
  contentLengthCompressed: number | null;
  elapsed: number;
@@ -171,6 +171,12 @@ pub enum InternalEventPayload {

    FindHttpResponsesRequest(FindHttpResponsesRequest),
    FindHttpResponsesResponse(FindHttpResponsesResponse),
+
+    GetHttpResponseBodyInfoRequest(GetHttpResponseBodyInfoRequest),
+    GetHttpResponseBodyInfoResponse(GetHttpResponseBodyInfoResponse),
+    ReadHttpResponseBodyChunkRequest(ReadHttpResponseBodyChunkRequest),
+    ReadHttpResponseBodyChunkResponse(ReadHttpResponseBodyChunkResponse),
+
    ListHttpRequestsRequest(ListHttpRequestsRequest),
    ListHttpRequestsResponse(ListHttpRequestsResponse),
    ListFoldersRequest(ListFoldersRequest),
@@ -288,6 +294,15 @@ pub struct SendHttpRequestRequest {
 #[ts(export, export_to = "gen_events.ts")]
 pub struct SendHttpRequestResponse {
    pub http_response: HttpResponse,
+
+    /// The body, base64, when the send saved nothing.
+    ///
+    /// A request with no id behind it produces a response the model store never
+    /// sees, so it cannot be read back by id later the way a saved one can.
+    /// This is the only copy of it. `None` means the body was stored and should
+    /// be read with `read_http_response_body_chunk_request`.
+    #[ts(optional = nullable)]
+    pub body: Option<String>,
 }

 #[derive(Debug, Clone, Default, Serialize, Deserialize, TS)]
@@ -1413,6 +1428,67 @@ pub struct FindHttpResponsesResponse {
    pub http_responses: Vec<HttpResponse>,
 }

+/// Ask what a response's body is, before deciding whether to pull it.
+///
+/// Bodies are addressed by response id and never by path, so where the host
+/// keeps the bytes is its own business.
+#[derive(Debug, Clone, Default, Serialize, Deserialize, TS)]
+#[serde(default, rename_all = "camelCase")]
+#[ts(export, export_to = "gen_events.ts")]
+pub struct GetHttpResponseBodyInfoRequest {
+    pub response_id: String,
+}
+
+#[derive(Debug, Clone, Default, Serialize, Deserialize, TS)]
+#[serde(default, rename_all = "camelCase")]
+#[ts(export, export_to = "gen_events.ts")]
+pub struct GetHttpResponseBodyInfoResponse {
+    /// How many bytes are stored right now, which is not necessarily what the
+    /// `Content-Length` header claimed. Zero when the response has no body.
+    #[ts(type = "number")]
+    pub content_length: u64,
+
+    /// Whether the response has finished arriving. While it has not, the body
+    /// keeps growing past `content_length`, and a reader that wants all of it
+    /// asks again.
+    pub complete: bool,
+
+    /// The response's `Content-Type` header, verbatim, so the reader can pick a
+    /// charset.
+    #[ts(optional = nullable)]
+    pub content_type: Option<String>,
+}
+
+/// Pull one window of a response body.
+///
+/// Reads are idempotent: the bytes live in durable storage, so the same window
+/// can be asked for as many times as the plugin likes.
+#[derive(Debug, Clone, Default, Serialize, Deserialize, TS)]
+#[serde(default, rename_all = "camelCase")]
+#[ts(export, export_to = "gen_events.ts")]
+pub struct ReadHttpResponseBodyChunkRequest {
+    pub response_id: String,
+    #[ts(type = "number")]
+    pub offset: u64,
+    #[ts(type = "number")]
+    pub length: u64,
+}
+
+#[derive(Debug, Clone, Default, Serialize, Deserialize, TS)]
+#[serde(default, rename_all = "camelCase")]
+#[ts(export, export_to = "gen_events.ts")]
+pub struct ReadHttpResponseBodyChunkResponse {
+    /// Base64, because the desktop transport is a WebSocket that only sends
+    /// text frames today. A host that can carry binary sends the bytes as they
+    /// are and fills this in from them.
+    pub data: String,
+
+    /// Bytes decoded from `data`. Short of the requested length means the body
+    /// ended here.
+    #[ts(type = "number")]
+    pub length: u64,
+}
+
 #[derive(Debug, Clone, Default, Serialize, Deserialize, TS)]
 #[serde(default, rename_all = "camelCase")]
 #[ts(export, export_to = "gen_events.ts")]
@@ -29,8 +29,23 @@ export function boot(): Promise<void>;
 * Run one command as `label` (the calling tab's identity, which stands in for
 * the desktop's window label on every write it makes).
 *
- * The payload shapes match the `Cmd*Req` types in `yaak-rpc-schema` — that
- * crate itself pulls the git, gRPC and plugin crates for their response types
- * and cannot come to wasm, so the handful needed here are declared locally.
+ * The payload shapes match the `Cmd*Req` types in `yaak-rpc-schema`, but are
+ * declared locally and dispatched by name, which is the one place this host
+ * does not share the desktop's guarantees: the desktop builds its router from
+ * the schema, so every command has a handler by construction. Here a renamed
+ * command would surface as a runtime "not a command this host answers".
+ *
+ * The fix is `yaak-commands` (the `Host` trait), not more machinery here —
+ * its `models::*` handlers are already this file, typed. Three things have to
+ * give before a wasm host can register them:
+ *
+ * 1. `Host: Send + Sync`, which a browser cannot satisfy: there is one thread
+ *    and the connection pool is an `Rc`.
+ * 2. `models_delete` reaches for `spawn_blocking`; there is nothing to spawn
+ *    onto here.
+ * 3. `yaak-commands` depends on `yaak` and `yaak-plugins`, which pull the HTTP
+ *    stack and the Node sidecar and do not build for wasm32.
+ *
+ * None of those are hard; they are just not this PR.
 */
 export function rpc(cmd: string, payload: any, label: string): any;
@@ -66,9 +66,24 @@ export function boot() {
 * Run one command as `label` (the calling tab's identity, which stands in for
 * the desktop's window label on every write it makes).
 *
- * The payload shapes match the `Cmd*Req` types in `yaak-rpc-schema` — that
- * crate itself pulls the git, gRPC and plugin crates for their response types
- * and cannot come to wasm, so the handful needed here are declared locally.
+ * The payload shapes match the `Cmd*Req` types in `yaak-rpc-schema`, but are
+ * declared locally and dispatched by name, which is the one place this host
+ * does not share the desktop's guarantees: the desktop builds its router from
+ * the schema, so every command has a handler by construction. Here a renamed
+ * command would surface as a runtime "not a command this host answers".
+ *
+ * The fix is `yaak-commands` (the `Host` trait), not more machinery here —
+ * its `models::*` handlers are already this file, typed. Three things have to
+ * give before a wasm host can register them:
+ *
+ * 1. `Host: Send + Sync`, which a browser cannot satisfy: there is one thread
+ *    and the connection pool is an `Rc`.
+ * 2. `models_delete` reaches for `spawn_blocking`; there is nothing to spawn
+ *    onto here.
+ * 3. `yaak-commands` depends on `yaak` and `yaak-plugins`, which pull the HTTP
+ *    stack and the Node sidecar and do not build for wasm32.
+ *
+ * None of those are hard; they are just not this PR.
 * @param {string} cmd
 * @param {any} payload
 * @param {string} label
@@ -674,7 +689,7 @@ export function __wbindgen_cast_0000000000000002(arg0, arg1) {
 }
 export function __wbindgen_cast_0000000000000003(arg0, arg1) {
    // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [NamedExternref("IDBVersionChangeEvent")], shim_idx: 180, ret: Result(Unit), inner_ret: Some(Result(Unit)) }, mutable: true }) -> Externref`.
-    const ret = makeMutClosure(arg0, arg1, wasm_bindgen__convert__closures_____invoke__ha579407f9663b071);
+    const ret = makeMutClosure(arg0, arg1, wasm_bindgen__convert__closures_____invoke__h7e53e249a4dc4aa9);
    return ret;
 }
 export function __wbindgen_cast_0000000000000004(arg0, arg1) {
@@ -731,8 +746,8 @@ function wasm_bindgen__convert__closures_____invoke__hf84d53817e0238b4(arg0, arg
    }
 }

-function wasm_bindgen__convert__closures_____invoke__ha579407f9663b071(arg0, arg1, arg2) {
-    const ret = wasm.wasm_bindgen__convert__closures_____invoke__ha579407f9663b071(arg0, arg1, arg2);
+function wasm_bindgen__convert__closures_____invoke__h7e53e249a4dc4aa9(arg0, arg1, arg2) {
+    const ret = wasm.wasm_bindgen__convert__closures_____invoke__h7e53e249a4dc4aa9(arg0, arg1, arg2);
    if (ret[1]) {
        throw takeFromExternrefTable0(ret[0]);
    }
@@ -17,7 +17,7 @@ export const rust_sqlite_wasm_realloc: (a: number, b: number) => number;
 export const sqlite3_os_end: () => number;
 export const sqlite3_os_init: () => number;
 export const wasm_bindgen__convert__closures_____invoke__hf84d53817e0238b4: (a: number, b: number, c: any) => [number, number];
-export const wasm_bindgen__convert__closures_____invoke__ha579407f9663b071: (a: number, b: number, c: any) => [number, number];
+export const wasm_bindgen__convert__closures_____invoke__h7e53e249a4dc4aa9: (a: number, b: number, c: any) => [number, number];
 export const wasm_bindgen__convert__closures_____invoke__h2c72ca09e851b7f3: (a: number, b: number, c: any, d: any) => void;
 export const wasm_bindgen__convert__closures_____invoke__h7e06bb925b918fbb: (a: number, b: number, c: any) => void;
 export const wasm_bindgen__convert__closures_____invoke__h87640adb2bbfa2fc: (a: number, b: number) => void;
@@ -6,6 +6,7 @@ publish = false

 [dependencies]
 async-trait = "0.1"
+base64 = "0.22.1" # For carrying body chunks over a text-only plugin transport
 log = { workspace = true }
 md5 = "0.8.0"
 serde_json = { workspace = true }
@@ -3,6 +3,7 @@ pub mod export;
 pub mod import;
 pub mod plugin_events;
 pub mod render;
+pub mod response_body;
 pub mod send;

 pub use error::Error;
@@ -1,3 +1,6 @@
+use crate::response_body::ResponseBodyStore;
+use base64::Engine;
+use base64::prelude::BASE64_STANDARD;
 use yaak_models::models::AnyModel;
 use yaak_models::query_manager::QueryManager;
 use yaak_models::util::UpdateSource;
@@ -5,12 +8,14 @@ use yaak_plugins::events::{
    CloseWindowRequest, CopyTextRequest, DeleteKeyValueRequest, DeleteKeyValueResponse,
    DeleteModelRequest, DeleteModelResponse, ErrorResponse, FindHttpResponsesRequest,
    FindHttpResponsesResponse, GetCookieValueRequest, GetHttpRequestByIdRequest,
-    GetHttpRequestByIdResponse, GetKeyValueRequest, GetKeyValueResponse, InternalEventPayload,
-    ListCookieNamesRequest, ListFoldersRequest, ListFoldersResponse, ListHttpRequestsRequest,
-    ListHttpRequestsResponse, ListOpenWorkspacesRequest, OpenExternalUrlRequest, OpenWindowRequest,
-    PromptFormRequest, PromptTextRequest, ReloadResponse, RenderGrpcRequestRequest,
-    RenderHttpRequestRequest, SendHttpRequestRequest, SetKeyValueRequest, ShowToastRequest,
-    TemplateRenderRequest, UpsertModelRequest, UpsertModelResponse, WindowInfoRequest,
+    GetHttpRequestByIdResponse, GetHttpResponseBodyInfoRequest, GetHttpResponseBodyInfoResponse,
+    GetKeyValueRequest, GetKeyValueResponse, InternalEventPayload, ListCookieNamesRequest,
+    ListFoldersRequest, ListFoldersResponse, ListHttpRequestsRequest, ListHttpRequestsResponse,
+    ListOpenWorkspacesRequest, OpenExternalUrlRequest, OpenWindowRequest, PromptFormRequest,
+    PromptTextRequest, ReadHttpResponseBodyChunkRequest, ReadHttpResponseBodyChunkResponse,
+    ReloadResponse, RenderGrpcRequestRequest, RenderHttpRequestRequest, SendHttpRequestRequest,
+    SetKeyValueRequest, ShowToastRequest, TemplateRenderRequest, UpsertModelRequest,
+    UpsertModelResponse, WindowInfoRequest,
 };

 pub struct SharedPluginEventContext<'a> {
@@ -40,6 +45,8 @@ pub enum SharedRequest<'a> {
    ListFolders(&'a ListFoldersRequest),
    ListHttpRequests(&'a ListHttpRequestsRequest),
    FindHttpResponses(&'a FindHttpResponsesRequest),
+    GetHttpResponseBodyInfo(&'a GetHttpResponseBodyInfoRequest),
+    ReadHttpResponseBodyChunk(&'a ReadHttpResponseBodyChunkRequest),
    UpsertModel(&'a UpsertModelRequest),
    DeleteModel(&'a DeleteModelRequest),
 }
@@ -136,6 +143,12 @@ impl<'a> From<&'a InternalEventPayload> for GroupedPluginRequest<'a> {
            InternalEventPayload::FindHttpResponsesRequest(req) => {
                GroupedPluginRequest::Shared(SharedRequest::FindHttpResponses(req))
            }
+            InternalEventPayload::GetHttpResponseBodyInfoRequest(req) => {
+                GroupedPluginRequest::Shared(SharedRequest::GetHttpResponseBodyInfo(req))
+            }
+            InternalEventPayload::ReadHttpResponseBodyChunkRequest(req) => {
+                GroupedPluginRequest::Shared(SharedRequest::ReadHttpResponseBodyChunk(req))
+            }
            InternalEventPayload::UpsertModelRequest(req) => {
                GroupedPluginRequest::Shared(SharedRequest::UpsertModel(req))
            }
@@ -182,13 +195,17 @@ impl<'a> From<&'a InternalEventPayload> for GroupedPluginRequest<'a> {

