Read OAuth 2.0 token responses from the send instead of the filesystem

Both token requests opened HttpResponse.bodyPath with readFileSync, which ties the plugin to bodies living on a filesystem. The send now hands the body back, so they read it from there and keep working once bodies move into the blob DB and in the browser Worker, where there is no fs to read. text() on a response with no body returns "", which is what the bodyPath check produced, so an empty response still parses to {} rather than throwing.
Hand the body back from send instead of holding it for a lookup
2026-11-13 20:23:40 +01:00 · 2026-08-16 10:09:43 -07:00 · 2026-08-16 10:07:44 -07:00 · 2026-08-16 10:00:35 -07:00 · 2026-08-16 09:54:56 -07:00 · 2026-08-16 09:35:03 -07:00
318 changed files with 8361 additions and 32614 deletions
@@ -1,11 +0,0 @@
-node_modules
-**/node_modules
-dist
-**/dist
-target
-**/target
-.claude
-vendored
-**/vendored
-*.log
-.git
@@ -1,34 +0,0 @@
-version: 2
-
-updates:
-  - package-ecosystem: npm
-    directory: /
-    schedule:
-      interval: weekly
-      day: monday
-    open-pull-requests-limit: 5
-    groups:
-      npm-production:
-        dependency-type: production
-        update-types:
-          - minor
-          - patch
-      npm-development:
-        dependency-type: development
-        update-types:
-          - minor
-          - patch
-
-  - package-ecosystem: cargo
-    directory: /
-    schedule:
-      interval: weekly
-      day: monday
-    open-pull-requests-limit: 5
-    groups:
-      cargo:
-        patterns:
-          - "*"
-        update-types:
-          - minor
-          - patch
@@ -31,7 +31,3 @@ jobs:
        run: vp test
      - name: Run Rust Tests
        run: cargo test --all --features yaak-app-client/wry
-      - name: OpenAPI import round-trip
-        run: |
-          cargo build -p yaak-cli
-          node plugins/importer-openapi/tests/roundtrip.mjs
@@ -103,18 +103,6 @@ jobs:
        run: |
          sudo apt-get update
          sudo apt-get install -y cmake ninja-build libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev libnss3 patchelf xdg-utils
-          # crates/yaak-wasm compiles SQLite to wasm via sqlite-wasm-rs, whose C shim
-          # uses C23 [[noreturn]] and expects a freestanding wasm32 target. Ubuntu
-          # 22.04 ships only clang <=15: 14 rejects the attribute, and 15 falls
-          # through to host glibc headers ("bits/libc-header-start.h" not found).
-          # clang-18 handles it (it is what ubuntu-24.04 uses). Install it from
-          # apt.llvm.org since 22.04's repos stop at 15. Only the wasm build uses
-          # this compiler, so the shipped binary keeps 22.04's glibc floor.
-          wget -qO /tmp/llvm.sh https://apt.llvm.org/llvm.sh
-          chmod +x /tmp/llvm.sh
-          sudo /tmp/llvm.sh 18
-          echo "CC_wasm32_unknown_unknown=/usr/bin/clang-18" >> "$GITHUB_ENV"
-          echo "AR_wasm32_unknown_unknown=/usr/bin/llvm-ar-18" >> "$GITHUB_ENV"

      - name: Install Protoc for plugin-runtime
        uses: arduino/setup-protoc@v3
@@ -1,123 +0,0 @@
-name: Release web image
-
-# Builds ghcr.io/mountain-loop/yaak-web: the browser client and the server that serves it.
-# One image per architecture on its own native runner (emulating a Rust release build is hours),
-# joined into one multi-arch tag at the end.
-
-on:
-  push:
-    tags: [v*]
-  workflow_dispatch:
-    inputs:
-      version:
-        description: Version to publish, without the v (e.g. 2026.2.0). Empty publishes main and sha tags only.
-        required: false
-        type: string
-
-permissions:
-  contents: read
-  packages: write
-
-env:
-  IMAGE: ghcr.io/mountain-loop/yaak-web
-
-jobs:
-  build:
-    if: github.repository == 'mountain-loop/yaak'
-    name: Build ${{ matrix.platform }}
-    runs-on: ${{ matrix.runner }}
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - platform: linux/amd64
-            runner: ubuntu-22.04
-            arch: amd64
-          - platform: linux/arm64
-            runner: ubuntu-22.04-arm
-            arch: arm64
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Set up Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Log in to GHCR
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Build and push by digest
-        id: build
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          file: Dockerfile.web
-          platforms: ${{ matrix.platform }}
-          outputs: type=image,name=${{ env.IMAGE }},push-by-digest=true,name-canonical=true,push=true
-
-      - name: Export digest
-        run: |
-          mkdir -p "${{ runner.temp }}/digests"
-          digest="${{ steps.build.outputs.digest }}"
-          touch "${{ runner.temp }}/digests/${digest#sha256:}"
-
-      - name: Upload digest
-        uses: actions/upload-artifact@v4
-        with:
-          name: digest-${{ matrix.arch }}
-          path: ${{ runner.temp }}/digests/*
-          if-no-files-found: error
-          retention-days: 1
-
-  publish:
-    name: Publish manifest
-    needs: build
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Download digests
-        uses: actions/download-artifact@v4
-        with:
-          path: ${{ runner.temp }}/digests
-          pattern: digest-*
-          merge-multiple: true
-
-      - name: Set up Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Log in to GHCR
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      # `latest` follows a release tag, and a manual run that names a version — the way to
-      # publish before the first release. A prerelease (v2026.2.1-beta.1) never takes it.
-      - name: Tags
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: ${{ env.IMAGE }}
-          flavor: latest=false
-          tags: |
-            type=semver,pattern={{version}}
-            type=raw,value=${{ inputs.version }},enable=${{ inputs.version != '' }}
-            type=raw,value=latest,enable=${{ inputs.version != '' || (github.event_name == 'push' && !contains(github.ref_name, '-')) }}
-            type=ref,event=branch
-            type=sha,format=short
-
-      - name: Create and push the manifest
-        working-directory: ${{ runner.temp }}/digests
-        run: |
-          docker buildx imagetools create \
-            $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
-            $(printf '${{ env.IMAGE }}@sha256:%s ' *)
-
-      - name: Inspect
-        run: docker buildx imagetools inspect ${{ env.IMAGE }}:${{ steps.meta.outputs.version }}
@@ -0,0 +1,3 @@
+**/bindings/**
+**/routeTree.gen.ts
+crates/yaak-templates/pkg/**
@@ -249,7 +249,7 @@ dependencies = [
 "enumflags2",
 "futures-channel",
 "futures-util",
- "rand 0.8.7",
+ "rand 0.8.5",
 "serde",
 "serde_repr",
 "url",
@@ -265,7 +265,7 @@ dependencies = [
 "enumflags2",
 "futures-channel",
 "futures-util",
- "rand 0.9.5",
+ "rand 0.9.1",
 "raw-window-handle",
 "serde",
 "serde_repr",
@@ -585,9 +585,9 @@ checksum = "ace50bade8e6234aa140d9a2f552bbee1db4d353f69b8217bc503490fc1a9f26"

 [[package]]
 name = "aws-lc-rs"
-version = "1.18.0"
+version = "1.16.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce2b2dcc879c3bae0d371e77c99f2238400ef24ec001394befa67b6e543add9e"
+checksum = "94bffc006df10ac2a68c83692d734a465f8ee6c5b384d8545a636f81d858f4bf"
 dependencies = [
 "aws-lc-sys",
 "zeroize",
@@ -595,15 +595,14 @@ dependencies = [

 [[package]]
 name = "aws-lc-sys"
-version = "0.44.0"
+version = "0.38.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f09fae7be8bb3174e05c6afdb34199e6dc0c7c04ba9fa237b1967adfbde27483"
+checksum = "4321e568ed89bb5a7d291a7f37997c2c0df89809d7b6d12062c81ddb54aa782e"
 dependencies = [
 "cc",
 "cmake",
 "dunce",
 "fs_extra",
- "pkg-config",
 ]

 [[package]]
@@ -619,8 +618,6 @@ dependencies = [
 "http",
 "http-body",
 "http-body-util",
- "hyper",
- "hyper-util",
 "itoa",
 "matchit",
 "memchr",
@@ -629,15 +626,10 @@ dependencies = [
 "pin-project-lite",
 "rustversion",
 "serde",
- "serde_json",
- "serde_path_to_error",
- "serde_urlencoded",
 "sync_wrapper",
- "tokio",
 "tower 0.5.2",
 "tower-layer",
 "tower-service",
- "tracing",
 ]

 [[package]]
@@ -658,7 +650,6 @@ dependencies = [
 "sync_wrapper",
 "tower-layer",
 "tower-service",
- "tracing",
 ]

 [[package]]
@@ -960,6 +951,15 @@ dependencies = [
 "serde",
 ]

+[[package]]
+name = "bzip2"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49ecfb22d906f800d4fe833b6282cf4dc1c298f5057ca0b5445e5c209735ca47"
+dependencies = [
+ "bzip2-sys",
+]
+
 [[package]]
 name = "bzip2"
 version = "0.6.1"
@@ -969,6 +969,16 @@ dependencies = [
 "libbz2-rs-sys",
 ]

+[[package]]
+name = "bzip2-sys"
+version = "0.1.13+1.0.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "225bff33b2141874fe80d71e07d6eec4f85c5c216453dd96388240f96e1acc14"
+dependencies = [
+ "cc",
+ "pkg-config",
+]
+
 [[package]]
 name = "cairo-rs"
 version = "0.18.5"
@@ -2095,7 +2105,7 @@ version = "2.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c169adf067a787e1f1c58ed62906a557de85388bee4b54fb878b722ff606b113"
 dependencies = [
- "bzip2",
+ "bzip2 0.6.1",
 "clap",
 "fs-err",
 "indicatif",
@@ -2895,9 +2905,11 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "26145e563e54f2cadc477553f1ec5ee650b00862f0a58bcd12cbdc5f0ea2d2f4"
 dependencies = [
 "cfg-if",
+ "js-sys",
 "libc",
 "r-efi",
 "wasi 0.14.2+wasi-0.2.4",
+ "wasm-bindgen",
 ]

 [[package]]
@@ -3263,12 +3275,6 @@ version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "21dec9db110f5f872ed9699c3ecf50cf16f423502706ba5c72462e28d3157573"

-[[package]]
-name = "http-range-header"
-version = "0.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9171a2ea8a68358193d15dd5d70c1c10a2afc3e7e4c5bc92bc9f025cebd7359c"
-
 [[package]]
 name = "httparse"
 version = "1.10.1"
@@ -4173,15 +4179,6 @@ dependencies = [
 "value-bag",
 ]

-[[package]]
-name = "lzma-rust2"
-version = "0.15.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e20f57f9918e5bd7bc58c22cdd70a6afc7375d4dd9683af5f2b34bd3d2bba619"
-dependencies = [
- "sha2",
-]
-
 [[package]]
 name = "mac"
 version = "0.1.1"
@@ -4466,7 +4463,7 @@ version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3ffa00dec017b5b1a8b7cf5e2c008bfda1aa7e0697ac1508b491fdf2622fb4d8"
 dependencies = [
- "rand 0.8.7",
+ "rand 0.8.5",
 ]

 [[package]]
@@ -5026,14 +5023,15 @@ dependencies = [

 [[package]]
 name = "openssl"
-version = "0.10.81"
+version = "0.10.73"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77823a27f0babb03091cb9ed9ef80af3b39dbc82f97e8fa530374b7dafd87a45"
+checksum = "8505734d46c8ab1e19a1dce3aef597ad87dcb4c37e7188231769bd6bd51cebf8"
 dependencies = [
 "bitflags 2.11.0",
 "cfg-if",
 "foreign-types 0.3.2",
 "libc",
+ "once_cell",
 "openssl-macros",
 "openssl-sys",
 ]
@@ -5057,18 +5055,18 @@ checksum = "d05e27ee213611ffe7d6348b942e8f942b37114c00cc03cec254295a4a17852e"

 [[package]]
 name = "openssl-src"
-version = "300.6.1+3.6.3"
+version = "300.5.0+3.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "46eb8fb9fb3b61ce1c0f8a026c4c1a0714d3a9e138e7fbde78753ce2babc3846"
+checksum = "e8ce546f549326b0e6052b649198487d91320875da901e7bd11a06d1ee3f9c2f"
 dependencies = [
 "cc",
 ]

 [[package]]
 name = "openssl-sys"
-version = "0.9.117"
+version = "0.9.109"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b47e7e6bb2c38cd930d25a23b40fa52e068c10e85f3e03a7f5ba5aaca5713695"
+checksum = "90096e2e47630d78b7d1c20952dc621f957103f8bc2c8359ec81290d75238571"
 dependencies = [
 "cc",
 "libc",
@@ -5882,7 +5880,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5d5285893bb5eb82e6aaf5d59ee909a06a16737a8970984dd7746ba9283498d6"
 dependencies = [
 "phf_shared 0.10.0",
- "rand 0.8.7",
+ "rand 0.8.5",
 ]

 [[package]]
@@ -5892,7 +5890,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3c80231409c20246a13fddb31776fb942c38553c51e871f8cbd687a4cfb5843d"
 dependencies = [
 "phf_shared 0.11.3",
- "rand 0.8.7",
+ "rand 0.8.5",
 ]

 [[package]]
@@ -6162,12 +6160,6 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"

-[[package]]
-name = "ppmd-rust"
-version = "1.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9e9219bcb9d7aca6b2f63c83cf100cf78bcd619ac46e6ecbd0dd90869a39345d"
-
 [[package]]
 name = "ppv-lite86"
 version = "0.2.21"
@@ -6463,9 +6455,9 @@ dependencies = [

 [[package]]
 name = "rand"
-version = "0.8.7"
+version = "0.8.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22f6172bdec972074665ed81ed53b71da00bfc44b65a753cfde883ec4c702a1a"
+checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
 dependencies = [
 "libc",
 "rand_chacha 0.3.1",
@@ -6474,9 +6466,9 @@ dependencies = [

 [[package]]
 name = "rand"
-version = "0.9.5"
+version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9ef1d0d795eb7d84685bca4f72f3649f064e6641543d3a8c415898726a57b41"
+checksum = "9fbfd9d094a40bf3ae768db9361049ace4c0e04a4fd6b359518bd7b73a73dd97"
 dependencies = [
 "rand_chacha 0.9.0",
 "rand_core 0.9.3",
@@ -7356,7 +7348,7 @@ dependencies = [
 "borsh",
 "bytes",
 "num-traits",
- "rand 0.8.7",
+ "rand 0.8.5",
 "rkyv",
 "serde",
 "serde_json",
@@ -8900,7 +8892,7 @@ dependencies = [
 "tokio",
 "url",
 "windows-sys 0.60.2",
- "zip 4.6.1",
+ "zip",
 ]

 [[package]]
@@ -9517,7 +9509,7 @@ dependencies = [
 "indexmap 1.9.3",
 "pin-project",
 "pin-project-lite",
- "rand 0.8.7",
+ "rand 0.8.5",
 "slab",
 "tokio",
 "tokio-util",
@@ -9539,7 +9531,6 @@ dependencies = [
 "tokio",
 "tower-layer",
 "tower-service",
- "tracing",
 ]

 [[package]]
@@ -9548,22 +9539,12 @@ version = "0.6.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "68d6fdd9f81c2819c9a8b0e0cd91660e7746a8e6ea2ba7c6b2b057985f6bcb51"
 dependencies = [
- "async-compression",
 "bitflags 2.11.0",
 "bytes",
- "futures-core",
 "futures-util",
 "http",
 "http-body",
- "http-body-util",
- "http-range-header",
- "httpdate",
- "mime",
- "mime_guess",
- "percent-encoding",
 "pin-project-lite",
- "tokio",
- "tokio-util",
 "tower 0.5.2",
 "tower-layer",
 "tower-service",
@@ -9588,7 +9569,6 @@ version = "0.1.41"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "784e0ac535deb450455cbfa28a6f0df145ea1bb7ae51b821cf5e7927fdcfbdd0"
 dependencies = [
- "log 0.4.29",
 "pin-project-lite",
 "tracing-attributes",
 "tracing-core",
@@ -9746,7 +9726,7 @@ dependencies = [
 "http",
 "httparse",
 "log 0.4.29",
- "rand 0.9.5",
+ "rand 0.9.1",
 "rustls",
 "rustls-pki-types",
 "sha1",
@@ -10016,7 +9996,7 @@ checksum = "3cf4199d1e5d15ddd86a694e4d0dffa9c323ce759fea589f00fef9d81cc1931d"
 dependencies = [
 "getrandom 0.3.3",
 "js-sys",
- "rand 0.9.5",
+ "rand 0.9.1",
 "serde",
 "wasm-bindgen",
 ]
@@ -11217,12 +11197,9 @@ version = "0.1.0"
 dependencies = [
 "async-trait",
 "base64 0.22.1",
- "chrono",
 "log 0.4.29",
 "md5 0.8.0",
- "rusqlite",
 "serde_json",
- "sha2",
 "tempfile",
 "thiserror 2.0.17",
 "tokio",
@@ -11264,7 +11241,7 @@ dependencies = [
 "pretty_graphql",
 "r2d2",
 "r2d2_sqlite",
- "rand 0.9.5",
+ "rand 0.9.1",
 "reqwest 0.12.20",
 "rlimit",
 "serde",
@@ -11300,7 +11277,6 @@ dependencies = [
 "yaak-grpc",
 "yaak-http",
 "yaak-license",
- "yaak-lifecycle",
 "yaak-mac-window",
 "yaak-models",
 "yaak-plugins",
@@ -11350,7 +11326,7 @@ dependencies = [
 "log 0.4.29",
 "oxc_resolver",
 "predicates",
- "rand 0.8.7",
+ "rand 0.8.5",
 "reqwest 0.12.20",
 "rolldown",
 "schemars 0.8.22",
@@ -11366,17 +11342,17 @@ dependencies = [
 "yaak-core",
 "yaak-crypto",
 "yaak-http",
- "yaak-lifecycle",
 "yaak-models",
 "yaak-plugins",
 "yaak-templates",
- "zip 7.0.0",
+ "zip",
 ]

 [[package]]
 name = "yaak-commands"
 version = "0.0.0"
 dependencies = [
+ "log 0.4.29",
 "serde_json",
 "tempfile",
 "thiserror 2.0.17",
@@ -11515,6 +11491,7 @@ dependencies = [
 "log 0.4.29",
 "mime_guess",
 "native-tls",
+ "regex 1.11.1",
 "reqwest 0.12.20",
 "serde",
 "serde_json",
@@ -11550,14 +11527,6 @@ dependencies = [
 "yaak-models",
 ]

-[[package]]
-name = "yaak-lifecycle"
-version = "0.0.0"
-dependencies = [
- "log 0.4.29",
- "yaak-models",
-]
-
 [[package]]
 name = "yaak-mac-window"
 version = "0.1.0"
@@ -11566,7 +11535,7 @@ dependencies = [
 "csscolorparser",
 "log 0.4.29",
 "objc",
- "rand 0.9.5",
+ "rand 0.9.1",
 "tauri",
 "tauri-plugin",
 ]
@@ -11591,10 +11560,8 @@ dependencies = [
 "sha2",
 "thiserror 2.0.17",
 "ts-rs",
- "urlencoding",
 "yaak-core",
 "yaak-database",
- "yaak-templates",
 ]

 [[package]]
@@ -11610,7 +11577,7 @@ dependencies = [
 "log 0.4.29",
 "md5 0.7.0",
 "path-slash",
- "rand 0.9.5",
+ "rand 0.9.1",
 "reqwest 0.12.20",
 "serde",
 "serde_json",
@@ -11720,10 +11687,7 @@ name = "yaak-system-appearance"
 version = "0.1.0"
 dependencies = [
 "dark-light",
- "dispatch2",
 "log 0.4.29",
- "objc2-app-kit",
- "objc2-foundation 0.3.1",
 "tauri",
 ]

@@ -11769,7 +11733,7 @@ dependencies = [
 ]

 [[package]]
-name = "yaak-wasm"
+name = "yaak-web"
 version = "0.1.0"
 dependencies = [
 "console_error_panic_hook",
@@ -11782,32 +11746,6 @@ dependencies = [
 "sqlite-wasm-vfs",
 "wasm-bindgen",
 "wasm-bindgen-futures",
- "web-sys",
- "yaak-lifecycle",
- "yaak-models",
- "yaak-templates",
-]
-
-[[package]]
-name = "yaak-web"
-version = "0.1.0"
-dependencies = [
- "async-trait",
- "axum",
- "base64 0.22.1",
- "bytes",
- "clap",
- "env_logger",
- "futures-util",
- "log 0.4.29",
- "serde",
- "serde_json",
- "tokio",
- "tower-http",
- "ts-rs",
- "url",
- "uuid",
- "yaak-http",
 "yaak-models",
 ]