 pub fn handle_shared_plugin_event<'a>(
    query_manager: &QueryManager,
+    body_store: &dyn ResponseBodyStore,
    payload: &'a InternalEventPayload,
    context: SharedPluginEventContext<'_>,
 ) -> GroupedPluginEvent<'a> {
    match GroupedPluginRequest::from(payload) {
-        GroupedPluginRequest::Shared(req) => {
-            GroupedPluginEvent::Handled(Some(build_shared_reply(query_manager, req, context)))
-        }
+        GroupedPluginRequest::Shared(req) => GroupedPluginEvent::Handled(Some(build_shared_reply(
+            query_manager,
+            body_store,
+            req,
+            context,
+        ))),
        GroupedPluginRequest::Host(req) => GroupedPluginEvent::ToHandle(req),
        GroupedPluginRequest::Ignore => GroupedPluginEvent::Handled(None),
    }
@@ -196,6 +213,7 @@ pub fn handle_shared_plugin_event<'a>(

 fn build_shared_reply(
    query_manager: &QueryManager,
+    body_store: &dyn ResponseBodyStore,
    request: SharedRequest<'_>,
    context: SharedPluginEventContext<'_>,
 ) -> InternalEventPayload {
@@ -283,6 +301,31 @@ fn build_shared_reply(
                http_responses,
            })
        }
+        SharedRequest::GetHttpResponseBodyInfo(req) => match body_store.info(&req.response_id) {
+            Ok(info) => InternalEventPayload::GetHttpResponseBodyInfoResponse(
+                GetHttpResponseBodyInfoResponse {
+                    content_length: info.content_length,
+                    content_type: info.content_type,
+                    complete: info.complete,
+                },
+            ),
+            Err(err) => InternalEventPayload::ErrorResponse(ErrorResponse {
+                error: format!("Failed to read body of response {}: {err}", req.response_id),
+            }),
+        },
+        SharedRequest::ReadHttpResponseBodyChunk(req) => {
+            match body_store.read_chunk(&req.response_id, req.offset, req.length) {
+                Ok(bytes) => InternalEventPayload::ReadHttpResponseBodyChunkResponse(
+                    ReadHttpResponseBodyChunkResponse {
+                        length: bytes.len() as u64,
+                        data: BASE64_STANDARD.encode(bytes),
+                    },
+                ),
+                Err(err) => InternalEventPayload::ErrorResponse(ErrorResponse {
+                    error: format!("Failed to read body of response {}: {err}", req.response_id),
+                }),
+            }
+        }
        SharedRequest::UpsertModel(req) => {
            use AnyModel::*;

@@ -437,10 +480,26 @@ fn build_shared_reply(
 #[cfg(test)]
 mod tests {
    use super::*;
+    use crate::response_body::{FileResponseBodyStore, ResponseBodyInfo};
+    use std::cell::RefCell;
    use tempfile::TempDir;
    use yaak_models::models::{AnyModel, Folder, HttpRequest, Workspace};
    use yaak_models::util::UpdateSource;

+    /// The real dispatch, with the store the desktop and CLI hand it.
+    fn dispatch<'a>(
+        query_manager: &QueryManager,
+        payload: &'a InternalEventPayload,
+        context: SharedPluginEventContext<'_>,
+    ) -> GroupedPluginEvent<'a> {
+        handle_shared_plugin_event(
+            query_manager,
+            &FileResponseBodyStore::new(query_manager),
+            payload,
+            context,
+        )
+    }
+
    fn seed_query_manager() -> (QueryManager, TempDir) {
        let temp_dir = TempDir::new().expect("Failed to create temp dir");
        let db_path = temp_dir.path().join("db.sqlite");
@@ -498,7 +557,7 @@ mod tests {
        let payload = InternalEventPayload::ListHttpRequestsRequest(
            yaak_plugins::events::ListHttpRequestsRequest { folder_id: None },
        );
-        let result = handle_shared_plugin_event(
+        let result = dispatch(
            &query_manager,
            &payload,
            SharedPluginEventContext { plugin_name: "@yaak/test", workspace_id: None },
@@ -517,7 +576,7 @@ mod tests {
        let by_workspace_payload = InternalEventPayload::ListHttpRequestsRequest(
            yaak_plugins::events::ListHttpRequestsRequest { folder_id: None },
        );
-        let by_workspace = handle_shared_plugin_event(
+        let by_workspace = dispatch(
            &query_manager,
            &by_workspace_payload,
            SharedPluginEventContext { plugin_name: "@yaak/test", workspace_id: Some("wk_test") },
@@ -536,7 +595,7 @@ mod tests {
                folder_id: Some("fl_test".to_string()),
            },
        );
-        let by_folder = handle_shared_plugin_event(
+        let by_folder = dispatch(
            &query_manager,
            &by_folder_payload,
            SharedPluginEventContext { plugin_name: "@yaak/test", workspace_id: None },
@@ -559,7 +618,7 @@ mod tests {
            limit: Some(1),
        });

-        let result = handle_shared_plugin_event(
+        let result = dispatch(
            &query_manager,
            &payload,
            SharedPluginEventContext { plugin_name: "@yaak/test", workspace_id: Some("wk_test") },
@@ -575,6 +634,105 @@ mod tests {
        }
    }

+    /// A store that answers from memory, standing in for whatever holds the
+    /// bytes — the point being that the dispatch below never learns which.
+    struct FakeBodyStore {
+        body: Vec<u8>,
+        reads: RefCell<Vec<(u64, u64)>>,
+    }
+
+    impl ResponseBodyStore for FakeBodyStore {
+        fn info(&self, _response_id: &str) -> crate::error::Result<ResponseBodyInfo> {
+            Ok(ResponseBodyInfo {
+                content_length: self.body.len() as u64,
+                content_type: Some("text/plain; charset=utf-8".to_string()),
+                complete: true,
+            })
+        }
+
+        fn read_chunk(
+            &self,
+            _response_id: &str,
+            offset: u64,
+            length: u64,
+        ) -> crate::error::Result<Vec<u8>> {
+            self.reads.borrow_mut().push((offset, length));
+            let start = (offset as usize).min(self.body.len());
+            let end = (start + length as usize).min(self.body.len());
+            Ok(self.body[start..end].to_vec())
+        }
+    }
+
+    #[test]
+    fn response_body_is_read_by_id_through_the_store() {
+        let (query_manager, _temp_dir) = seed_query_manager();
+        let store = FakeBodyStore { body: b"hello".to_vec(), reads: RefCell::new(Vec::new()) };
+
+        let info_payload = InternalEventPayload::GetHttpResponseBodyInfoRequest(
+            GetHttpResponseBodyInfoRequest { response_id: "rs_test".to_string() },
+        );
+        let info = handle_shared_plugin_event(
+            &query_manager,
+            &store,
+            &info_payload,
+            SharedPluginEventContext { plugin_name: "@yaak/test", workspace_id: None },
+        );
+        match info {
+            GroupedPluginEvent::Handled(Some(
+                InternalEventPayload::GetHttpResponseBodyInfoResponse(resp),
+            )) => {
+                assert_eq!(resp.content_length, 5);
+                assert_eq!(resp.content_type.as_deref(), Some("text/plain; charset=utf-8"));
+            }
+            other => panic!("unexpected body info result: {other:?}"),
+        }
+
+        let chunk_payload = InternalEventPayload::ReadHttpResponseBodyChunkRequest(
+            ReadHttpResponseBodyChunkRequest {
+                response_id: "rs_test".to_string(),
+                offset: 1,
+                length: 3,
+            },
+        );
+        let chunk = handle_shared_plugin_event(
+            &query_manager,
+            &store,
+            &chunk_payload,
+            SharedPluginEventContext { plugin_name: "@yaak/test", workspace_id: None },
+        );
+        match chunk {
+            GroupedPluginEvent::Handled(Some(
+                InternalEventPayload::ReadHttpResponseBodyChunkResponse(resp),
+            )) => {
+                assert_eq!(resp.length, 3);
+                assert_eq!(BASE64_STANDARD.decode(resp.data).unwrap(), b"ell");
+            }
+            other => panic!("unexpected body chunk result: {other:?}"),
+        }
+
+        assert_eq!(*store.reads.borrow(), vec![(1, 3)]);
+    }
+
+    #[test]
+    fn an_unreadable_response_body_becomes_an_error_reply() {
+        let (query_manager, _temp_dir) = seed_query_manager();
+        let payload = InternalEventPayload::GetHttpResponseBodyInfoRequest(
+            GetHttpResponseBodyInfoRequest { response_id: "rs_never_persisted".to_string() },
+        );
+        let result = dispatch(
+            &query_manager,
+            &payload,
+            SharedPluginEventContext { plugin_name: "@yaak/test", workspace_id: None },
+        );
+
+        match result {
+            GroupedPluginEvent::Handled(Some(InternalEventPayload::ErrorResponse(resp))) => {
+                assert!(resp.error.contains("rs_never_persisted"), "unhelpful error: {}", resp.error)
+            }
+            other => panic!("unexpected missing-response result: {other:?}"),
+        }
+    }
+
    #[test]
    fn upsert_and_delete_model_are_shared_handled() {
        let (query_manager, _temp_dir) = seed_query_manager();
@@ -590,7 +748,7 @@ mod tests {
            }),
        });