@@ -11817,7 +11755,7 @@ version = "0.1.0"
 dependencies = [
 "log 0.4.29",
 "md5 0.8.0",
- "rand 0.9.5",
+ "rand 0.9.1",
 "serde",
 "serde_json",
 "tauri",
@@ -12040,13 +11978,13 @@ dependencies = [

 [[package]]
 name = "zip"
-version = "4.6.1"
+version = "4.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "caa8cd6af31c3b31c6631b8f483848b91589021b28fffe50adada48d4f4d2ed1"
+checksum = "153a6fff49d264c4babdcfa6b4d534747f520e56e8f0f384f3b808c4b64cc1fd"
 dependencies = [
 "aes",
 "arbitrary",
- "bzip2",
+ "bzip2 0.5.2",
 "constant_time_eq 0.3.1",
 "crc32fast",
 "deflate64",
@@ -12057,35 +11995,6 @@ dependencies = [
 "liblzma",
 "memchr",
 "pbkdf2",
- "ppmd-rust",
- "sha1",
- "time",
- "zeroize",
- "zopfli",
- "zstd",
-]
-
-[[package]]
-name = "zip"
-version = "7.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bdd8a47718a4ee5fe78e07667cd36f3de80e7c2bfe727c7074245ffc7303c037"
-dependencies = [
- "aes",
- "arbitrary",
- "bzip2",
- "constant_time_eq 0.3.1",
- "crc32fast",
- "deflate64",
- "flate2",
- "generic-array",
- "getrandom 0.3.3",
- "hmac",
- "indexmap 2.14.0",
- "lzma-rust2",
- "memchr",
- "pbkdf2",
- "ppmd-rust",
 "sha1",
 "time",
 "zeroize",
@@ -12101,7 +12010,7 @@ checksum = "aed5f10c571472911e37d8f7601a8dfba52b4f7f73a344015291b82ab292faf6"
 dependencies = [
 "log 0.4.29",
 "thiserror 2.0.17",
- "zip 4.6.1",
+ "zip",
 ]

 [[package]]
@@ -14,7 +14,6 @@ members = [
  "crates/yaak-git",
  "crates/yaak-grpc",
  "crates/yaak-http",
-  "crates/yaak-lifecycle",
  "crates/yaak-models",
  "crates/yaak-plugins",
  "crates/yaak-sse",
@@ -22,13 +21,11 @@ members = [
  "crates/yaak-templates",
  "crates/yaak-tls",
  "crates/yaak-ws",
-  "crates/yaak-wasm",
+  "crates/yaak-web",
  "crates/yaak-api",
  "crates/yaak-proxy",
  # Proxy-specific crates
  "crates-proxy/yaak-proxy-lib",
-  # Server crates (the browser tier's hosted send executor)
-  "crates-server/yaak-web",
  # CLI crates
  "crates-cli/yaak-cli",
  # Tauri-specific crates
@@ -80,7 +77,6 @@ yaak-crypto = { path = "crates/yaak-crypto" }
 yaak-git = { path = "crates/yaak-git" }
 yaak-grpc = { path = "crates/yaak-grpc" }
 yaak-http = { path = "crates/yaak-http" }
-yaak-lifecycle = { path = "crates/yaak-lifecycle" }
 yaak-models = { path = "crates/yaak-models" }
 yaak-plugins = { path = "crates/yaak-plugins" }
 yaak-sse = { path = "crates/yaak-sse" }
@@ -1,46 +0,0 @@
-# syntax=docker/dockerfile:1
-# Yaak in a browser, whole: the web client and the server that executes its sends, in one
-# image serving both from one origin.
-#
-#   docker run -p 8080:8080 ghcr.io/mountain-loop/yaak-web
-#
-# See crates-server/yaak-web/README.md for the knobs.
-
-FROM node:22-slim AS web
-WORKDIR /app
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    git python3 make g++ ca-certificates && rm -rf /var/lib/apt/lists/*
-COPY . .
-# `npm ci` runs a prepare hook (`vp config`) that shells out to git, and there is no .git in
-# the build context — it is ignored, and in a worktree it is a pointer file anyway.
-RUN git init -q && git add -A \
-    && git -c user.email=build@yaak.app -c user.name=build commit -qm build
-# Empty means the tab posts sends to its own origin, which is what this image serves. Set it
-# only to build a bundle for a deployment whose server lives somewhere else.
-ARG VITE_YAAK_WEB_URL=""
-ENV VITE_YAAK_WEB_URL=$VITE_YAAK_WEB_URL
-ENV YAAK_TARGET=web
-# crates/yaak-wasm's wasm package is committed; rebuilding it needs a clang with a WebAssembly
-# backend, which this image has no reason to carry.
-ENV SKIP_WASM_BUILD=1
-RUN npm ci
-RUN node_modules/.bin/vp -C apps/yaak-client build
-
-FROM rust:1-bookworm AS server
-WORKDIR /app
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    pkg-config libssl-dev protobuf-compiler && rm -rf /var/lib/apt/lists/*
-COPY . .
-RUN cargo build --release -p yaak-web
-
-FROM debian:bookworm-slim
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    ca-certificates libssl3 && rm -rf /var/lib/apt/lists/*
-COPY --from=server /app/target/release/yaak-web /usr/local/bin/yaak-web
-COPY --from=web /app/dist/apps/yaak-client /srv
-ENV YAAK_WEB_BIND=0.0.0.0:8080
-EXPOSE 8080
-USER nobody
-# Overriding the command (dropping --serve) leaves the stateless send executor:
-#   docker run ghcr.io/mountain-loop/yaak-web yaak-web
-CMD ["yaak-web", "--serve", "/srv"]
@@ -17,7 +17,7 @@
 <br>

 <p align="center">
-  <!-- sponsors-premium --><a href="https://github.com/MVST-Solutions"><img src="https:&#x2F;&#x2F;github.com&#x2F;MVST-Solutions.png" width="80px" alt="User avatar: MVST-Solutions" /></a>&nbsp;&nbsp;<a href="https://github.com/dharsanb"><img src="https:&#x2F;&#x2F;github.com&#x2F;dharsanb.png" width="80px" alt="User avatar: dharsanb" /></a>&nbsp;&nbsp;<a href="https://github.com/railwayapp"><img src="https:&#x2F;&#x2F;github.com&#x2F;railwayapp.png" width="80px" alt="User avatar: railwayapp" /></a>&nbsp;&nbsp;<a href="https://github.com/caseyamcl"><img src="https:&#x2F;&#x2F;github.com&#x2F;caseyamcl.png" width="80px" alt="User avatar: caseyamcl" /></a>&nbsp;&nbsp;<a href="https://github.com/bytebase"><img src="https:&#x2F;&#x2F;github.com&#x2F;bytebase.png" width="80px" alt="User avatar: bytebase" /></a>&nbsp;&nbsp;<a href="https://github.com/rauchg"><img src="https:&#x2F;&#x2F;github.com&#x2F;rauchg.png" width="80px" alt="User avatar: rauchg" /></a>&nbsp;&nbsp;<a href="https://github.com/"><img src="https:&#x2F;&#x2F;raw.githubusercontent.com&#x2F;JamesIves&#x2F;github-sponsors-readme-action&#x2F;dev&#x2F;.github&#x2F;assets&#x2F;placeholder.png" width="80px" alt="User avatar: " /></a>&nbsp;&nbsp;<!-- sponsors-premium -->
+  <!-- sponsors-premium --><a href="https://github.com/MVST-Solutions"><img src="https:&#x2F;&#x2F;github.com&#x2F;MVST-Solutions.png" width="80px" alt="User avatar: MVST-Solutions" /></a>&nbsp;&nbsp;<a href="https://github.com/dharsanb"><img src="https:&#x2F;&#x2F;github.com&#x2F;dharsanb.png" width="80px" alt="User avatar: dharsanb" /></a>&nbsp;&nbsp;<a href="https://github.com/railwayapp"><img src="https:&#x2F;&#x2F;github.com&#x2F;railwayapp.png" width="80px" alt="User avatar: railwayapp" /></a>&nbsp;&nbsp;<a href="https://github.com/caseyamcl"><img src="https:&#x2F;&#x2F;github.com&#x2F;caseyamcl.png" width="80px" alt="User avatar: caseyamcl" /></a>&nbsp;&nbsp;<a href="https://github.com/bytebase"><img src="https:&#x2F;&#x2F;github.com&#x2F;bytebase.png" width="80px" alt="User avatar: bytebase" /></a>&nbsp;&nbsp;<a href="https://github.com/"><img src="https:&#x2F;&#x2F;raw.githubusercontent.com&#x2F;JamesIves&#x2F;github-sponsors-readme-action&#x2F;dev&#x2F;.github&#x2F;assets&#x2F;placeholder.png" width="80px" alt="User avatar: " /></a>&nbsp;&nbsp;<!-- sponsors-premium -->
 </p>
 <p align="center">
  <!-- sponsors-base --><a href="https://github.com/seanwash"><img src="https:&#x2F;&#x2F;github.com&#x2F;seanwash.png" width="50px" alt="User avatar: seanwash" /></a>&nbsp;&nbsp;<a href="https://github.com/jerath"><img src="https:&#x2F;&#x2F;github.com&#x2F;jerath.png" width="50px" alt="User avatar: jerath" /></a>&nbsp;&nbsp;<a href="https://github.com/itsa-sh"><img src="https:&#x2F;&#x2F;github.com&#x2F;itsa-sh.png" width="50px" alt="User avatar: itsa-sh" /></a>&nbsp;&nbsp;<a href="https://github.com/dmmulroy"><img src="https:&#x2F;&#x2F;github.com&#x2F;dmmulroy.png" width="50px" alt="User avatar: dmmulroy" /></a>&nbsp;&nbsp;<a href="https://github.com/timcole"><img src="https:&#x2F;&#x2F;github.com&#x2F;timcole.png" width="50px" alt="User avatar: timcole" /></a>&nbsp;&nbsp;<a href="https://github.com/VLZH"><img src="https:&#x2F;&#x2F;github.com&#x2F;VLZH.png" width="50px" alt="User avatar: VLZH" /></a>&nbsp;&nbsp;<a href="https://github.com/terasaka2k"><img src="https:&#x2F;&#x2F;github.com&#x2F;terasaka2k.png" width="50px" alt="User avatar: terasaka2k" /></a>&nbsp;&nbsp;<a href="https://github.com/andriyor"><img src="https:&#x2F;&#x2F;github.com&#x2F;andriyor.png" width="50px" alt="User avatar: andriyor" /></a>&nbsp;&nbsp;<a href="https://github.com/majudhu"><img src="https:&#x2F;&#x2F;github.com&#x2F;majudhu.png" width="50px" alt="User avatar: majudhu" /></a>&nbsp;&nbsp;<a href="https://github.com/axelrindle"><img src="https:&#x2F;&#x2F;github.com&#x2F;axelrindle.png" width="50px" alt="User avatar: axelrindle" /></a>&nbsp;&nbsp;<a href="https://github.com/jirizverina"><img src="https:&#x2F;&#x2F;github.com&#x2F;jirizverina.png" width="50px" alt="User avatar: jirizverina" /></a>&nbsp;&nbsp;<a href="https://github.com/chip-well"><img src="https:&#x2F;&#x2F;github.com&#x2F;chip-well.png" width="50px" alt="User avatar: chip-well" /></a>&nbsp;&nbsp;<a href="https://github.com/GRAYAH"><img src="https:&#x2F;&#x2F;github.com&#x2F;GRAYAH.png" width="50px" alt="User avatar: GRAYAH" /></a>&nbsp;&nbsp;<a href="https://github.com/flashblaze"><img src="https:&#x2F;&#x2F;github.com&#x2F;flashblaze.png" width="50px" alt="User avatar: flashblaze" /></a>&nbsp;&nbsp;<a href="https://github.com/Frostist"><img src="https:&#x2F;&#x2F;github.com&#x2F;Frostist.png" width="50px" alt="User avatar: Frostist" /></a>&nbsp;&nbsp;<a href="https://github.com/PurplProto"><img src="https:&#x2F;&#x2F;github.com&#x2F;PurplProto.png" width="50px" alt="User avatar: PurplProto" /></a>&nbsp;&nbsp;<!-- sponsors-base -->
@@ -25,10 +25,6 @@

 ![Yaak API Client](https://yaak.app/static/screenshot.png)

-## Install
-
-Download Yaak for macOS, Windows, or Linux from [yaak.app/download](https://yaak.app/download). Package managers and other install methods are in the [installation docs](https://yaak.app/docs/getting-started/installation).
-
 ## Features

 Yaak is an offline-first API client designed to stay out of your way while giving you everything you need when you need it.
@@ -72,9 +68,3 @@ Built with [Tauri](https://tauri.app), Rust, and React, it’s fast, lightweight
 - [Yaak vs Postman](https://yaak.app/alternatives/postman)
 - [Yaak vs Bruno](https://yaak.app/alternatives/bruno)
 - [Yaak vs Insomnia](https://yaak.app/alternatives/insomnia)
-
-## License
-
-The source is [MIT licensed](LICENSE) and can be built and run for free, for both personal and commercial use.
-
-The prebuilt binaries follow Yaak's [pricing terms](https://yaak.app/pricing): free for personal use, license required for commercial use.
@@ -1,42 +1,33 @@
 import { platform } from "@yaakapp-internal/platform";
-import type { SettingsTab, SettingsTabWithSubtab } from "../components/Settings/Settings";
+import type { SettingsTab } from "../components/Settings/Settings";
 import { activeWorkspaceIdAtom } from "../hooks/useActiveWorkspace";
 import { createFastMutation } from "../hooks/useFastMutation";
-import { showDialog } from "../lib/dialog";
 import { jotaiStore } from "../lib/jotai";
 import { router } from "../lib/router";
 import { rpc } from "../lib/rpc";

-export const openSettings = createFastMutation<void, string, SettingsTabWithSubtab | null>({
+// Allow tab with optional subtab (e.g., "plugins:installed")
+type SettingsTabWithSubtab = SettingsTab | `${SettingsTab}:${string}` | null;
+
+export const openSettings = createFastMutation<void, string, SettingsTabWithSubtab>({
  mutationKey: ["open_settings"],
  mutationFn: async (tab) => {
    const workspaceId = jotaiStore.get(activeWorkspaceIdAtom);
    if (workspaceId == null) return;

+    const to = "/workspaces/$workspaceId/settings" as const;
+    const params = { workspaceId };
+    const search = { tab: (tab ?? undefined) as SettingsTab | undefined };
+
    // Settings is its own window where the host has windows to give. Where it
-    // doesn't — a browser tab — it's a dialog like any other, so opening it
-    // doesn't take you away from the request you were working on.
+    // doesn't — a browser tab — the same route opens in place, which is the
+    // whole difference: it is already a route, not a separate app.
    if (!platform.capabilities.multiWindow) {
-      // Imported here so Settings stays out of the startup bundle, the way the
-      // route that renders it on desktop already keeps it
-      const { default: Settings } = await import("../components/Settings/Settings");
-      showDialog({
-        id: "settings",
-        size: "md",
-        className: "h-[calc(100vh-5rem)] max-h-150! overflow-hidden",
-        noPadding: true,
-        noScroll: true,
-        // Keyed so opening a specific tab while the dialog is already up moves to it
-        render: ({ hide }) => <Settings key={tab ?? "general"} tab={tab} hide={hide} />,
-      });
+      await router.navigate({ to, params, search });
      return;
    }

-    const location = router.buildLocation({
-      to: "/workspaces/$workspaceId/settings",
-      params: { workspaceId },
-      search: { tab: (tab ?? undefined) as SettingsTab | undefined },
-    });
+    const location = router.buildLocation({ to, params, search });

    await rpc("cmd_new_child_window", {
      url: location.href,
@@ -1,16 +1,10 @@
-import type {
-  WorkspaceSettingsHighlight,
-  WorkspaceSettingsTab,
-} from "../components/WorkspaceSettingsDialog";
+import type { WorkspaceSettingsTab } from "../components/WorkspaceSettingsDialog";
 import { WorkspaceSettingsDialog } from "../components/WorkspaceSettingsDialog";
 import { activeWorkspaceIdAtom } from "../hooks/useActiveWorkspace";
 import { jotaiStore } from "../lib/jotai";

-export function openWorkspaceSettings(
-  tab?: WorkspaceSettingsTab,
-  highlight?: WorkspaceSettingsHighlight,
-) {
+export function openWorkspaceSettings(tab?: WorkspaceSettingsTab) {
  const workspaceId = jotaiStore.get(activeWorkspaceIdAtom);
  if (workspaceId == null) return;
-  WorkspaceSettingsDialog.show(workspaceId, tab, highlight);
+  WorkspaceSettingsDialog.show(workspaceId, tab);
 }
@@ -31,7 +31,6 @@ import type { Pair } from "./core/PairEditor";
 import { PairEditor } from "./core/PairEditor";
 import { PlainInput } from "./core/PlainInput";
 import { Select } from "./core/Select";
-import { SecretVariableHint } from "./hints/SecretVariableHint";
 import { Markdown } from "./Markdown";
 import { SelectFile } from "./SelectFile";

@@ -47,8 +46,6 @@ interface Props<T> {
  stateKey: string;
  className?: string;
  disabled?: boolean;
-  /** Offer to move literal secrets typed into password fields into a variable */
-  suggestVariables?: boolean;
 }

 export function DynamicForm<T extends Record<string, JsonPrimitive>>({
@@ -60,7 +57,6 @@ export function DynamicForm<T extends Record<string, JsonPrimitive>>({
  stateKey,
  className,
  disabled,
-  suggestVariables,
 }: Props<T>) {
  const setDataAttr = useCallback(
    (name: string, value: JsonPrimitive) => {
@@ -77,7 +73,6 @@ export function DynamicForm<T extends Record<string, JsonPrimitive>>({
      stateKey={stateKey}
      autocompleteFunctions={autocompleteFunctions}
      autocompleteVariables={autocompleteVariables}
-      suggestVariables={suggestVariables}
      data={data}
      className={classNames(className, "pb-4")} // Pad the bottom to look nice
    />
@@ -108,7 +103,6 @@ type FormInputsProps<T> = Pick<
 > & {
  setDataAttr: (name: string, value: JsonPrimitive) => void;
  disabled?: boolean;
-  suggestVariables?: boolean;
 };

 function FormInputs<T extends Record<string, JsonPrimitive>>({
@@ -119,7 +113,6 @@ function FormInputs<T extends Record<string, JsonPrimitive>>({
  setDataAttr,
  data,
  disabled,
-  suggestVariables,
 }: FormInputsProps<T>) {
  return (
    <>
@@ -154,7 +147,6 @@ function FormInputs<T extends Record<string, JsonPrimitive>>({
                arg={input}
                autocompleteFunctions={autocompleteFunctions || false}
                autocompleteVariables={autocompleteVariables || false}
-                suggestVariables={suggestVariables || false}
                onChange={(v) => setDataAttr(input.name, v)}
                value={
                  data[input.name] != null ? String(data[input.name]) : (input.defaultValue ?? "")
@@ -295,7 +287,6 @@ function TextArg({
  value,
  autocompleteFunctions,
  autocompleteVariables,
-  suggestVariables,
  stateKey,
 }: {
  arg: FormInputText;
@@ -303,7 +294,6 @@ function TextArg({
  onChange: (v: string) => void;
  autocompleteFunctions: boolean;
  autocompleteVariables: boolean;
-  suggestVariables: boolean;
  stateKey: string;
 }) {
  const props: InputProps = {
@@ -326,19 +316,10 @@ function TextArg({
    autocompleteFunctions,
    autocompleteVariables,
  };
-  const input =
-    autocompleteVariables || autocompleteFunctions || arg.completionOptions ? (
-      <Input {...props} />
-    ) : (
-      <PlainInput {...props} />
-    );
-  if (!suggestVariables || !arg.password) return input;
-  return (
-    <div className="flex flex-col gap-2">
-      {input}
-      <SecretVariableHint name={arg.name} value={value} onReplace={onChange} />
-    </div>
-  );
+  if (autocompleteVariables || autocompleteFunctions || arg.completionOptions) {
+    return <Input {...props} />;
+  }
+  return <PlainInput {...props} />;
 }