-        let upsert_result = handle_shared_plugin_event(
+        let upsert_result = dispatch(
            &query_manager,
            &upsert_payload,
            SharedPluginEventContext { plugin_name: "@yaak/test", workspace_id: Some("wk_test") },
@@ -609,7 +767,7 @@ mod tests {
            model: "http_request".to_string(),
            id: "rq_test".to_string(),
        });
-        let delete_result = handle_shared_plugin_event(
+        let delete_result = dispatch(
            &query_manager,
            &delete_payload,
            SharedPluginEventContext { plugin_name: "@yaak/test", workspace_id: Some("wk_test") },
@@ -631,7 +789,7 @@ mod tests {
        let payload = InternalEventPayload::WindowInfoRequest(WindowInfoRequest {
            label: "main".to_string(),
        });
-        let result = handle_shared_plugin_event(
+        let result = dispatch(
            &query_manager,
            &payload,
            SharedPluginEventContext { plugin_name: "@yaak/test", workspace_id: None },
@@ -0,0 +1,232 @@
+//! Reading response bodies back out, by response id.
+//!
+//! Plugins only ever name a response. Where its bytes actually live — files the
+//! engine wrote under `<data dir>/responses/<id>` today, blob rows later — is
+//! behind [`ResponseBodyStore`], so moving the bytes is a change to this file
+//! and nothing a plugin can see.
+//!
+//! Only saved responses are reachable by id. A send that saved nothing hands
+//! its body back with the reply instead, which is the only copy of it there is.
+
+use crate::error::Result;
+use std::fs::File;
+use std::io::{Read, Seek, SeekFrom};
+use yaak_models::models::HttpResponseState;
+use yaak_models::query_manager::QueryManager;
+
+/// The most bytes one read will hand back, however much was asked for.
+///
+/// A chunk is buffered whole and, on the desktop transport, base64'd into a
+/// single WebSocket frame, so an unbounded request is a way to make the host
+/// allocate on a plugin's say-so.
+pub const MAX_CHUNK_BYTES: u64 = 8 * 1024 * 1024;
+
+/// What a stored body is, without reading any of it.
+#[derive(Debug, Clone, Default)]
+pub struct ResponseBodyInfo {
+    /// Bytes actually stored, which is not necessarily what `Content-Length`
+    /// claimed. Zero when the response has no body.
+    pub content_length: u64,
+    /// The response's `Content-Type` header, verbatim.
+    pub content_type: Option<String>,
+    /// Whether the response has finished arriving, so `content_length` is
+    /// final. A body still being written grows past it.
+    pub complete: bool,
+}
+
+/// Somewhere response bodies can be read from, a window at a time.
+///
+/// Reads are repeatable — the bytes are durable, so nothing is consumed by
+/// looking at it.
+pub trait ResponseBodyStore {
+    fn info(&self, response_id: &str) -> Result<ResponseBodyInfo>;
+
+    /// Bytes `[offset, offset + length)`, clamped to what is there. A short
+    /// read means the body ended.
+    fn read_chunk(&self, response_id: &str, offset: u64, length: u64) -> Result<Vec<u8>>;
+}
+
+/// The desktop and CLI store: the database says where the file is, and the
+/// filesystem holds it.
+pub struct FileResponseBodyStore<'a> {
+    query_manager: &'a QueryManager,
+}
+
+impl<'a> FileResponseBodyStore<'a> {
+    pub fn new(query_manager: &'a QueryManager) -> Self {
+        Self { query_manager }
+    }
+
+    /// The file backing a response, or `None` when it stored no body.
+    ///
+    /// Only responses the store knows about are reachable here. A send with no
+    /// request behind it never reaches the store at all, and its bytes come
+    /// back from the send instead — see `SendHttpRequestResponse::body`.
+    fn body_path(&self, response_id: &str) -> Result<Option<String>> {
+        Ok(self.query_manager.connect().get_http_response(response_id)?.body_path)
+    }
+}
+
+impl ResponseBodyStore for FileResponseBodyStore<'_> {
+    fn info(&self, response_id: &str) -> Result<ResponseBodyInfo> {
+        let response = self.query_manager.connect().get_http_response(response_id)?;
+
+        let content_type = response
+            .headers
+            .iter()
+            .find(|h| h.name.eq_ignore_ascii_case("content-type"))
+            .map(|h| h.value.clone());
+
+        let content_length = match response.body_path {
+            Some(path) => std::fs::metadata(path)?.len(),
+            None => 0,
+        };
+
+        Ok(ResponseBodyInfo {
+            content_length,
+            content_type,
+            // Closed is the one terminal state: success, error, and cancel all end there.
+            complete: matches!(response.state, HttpResponseState::Closed),
+        })
+    }
+
+    fn read_chunk(&self, response_id: &str, offset: u64, length: u64) -> Result<Vec<u8>> {
+        let Some(path) = self.body_path(response_id)? else {
+            return Ok(Vec::new());
+        };
+
+        let length = length.min(MAX_CHUNK_BYTES);
+        if length == 0 {
+            return Ok(Vec::new());
+        }
+
+        let mut file = File::open(path)?;
+        file.seek(SeekFrom::Start(offset))?;
+
+        let mut buf = Vec::new();
+        file.take(length).read_to_end(&mut buf)?;
+        Ok(buf)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::io::Write;
+    use tempfile::TempDir;
+    use yaak_models::models::{HttpRequest, HttpResponse, HttpResponseHeader, Workspace};
+    use yaak_models::util::UpdateSource;
+
+    fn seed(body: Option<&[u8]>) -> (QueryManager, TempDir, String) {
+        let temp_dir = TempDir::new().unwrap();
+        let (query_manager, blob_manager, _rx) = yaak_models::init_standalone(
+            &temp_dir.path().join("db.sqlite"),
+            &temp_dir.path().join("blobs.sqlite"),
+        )
+        .unwrap();
+
+        query_manager
+            .connect()
+            .upsert_workspace(
+                &Workspace { id: "wk_test".to_string(), ..Default::default() },
+                &UpdateSource::Sync,
+            )
+            .unwrap();
+
+        query_manager
+            .connect()
+            .upsert_http_request(
+                &HttpRequest {
+                    id: "rq_test".to_string(),
+                    workspace_id: "wk_test".to_string(),
+                    ..Default::default()
+                },
+                &UpdateSource::Sync,
+            )
+            .unwrap();
+
+        let body_path = body.map(|bytes| {
+            let path = temp_dir.path().join("body");
+            let mut f = std::fs::File::create(&path).unwrap();
+            f.write_all(bytes).unwrap();
+            path.to_string_lossy().to_string()
+        });
+
+        let response = query_manager
+            .connect()
+            .upsert_http_response(
+                &HttpResponse {
+                    workspace_id: "wk_test".to_string(),
+                    request_id: "rq_test".to_string(),
+                    body_path,
+                    headers: vec![HttpResponseHeader {
+                        name: "Content-Type".to_string(),
+                        value: "application/json; charset=utf-8".to_string(),
+                    }],
+                    ..Default::default()
+                },
+                &UpdateSource::Sync,
+                &blob_manager,
+            )
+            .unwrap();
+
+        let id = response.id.clone();
+        (query_manager, temp_dir, id)
+    }
+
+    #[test]
+    fn info_reports_stored_size_and_content_type() {
+        let (qm, _tmp, id) = seed(Some(b"hello world"));
+        let info = FileResponseBodyStore::new(&qm).info(&id).unwrap();
+        assert_eq!(info.content_length, 11);
+        assert_eq!(info.content_type.as_deref(), Some("application/json; charset=utf-8"));
+    }
+
+    #[test]
+    fn chunks_cover_the_body_and_stop_short_at_the_end() {
+        let (qm, _tmp, id) = seed(Some(b"hello world"));
+        let store = FileResponseBodyStore::new(&qm);
+        assert_eq!(store.read_chunk(&id, 0, 5).unwrap(), b"hello");
+        assert_eq!(store.read_chunk(&id, 6, 100).unwrap(), b"world");
+        assert!(store.read_chunk(&id, 11, 100).unwrap().is_empty());
+        // Reading the same window twice gives the same bytes; nothing is consumed.
+        assert_eq!(store.read_chunk(&id, 0, 5).unwrap(), b"hello");
+    }
+
+    #[test]
+    fn a_response_with_no_body_is_empty_not_an_error() {
+        let (qm, _tmp, id) = seed(None);
+        let store = FileResponseBodyStore::new(&qm);
+        assert_eq!(store.info(&id).unwrap().content_length, 0);
+        assert!(store.read_chunk(&id, 0, 100).unwrap().is_empty());
+    }
+
+    #[test]
+    fn complete_tracks_whether_the_response_has_closed() {
+        let (qm, _tmp, id) = seed(Some(b"partial"));
+        // Seeded responses default to Initialized: still arriving.
+        assert!(!FileResponseBodyStore::new(&qm).info(&id).unwrap().complete);
+
+        let mut response = qm.connect().get_http_response(&id).unwrap();
+        response.state = HttpResponseState::Closed;
+        qm.connect().update_http_response_if_id(&response, &UpdateSource::Sync).unwrap();
+
+        assert!(FileResponseBodyStore::new(&qm).info(&id).unwrap().complete);
+    }
+
+    #[test]
+    fn an_unknown_response_fails() {
+        let (qm, _tmp, _id) = seed(Some(b"hi"));
+        assert!(FileResponseBodyStore::new(&qm).info("rs_nope").is_err());
+    }
+
+    #[test]
+    fn an_unsaved_response_is_not_reachable_by_id() {
+        // Its bytes rode back with the send; there is nothing here to find, and
+        // guessing at a file named for the id is exactly what this must not do.
+        let (qm, tmp, _id) = seed(Some(b"hi"));
+        std::fs::write(tmp.path().join("rs_ephemeral1"), b"access_token=abc").unwrap();
+
+        assert!(FileResponseBodyStore::new(&qm).info("rs_ephemeral1").is_err());
+    }
+}
@@ -354,6 +354,19 @@ pub enum ResponseBody {
    Returned(Vec<u8>),
 }

+impl ResponseBody {
+    /// The bytes, when this is the only copy of them.
+    ///
+    /// Stored and streamed bodies belong to whoever holds them; only `Returned`
+    /// has to travel back to the caller.
+    pub fn returned_bytes(&self) -> Option<&[u8]> {
+        match self {
+            ResponseBody::Returned(bytes) => Some(bytes),
+            ResponseBody::Stored | ResponseBody::Streamed => None,
+        }
+    }
+}
+
 pub struct SendHttpRequestResult {
    pub rendered_request: HttpRequest,
    pub response: HttpResponse,
@@ -119,21 +119,23 @@
    "@tauri-apps/cli": "npm:@tauri-apps/cli-cef@3.0.0-alpha.6",
    "@types/babel__core": "^7.20.5",
    "@vitejs/plugin-react": "^6.0.1",
-    "@yaakapp/cli": "latest",
+    "@yaakapp/cli": "0.5.1",
    "babel-plugin-react-compiler": "^1.0.0",
    "dotenv-cli": "^11.0.0",
    "nodejs-file-downloader": "^4.13.0",
    "npm-run-all": "^4.1.5",
    "postcss": "^8.5.25",
    "tailwindcss": "^4.3.2",
+    "tar": "^7.5.22",
    "typescript": "^5.8.3",
-    "vite": "npm:@voidzero-dev/vite-plus-core@^0.2.1",
-    "vite-plus": "^0.2.1",
-    "vitest": "^4.1.9"
+    "vite": "npm:@voidzero-dev/vite-plus-core@^0.2.9",
+    "vite-plus": "^0.2.9",
+    "vitest": "^4.1.10",
+    "yauzl": "^3.4.0"
  },
  "overrides": {
-    "js-yaml": "^4.1.1",
-    "vite": "npm:@voidzero-dev/vite-plus-core@^0.2.1"
+    "js-yaml": "^4.3.1",
+    "vite": "npm:@voidzero-dev/vite-plus-core@^0.2.9"
  },
  "packageManager": "npm@11.11.1"
 }
@@ -1,6 +1,6 @@
 {
  "name": "@yaakapp/api",
-  "version": "0.8.0",
+  "version": "0.9.0",
  "keywords": [
    "api-client",
    "bruno-alternative",
@@ -224,7 +224,6 @@ export type HttpResponse = {
  updatedAt: string;
  workspaceId: string;
  requestId: string;
-  bodyPath: string | null;
  contentLength: number | null;
  contentLengthCompressed: number | null;
  elapsed: number;
@@ -6,6 +6,7 @@ import type {
  GetCookieValueResponse,
  GetHttpRequestByIdRequest,
  GetHttpRequestByIdResponse,
+  GetHttpResponseBodyInfoRequest,
  JsonPrimitive,
  ListCookieNamesResponse,
  ListFoldersRequest,
@@ -22,12 +23,11 @@ import type {
  RenderHttpRequestRequest,
  RenderHttpRequestResponse,
  SendHttpRequestRequest,
-  SendHttpRequestResponse,
  ShowToastRequest,
  TemplateRenderRequest,
  WorkspaceInfo,
 } from "../bindings/gen_events.ts";
-import type { Folder, HttpRequest } from "../bindings/gen_models.ts";
+import type { Folder, HttpRequest, HttpResponse } from "../bindings/gen_models.ts";
 import type { JsonValue } from "../bindings/serde_json/JsonValue";
 import type { MaybePromise } from "../helpers";

@@ -65,6 +65,84 @@ type DynamicPromptFormRequest = Omit<PromptFormRequest, "inputs"> & {

 export type WorkspaceHandle = Pick<WorkspaceInfo, "id" | "name">;

+export interface ReadHttpResponseBodyOptions {
+  /**
+   * Refuse to buffer a body larger than this, in bytes. Defaults to 32 MiB.
+   * Pass `Infinity` to read whatever is there.
+   */
+  maxBytes?: number;
+
+  /** Bytes to pull from the host at a time. Defaults to 1 MiB. */
+  chunkSize?: number;
+}
+
+/**
+ * A response body, read back from wherever the host stored it.
+ *
+ * The accessors are named after `fetch`'s and behave the same way against a
+ * response that is still arriving: they wait for the rest, and one that never
+ * finishes is never finished reading — `chunks()` is the way to consume that.
+ * Unlike `fetch`, the body is not used up by reading it: the bytes are in
+ * durable storage, so every accessor can be called as many times as you like,
+ * in any order.
+ */
+export interface HttpResponseBody {
+  /** The response these bytes belong to. */
+  readonly responseId: string;
+
+  /**
+   * How many bytes were stored when this body was opened, which is not
+   * necessarily what the `Content-Length` header claimed. Zero when the
+   * response has no body. Final only if `complete`.
+   */
+  readonly contentLength: number;
+
+  /** The response's `Content-Type` header, verbatim, or null if it had none. */
+  readonly contentType: string | null;
+
+  /**
+   * Whether the response had finished arriving when this body was opened.
+   * When false, the accessors below will wait for the rest of it.
+   */
+  readonly complete: boolean;
+
+  /**
+   * The whole body decoded to a string, using the charset from `contentType`
+   * and falling back to UTF-8. Waits for a response still arriving. Throws
+   * once more than `maxBytes` has been read.
+   */
+  text(options?: ReadHttpResponseBodyOptions): Promise<string>;
+
+  /** `text()`, parsed as JSON. */
+  json<T = unknown>(options?: ReadHttpResponseBodyOptions): Promise<T>;
+
+  /** The whole body as raw bytes. Waits and throws as `text()` does. */
+  arrayBuffer(options?: ReadHttpResponseBodyOptions): Promise<ArrayBuffer>;
+
+  /**
+   * The raw bytes, a chunk at a time, so a body of any size can be read
+   * without holding all of it at once. Not subject to `maxBytes`.
+   *
+   * Follows a response that is still arriving, yielding as it comes, and ends
+   * when the response does. Break out of the loop to stop early.
+   */
+  chunks(options?: Pick<ReadHttpResponseBodyOptions, "chunkSize">): AsyncIterable<Uint8Array>;
+}
+
+/** What a send came back with. */
+export interface SentHttpRequest {
+  httpResponse: HttpResponse;
+
+  /**
+   * The response's body.
+   *
+   * Handed over here rather than looked up later, because a request with no id
+   * is not saved and this is the only copy of its body. Reading it is the same
+   * either way, so nothing has to know which kind of send it made.
+   */
+  body: HttpResponseBody;
+}
+
 export interface Context {
  clipboard: {
    copyText(text: string): Promise<void>;
@@ -101,7 +179,13 @@ export interface Context {
    render(args: RenderGrpcRequestRequest): Promise<RenderGrpcRequestResponse["grpcRequest"]>;
  };
  httpRequest: {
-    send(args: SendHttpRequestRequest): Promise<SendHttpRequestResponse["httpResponse"]>;
+    /**
+     * Send a request and wait for the response and its body.
+     *
+     * The body comes back with the response because a request with no id is
+     * never saved, and there would be nothing to look up afterwards.
+     */
+    send(args: SendHttpRequestRequest): Promise<SentHttpRequest>;
    getById(args: GetHttpRequestByIdRequest): Promise<GetHttpRequestByIdResponse["httpRequest"]>;
    render(args: RenderHttpRequestRequest): Promise<RenderHttpRequestResponse["httpRequest"]>;
    list(args?: ListHttpRequestsRequest): Promise<ListHttpRequestsResponse["httpRequests"]>;
@@ -129,6 +213,15 @@ export interface Context {
  };
  httpResponse: {
    find(args: FindHttpResponsesRequest): Promise<FindHttpResponsesResponse["httpResponses"]>;
+    /**
+     * Read a saved response's body by id. Where the host keeps the bytes —
+     * files on a desktop, rows in a database, somewhere else later — is not
+     * something a plugin sees or should depend on.
+     *
+     * Ids come from `find`. A response that was never saved has none to look
+     * up, so its body arrives with the send that made it instead.
+     */
+    body(args: GetHttpResponseBodyInfoRequest): Promise<HttpResponseBody>;
  };
  templates: {
    render<T extends JsonValue>(args: TemplateRenderRequest & { data: T }): Promise<T>;
@@ -13,7 +13,13 @@ import type { WorkspaceActionPlugin } from "./WorkspaceActionPlugin";