 function EditorArg({
@@ -67,14 +67,7 @@ export const EnvironmentActionsDropdown = memo(function EnvironmentActionsDropdo
        )}
        // If no environments, the button simply opens the dialog.
        // NOTE: We don't create a new button because we want to reuse the hotkey from the menu items
-        onClick={
-          subEnvironments.length === 0
-            ? (event) => {
-                event.preventDefault();
-                editEnvironment(null);
-              }
-            : undefined
-        }
+        onClick={subEnvironments.length === 0 ? () => editEnvironment(null) : undefined}
        {...buttonProps}
      >
        <EnvironmentColorIndicator environment={activeEnvironment ?? null} />
@@ -15,7 +15,6 @@ import {
  withEncryptionEnabled,
 } from "../lib/setupOrConfigureEncryption";
 import { DismissibleBanner } from "./core/DismissibleBanner";
-import { FeatureHint } from "./core/FeatureHint";
 import type { GenericCompletionConfig } from "./core/Editor/genericCompletion";
 import type { PairEditorHandle, PairWithId } from "./core/PairEditor";
 import { ensurePairId } from "./core/PairEditor.util";
@@ -153,17 +152,6 @@ export function EnvironmentEditor({ environment, hideName, className, setRef }:
            This sharable environment contains plain-text secrets
          </DismissibleBanner>
        )}
-        {!environment.public && !isEncryptionEnabled && hasSecretLookingVariable(environment) && (
-          <FeatureHint
-            id="encrypt-secrets"
-            className="mr-3"
-            docsUrl="https://yaak.app/docs/collaboration/secrets-encryption"
-            action={{ label: "Enable Encryption", onClick: setupOrConfigureEncryption }}
-          >
-            Some of these look like secrets. Encrypt them so the workspace is safe to sync to a
-            folder or share with a team.
-          </FeatureHint>
-        )}
      </div>
      <PairOrBulkEditor
        setRef={setRef}
@@ -185,9 +173,3 @@ export function EnvironmentEditor({ environment, hideName, className, setRef }:
    </div>
  );
 }
-
-const SECRET_NAME = /token|secret|password|passwd|api[_-]?key|private[_-]?key|credential/i;
-
-function hasSecretLookingVariable(environment: Environment) {
-  return environment.variables.some((v) => v.value.trim() !== "" && SECRET_NAME.test(v.name));
-}
@@ -1,8 +1,9 @@
 import { linter } from "@codemirror/lint";
 import type { EditorView } from "@codemirror/view";
 import { jsoncLanguage } from "@shopify/lang-jsonc";
-import { type GrpcRequest, patchModel } from "@yaakapp-internal/models";
-import { Banner, FormattedError, Icon, InlineCode, VStack } from "@yaakapp-internal/ui";
+import type { GrpcRequest } from "@yaakapp-internal/models";
+import { FormattedError, InlineCode, VStack } from "@yaakapp-internal/ui";
+import classNames from "classnames";
 import {
  handleRefresh,
  jsonCompletion,
@@ -10,20 +11,12 @@ import {
  stateExtensions,
  updateSchema,
 } from "codemirror-json-schema";
-import type { JSONSchema7 } from "json-schema";
-import type { ReactNode } from "react";
 import { useCallback, useEffect, useMemo, useState } from "react";
 import type { ReflectResponseService } from "../hooks/useGrpc";
-import { wasUpdatedExternally } from "../hooks/useRequestUpdateKey";
 import { showAlert } from "../lib/alert";
-import { showConfirm } from "../lib/confirm";
 import { showDialog } from "../lib/dialog";
-import type { JsonSchema } from "../lib/jsonSchemaExample";
-import { buildExampleFromSchema } from "../lib/jsonSchemaExample";
 import { pluralizeCount } from "../lib/pluralize";
-import { queryClient } from "../lib/queryClient";
 import { Button } from "./core/Button";
-import { Dropdown } from "./core/Dropdown";
 import type { EditorProps } from "./core/Editor/Editor";
 import { Editor } from "./core/Editor/LazyEditor";
 import { GrpcProtoSelectionDialog } from "./GrpcProtoSelectionDialog";
@@ -36,11 +29,6 @@ type Props = Pick<EditorProps, "heightMode" | "onChange" | "className" | "forceU
  protoFiles: string[];
 };

-type MethodSchema =
-  | { type: "none" }
-  | { type: "schema"; schema: JsonSchema }
-  | { type: "error"; id: string; title: string; body: ReactNode; log: unknown[] };
-
 export function GrpcEditor({
  services,
  reflectionError,
@@ -54,16 +42,21 @@ export function GrpcEditor({
    setEditorView(h);
  }, []);

-  // Find the schema for the selected service and method
-  const methodSchema = useMemo<MethodSchema>(() => {
-    if (services === null || request.service === null || request.method === null) {
-      return { type: "none" };
+  // Find the schema for the selected service and method and update the editor
+  useEffect(() => {
+    if (
+      editorView == null ||
+      services === null ||
+      request.service === null ||
+      request.method === null
+    ) {
+      return;
    }

    const s = services.find((s) => s.name === request.service);
    if (s == null) {
-      return {
-        type: "error",
+      console.log("Failed to find service", { service: request.service, services });
+      showAlert({
        id: "grpc-find-service-error",
        title: "Couldn't Find Service",
        body: (
@@ -71,14 +64,14 @@ export function GrpcEditor({
            Failed to find service <InlineCode>{request.service}</InlineCode> in schema
          </>
        ),
-        log: ["Failed to find service", { service: request.service, services }],
-      };
+      });
+      return;
    }

    const schema = s.methods.find((m) => m.name === request.method)?.schema;
-    if (schema == null) {
-      return {
-        type: "error",
+    if (request.method != null && schema == null) {
+      console.log("Failed to find method", { method: request.method, methods: s?.methods });
+      showAlert({
        id: "grpc-find-schema-error",
        title: "Couldn't Find Method",
        body: (
@@ -87,15 +80,18 @@ export function GrpcEditor({
            <InlineCode>{request.service}</InlineCode> in schema
          </>
        ),
-        log: ["Failed to find method", { method: request.method, methods: s.methods }],
-      };
+      });
+      return;
+    }
+
+    if (schema == null) {
+      return;
    }

    try {
-      return { type: "schema", schema: JSON.parse(schema) as JsonSchema };
+      updateSchema(editorView, JSON.parse(schema));
    } catch (err) {
-      return {
-        type: "error",
+      showAlert({
        id: "grpc-parse-schema-error",
        title: "Failed to Parse Schema",
        body: (
@@ -107,22 +103,9 @@ export function GrpcEditor({
            <FormattedError>{String(err)}</FormattedError>
          </VStack>
        ),
-        log: ["Failed to parse schema", err],
-      };
+      });
    }
-  }, [services, request.method, request.service]);
-
-  useEffect(() => {
-    if (methodSchema.type !== "error") return;
-    console.log(...methodSchema.log);
-    showAlert({ id: methodSchema.id, title: methodSchema.title, body: methodSchema.body });
-  }, [methodSchema]);
-
-  // Update the editor whenever the schema changes
-  useEffect(() => {
-    if (editorView == null || methodSchema.type !== "schema") return;
-    updateSchema(editorView, methodSchema.schema as JSONSchema7);
-  }, [editorView, methodSchema]);
+  }, [editorView, services, request.method, request.service]);

  const extraExtensions = useMemo(
    () => [
@@ -141,145 +124,45 @@ export function GrpcEditor({
  const reflectionUnavailable = reflectionError?.match(/unimplemented/i);
  reflectionError = reflectionUnavailable ? undefined : reflectionError;

-  const handleGenerateExample = useCallback(async () => {
-    if (methodSchema.type !== "schema") return;
-
-    if (request.message.trim() !== "") {
-      const confirmed = await showConfirm({
-        id: "grpc-generate-example",
-        title: "Generate Example",
-        description: "The current message will be replaced with an example.",
-        confirmText: "Generate",
-      });
-      if (!confirmed) return;
-    }
-
-    const message = JSON.stringify(buildExampleFromSchema(methodSchema.schema), null, 2);
-    await patchModel(request, { message });
-
-    // Force the editor to pick up the new message
-    wasUpdatedExternally(request.id);
-  }, [methodSchema, request]);
-
-  // The reflect query is keyed by request, url and proto files, so a prefix invalidate
-  // reaches it without threading a refetch down from the connection layout.
-  const handleReloadSchema = useCallback(
-    () => queryClient.invalidateQueries({ queryKey: ["grpc_reflect", request.id] }),
-    [request.id],
-  );
-
-  const handleShowReflectionError = useCallback(() => {
-    showDialog({
-      id: "grpc-reflection-error",
-      title: "Reflection Failed",
-      size: "sm",
-      render: ({ hide }) => (
-        <>
-          <FormattedError>{reflectionError ?? "unknown"}</FormattedError>
-          <div className="w-full my-4">
-            <Button
-              className="ml-auto"
-              color="primary"
-              size="sm"
-              onClick={async () => {
-                hide();
-                await handleReloadSchema();
-              }}
-            >
-              Retry
-            </Button>
-          </div>
-        </>
-      ),
-    });
-  }, [handleReloadSchema, reflectionError]);
-
  const actions = useMemo(
    () => [
-      // Matches the GraphQL editor: one always-visible control labelled by schema state,
-      // with everything schema-related behind it.
-      <div key="schema" className="opacity-100!">
-        <Dropdown
-          items={[
-            {
-              // Hidden for servers without reflection, which isn't an error
-              hidden: !reflectionError,
-              type: "content",
-              label: (
-                <Banner color="danger">
-                  <p className="mb-1">Reflection failed</p>
-                  <Button
-                    size="xs"
-                    color="danger"
-                    variant="border"
-                    onClick={handleShowReflectionError}
-                  >
-                    View Error
-                  </Button>
-                </Banner>
-              ),
-            },
-            {
-              label: "Generate Example Message",
-              leftSlot: <Icon icon="magic_wand" />,
-              disabled: methodSchema.type !== "schema",
-              onSelect: handleGenerateExample,
-            },
-            { type: "separator" },
-            {
-              label: "Reload Schema",
-              leftSlot: <Icon icon="refresh" spin={reflectionLoading} />,
-              keepOpenOnSelect: true,
-              onSelect: handleReloadSchema,
-            },
-            {
-              label: protoFiles.length > 0 ? "Select Proto Files\u2026" : "Configure Schema\u2026",
-              leftSlot: <Icon icon="settings" />,
-              onSelect: () => {
-                showDialog({
-                  title: "Configure Schema",
-                  size: "md",
-                  id: "grpc-configure-schema",
-                  render: ({ hide }) => <GrpcProtoSelectionDialog onDone={hide} />,
-                });
-              },
-            },
-          ]}
-        >
-          <Button
-            size="sm"
-            variant="border"
-            title="Schema"
-            forDropdown
-            isLoading={reflectionLoading}
-            color={reflectionUnavailable ? "info" : reflectionError ? "danger" : "default"}
-          >
-            {reflectionLoading
-              ? "Inspecting Schema"
+      <div key="reflection" className={classNames(services == null && "opacity-100!")}>
+        <Button
+          size="xs"
+          color={
+            reflectionLoading
+              ? "secondary"
              : reflectionUnavailable
-                ? "Select Proto Files"
+                ? "info"
                : reflectionError
-                  ? "Server Error"
-                  : protoFiles.length > 0
-                    ? pluralizeCount("File", protoFiles.length)
-                    : services != null
-                      ? "Schema Detected"
-                      : "Select Schema"}
-          </Button>
-        </Dropdown>
+                  ? "danger"
+                  : "secondary"
+          }
+          isLoading={reflectionLoading}
+          onClick={() => {
+            showDialog({
+              title: "Configure Schema",
+              size: "md",
+              id: "reflection-failed",
+              render: ({ hide }) => <GrpcProtoSelectionDialog onDone={hide} />,
+            });
+          }}
+        >
+          {reflectionLoading
+            ? "Inspecting Schema"
+            : reflectionUnavailable
+              ? "Select Proto Files"
+              : reflectionError
+                ? "Server Error"
+                : protoFiles.length > 0
+                  ? pluralizeCount("File", protoFiles.length)
+                  : services != null && protoFiles.length === 0
+                    ? "Schema Detected"
+                    : "Select Schema"}
+        </Button>
      </div>,
    ],
-    [
-      handleGenerateExample,
-      handleReloadSchema,
-      handleShowReflectionError,
-      methodSchema.type,
-      protoFiles.length,
-      reflectionError,
-      reflectionLoading,
-      reflectionUnavailable,
-      services,
-    ],
+    [protoFiles.length, reflectionError, reflectionLoading, reflectionUnavailable, services],
  );

  return (
@@ -133,8 +133,6 @@ export function GrpcRequestPane({
    onSend({ message: activeRequest.message });
  }, [activeRequest, onSend]);

-  const hasDescription = activeRequest.description.trim().length > 0;
-
  const tabs: TabItem[] = useMemo(
    () => [
      { value: TAB_MESSAGE, label: "Message" },
@@ -148,10 +146,10 @@ export function GrpcRequestPane({
      {
        value: TAB_DESCRIPTION,
        label: "Info",
-        rightSlot: hasDescription && <CountBadge count={true} />,
+        rightSlot: activeRequest.description && <CountBadge count={true} />,
      },
    ],
-    [authTab, hasDescription, metadataTab, numSettingsOverrides],
+    [activeRequest.description, authTab, metadataTab, numSettingsOverrides],
  );

  const handleMetadataChange = useCallback(
@@ -196,6 +194,13 @@ export function GrpcRequestPane({
              type: "default",
              shortLabel: o.label,
            }))}
+            itemsAfter={[
+              {
+                label: "Refresh",
+                type: "default",
+                leftSlot: <Icon size="sm" icon="refresh" />,
+              },
+            ]}
          >
            <Button
              size="sm"
@@ -178,7 +178,6 @@ export function HttpAuthenticationEditor({ model }: Props) {
        disabled={model.authentication.disabled === true}
        autocompleteVariables
        autocompleteFunctions
-        suggestVariables
        stateKey={`auth.${model.id}.${model.authenticationType}`}
        inputs={authConfig.data?.args ?? []}
        data={model.authentication}
@@ -52,7 +52,6 @@ import { JsonBodyEditor } from "./JsonBodyEditor";
 import { MarkdownEditor } from "./MarkdownEditor";
 import { RequestMethodDropdown } from "./RequestMethodDropdown";
 import { countOverriddenSettings, ModelSettingsEditor } from "./ModelSettingsEditor";
-import { SharedOriginHint } from "./hints/SharedOriginHint";
 import { UrlBar } from "./UrlBar";
 import { UrlParametersEditor } from "./UrlParameterEditor";

@@ -166,8 +165,6 @@ export function HttpRequestPane({ style, fullHeight, className, activeRequest }:
      : 0;
  }

-  const hasDescription = activeRequest.description.trim().length > 0;
-
  const tabs = useMemo<TabItem[]>(
    () => [
      {
@@ -263,7 +260,6 @@ export function HttpRequestPane({ style, fullHeight, className, activeRequest }:
      {
        value: TAB_DESCRIPTION,
        label: "Info",
-        rightSlot: hasDescription && <CountBadge count={true} />,
      },
    ],
    [
@@ -271,7 +267,6 @@ export function HttpRequestPane({ style, fullHeight, className, activeRequest }:
      authTab,
      contentType,
      handleContentTypeChange,
-      hasDescription,
      headersTab,
      numParams,
      numSettingsOverrides,
@@ -345,27 +340,24 @@ export function HttpRequestPane({ style, fullHeight, className, activeRequest }:
    >
      {activeRequest && (
        <>
-          <div>
-            <UrlBar
-              stateKey={`url.${activeRequest.id}`}
-              key={forceUpdateKey + urlKey}
-              url={activeRequest.url}
-              placeholder="https://example.com"
-              onPasteOverwrite={handlePaste}
-              autocomplete={autocomplete}
-              onSend={handleSend}
-              onCancel={cancelResponse}
-              onUrlChange={handleUrlChange}
-              leftSlot={
-                <div className="py-0.5">
-                  <RequestMethodDropdown request={activeRequest} className="ml-0.5 h-full!" />
-                </div>
-              }
-              forceUpdateKey={updateKey}
-              isLoading={activeResponse != null && activeResponse.state !== "closed"}
-            />
-            <SharedOriginHint />
-          </div>
+          <UrlBar
+            stateKey={`url.${activeRequest.id}`}
+            key={forceUpdateKey + urlKey}
+            url={activeRequest.url}
+            placeholder="https://example.com"
+            onPasteOverwrite={handlePaste}
+            autocomplete={autocomplete}
+            onSend={handleSend}
+            onCancel={cancelResponse}
+            onUrlChange={handleUrlChange}
+            leftSlot={
+              <div className="py-0.5">
+                <RequestMethodDropdown request={activeRequest} className="ml-0.5 h-full!" />
+              </div>
+            }
+            forceUpdateKey={updateKey}
+            isLoading={activeResponse != null && activeResponse.state !== "closed"}
+          />
          <Tabs
            ref={tabsRef}
            label="Request"
@@ -28,7 +28,6 @@ import { TabContent, Tabs } from "./core/Tabs/Tabs";
 import { Tooltip } from "./core/Tooltip";
 import { EmptyStateText } from "./EmptyStateText";
 import { ErrorBoundary } from "./ErrorBoundary";
-import { ChainingHint } from "./hints/ChainingHint";
 import { HttpResponseTimeline } from "./HttpResponseTimeline";
 import { RecentHttpResponsesDropdown } from "./RecentHttpResponsesDropdown";
 import { RequestBodyViewer } from "./RequestBodyViewer";
@@ -281,7 +280,6 @@ export function HttpResponsePane({ style, className, activeRequestId }: Props) {
                {activeResponse.error}
              </Banner>
            )}
-            {activeResponse && <ChainingHint response={activeResponse} mimeType={mimeType} />}
            {/* Show tabs if we have any data (headers, body, etc.) even if there's an error */}
            <Tabs
              tabs={tabs}
@@ -1,38 +1,15 @@
-import {
-  type Folder,
-  type ImportDestination,
-  type ImportPlan,
-  type ImportPlanItem,
-  type ImportSource,
-  type Workspace,
-} from "@yaakapp-internal/models";
-import { Banner, HStack, Icon, type IconProps, InlineCode, VStack } from "@yaakapp-internal/ui";
 import { platform } from "@yaakapp-internal/platform";
+import { Icon, VStack } from "@yaakapp-internal/ui";
 import classNames from "classnames";
-import { formatDistanceToNowStrict } from "date-fns";
-import { useEffect, useMemo, useRef, useState } from "react";
-import { pluralize } from "../lib/pluralize";
+import { useEffect, useRef, useState } from "react";
+import { useLocalStorage } from "react-use";
 import { CommercialUseBanner } from "./CommercialUseBanner";
 import { Button } from "./core/Button";
-import { Checkbox } from "./core/Checkbox";
-import type { CheckboxTreeNode } from "./core/CheckboxTree";
-import { CheckboxTree } from "./core/CheckboxTree";
-import { IconTooltip } from "./core/IconTooltip";
 import { PlainInput } from "./core/PlainInput";
-import { Select } from "./core/Select";
-import { SegmentedControl } from "./core/SegmentedControl";

 interface Props {
-  currentWorkspace: Workspace | null;
-  workspaces: Workspace[];
-  selectedFolder: Folder | null;
-  planFile: (filePath: string, destination: ImportDestination) => Promise<ImportPlan>;
-  planUrl: (url: string, destination: ImportDestination) => Promise<ImportPlan>;
-  listSources: (workspaceId: string) => Promise<ImportSource[]>;
-  findSourcesForOrigin: (args: { filePath?: string; url?: string }) => Promise<ImportSource[]>;
-  commit: (plan: ImportPlan) => Promise<void>;
-  cancel: () => void;
-  onError: (err: unknown) => void;
+  importFile: (filePath: string) => Promise<void>;
+  importUrl: (url: string) => Promise<void>;
 }

 /**
@@ -54,74 +31,10 @@ function fileName(path: string): string {
  return path.split(/[/\\]/).at(-1) || path;
 }