 export type { Context };
 export type { DynamicAuthenticationArg } from "./AuthenticationPlugin";
-export type { CallPromptFormDynamicArgs, DynamicPromptFormArg } from "./Context";
+export type {
+  CallPromptFormDynamicArgs,
+  DynamicPromptFormArg,
+  HttpResponseBody,
+  ReadHttpResponseBodyOptions,
+  SentHttpRequest,
+} from "./Context";
 export type { DynamicTemplateFunctionArg } from "./TemplateFunctionPlugin";
 export type { TemplateFunctionPlugin };
 export type { FolderActionPlugin } from "./FolderActionPlugin";
@@ -10,6 +10,7 @@
  },
  "devDependencies": {
    "@types/node": "^24.0.13",
-    "@types/ws": "^8.5.13"
+    "@types/ws": "^8.5.13",
+    "esbuild": "^0.28.0"
  }
 }
@@ -21,11 +21,13 @@ import type {
  GetCookieValueRequest,
  GetCookieValueResponse,
  GetHttpRequestByIdResponse,
+  GetHttpResponseBodyInfoResponse,
  GetKeyValueResponse,
  GrpcRequestAction,
  HttpAuthenticationAction,
  HttpRequest,
  HttpRequestAction,
+  HttpResponse,
  ImportResources,
  InternalEvent,
  InternalEventPayload,
@@ -37,6 +39,7 @@ import type {
  PluginContext,
  PromptFormResponse,
  PromptTextResponse,
+  ReadHttpResponseBodyChunkResponse,
  RenderGrpcRequestResponse,
  RenderHttpRequestResponse,
  SendHttpRequestResponse,
@@ -49,6 +52,22 @@ import type {
 import { applyDynamicFormInput } from "./common";
 import { EventChannel } from "./EventChannel";
 import { migrateTemplateFunctionSelectOptions } from "./migrations";
+import { createResponseBody, decodeBase64Chunk } from "./responseBody";
+
+/**
+ * A response as a plugin should see it.
+ *
+ * The host still puts `bodyPath` on the wire for its own callers, but it names
+ * a file on the host's disk — meaningless to a plugin, absent once bodies move
+ * off the filesystem, and impossible in a browser. Plugins address bodies by
+ * response id, so drop it here rather than let one grow a dependency on it.
+ */
+function forPlugin(httpResponse: HttpResponse): HttpResponse {
+  const { bodyPath: _bodyPath, ...rest } = httpResponse as HttpResponse & {
+    bodyPath?: string | null;
+  };
+  return rest;
+}

 export interface PluginWorkerData {
  bootRequest: BootRequest;
@@ -552,6 +571,14 @@ export class PluginInstance {
    return this.#sendPayload(context, { type: "empty_response" }, replyId);
  }

+  /**
+   * Send a request to the host and wait for its reply.
+   *
+   * A host that cannot answer replies with an error, which becomes a thrown
+   * error here. The alternative is handing back a reply-shaped object with
+   * none of the fields the caller destructures, and letting it fail somewhere
+   * further along with no idea why.
+   */
  #sendForReply<T extends Omit<InternalEventPayload, "type">>(
    context: PluginContext,
    payload: InternalEventPayload,
@@ -560,11 +587,16 @@ export class PluginInstance {
    const eventToSend = this.#buildEventToSend(context, payload, null);

    // 2. Spawn listener in background
-    const promise = new Promise<T>((resolve) => {
+    const promise = new Promise<T>((resolve, reject) => {
      const cb = (event: InternalEvent) => {
        if (event.replyId === eventToSend.id) {
          this.#appToPluginEvents.unlisten(cb); // Unlisten, now that we're done
          const { type: _, ...payload } = event.payload;
+          if (event.payload.type === "error_response") {
+            const { error } = payload as { error?: string };
+            reject(new Error(error || `Host failed to handle ${eventToSend.payload.type}`));
+            return;
+          }
          resolve(payload as T);
        }
      };
@@ -598,6 +630,33 @@ export class PluginInstance {
  }

  #newCtx(context: PluginContext): Context {
+    /** Read a body the host has stored, a chunk at a time, following it if it is still arriving. */
+    const storedBody = async (responseId: string) => {
+      const bodyInfo = () =>
+        this.#sendForReply<GetHttpResponseBodyInfoResponse>(context, {
+          type: "get_http_response_body_info_request",
+          responseId,
+        });
+      const info = await bodyInfo();
+
+      return createResponseBody(
+        {
+          responseId,
+          contentLength: info.contentLength,
+          contentType: info.contentType ?? null,
+          complete: info.complete,
+        },
+        async (offset, length) => {
+          const chunk = await this.#sendForReply<ReadHttpResponseBodyChunkResponse>(
+            context,
+            { type: "read_http_response_body_chunk_request", responseId, offset, length },
+          );
+          return decodeBase64Chunk(chunk.data);
+        },
+        { refresh: bodyInfo },
+      );
+    };
+
    const _windowInfo = async () => {
      if (context.label == null) {
        throw new Error("Can't get window context without an active window");
@@ -749,8 +808,9 @@ export class PluginInstance {
            context,
            payload,
          );
-          return httpResponses;
+          return httpResponses.map(forPlugin);
        },
+        body: ({ responseId }) => storedBody(responseId),
      },
      grpcRequest: {
        render: async (args) => {
@@ -782,11 +842,34 @@ export class PluginInstance {
            type: "send_http_request_request",
            ...args,
          } as const;
-          const { httpResponse } = await this.#sendForReply<SendHttpRequestResponse>(
+          const { httpResponse, body } = await this.#sendForReply<SendHttpRequestResponse>(
            context,
            payload,
          );
-          return httpResponse;
+
+          // A send with no request behind it saves nothing, so the reply
+          // carries the only copy of its body. A saved one is read back from
+          // the host like any other. Callers get the same thing either way.
+          if (body == null) {
+            return { httpResponse: forPlugin(httpResponse), body: await storedBody(httpResponse.id) };
+          }
+
+          const bytes = decodeBase64Chunk(body);
+          return {
+            httpResponse: forPlugin(httpResponse),
+            body: createResponseBody(
+              {
+                responseId: httpResponse.id,
+                contentLength: bytes.byteLength,
+                contentType:
+                  httpResponse.headers.find((h) => h.name.toLowerCase() === "content-type")
+                    ?.value ?? null,
+                // The host waited for the whole send before replying.
+                complete: true,
+              },
+              async (offset, length) => bytes.slice(offset, offset + length),
+            ),
+          };
        },
        render: async (args) => {
          const payload = {
@@ -0,0 +1,194 @@
+import type { HttpResponseBody, ReadHttpResponseBodyOptions } from "@yaakapp/api";
+
+/** Bytes pulled from the host per round trip, when the caller doesn't say. */
+const DEFAULT_CHUNK_SIZE = 1024 * 1024;
+
+/**
+ * The most a plugin buffers by default.
+ *
+ * Reading a body used to be unbounded, so any ceiling is an improvement; this
+ * one is set well above what an API returns and well below what makes the
+ * plugin runtime fall over. `chunks()` has no ceiling, and any caller that
+ * really wants the whole thing can raise `maxBytes`.
+ */
+const DEFAULT_MAX_BYTES = 32 * 1024 * 1024;
+
+/** How long to wait, having caught up with a body still arriving, before looking again. */
+const DEFAULT_POLL_INTERVAL_MS = 100;
+
+/** Fetch one window of body bytes from the host. */
+export type ReadResponseBodyChunk = (offset: number, length: number) => Promise<Uint8Array>;
+
+export interface ResponseBodyInfo {
+  responseId: string;
+  contentLength: number;
+  contentType: string | null;
+  /** Whether the response has finished arriving, so `contentLength` is final. */
+  complete: boolean;
+}
+
+/** What can change while a body is still arriving. */
+export type ResponseBodyProgress = Pick<ResponseBodyInfo, "contentLength" | "complete">;
+
+export interface CreateResponseBodyOptions {
+  /**
+   * Ask the host where the body has got to. Needed only for a body that was
+   * not complete when opened; a reader that has caught up calls this to learn
+   * whether to wait for more or stop.
+   */
+  refresh?: () => Promise<ResponseBodyProgress>;
+  pollIntervalMs?: number;
+}
+
+export function createResponseBody(
+  info: ResponseBodyInfo,
+  readChunk: ReadResponseBodyChunk,
+  { refresh, pollIntervalMs = DEFAULT_POLL_INTERVAL_MS }: CreateResponseBodyOptions = {},
+): HttpResponseBody {
+  const { responseId, contentLength, contentType, complete } = info;
+
+  /**
+   * Yield the body from the start until it has all arrived.
+   *
+   * A complete body is read up to its known length and no further. One still
+   * arriving is followed: on catching up, ask the host whether it has finished,
+   * and if not, wait and look again. So this ends when the response does —
+   * which for a stream that never closes means it doesn't, exactly as
+   * iterating `fetch`'s body would not.
+   */
+  async function* chunks(
+    options?: Pick<ReadHttpResponseBodyOptions, "chunkSize">,
+  ): AsyncIterable<Uint8Array> {
+    const chunkSize = Math.max(1, Math.floor(options?.chunkSize ?? DEFAULT_CHUNK_SIZE));
+    let known = contentLength;
+    let done = complete;
+    let offset = 0;
+
+    while (true) {
+      if (done && offset >= known) return;
+
+      const want = done ? Math.min(chunkSize, known - offset) : chunkSize;
+      const chunk = await readChunk(offset, want);
+      if (chunk.byteLength > 0) {
+        yield chunk;
+        offset += chunk.byteLength;
+        continue;
+      }
+
+      // Caught up. A complete body that came up short simply ended sooner than
+      // the host said; one still arriving needs asking about.
+      if (done || refresh == null) return;
+      ({ contentLength: known, complete: done } = await refresh());
+      if (offset < known) continue;
+      if (done) return;
+      await new Promise((resolve) => setTimeout(resolve, pollIntervalMs));
+    }
+  }
+
+  async function readAll(accessor: string, options?: ReadHttpResponseBodyOptions) {
+    const maxBytes = options?.maxBytes ?? DEFAULT_MAX_BYTES;
+    refuseIfTooBig(accessor, contentLength, maxBytes);
+
+    const parts: Uint8Array[] = [];
+    let total = 0;
+    for await (const chunk of chunks(options)) {
+      total += chunk.byteLength;
+      // The size the host reported is a claim about a moment ago, so check the
+      // bytes actually arriving too.
+      refuseIfTooBig(accessor, total, maxBytes);
+      parts.push(chunk);
+    }
+
+    const bytes = new Uint8Array(total);
+    let offset = 0;
+    for (const part of parts) {
+      bytes.set(part, offset);
+      offset += part.byteLength;
+    }
+    return bytes;
+  }
+
+  return {
+    responseId,
+    contentLength,
+    contentType,
+    complete,
+    chunks,
+    async arrayBuffer(options) {
+      const bytes = await readAll("arrayBuffer", options);
+      return bytes.buffer as ArrayBuffer;
+    },
+    async text(options) {
+      return decodeBody(await readAll("text", options), contentType);
+    },
+    async json<T>(options?: ReadHttpResponseBodyOptions) {
+      return JSON.parse(decodeBody(await readAll("json", options), contentType)) as T;
+    },
+  };
+}
+
+function refuseIfTooBig(accessor: string, bytes: number, maxBytes: number) {
+  if (bytes <= maxBytes) return;
+  throw new Error(
+    `Response body is ${formatBytes(bytes)}, over the ${formatBytes(maxBytes)} limit for ` +
+      `${accessor}(). Read it with chunks() instead, or pass a larger maxBytes.`,
+  );
+}
+
+/**
+ * Decode using the charset the response declared.
+ *
+ * Assuming UTF-8 mangles every response that isn't, and the header is right
+ * there. An unknown label is the one case worth guessing on, since the
+ * alternative is refusing to read a body we can very likely still read.
+ */
+function decodeBody(bytes: Uint8Array, contentType: string | null): string {
+  const charset = parseCharset(contentType);
+  if (charset != null) {
+    try {
+      return new TextDecoder(charset).decode(bytes);
+    } catch {
+      // Not a label this runtime knows.
+    }
+  }
+  // TextDecoder drops a leading BOM on its own.
+  return new TextDecoder("utf-8").decode(bytes);
+}
+
+function parseCharset(contentType: string | null): string | null {
+  const match = contentType?.match(/;\s*charset\s*=\s*"?([^";]+)"?/i);
+  return match?.[1]?.trim() || null;
+}
+
+function formatBytes(bytes: number): string {
+  if (bytes === Infinity) return "unlimited";
+  if (bytes < 1024) return `${bytes} B`;
+  const units = ["KB", "MB", "GB"];
+  let value = bytes / 1024;
+  let unit = 0;
+  while (value >= 1024 && unit < units.length - 1) {
+    value /= 1024;
+    unit++;
+  }
+  return `${value.toFixed(1)} ${units[unit]}`;
+}
+
+/**
+ * Decode a chunk that arrived as base64.
+ *
+ * The desktop transport is a WebSocket carrying JSON text frames, so bytes
+ * have to be spelled out. A host that can pass an ArrayBuffer along skips this.
+ */
+export function decodeBase64Chunk(data: string): Uint8Array {
+  if (typeof Buffer !== "undefined") {
+    const buf = Buffer.from(data, "base64");
+    return new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength);
+  }
+
+  const binary = atob(data);
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) {
+    bytes[i] = binary.charCodeAt(i);
+  }
+  return bytes;
+}
@@ -0,0 +1,203 @@
+import { describe, expect, test } from "vite-plus/test";
+import { createResponseBody, decodeBase64Chunk } from "../src/responseBody";
+
+/** A finished body, in a store that records every window it was asked for. */
+function fakeBody(bytes: Uint8Array, contentType: string | null) {
+  const reads: Array<[number, number]> = [];
+  const body = createResponseBody(
+    { responseId: "rs_test", contentLength: bytes.byteLength, contentType, complete: true },
+    async (offset, length) => {
+      reads.push([offset, length]);
+      return bytes.slice(offset, offset + length);
+    },
+  );
+  return { body, reads };
+}
+
+/**
+ * A body still arriving: it grows by one script step every time the reader
+ * asks the host where it has got to, and completes on the last step.
+ */
+function streamingBody(steps: string[], contentType = "text/plain") {
+  let stored = new Uint8Array();
+  let step = 0;
+  let refreshes = 0;
+  const advance = () => {
+    if (step < steps.length) {
+      const next = utf8(steps[step]!);
+      const grown = new Uint8Array(stored.byteLength + next.byteLength);
+      grown.set(stored);
+      grown.set(next, stored.byteLength);
+      stored = grown;
+      step++;
+    }
+    return { contentLength: stored.byteLength, complete: step >= steps.length };
+  };
+  const body = createResponseBody(
+    { responseId: "rs_live", contentLength: 0, contentType, complete: false },
+    async (offset, length) => stored.slice(offset, offset + length),
+    {
+      refresh: async () => {
+        refreshes++;
+        return advance();
+      },
+      pollIntervalMs: 1,
+    },
+  );
+  return { body, refreshCount: () => refreshes };
+}
+
+function utf8(text: string) {
+  return new TextEncoder().encode(text);
+}
+
+describe("response body", () => {
+  test("pulls a body in chunks and reassembles it", async () => {
+    const { body, reads } = fakeBody(utf8("abcdefghij"), "text/plain");
+
+    expect(await body.text({ chunkSize: 4 })).toEqual("abcdefghij");
+    expect(reads).toEqual([
+      [0, 4],
+      [4, 4],
+      [8, 2],
+    ]);
+  });
+
+  test("can be read more than once, unlike fetch", async () => {
+    const { body } = fakeBody(utf8('{"a":1}'), "application/json");
+
+    expect(await body.text()).toEqual('{"a":1}');
+    expect(await body.json()).toEqual({ a: 1 });
+    expect(new Uint8Array(await body.arrayBuffer())).toEqual(utf8('{"a":1}'));
+  });
+
+  test("decodes using the charset the response declared", async () => {
+    // "café naïve" as Latin-1, which is mojibake if read as UTF-8.
+    const latin1 = new Uint8Array([0x63, 0x61, 0x66, 0xe9, 0x20, 0x6e, 0x61, 0xef, 0x76, 0x65]);
+
+    const declared = fakeBody(latin1, "text/plain; charset=iso-8859-1");
+    expect(await declared.body.text()).toEqual("café naïve");
+
+    const undeclared = fakeBody(latin1, "text/plain");
+    expect(await undeclared.body.text()).not.toEqual("café naïve");
+  });
+
+  test("falls back to UTF-8 for a charset the runtime doesn't know", async () => {
+    const { body } = fakeBody(utf8("hello"), "text/plain; charset=not-a-real-charset");
+    expect(await body.text()).toEqual("hello");
+  });
+
+  test("drops a UTF-8 BOM", async () => {
+    const withBom = new Uint8Array([0xef, 0xbb, 0xbf, ...utf8('{"a":1}')]);
+    const { body } = fakeBody(withBom, "application/json");
+
+    expect(await body.text()).toEqual('{"a":1}');
+    expect(await body.json()).toEqual({ a: 1 });
+  });
+
+  test("refuses to buffer past maxBytes, and says what to do instead", async () => {
+    const { body } = fakeBody(utf8("x".repeat(100)), "text/plain");
+
+    await expect(body.text({ maxBytes: 50 })).rejects.toThrow(/chunks\(\)/);
+    await expect(body.json({ maxBytes: 50 })).rejects.toThrow(/over the/);
+    await expect(body.arrayBuffer({ maxBytes: 50 })).rejects.toThrow(/arrayBuffer\(\)/);
+
+    // The ceiling is the caller's to raise.
+    expect(await body.text({ maxBytes: 100 })).toHaveLength(100);
+  });
+
+  test("streams past maxBytes through chunks()", async () => {
+    const { body } = fakeBody(utf8("x".repeat(100)), "text/plain");
+
+    let total = 0;
+    for await (const chunk of body.chunks({ chunkSize: 10 })) {
+      total += chunk.byteLength;
+    }
+    expect(total).toEqual(100);
+  });
+
+  test("stops early when the host runs out of bytes sooner than it claimed", async () => {
+    // contentLength says 100; the store only ever hands back 10.
+    const body = createResponseBody(
+      { responseId: "rs_test", contentLength: 100, contentType: "text/plain", complete: true },
+      async (offset) => (offset === 0 ? utf8("0123456789") : new Uint8Array()),
+    );
+
+    expect(await body.text()).toEqual("0123456789");
+  });
+
+  test("a response with no body reads as empty", async () => {
+    const { body, reads } = fakeBody(new Uint8Array(), "application/json");
+
+    expect(body.contentLength).toEqual(0);
+    expect(await body.text()).toEqual("");
+    expect(reads).toEqual([]);
+  });
+
+  test("keeps binary bytes intact", async () => {
+    const png = new Uint8Array([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a, 0x00, 0xff]);
+    const { body } = fakeBody(png, "image/png");
+
+    expect(new Uint8Array(await body.arrayBuffer({ chunkSize: 3 }))).toEqual(png);
+  });
+});
+
+describe("a response still arriving", () => {
+  test("chunks() follows it until it finishes", async () => {
+    const { body, refreshCount } = streamingBody(["data: 1\n", "data: 2\n", "data: 3\n"]);
+    expect(body.complete).toBe(false);
+
+    const seen: string[] = [];
+    for await (const chunk of body.chunks()) {
+      seen.push(new TextDecoder().decode(chunk));
+    }
+
+    expect(seen.join("")).toEqual("data: 1\ndata: 2\ndata: 3\n");
+    // Asked once per catch-up, and stopped as soon as the host said it was done.
+    expect(refreshCount()).toEqual(3);
+  });
+
+  test("text() waits for the rest rather than returning a prefix", async () => {
+    const { body } = streamingBody(['{"token":', '"abc"}']);
+    expect(await body.json()).toEqual({ token: "abc" });
+  });
+
+  test("keeps waiting through a stretch with nothing new", async () => {
+    // Two refreshes report no growth before the body finally moves.
+    const { body } = streamingBody(["", "", "late"]);
+    expect(await body.text()).toEqual("late");
+  });
+
+  test("still refuses to buffer past maxBytes as it streams", async () => {
+    const { body } = streamingBody(["x".repeat(40), "x".repeat(40), "x".repeat(40)]);
+    await expect(body.text({ maxBytes: 100 })).rejects.toThrow(/chunks\(\)/);
+  });
+
+  test("a finished body never asks the host again", async () => {
+    let refreshes = 0;
+    const body = createResponseBody(
+      { responseId: "rs_done", contentLength: 5, contentType: null, complete: true },
+      async (offset, length) => utf8("hello").slice(offset, offset + length),
+      {
+        refresh: async () => {
+          refreshes++;
+          return { contentLength: 5, complete: true };
+        },
+      },
+    );
+    expect(await body.text()).toEqual("hello");
+    expect(refreshes).toEqual(0);
+  });
+});
+
+describe("decodeBase64Chunk", () => {
+  test("round-trips arbitrary bytes", () => {
+    const bytes = new Uint8Array([0, 1, 127, 128, 254, 255]);
+    const base64 = Buffer.from(bytes).toString("base64");
+    expect(decodeBase64Chunk(base64)).toEqual(bytes);
+  });
+
+  test("decodes an empty chunk", () => {
+    expect(decodeBase64Chunk("")).toEqual(new Uint8Array());
+  });
+});
@@ -80,7 +80,7 @@ export function registerHttpRequestTools(server: McpServer, ctx: McpServerContex
        throw new Error(`HTTP request with ID ${id} not found`);
      }

-      const response = await workspaceCtx.yaak.httpRequest.send({ httpRequest });
+      const { httpResponse: response } = await workspaceCtx.yaak.httpRequest.send({ httpRequest });

      return {
        content: [
@@ -67,7 +67,7 @@ export const plugin: PluginDefinition = {

      const type1 = ntlm.createType1Message(options);

-      const negotiateResponse = await ctx.httpRequest.send({
+      const { httpResponse: negotiateResponse } = await ctx.httpRequest.send({
        httpRequest: {
          method,
          url,
@@ -24,10 +24,12 @@ describe("auth-ntlm", () => {

  test("uses NTLM challenge when Negotiate and NTLM headers are separate", async () => {
    const send = vi.fn().mockResolvedValue({
-      headers: [
-        { name: "WWW-Authenticate", value: "Negotiate" },
-        { name: "WWW-Authenticate", value: "NTLM TlRMTVNTUAACAAAAAA==" },
-      ],
+      httpResponse: {
+        headers: [
+          { name: "WWW-Authenticate", value: "Negotiate" },
+          { name: "WWW-Authenticate", value: "NTLM TlRMTVNTUAACAAAAAA==" },
+        ],
+      },
    });
    const ctx = { httpRequest: { send } } as unknown as Context;

@@ -48,7 +50,9 @@ describe("auth-ntlm", () => {

  test("uses NTLM challenge when auth schemes are comma-separated in one header", async () => {
    const send = vi.fn().mockResolvedValue({
-      headers: [{ name: "www-authenticate", value: "Negotiate, NTLM TlRMTVNTUAACAAAAAA==" }],
+      httpResponse: {
+        headers: [{ name: "www-authenticate", value: "Negotiate, NTLM TlRMTVNTUAACAAAAAA==" }],
+      },
    });
    const ctx = { httpRequest: { send } } as unknown as Context;

@@ -68,7 +72,7 @@ describe("auth-ntlm", () => {

  test("throws a clear error when NTLM challenge is missing", async () => {
    const send = vi.fn().mockResolvedValue({
-      headers: [{ name: "WWW-Authenticate", value: "Negotiate" }],
+      httpResponse: { headers: [{ name: "WWW-Authenticate", value: "Negotiate" }] },
    });
    const ctx = { httpRequest: { send } } as unknown as Context;

@@ -1,4 +1,3 @@
-import { readFileSync } from "node:fs";
 import type { Context, HttpRequest, HttpUrlParameter } from "@yaakapp/api";
 import type { AccessTokenRawResponse } from "./store";

@@ -57,7 +56,7 @@ export async function fetchAccessToken(
  }

  httpRequest.authenticationType = "none"; // Don't inherit workspace auth
-  const resp = await ctx.httpRequest.send({ httpRequest });
+  const { httpResponse: resp, body: responseBody } = await ctx.httpRequest.send({ httpRequest });

  console.log("[oauth2] Got access token response", resp.status);

@@ -65,7 +64,10 @@ export async function fetchAccessToken(
    throw new Error(`Failed to fetch access token: ${resp.error}`);
  }

-  const body = resp.bodyPath ? readFileSync(resp.bodyPath, "utf8") : "";
+  // A token request is sent ad-hoc, with no id, so nothing saves the response
+  // and this body is the only copy of it. An empty one parses to {} below,
+  // which is what reading a missing file used to give.
+  const body = await responseBody.text();

  if (resp.status < 200 || resp.status >= 300) {
    throw new Error(`Failed to fetch access token with status=${resp.status} and body=${body}`);
@@ -1,4 +1,3 @@
-import { readFileSync } from "node:fs";
 import type { Context, HttpRequest } from "@yaakapp/api";
 import type { AccessToken, AccessTokenRawResponse, TokenStoreArgs } from "./store";
 import { deleteToken, getToken, storeToken } from "./store";
@@ -71,7 +70,7 @@ export async function getOrRefreshAccessToken(
  }

  httpRequest.authenticationType = "none"; // Don't inherit workspace auth
-  const resp = await ctx.httpRequest.send({ httpRequest });
+  const { httpResponse: resp, body: responseBody } = await ctx.httpRequest.send({ httpRequest });

  if (resp.error) {
    throw new Error(`Failed to refresh access token: ${resp.error}`);
@@ -85,7 +84,9 @@ export async function getOrRefreshAccessToken(
    return null;
  }

-  const body = resp.bodyPath ? readFileSync(resp.bodyPath, "utf8") : "";
+  // Sent ad-hoc, so this body came back with the response rather than being
+  // saved anywhere to read later.
+  const body = await responseBody.text();

  console.log("[oauth2] Got refresh token response", resp.status);