-/**
- * Loads the current workspace's linked sources before rendering the dialog, so the inner
- * component can construct its initial state (prefilled path, destination) in one pass instead of
- * patching it in with effects after the first paint.
- */
-export function ImportDataDialog(props: Props) {
-  const [initialSources, setInitialSources] = useState<ImportSource[] | null>(null);
-  const { currentWorkspace, listSources } = props;
-
-  useEffect(() => {
-    let cancelled = false;
-    const load = currentWorkspace == null ? Promise.resolve([]) : listSources(currentWorkspace.id);
-    load
-      .then((sources) => {
-        if (!cancelled) setInitialSources(sources);
-      })
-      .catch(() => {
-        if (!cancelled) setInitialSources([]);
-      });
-    return () => {
-      cancelled = true;
-    };
-  }, [currentWorkspace, listSources]);
-
-  if (initialSources == null) return null;
-  return <LoadedImportDataDialog {...props} initialSources={initialSources} />;
-}
-
-function latestSource(sources: ImportSource[]): ImportSource | null {
-  return sources.reduce<ImportSource | null>(
-    (latest, s) => (latest == null || s.lastImportedAt > latest.lastImportedAt ? s : latest),
-    null,
-  );
-}
-
-function LoadedImportDataDialog({
-  currentWorkspace,
-  workspaces,
-  selectedFolder,
-  planFile,
-  planUrl,
-  listSources,
-  findSourcesForOrigin,
-  commit,
-  cancel,
-  onError,
-  initialSources,
-}: Props & { initialSources: ImportSource[] }) {
-  // A workspace with a linked source is probably being re-imported, so start from that source
-  const prefill = latestSource(initialSources);
-
+export function ImportDataDialog({ importFile, importUrl }: Props) {
  const [isLoading, setIsLoading] = useState<boolean>(false);
-  const [plan, setPlan] = useState<ImportPlan | null>(null);
-  const [items, setItems] = useState<ImportPlanItem[]>([]);
-  // null means no explicit choice yet, so the default below applies
-  const [destinationChoice, setDestinationChoice] = useState<"new" | "current" | "other" | null>(
-    null,
-  );
-  const [otherWorkspaceId, setOtherWorkspaceId] = useState<string | null>(null);
-  const [targetSelectedFolder, setTargetSelectedFolder] = useState(selectedFolder != null);
-  const [linkedSources, setLinkedSources] = useState<ImportSource[]>(
-    prefill != null ? initialSources : [],
-  );
-  const [originSources, setOriginSources] = useState<ImportSource[]>(
-    prefill != null ? [prefill] : [],
-  );
  // A file path or a URL. Both inputs write here, so there is only ever one thing to import
-  const [source, setSource] = useState<string | null>(prefill?.origin ?? null);
+  const [source, setSource] = useLocalStorage<string | null>("importPathOrUrl", null);
  const [forceUpdateKey, setForceUpdateKey] = useState<number>(0);
  const [isHovering, setIsHovering] = useState<boolean>(false);
  const ref = useRef<HTMLDivElement>(null);
@@ -152,272 +65,25 @@ function LoadedImportDataDialog({
    });
  }, [isHovering, setSource]);

-  useEffect(() => {
-    if (trimmedSource === "") {
-      setOriginSources([]);
-      return;
-    }
-    let cancelled = false;
-    const timeout = setTimeout(() => {
-      findSourcesForOrigin(filePath != null ? { filePath } : { url: trimmedSource })
-        .then((sources) => {
-          if (!cancelled) setOriginSources(sources);
-        })
-        .catch(() => setOriginSources([]));
-    }, 300);
-    return () => {
-      cancelled = true;
-      clearTimeout(timeout);
-    };
-  }, [trimmedSource, filePath, findSourcesForOrigin]);
-
-  // The one workspace this file is linked to, if there is exactly one.
-  const linkedWorkspace = useMemo(() => {
-    const ids = [...new Set(originSources.map((s) => s.workspaceId))];
-    if (ids.length !== 1) return null;
-    return workspaces.find((w) => w.id === ids[0]) ?? null;
-  }, [originSources, workspaces]);
-
-  // A file linked to the current workspace defaults back into it, so re-importing doesn't
-  // accidentally create a duplicate workspace. A file linked elsewhere only gets a suggestion —
-  // silently targeting a workspace that is neither new nor current is too surprising. An
-  // explicit choice always wins.
-  const destinationKind =
-    destinationChoice ??
-    (linkedWorkspace != null && linkedWorkspace.id === currentWorkspace?.id ? "current" : "new");
-
-  const destinationWorkspaceId =
-    destinationKind === "current"
-      ? (currentWorkspace?.id ?? null)
-      : destinationKind === "other"
-        ? otherWorkspaceId
-        : null;
-
-  useEffect(() => {
-    if (destinationWorkspaceId == null) {
-      setLinkedSources([]);
-      return;
-    }
-    let cancelled = false;
-    listSources(destinationWorkspaceId)
-      .then((sources) => {
-        if (!cancelled) setLinkedSources(sources);
-      })
-      .catch(() => setLinkedSources([]));
-    return () => {
-      cancelled = true;
-    };
-  }, [destinationWorkspaceId, listSources]);
-
  const handleSelectFile = async () => {
    const selected = await platform.dialog.open({ title: "Select File", multiple: false });
    if (selected == null) return;
    selectSource(selected);
  };

-  // The selected folder belongs to the workspace being viewed, so it is only offerable when that
-  // is also the destination.
-  const canTargetSelectedFolder = selectedFolder != null && destinationKind === "current";
-
-  const destination = (): ImportDestination => {
-    if (destinationWorkspaceId == null) {
-      return { type: "new_workspace" };
-    }
-    return {
-      type: "existing_workspace",
-      workspaceId: destinationWorkspaceId,
-      folderId: canTargetSelectedFolder && targetSelectedFolder ? selectedFolder.id : undefined,
-    };
-  };
-
-  const handlePreview = async () => {
+  const handleImport = async () => {
    setIsLoading(true);
    try {
-      const nextPlan =
-        filePath != null
-          ? await planFile(filePath, destination())
-          : await planUrl(trimmedSource, destination());
-      setPlan(nextPlan);
-      setItems(nextPlan.items);
-    } catch (err) {
-      onError(err);
+      if (filePath != null) {
+        await importFile(filePath);
+      } else {
+        await importUrl(trimmedSource);
+      }
    } finally {
      setIsLoading(false);
    }
  };

-  const handleCommit = async () => {
-    if (plan == null) return;
-    setIsLoading(true);
-    try {
-      await commit({ ...plan, items });
-    } catch (err) {
-      onError(err);
-    } finally {
-      setIsLoading(false);
-    }
-  };
-
-  const itemTree = useMemo(() => buildItemTree(items), [items]);
-
-  // A folder row's checkbox carries everything beneath it, deletions included — the row labels
-  // say which of those are destructive. Checking anything also brings back the folders it needs
-  // to live in.
-  const toggleNode = (node: CheckboxTreeNode<TreeRow>, checked: boolean) => {
-    const targets = new Set(togglableItems(node).map((i) => i.modelId));
-    if (checked && node.data.kind === "item") {
-      const byId = new Map(items.map((i) => [i.modelId, i]));
-      for (const ancestor of ancestorsOf(node.data.item, byId)) {
-        if (isMissingFolder(ancestor)) targets.add(ancestor.modelId);
-      }
-    }
-    setItems((prev) => prev.map((i) => (targets.has(i.modelId) ? { ...i, selected: checked } : i)));
-  };
-
-  const resolveConflict = (modelId: string, resolution: "keep_mine" | "take_source") => {
-    setItems((prev) =>
-      prev.map((item) => (item.modelId === modelId ? { ...item, resolution } : item)),
-    );
-  };
-
-  // Deleting a folder takes its contents with it, so those rows have nothing left to decide.
-  const disabledIds = useMemo(() => {
-    const disabled = new Set<string>();
-    const byId = new Map(items.map((i) => [i.modelId, i]));
-    for (const item of items) {
-      if (item.action !== "delete") continue;
-      for (const parent of ancestorsOf(item, byId)) {
-        if (parent.action === "delete" && parent.selected) {
-          disabled.add(item.modelId);
-        }
-      }
-    }
-    return disabled;
-  }, [items]);
-
-  if (plan != null) {
-    const unchanged = items.filter((i) => i.action === "unchanged");
-    const footerNote =
-      unchanged.length > 0
-        ? `${unchanged.length} ${pluralize("resource", unchanged.length)} unchanged`
-        : "";
-    const changeCount = items.filter((item) => {
-      if (disabledIds.has(item.modelId)) return false;
-      if (item.action === "conflict") return item.resolution === "take_source";
-      if (item.action === "unchanged") return false;
-      return item.selected;
-    }).length;
-
-    // The row's label carries what kind of destination it is, so the value can just be its name
-    const [destinationLabel, destinationValue] = ((): [string, string] => {
-      if (plan.destination.type === "new_workspace") {
-        const names = plan.resources.workspaces.map((w) => w.name).filter((n) => n !== "");
-        if (names.length === 0) return ["New workspace", "Untitled"];
-        return [pluralize("New workspace", names.length), names.join(", ")];
-      }
-      const { workspaceId, folderId } = plan.destination;
-      const name = workspaces.find((w) => w.id === workspaceId)?.name ?? "Unknown workspace";
-      return [
-        "Destination",
-        folderId != null && folderId === selectedFolder?.id
-          ? `${name} / ${selectedFolder.name}`
-          : name,
-      ];
-    })();
-
-    // The destination workspace roots the tree. It is not a plan item — commit always applies
-    // it — so its checkbox only aggregates the subtree.
-    const workspaceRoot: CheckboxTreeNode<TreeRow> = (() => {
-      const planned = plan.resources.workspaces[0];
-      const planDestination = plan.destination;
-      const existing =
-        planDestination.type === "existing_workspace"
-          ? workspaces.find((w) => w.id === planDestination.workspaceId)
-          : null;
-      return {
-        key: existing?.id ?? planned?.id ?? "workspace",
-        data: {
-          kind: "destination",
-          label: existing?.name ?? planned?.name ?? "New workspace",
-          isNew: planDestination.type === "new_workspace",
-        },
-        children: itemTree,
-      };
-    })();
-
-    return (
-      <VStack space={4} className="pb-4">
-        <div className="rounded-lg border border-border-subtle divide-y divide-border-subtle">
-          <PreviewRow label="Detected format" value={plan.importer} />
-          <PreviewRow label={destinationLabel} value={destinationValue} />
-        </div>
-
-        {plan.warnings.map((warning) => (
-          <Banner
-            key={`${warning.title}:${warning.detail}`}
-            color={warning.level === "warning" ? "warning" : "info"}
-            className="flex items-start gap-2.5"
-          >
-            <Icon
-              icon={warning.level === "warning" ? "alert_triangle" : "info"}
-              size="sm"
-              className="mt-0.5"
-            />
-            <div className="min-w-0">
-              <div className="text-sm font-medium">{warning.title}</div>
-              <div className="text-xs text-text-subtle mt-0.5">{warning.detail}</div>
-            </div>
-          </Banner>
-        ))}
-
-        <div className="rounded-lg border border-border-subtle px-3 py-2 overflow-y-auto max-h-[40vh]">
-          <CheckboxTree
-            node={workspaceRoot}
-            checked={nodeCheckedStatus}
-            onCheck={toggleNode}
-            isCheckboxDisabled={(n) => disabledIds.has(n.key)}
-            isCollapsedByDefault={(n) => n.data.kind === "item" && n.data.item.action === "ignored"}
-            isRelevant={(n) =>
-              n.data.kind === "destination" ||
-              (n.data.kind === "item" && n.data.item.action !== "unchanged")
-            }
-            renderRow={(n) => <ImportTreeRow row={n.data} onResolveConflict={resolveConflict} />}
-          />
-        </div>
-
-        <HStack space={2} alignItems="center" className="mt-3">
-          {footerNote !== "" && <div className="text-xs text-text-subtle">{footerNote}</div>}
-          <Button
-            className="ml-auto"
-            color="secondary"
-            variant="border"
-            disabled={isLoading}
-            onClick={() => {
-              setPlan(null);
-              setItems([]);
-            }}
-          >
-            Back
-          </Button>
-          <Button color="primary" isLoading={isLoading} onClick={handleCommit}>
-            {isLoading
-              ? "Importing"
-              : changeCount > 0
-                ? `Apply ${changeCount} ${changeCount === 1 ? "Change" : "Changes"}`
-                : "Done"}
-          </Button>
-        </HStack>
-      </VStack>
-    );
-  }
-
-  const lastImported =
-    originSources.find((s) => s.workspaceId === destinationWorkspaceId) ??
-    linkedSources.reduce<ImportSource | null>(
-      (latest, s) => (latest == null || s.lastImportedAt > latest.lastImportedAt ? s : latest),
-      null,
-    );
-
  return (
    <VStack ref={ref} space={4} className="pb-4">
      <CommercialUseBanner source="data-import" title="Importing work data?" />
@@ -428,9 +94,7 @@ function LoadedImportDataDialog({
        className={classNames(
          "w-full rounded-lg border border-dashed px-4 py-6",
          "flex flex-col items-center gap-1 text-center",
-          isHovering
-            ? "border-notice bg-surface-highlight"
-            : "border-border hover:border-text-subtle",
+          isHovering ? "border-notice bg-surface-highlight" : "border-border hover:border-text",
        )}
      >
        <Icon icon="folder_input" className="text-text-subtlest w-8! h-8! mb-2" />
@@ -451,345 +115,25 @@ function LoadedImportDataDialog({
        </div>
      </button>