@@ -10,10 +10,6 @@
    "test": "vp test --run tests"
  },
  "dependencies": {
-    "openapi-to-postmanv2": "^5.8.0",
    "yaml": "^2.8.3"
-  },
-  "devDependencies": {
-    "@types/openapi-to-postmanv2": "^5.0.0"
  }
 }
@@ -0,0 +1,8 @@
+# Real-World OpenAPI Fixtures
+
+These fixtures were copied from the public APIs.guru OpenAPI directory:
+
+- `apis-guru.yaml`: https://api.apis.guru/v2/specs/apis.guru/2.2.0/openapi.yaml
+- `httpbin.yaml`: https://api.apis.guru/v2/specs/httpbin.org/0.9.2/openapi.yaml
+- `nasa-apod.yaml`: https://api.apis.guru/v2/specs/nasa.gov/apod/1.0.0/openapi.yaml
+- `xkcd.yaml`: https://api.apis.guru/v2/specs/xkcd.com/1.0.0/openapi.yaml
@@ -0,0 +1,399 @@
+openapi: 3.0.0
+servers:
+  - url: https://api.apis.guru/v2
+info:
+  contact:
+    email: mike.ralphson@gmail.com
+    name: APIs.guru
+    url: https://APIs.guru
+  description: |
+    Wikipedia for Web APIs. Repository of API definitions in OpenAPI format.
+    **Warning**: If you want to be notified about changes in advance please join our [Slack channel](https://join.slack.com/t/mermade/shared_invite/zt-g78g7xir-MLE_CTCcXCdfJfG3CJe9qA).
+    Client sample: [[Demo]](https://apis.guru/simple-ui) [[Repo]](https://github.com/APIs-guru/simple-ui)
+  license:
+    name: CC0 1.0
+    url: https://github.com/APIs-guru/openapi-directory#licenses
+  title: APIs.guru
+  version: 2.2.0
+  x-apisguru-categories:
+    - open_data
+    - developer_tools
+  x-logo:
+    url: https://api.apis.guru/v2/cache/logo/https_apis.guru_branding_logo_vertical.svg
+  x-origin:
+    - format: openapi
+      url: https://api.apis.guru/v2/openapi.yaml
+      version: "3.0"
+  x-providerName: apis.guru
+  x-tags:
+    - API
+    - Catalog
+    - Directory
+    - REST
+    - Swagger
+    - OpenAPI
+externalDocs:
+  url: https://github.com/APIs-guru/openapi-directory/blob/master/API.md
+security: []
+tags:
+  - description: Actions relating to APIs in the collection
+    name: APIs
+paths:
+  /list.json:
+    get:
+      description: |
+        List all APIs in the directory.
+        Returns links to the OpenAPI definitions for each API in the directory.
+        If API exist in multiple versions `preferred` one is explicitly marked.
+        Some basic info from the OpenAPI definition is cached inside each object.
+        This allows you to generate some simple views without needing to fetch the OpenAPI definition for each API.
+      operationId: listAPIs
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/APIs"
+          description: OK
+      summary: List all APIs
+      tags:
+        - APIs
+  /metrics.json:
+    get:
+      description: |
+        Some basic metrics for the entire directory.
+        Just stunning numbers to put on a front page and are intended purely for WoW effect :)
+      operationId: getMetrics
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Metrics"
+          description: OK
+      summary: Get basic metrics
+      tags:
+        - APIs
+  /providers.json:
+    get:
+      description: |
+        List all the providers in the directory
+      operationId: getProviders
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                properties:
+                  data:
+                    items:
+                      minLength: 1
+                      type: string
+                    minItems: 1
+                    type: array
+                type: object
+          description: OK
+      summary: List all providers
+      tags:
+        - APIs
+  "/specs/{provider}/{api}.json":
+    get:
+      description: Returns the API entry for one specific version of an API where there is no serviceName.
+      operationId: getAPI
+      parameters:
+        - $ref: "#/components/parameters/provider"
+        - $ref: "#/components/parameters/api"
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/API"
+          description: OK
+      summary: Retrieve one version of a particular API
+      tags:
+        - APIs
+  "/specs/{provider}/{service}/{api}.json":
+    get:
+      description: Returns the API entry for one specific version of an API where there is a serviceName.
+      operationId: getServiceAPI
+      parameters:
+        - $ref: "#/components/parameters/provider"
+        - in: path
+          name: service
+          required: true
+          schema:
+            example: graph
+            maxLength: 255
+            minLength: 1
+            type: string
+        - $ref: "#/components/parameters/api"
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/API"
+          description: OK
+      summary: Retrieve one version of a particular API with a serviceName.
+      tags:
+        - APIs
+  "/{provider}.json":
+    get:
+      description: |
+        List all APIs in the directory for a particular providerName
+        Returns links to the individual API entry for each API.
+      operationId: getProvider
+      parameters:
+        - $ref: "#/components/parameters/provider"
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/APIs"
+          description: OK
+      summary: List all APIs for a particular provider
+      tags:
+        - APIs
+  "/{provider}/services.json":
+    get:
+      description: |
+        List all serviceNames in the directory for a particular providerName
+      operationId: getServices
+      parameters:
+        - $ref: "#/components/parameters/provider"
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                properties:
+                  data:
+                    items:
+                      minLength: 0
+                      type: string
+                    minItems: 1
+                    type: array
+                type: object
+          description: OK
+      summary: List all serviceNames for a particular provider
+      tags:
+        - APIs
+components:
+  parameters:
+    api:
+      in: path
+      name: api
+      required: true
+      schema:
+        example: 2.1.0
+        maxLength: 255
+        minLength: 1
+        type: string
+    provider:
+      in: path
+      name: provider
+      required: true
+      schema:
+        example: apis.guru
+        maxLength: 255
+        minLength: 1
+        type: string
+  schemas:
+    API:
+      additionalProperties: false
+      description: Meta information about API
+      properties:
+        added:
+          description: Timestamp when the API was first added to the directory
+          format: date-time
+          type: string
+        preferred:
+          description: Recommended version
+          type: string
+        versions:
+          additionalProperties:
+            $ref: "#/components/schemas/ApiVersion"
+          description: List of supported versions of the API
+          minProperties: 1
+          type: object
+      required:
+        - added
+        - preferred
+        - versions
+      type: object
+    APIs:
+      additionalProperties:
+        $ref: "#/components/schemas/API"
+      description: |
+        List of API details.
+        It is a JSON object with API IDs(`<provider>[:<service>]`) as keys.
+      example:
+        googleapis.com:drive:
+          added: 2015-02-22T20:00:45.000Z
+          preferred: v3
+          versions:
+            v2:
+              added: 2015-02-22T20:00:45.000Z
+              info:
+                title: Drive
+                version: v2
+                x-apiClientRegistration:
+                  url: https://console.developers.google.com
+                x-logo:
+                  url: https://api.apis.guru/v2/cache/logo/https_www.gstatic.com_images_icons_material_product_2x_drive_32dp.png
+                x-origin:
+                  format: google
+                  url: https://www.googleapis.com/discovery/v1/apis/drive/v2/rest
+                  version: v1
+                x-preferred: false
+                x-providerName: googleapis.com
+                x-serviceName: drive
+              swaggerUrl: https://api.apis.guru/v2/specs/googleapis.com/drive/v2/swagger.json
+              swaggerYamlUrl: https://api.apis.guru/v2/specs/googleapis.com/drive/v2/swagger.yaml
+              updated: 2016-06-17T00:21:44.000Z
+            v3:
+              added: 2015-12-12T00:25:13.000Z
+              info:
+                title: Drive
+                version: v3
+                x-apiClientRegistration:
+                  url: https://console.developers.google.com
+                x-logo:
+                  url: https://api.apis.guru/v2/cache/logo/https_www.gstatic.com_images_icons_material_product_2x_drive_32dp.png
+                x-origin:
+                  format: google
+                  url: https://www.googleapis.com/discovery/v1/apis/drive/v3/rest
+                  version: v1
+                x-preferred: true
+                x-providerName: googleapis.com
+                x-serviceName: drive
+              swaggerUrl: https://api.apis.guru/v2/specs/googleapis.com/drive/v3/swagger.json
+              swaggerYamlUrl: https://api.apis.guru/v2/specs/googleapis.com/drive/v3/swagger.yaml
+              updated: 2016-06-17T00:21:44.000Z
+      minProperties: 1
+      type: object
+    ApiVersion:
+      additionalProperties: false
+      properties:
+        added:
+          description: Timestamp when the version was added
+          format: date-time
+          type: string
+        externalDocs:
+          description: Copy of `externalDocs` section from OpenAPI definition
+          minProperties: 1
+          type: object
+        info:
+          description: Copy of `info` section from OpenAPI definition
+          minProperties: 1
+          type: object
+        link:
+          description: Link to the individual API entry for this API
+          format: url
+          type: string
+        openapiVer:
+          description: The value of the `openapi` or `swagger` property of the source definition
+          type: string
+        swaggerUrl:
+          description: URL to OpenAPI definition in JSON format
+          format: url
+          type: string
+        swaggerYamlUrl:
+          description: URL to OpenAPI definition in YAML format
+          format: url
+          type: string
+        updated:
+          description: Timestamp when the version was updated
+          format: date-time
+          type: string
+      required:
+        - added
+        - updated
+        - swaggerUrl
+        - swaggerYamlUrl
+        - info
+        - openapiVer
+      type: object
+    Metrics:
+      additionalProperties: false
+      description: List of basic metrics
+      example:
+        datasets: []
+        fixedPct: 22
+        fixes: 81119
+        invalid: 598
+        issues: 28
+        numAPIs: 2501
+        numDrivers: 10
+        numEndpoints: 106448
+        numProviders: 659
+        numSpecs: 3329
+        stars: 2429
+        thisWeek:
+          added: 45
+          updated: 171
+        unofficial: 25
+        unreachable: 123
+      properties:
+        datasets:
+          description: Data used for charting etc
+          items: {}
+          type: array
+        fixedPct:
+          description: Percentage of all APIs where auto fixes have been applied
+          type: integer
+        fixes:
+          description: Total number of fixes applied across all APIs
+          type: integer
+        invalid:
+          description: Number of newly invalid APIs
+          type: integer
+        issues:
+          description: Open GitHub issues on our main repo
+          type: integer
+        numAPIs:
+          description: Number of unique APIs
+          minimum: 1
+          type: integer
+        numDrivers:
+          description: Number of methods of API retrieval
+          type: integer
+        numEndpoints:
+          description: Total number of endpoints inside all definitions
+          minimum: 1
+          type: integer
+        numProviders:
+          description: Number of API providers in directory
+          type: integer
+        numSpecs:
+          description: Number of API definitions including different versions of the same API
+          minimum: 1
+          type: integer
+        stars:
+          description: GitHub stars for our main repo
+          type: integer
+        thisWeek:
+          description: Summary totals for the last 7 days
+          properties:
+            added:
+              description: APIs added in the last week
+              type: integer
+            updated:
+              description: APIs updated in the last week
+              type: integer
+          type: object
+        unofficial:
+          description: Number of unofficial APIs
+          type: integer
+        unreachable:
+          description: Number of unreachable (4XX,5XX status) APIs
+          type: integer
+      required:
+        - numSpecs
+        - numAPIs
+        - numEndpoints
+      type: object
+x-optic-standard: "@febf8ac6-ee67-4565-b45a-5c85a469dca7/Fz6KU3_wMIO5iJ6_VUZ30"
+x-optic-url: https://app.useoptic.com/organizations/febf8ac6-ee67-4565-b45a-5c85a469dca7/apis/_0fKWqUvhs9ssYNkq1k-c
@@ -0,0 +1,69 @@
+openapi: 3.0.0
+servers:
+  - url: https://api.nasa.gov/planetary
+  - url: http://api.nasa.gov/planetary
+info:
+  contact:
+    email: evan.t.yates@nasa.gov
+  description: This endpoint structures the APOD imagery and associated metadata so that it can be repurposed for other applications. In addition, if the concept_tags parameter is set to True, then keywords derived from the image explanation are returned. These keywords could be used as auto-generated hashtags for twitter or instagram feeds; but generally help with discoverability of relevant imagery
+  license:
+    name: Apache 2.0
+    url: http://www.apache.org/licenses/LICENSE-2.0.html
+  title: APOD
+  version: 1.0.0
+  x-apisguru-categories:
+    - media
+    - open_data
+  x-origin:
+    - format: swagger
+      url: https://raw.githubusercontent.com/nasa/api-docs/gh-pages/assets/json/APOD
+      version: "2.0"
+  x-providerName: nasa.gov
+  x-serviceName: apod
+  x-logo:
+    url: https://api.apis.guru/v2/cache/logo/https_apis.guru_assets_images_no-logo.svg
+tags:
+  - description: An example tag
+    externalDocs:
+      description: Here's a link
+      url: https://example.com
+    name: request tag
+paths:
+  /apod:
+    get:
+      description: Returns the picture of the day
+      parameters:
+        - description: The date of the APOD image to retrieve
+          in: query
+          name: date
+          required: false
+          schema:
+            type: string
+        - description: Retrieve the URL for the high resolution image
+          in: query
+          name: hd
+          required: false
+          schema:
+            type: boolean
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                items:
+                  x-thing: ok
+                type: array
+          description: successful operation
+        "400":
+          description: Date must be between Jun 16, 1995 and Mar 28, 2019.
+      security:
+        - api_key: []
+      summary: Returns images
+      tags:
+        - request tag
+components:
+  securitySchemes:
+    api_key:
+      in: query
+      name: api_key
+      type: apiKey
@@ -0,0 +1,78 @@
+openapi: 3.0.0
+servers:
+  - url: http://xkcd.com/
+info:
+  description: Webcomic of romance, sarcasm, math, and language.
+  title: XKCD
+  version: 1.0.0
+  x-apisguru-categories:
+    - media
+  x-logo:
+    url: https://api.apis.guru/v2/cache/logo/http_imgs.xkcd.com_static_terrible_small_logo.png
+  x-origin:
+    - format: openapi
+      url: https://raw.githubusercontent.com/APIs-guru/unofficial_openapi_specs/master/xkcd.com/1.0.0/openapi.yaml
+      version: "3.0"
+  x-providerName: xkcd.com
+  x-tags:
+    - humor
+    - comics
+  x-unofficialSpec: true
+externalDocs:
+  url: https://xkcd.com/json.html
+paths:
+  /info.0.json:
+    get:
+      description: |
+        Fetch current comic and metadata.
+      responses:
+        "200":
+          content:
+            "*/*":
+              schema:
+                $ref: "#/components/schemas/comic"
+          description: OK
+  "/{comicId}/info.0.json":
+    get:
+      description: |
+        Fetch comics and metadata  by comic id.
+      parameters:
+        - in: path
+          name: comicId
+          required: true
+          schema:
+            type: number
+      responses:
+        "200":
+          content:
+            "*/*":
+              schema:
+                $ref: "#/components/schemas/comic"
+          description: OK
+components:
+  schemas:
+    comic:
+      properties:
+        alt:
+          type: string
+        day:
+          type: string
+        img:
+          type: string
+        link:
+          type: string
+        month:
+          type: string
+        news:
+          type: string
+        num:
+          type: number
+        safe_title:
+          type: string
+        title:
+          type: string
+        transcript:
+          type: string
+        year:
+          type: string
+      type: object
@@ -5,7 +5,13 @@ import { convertOpenApi } from "../src";

 describe("importer-openapi", () => {
  const p = path.join(__dirname, "fixtures");
-  const fixtures = fs.readdirSync(p);
+  const fixtures = fs.readdirSync(p).filter((fixture) => {
+    return fs.statSync(path.join(p, fixture)).isFile();
+  });
+  const realWorldFixturesPath = path.join(p, "real-world");
+  const realWorldFixtures = fs
+    .readdirSync(realWorldFixturesPath)
+    .filter((fixture) => fixture.endsWith(".yaml"));

  test("Maps operation description to request description", async () => {
    const imported = await convertOpenApi(
@@ -25,7 +31,195 @@ describe("importer-openapi", () => {

    expect(imported?.resources.httpRequests).toEqual([
      expect.objectContaining({
-        description: "Lijst van klanten",
+        description: expect.stringContaining("Lijst van klanten"),
+      }),
+    ]);
+  });
+
+  test("Imports requests directly from OpenAPI details", async () => {
+    const imported = await convertOpenApi(
+      JSON.stringify({
+        openapi: "3.0.0",
+        info: { title: "Native Import Test", version: "1.0.0" },
+        servers: [
+          { url: "https://api.example.com/{version}", variables: { version: { default: "v1" } } },
+        ],
+        tags: [{ name: "accounts", description: "Account operations" }],
+        paths: {
+          "/accounts/{accountId}/members": {
+            parameters: [
+              {
+                name: "accountId",
+                in: "path",
+                required: true,
+                description: "Account identifier",
+                schema: { type: "string", example: "acct_123" },
+              },
+            ],
+            post: {
+              tags: ["accounts"],
+              summary: "Create member",
+              operationId: "createMember",
+              parameters: [
+                {
+                  name: "include",
+                  in: "query",
+                  description: "Related resources to include",
+                  schema: { type: "string", enum: ["roles"] },
+                },
+                {
+                  name: "X-Trace-Id",
+                  in: "header",
+                  schema: { type: "string", example: "trace-123" },
+                },
+              ],
+              security: [{ tokenAuth: [] }],
+              requestBody: {
+                description: "Member payload",
+                content: {
+                  "application/json": {
+                    schema: { $ref: "#/components/schemas/MemberInput" },
+                  },
+                },
+              },
+              responses: {
+                "201": { description: "Created" },
+              },
+            },
+          },
+        },
+        components: {
+          securitySchemes: {
+            tokenAuth: { type: "http", scheme: "bearer" },
+          },
+          schemas: {
+            MemberInput: {
+              type: "object",
+              required: ["email"],
+              properties: {
+                email: { type: "string", example: "me@example.com" },
+                admin: { type: "boolean", default: false },
+                primaryContact: { $ref: "#/components/schemas/Contact" },
+                secondaryContact: { $ref: "#/components/schemas/Contact" },
+              },
+            },
+            Contact: {
+              type: "object",
+              properties: {
+                name: { type: "string", example: "Taylor" },
+              },
+            },
+          },
+        },
+      }),
+    );
+
+    expect(imported?.resources.folders).toEqual([
+      expect.objectContaining({ name: "accounts", description: "Account operations" }),
+    ]);
+    expect(imported?.resources.environments).toEqual([
+      expect.objectContaining({
+        name: "Global Variables",
+        variables: [{ name: "baseUrl", value: "https://api.example.com/v1" }],
+      }),
+    ]);
+    expect(imported?.resources.httpRequests).toEqual([
+      expect.objectContaining({
+        name: "Create member",
+        method: "POST",
+        url: "${[baseUrl]}/accounts/:accountId/members",
+        authenticationType: "bearer",
+        authentication: { token: "", prefix: "Bearer" },
+        bodyType: "application/json",
+        body: {
+          text: JSON.stringify(
+            {
+              email: "me@example.com",
+              admin: false,
+              primaryContact: { name: "Taylor" },
+              secondaryContact: { name: "Taylor" },
+            },
+            null,
+            2,
+          ),
+        },
+        headers: expect.arrayContaining([
+          { enabled: false, name: "X-Trace-Id", value: "trace-123" },
+          { enabled: true, name: "Content-Type", value: "application/json" },
+        ]),
+        urlParameters: [
+          { enabled: true, name: ":accountId", value: "acct_123" },
+          { enabled: false, name: "include", value: "roles" },
+        ],
+        description: expect.stringContaining("Operation ID: createMember"),
+      }),
+    ]);
+    expect(imported?.resources.httpRequests[0]?.description).toContain("Member payload");
+    expect(imported?.resources.httpRequests[0]?.description).toContain("201: Created");
+  });
+
+  test("Handles large schemas without the Postman converter path", async () => {
+    const paths: Record<string, unknown> = {};
+    for (let i = 0; i < 500; i++) {
+      paths[`/zones/{zoneId}/resources/${i}`] = {
+        get: {
+          tags: ["zones"],
+          summary: `Read resource ${i}`,
+          parameters: [
+            { name: "zoneId", in: "path", required: true, schema: { type: "string" } },
+            { name: "page", in: "query", schema: { type: "integer", default: 1 } },
+          ],
+          responses: {
+            "200": {
+              description: "OK",
+              content: {
+                "application/json": { schema: { $ref: "#/components/schemas/Resource" } },
+              },
+            },
+          },
+        },
+      };
+    }
+
+    const imported = await convertOpenApi(
+      JSON.stringify({
+        openapi: "3.1.0",
+        info: { title: "Large API", version: "1.0.0" },
+        servers: [{ url: "https://api.example.com/client/v4" }],
+        tags: [{ name: "zones" }],
+        paths,
+        components: {
+          schemas: {
+            Resource: {
+              type: "object",
+              properties: {
+                id: { type: "string" },
+                name: { type: "string" },
+                metadata: { $ref: "#/components/schemas/Metadata" },
+              },
+            },
+            Metadata: {
+              type: "object",
+              properties: {
+                createdOn: { type: "string", format: "date-time" },
+                tags: { type: "array", items: { type: "string" } },
+              },
+            },
+          },
+        },
+      }),
+    );
+
+    expect(imported?.resources.httpRequests.length).toBe(500);
+    expect(imported?.resources.httpRequests[499]).toEqual(
+      expect.objectContaining({
+        name: "Read resource 499",
+        url: "${[baseUrl]}/zones/:zoneId/resources/499",
+      }),
+    );
+    expect(imported?.resources.environments).toEqual([
+      expect.objectContaining({
+        variables: [{ name: "baseUrl", value: "https://api.example.com/client/v4" }],
      }),
    ]);
  });
@@ -35,6 +229,340 @@ describe("importer-openapi", () => {
    expect(imported).toBeUndefined();
  });

+  test("Prefers operation and path servers over the spec base URL", async () => {
+    const imported = await convertOpenApi(
+      JSON.stringify({
+        openapi: "3.0.0",
+        info: { title: "Servers Test", version: "1.0.0" },
+        servers: [{ url: "https://root.example.com" }],
+        paths: {
+          "/root": { get: { responses: {} } },
+          "/path-level": {
+            servers: [{ url: "https://path.example.com" }],
+            get: { responses: {} },
+          },
+          "/operation-level": {
+            servers: [{ url: "https://path.example.com" }],
+            get: { servers: [{ url: "https://operation.example.com" }], responses: {} },
+          },
+        },
+      }),
+    );
+
+    expect(imported?.resources.httpRequests.map((r) => r.url)).toEqual([
+      "${[baseUrl]}/root",
+      "https://path.example.com/path-level",
+      "https://operation.example.com/operation-level",
+    ]);
+  });
+
+  test("Imports OpenAPI 3 OAuth2 flows", async () => {
+    const imported = await convertOpenApi(
+      JSON.stringify({
+        openapi: "3.0.0",
+        info: { title: "OAuth Test", version: "1.0.0" },
+        paths: {
+          "/a": { get: { security: [{ oauth: ["read", "write"] }], responses: {} } },
+          "/b": { get: { security: [{ implicitOauth: [] }], responses: {} } },
+        },
+        components: {
+          securitySchemes: {
+            oauth: {
+              type: "oauth2",
+              flows: {
+                clientCredentials: { tokenUrl: "https://example.com/token", scopes: {} },
+              },
+            },
+            implicitOauth: {
+              type: "oauth2",
+              flows: {
+                implicit: { authorizationUrl: "https://example.com/authorize", scopes: {} },
+              },
+            },
+          },
+        },
+      }),
+    );
+
+    expect(imported?.resources.httpRequests[0]).toEqual(
+      expect.objectContaining({
+        authenticationType: "oauth2",
+        authentication: {
+          grantType: "client_credentials",
+          clientId: "",
+          clientSecret: "",
+          headerPrefix: "Bearer",
+          scope: "read write",
+          accessTokenUrl: "https://example.com/token",
+        },
+      }),
+    );
+    expect(imported?.resources.httpRequests[1]).toEqual(
+      expect.objectContaining({
+        authenticationType: "oauth2",
+        authentication: {
+          grantType: "implicit",
+          clientId: "",
+          headerPrefix: "Bearer",
+          authorizationUrl: "https://example.com/authorize",
+        },
+      }),
+    );
+  });
+
+  test("Imports Swagger 2 OAuth2 flows and produces", async () => {
+    const imported = await convertOpenApi(
+      JSON.stringify({
+        swagger: "2.0",
+        info: { title: "Swagger OAuth Test", version: "1.0.0" },
+        host: "example.com",
+        produces: ["application/json"],
+        paths: { "/a": { get: { security: [{ oauth: ["admin"] }], responses: {} } } },
+        securityDefinitions: {
+          oauth: {
+            type: "oauth2",
+            flow: "accessCode",
+            authorizationUrl: "https://example.com/authorize",
+            tokenUrl: "https://example.com/token",
+            scopes: { admin: "Admin access" },
+          },
+        },
+      }),
+    );
+
+    expect(imported?.resources.httpRequests[0]).toEqual(
+      expect.objectContaining({
+        authenticationType: "oauth2",
+        authentication: {
+          grantType: "authorization_code",
+          clientId: "",
+          clientSecret: "",
+          headerPrefix: "Bearer",
+          scope: "admin",
+          authorizationUrl: "https://example.com/authorize",
+          accessTokenUrl: "https://example.com/token",
+        },
+        headers: [{ enabled: true, name: "Accept", value: "application/json" }],
+      }),
+    );
+  });
+
+  test("Names operations that only carry a description", async () => {
+    const imported = await convertOpenApi(
+      JSON.stringify({
+        openapi: "3.0.0",
+        info: { title: "Naming Test", version: "1.0.0" },
+        paths: {
+          "/a": { get: { description: "Fetch the current comic.\nMore detail here.\n" } },
+          "/b": { get: { description: `${"x".repeat(101)}` } },
+          "/c": { get: { summary: "Explicit summary", description: "Ignored" } },
+        },
+      }),
+    );
+
+    expect(imported?.resources.httpRequests.map((r) => r.name)).toEqual([
+      "Fetch the current comic.",
+      // Too long to read as a name, so the route is clearer
+      "GET /b",
+      "Explicit summary",
+    ]);
+  });
+
+  test("Disambiguates requests that would share a name", async () => {
+    const imported = await convertOpenApi(
+      JSON.stringify({
+        openapi: "3.0.0",
+        info: { title: "Duplicate Test", version: "1.0.0" },
+        paths: {
+          "/anything": {
+            get: { summary: "Returns anything" },
+            post: { summary: "Returns anything" },
+          },
+          "/unique": { get: { summary: "Stands alone" } },
+        },
+      }),
+    );
+
+    expect(imported?.resources.httpRequests.map((r) => r.name)).toEqual([
+      "Returns anything (GET /anything)",
+      "Returns anything (POST /anything)",
+      "Stands alone",
+    ]);
+  });
+
+  test("Flags deprecated operations", async () => {
+    const imported = await convertOpenApi(
+      JSON.stringify({
+        openapi: "3.0.0",
+        info: { title: "Deprecated Test", version: "1.0.0" },
+        paths: {
+          "/old": { get: { summary: "Old", deprecated: true, description: "Use /new instead." } },
+          "/new": { get: { summary: "New" } },
+        },
+      }),
+    );
+
+    expect(imported?.resources.httpRequests[0]?.description).toBe(
+      "Deprecated.\n\nUse /new instead.",
+    );
+    expect(imported?.resources.httpRequests[1]?.description).toBe("New");
+  });
+
+  test("Derives an Accept header from OpenAPI 3 responses", async () => {
+    const imported = await convertOpenApi(
+      JSON.stringify({
+        openapi: "3.0.0",
+        info: { title: "Accept Test", version: "1.0.0" },
+        paths: {
+          "/prefers-json": {
+            get: {
+              responses: {
+                "200": {
+                  description: "ok",
+                  content: { "application/xml": {}, "application/json": {} },
+                },
+              },
+            },
+          },
+          // Only failures describe content, so there is nothing to accept
+          "/errors-only": {
+            get: {
+              responses: { "500": { description: "nope", content: { "application/json": {} } } },
+            },
+          },
+        },
+      }),
+    );
+
+    expect(imported?.resources.httpRequests[0]?.headers).toEqual([
+      { enabled: true, name: "Accept", value: "application/json" },
+    ]);
+    expect(imported?.resources.httpRequests[1]?.headers).toEqual([]);
+  });
+
+  test("Lets an operation override a path-level parameter", async () => {
+    const imported = await convertOpenApi(
+      JSON.stringify({
+        openapi: "3.0.0",
+        info: { title: "Override Test", version: "1.0.0" },
+        paths: {
+          "/a": {
+            parameters: [
+              { name: "page", in: "query", required: false, schema: { example: "path-level" } },
+              { name: "keep", in: "query", required: true, schema: { example: "untouched" } },
+            ],
+            get: {
+              parameters: [
+                // Same name and location as above, so it replaces rather than adds
+                { name: "page", in: "query", required: true, schema: { example: "operation" } },
+                // Same name but a different location, so it is its own parameter
+                { name: "page", in: "header", schema: { example: "header-level" } },
+              ],
+              responses: {},
+            },
+          },
+        },
+      }),
+    );
+
+    expect(imported?.resources.httpRequests[0]?.urlParameters).toEqual([
+      { enabled: true, name: "page", value: "operation" },
+      { enabled: true, name: "keep", value: "untouched" },
+    ]);
+    expect(imported?.resources.httpRequests[0]?.headers).toEqual([
+      { enabled: false, name: "page", value: "header-level" },
+    ]);
+  });
+
+  test("Prefers operation-level consumes for Swagger bodies", async () => {
+    const imported = await convertOpenApi(
+      JSON.stringify({
+        swagger: "2.0",
+        info: { title: "Consumes Test", version: "1.0.0" },
+        host: "example.com",
+        consumes: ["application/json"],
+        paths: {
+          "/a": {
+            post: {
+              consumes: ["application/xml"],
+              parameters: [{ name: "body", in: "body", schema: { type: "object" } }],
+              responses: {},
+            },
+          },
+        },
+      }),
+    );
+
+    expect(imported?.resources.httpRequests[0]).toEqual(
+      expect.objectContaining({
+        bodyType: "application/xml",
+        headers: expect.arrayContaining([
+          { enabled: true, name: "Content-Type", value: "application/xml" },
+        ]),
+      }),
+    );
+  });
+
+  test("Imports Swagger 2 basic auth and cookie API keys", async () => {
+    const imported = await convertOpenApi(
+      JSON.stringify({
+        swagger: "2.0",
+        info: { title: "Auth Test", version: "1.0.0" },
+        host: "example.com",
+        paths: {
+          "/a": { get: { security: [{ basicAuth: [] }], responses: {} } },
+          "/b": { get: { security: [{ cookieKey: [] }], responses: {} } },
+        },
+        securityDefinitions: {
+          basicAuth: { type: "basic" },
+          cookieKey: { type: "apiKey", in: "cookie", name: "session" },
+        },
+      }),
+    );
+
+    expect(imported?.resources.httpRequests[0]).toEqual(
+      expect.objectContaining({
+        authenticationType: "basic",
+        authentication: { username: "", password: "" },
+      }),
+    );
+    // The auth plugin has no cookie location, so it becomes the Cookie header
+    expect(imported?.resources.httpRequests[1]).toEqual(
+      expect.objectContaining({
+        authenticationType: "apikey",
+        authentication: { location: "header", key: "Cookie", value: "session=" },
+      }),
+    );
+  });
+
+  test("Reports references that point outside the document", async () => {
+    const imported = await convertOpenApi(
+      JSON.stringify({
+        openapi: "3.0.0",
+        info: { title: "External Ref Test", version: "1.0.0" },
+        paths: {
+          "/a": {
+            post: {
+              requestBody: {
+                content: {
+                  "application/json": { schema: { $ref: "./shared.yaml#/components/schemas/Foo" } },
+                },
+              },
+              responses: {},
+            },
+          },
+          "/b": { get: { responses: {} } },
+        },
+      }),
+    );
+
+    expect(imported?.resources.httpRequests[0]?.description).toContain(
+      "./shared.yaml#/components/schemas/Foo",
+    );
+    // The report is per-operation, so an unrelated request stays clean
+    expect(imported?.resources.httpRequests[1]?.description).toBeUndefined();
+  });
+
  for (const fixture of fixtures) {
    test(`Imports ${fixture}`, async () => {
      const contents = fs.readFileSync(path.join(p, fixture), "utf-8");
@@ -46,7 +574,15 @@ describe("importer-openapi", () => {
        }),
      ]);
      expect(imported?.resources.httpRequests.length).toBe(19);
-      expect(imported?.resources.folders.length).toBe(7);
+      expect(imported?.resources.folders.map((f) => f.name)).toEqual(["pet", "store", "user"]);
+    });
+  }
+
+  for (const fixture of realWorldFixtures) {
+    test(`Snapshots real-world fixture ${fixture}`, async () => {
+      const contents = fs.readFileSync(path.join(realWorldFixturesPath, fixture), "utf-8");
+      const imported = await convertOpenApi(contents);
+      expect(imported).toMatchSnapshot();
    });
  }
 });
@@ -1,4 +1,3 @@
-import { readFileSync } from "node:fs";
 import type {
  CallTemplateFunctionArgs,
  Context,
@@ -196,17 +195,8 @@ export const plugin: PluginDefinition = {
        });
        if (response == null) return null;

-        if (response.bodyPath == null) {
-          return null;
-        }
-
-        const BOM = "\ufeff";
-        let body: string;
-        try {
-          body = readFileSync(response.bodyPath, "utf-8").replace(BOM, "");
-        } catch {
-          return null;
-        }
+        const body = await readResponseBody(ctx, response);
+        if (body == null) return null;

        try {
          const result: JSONPathResult =
@@ -261,23 +251,32 @@ export const plugin: PluginDefinition = {
        });
        if (response == null) return null;

-        if (response.bodyPath == null) {
-          return null;
-        }
-
-        let body: string;
-        try {
-          body = readFileSync(response.bodyPath, "utf-8");
-        } catch {
-          return null;
-        }
-
-        return body;
+        return await readResponseBody(ctx, response);
      },
    },
  ],
 };

+/**
+ * The response's body as text, or null when there is nothing to read.
+ *
+ * The host is asked for it by response id, so this works wherever the bytes
+ * happen to live — including responses it never recorded, which still get an
+ * id. A body over the runtime's size limit throws rather than coming back
+ * empty, since a template silently rendering to nothing is worse than one that
+ * says why.
+ */
+async function readResponseBody(ctx: Context, response: HttpResponse): Promise<string | null> {
+  // Belt and braces: everything reaching here came from find() or send() and so
+  // has an id. An empty one would just be an unreadable id.
+  if (!response.id) return null;
+
+  const body = await ctx.httpResponse.body({ responseId: response.id });
+  if (body.contentLength === 0) return null;
+
+  return await body.text();
+}
+
 async function getResponse(
  ctx: Context,
  {
@@ -320,7 +319,7 @@ async function getResponse(
    // Explicitly render the request before send (instead of relying on send() to render) so that we can
    // preserve the render purpose.
    const renderedHttpRequest = await ctx.httpRequest.render({ httpRequest, purpose });
-    response = await ctx.httpRequest.send({ httpRequest: renderedHttpRequest });
+    response = (await ctx.httpRequest.send({ httpRequest: renderedHttpRequest })).httpResponse;
  }

  return response;
@@ -0,0 +1,77 @@
+const fs = require("node:fs");
+const path = require("node:path");
+const tar = require("tar");
+const yauzl = require("yauzl");
+
+// Resolve an archive entry against destDir, refusing anything that escapes it.
+function safeJoin(destDir, entryName) {
+  const root = path.resolve(destDir);
+  const resolved = path.resolve(root, entryName);
+  if (resolved !== root && !resolved.startsWith(root + path.sep)) {
+    throw new Error(`Archive entry escapes destination directory: ${entryName}`);
+  }
+  return resolved;
+}
+
+function extractZip(filePath, destDir) {
+  return new Promise((resolve, reject) => {
+    yauzl.open(filePath, { lazyEntries: true }, (err, zip) => {
+      if (err) return reject(err);
+      zip.on("error", reject);
+      zip.on("end", resolve);
+      zip.on("entry", (entry) => {
+        let dst;
+        try {
+          dst = safeJoin(destDir, entry.fileName);
+        } catch (e) {
+          return reject(e);
+        }
+
+        // Unix mode lives in the high 16 bits of the external attributes
+        const rawMode = (entry.externalFileAttributes >>> 16) & 0xffff;
+        const isSymlink = (rawMode & 0o170000) === 0o120000;
+        if (isSymlink) {
+          return reject(new Error(`Refusing to extract symlink from archive: ${entry.fileName}`));
+        }
+
+        if (entry.fileName.endsWith("/")) {
+          fs.mkdirSync(dst, { recursive: true });
+          return zip.readEntry();
+        }
+
+        zip.openReadStream(entry, (err2, stream) => {
+          if (err2) return reject(err2);
+          fs.mkdirSync(path.dirname(dst), { recursive: true });
+          const out = fs.createWriteStream(dst);
+          stream.on("error", reject);
+          out.on("error", reject);
+          out.on("close", () => {
+            const mode = rawMode & 0o7777;
+            if (mode !== 0) fs.chmodSync(dst, mode);
+            zip.readEntry();
+          });
+          stream.pipe(out);
+        });
+      });
+      zip.readEntry();
+    });
+  });
+}
+
+/**
+ * Extract a `.zip` or `.tar.gz` archive into destDir, preserving file modes.
+ * Entries that would land outside destDir are rejected.
+ */
+async function extractArchive(filePath, destDir) {
+  fs.mkdirSync(destDir, { recursive: true });
+  if (filePath.endsWith(".zip")) {
+    await extractZip(filePath, destDir);
+  } else if (filePath.endsWith(".tar.gz") || filePath.endsWith(".tgz")) {
+    // oxlint-disable-next-line await-thenable -- tar.x() returns a promise when `file` is set
+    await tar.x({ file: filePath, cwd: destDir });
+  } else {
+    throw new Error(`Unsupported archive format: ${path.basename(filePath)}`);
+  }
+}
+
+module.exports = { extractArchive };
@@ -1,8 +1,8 @@
 const path = require("node:path");
 const crypto = require("node:crypto");
 const fs = require("node:fs");
-const decompress = require("decompress");
 const Downloader = require("nodejs-file-downloader");
+const { extractArchive } = require("./extract-archive.cjs");
 const { rmSync, cpSync, mkdirSync, existsSync } = require("node:fs");
 const { execSync } = require("node:child_process");

@@ -92,7 +92,7 @@ rmSync(tmpDir, { recursive: true, force: true });
  console.log("SHA256 verified:", actualHash);

  // Decompress to the same directory
-  await decompress(filePath, tmpDir, {});
+  await extractArchive(filePath, tmpDir);

  // Copy binary
  const binSrc = path.join(tmpDir, SRC_BIN_MAP[key]);
@@ -1,7 +1,7 @@
 const crypto = require("node:crypto");
 const fs = require("node:fs");
-const decompress = require("decompress");
 const Downloader = require("nodejs-file-downloader");
+const { extractArchive } = require("./extract-archive.cjs");
 const path = require("node:path");
 const { rmSync, mkdirSync, cpSync, existsSync, statSync, chmodSync } = require("node:fs");
 const { execSync } = require("node:child_process");
@@ -86,7 +86,7 @@ mkdirSync(dstDir, { recursive: true });
  console.log("SHA256 verified:", actualHash);

  // Decompress to the same directory
-  await decompress(filePath, tmpDir, {});
+  await extractArchive(filePath, tmpDir);

  // Copy binary
  cpSync(binSrc, binDst);
Author	SHA1	Message	Date
Gregory Schier	0f434361a7	Fix Linux WASM release builds	2026-08-16 15:41:00 -07:00
Gregory SchierandGitHub	d27d11af7c	Move plugin actions and authentication onto PluginHost (#563 )	2026-08-16 11:41:03 -07:00
Gregory SchierandGitHub	1a19a06a23	Add native OpenAPI importer (#486 )	2026-08-16 11:40:34 -07:00
Gregory SchierandGitHub	07a9a6c6c0	Update NTLM auth tests for the new send() response shape (#567 )	2026-08-16 11:35:17 -07:00
Gregory SchierandGitHub	e54240d579	Let plugins declare assets to place beside the bundle (#565 )	2026-08-16 11:22:43 -07:00
Gregory SchierandGitHub	8bca013ab4	Fix plugin runtime build and JSON linter crash (#566 )	2026-08-16 11:22:02 -07:00
Gregory SchierandGitHub	10e962a0e6	Add a plugin API for reading HTTP response bodies (#560 )	2026-08-16 11:10:14 -07:00
Gregory SchierandGitHub	78954e10c8	Fix 23 Dependabot alerts (#562 )	2026-08-16 10:27:28 -07:00
Gregory SchierandGitHub	9eb7a001da	Move template rendering and themes onto PluginHost (#559 )	2026-08-16 09:22:46 -07:00