-      <PlainInput
-        label="Or enter a file path or URL"
-        size="sm"
-        placeholder="https://example.com/openapi.json"
-        defaultValue={source ?? ""}
-        forceUpdateKey={String(forceUpdateKey)}
-        onChange={setSource}
-      />
-
      <VStack space={2}>
-        <Select
-          name="import-destination-kind"
-          label="Import location"
+        <PlainInput
+          label="Or enter a file path or URL"
          size="sm"
-          value={destinationKind}
-          onChange={setDestinationChoice}
-          options={[
-            { value: "new", label: "New Workspace" },
-            ...(currentWorkspace != null
-              ? [{ value: "current" as const, label: "Current Workspace" }]
-              : []),
-            { value: "other", label: "Other Workspace" },
-          ]}
+          placeholder="https://example.com/openapi.json"
+          defaultValue={source ?? ""}
+          forceUpdateKey={String(forceUpdateKey)}
+          onChange={setSource}
        />
-        {destinationKind === "other" && (
-          <Select
-            name="import-destination-workspace"
-            label="Workspace"
-            hideLabel
-            size="sm"
-            value={otherWorkspaceId ?? ""}
-            onChange={(id) => setOtherWorkspaceId(id === "" ? null : id)}
-            filterable
-            options={[
-              { value: "", label: "Select a workspace" },
-              ...workspaces
-                .filter((w) => w.id !== currentWorkspace?.id)
-                .map((w) => ({ value: w.id, label: w.name })),
-            ]}
-          />
-        )}
-        {lastImported != null && destinationWorkspaceId != null ? (
-          <div className="text-xs text-text-subtle">
-            Last imported from {lastImported.originLabel} ·{" "}
-            {formatDistanceToNowStrict(`${lastImported.lastImportedAt}Z`, { addSuffix: true })}
-          </div>
-        ) : linkedWorkspace != null && linkedWorkspace.id !== destinationWorkspaceId ? (
-          <div className="text-xs text-text-subtle">
-            This file was last imported into{" "}
-            <button
-              type="button"
-              className="underline hocus:text-text"
-              onClick={() => {
-                if (linkedWorkspace.id === currentWorkspace?.id) {
-                  setDestinationChoice("current");
-                } else {
-                  setDestinationChoice("other");
-                  setOtherWorkspaceId(linkedWorkspace.id);
-                }
-              }}
-            >
-              {linkedWorkspace.name}
-            </button>
-          </div>
-        ) : null}
-        {canTargetSelectedFolder && (
-          <Checkbox
-            checked={targetSelectedFolder}
-            title={`Place root resources in selected folder “${selectedFolder.name}”`}
-            onChange={setTargetSelectedFolder}
-          />
-        )}
-      </VStack>
-
-      <HStack space={2} justifyContent="end">
-        <Button color="secondary" variant="border" disabled={isLoading} onClick={cancel}>
-          Cancel
-        </Button>
        <Button
          color="primary"
-          disabled={
-            trimmedSource === "" ||
-            isLoading ||
-            (destinationKind === "other" && otherWorkspaceId == null)
-          }
+          disabled={trimmedSource === "" || isLoading}
          isLoading={isLoading}
-          onClick={handlePreview}
+          size="sm"
+          onClick={handleImport}
        >
-          {isLoading ? "Analyzing" : "Preview Import"}
+          {isLoading ? "Importing" : "Import"}
        </Button>
-      </HStack>
+      </VStack>
    </VStack>
  );
 }
-
-function ImportTreeRow({
-  row,
-  onResolveConflict,
-}: {
-  row: TreeRow;
-  onResolveConflict: (modelId: string, resolution: "keep_mine" | "take_source") => void;
-}) {
-  if (row.kind !== "item") {
-    return (
-      <>
-        <Icon color="secondary" icon={row.kind === "destination" ? "house" : row.icon} />
-        <div className="truncate flex-1">{row.label}</div>
-        {row.kind === "destination" && row.isNew && (
-          <ActionChip label="new" help="Created by this import" className="text-success" />
-        )}
-      </>
-    );
-  }
-
-  const { item } = row;
-  const label = actionLabel(item);
-  return (
-    <>
-      {item.model === "folder" || item.model === "environment" ? (
-        <Icon color="secondary" icon={item.model === "folder" ? "folder" : "variable"} />
-      ) : (
-        <span aria-hidden className="w-4" />
-      )}
-      <div className="truncate flex-1">{item.name}</div>
-      {item.action === "conflict" ? (
-        <div className="shrink-0">
-          <SegmentedControl
-            name={`conflict-${item.modelId}`}
-            label={`Resolve conflict for ${item.name}`}
-            hideLabel
-            size="2xs"
-            help={actionHelp(item)}
-            value={item.resolution ?? "keep_mine"}
-            onChange={(v) => onResolveConflict(item.modelId, v)}
-            options={[
-              { value: "keep_mine", label: "Keep mine" },
-              { value: "take_source", label: "Take source" },
-            ]}
-          />
-        </div>
-      ) : (
-        label != null && (
-          <ActionChip
-            label={label}
-            help={actionHelp(item)}
-            className={classNames(
-              item.action === "create" && "text-success",
-              item.action === "update" && "text-info",
-              item.action === "delete" && "text-danger",
-              item.action === "keep_local" && item.selected && "text-warning",
-              item.action === "ignored" && "text-text-subtlest",
-            )}
-          />
-        )
-      )}
-    </>
-  );
-}
-
-function ActionChip({
-  label,
-  help,
-  className,
-}: {
-  label: string;
-  help: string | null;
-  className?: string;
-}) {
-  return (
-    <InlineCode
-      className={classNames(
-        "py-0 bg-transparent w-32 shrink-0 whitespace-nowrap text-xs",
-        "inline-flex items-center justify-center gap-1.5",
-        className,
-      )}
-    >
-      {label}
-      {help != null && <IconTooltip content={help} iconSize="xs" />}
-    </InlineCode>
-  );
-}
-
-function actionLabel(item: ImportPlanItem): string | null {
-  switch (item.action) {
-    case "create":
-      return "new";
-    case "update":
-      return "updated";
-    case "delete":
-      return "removed";
-    case "keep_local":
-      return "edited";
-    case "ignored":
-      return "ignored";
-    default:
-      return null;
-  }
-}
-
-function actionHelp(item: ImportPlanItem): string | null {
-  const help = (text: string) =>
-    item.changedFields.length > 0
-      ? `${text} · ${item.changedFields.map(fieldLabel).join(", ")}`
-      : text;
-  switch (item.action) {
-    case "create":
-      return "Not in this workspace yet";
-    case "update":
-      return item.reason === "moved_into_ignored_folder"
-        ? "Moved into a folder that isn't imported. Importing that folder brings it along"
-        : help("Changed in the source since the last import");
-    case "delete":
-      return "Gone from the source since the last import. Checking it deletes it here";
-    case "keep_local":
-      return help("Changed here since the last import. Checking it reverts to the source");
-    case "conflict":
-      return help("Changed here and in the source since the last import");
-    case "ignored":
-      return "Not in this workspace. Imports leave it alone until you check it";
-    default:
-      return null;
-  }
-}
-
-function fieldLabel(field: string): string {
-  return field.replace(/([A-Z])/g, " $1").toLowerCase();
-}
-
-/** Every plan item above `item`, nearest first. */
-function ancestorsOf(item: ImportPlanItem, byId: Map<string, ImportPlanItem>): ImportPlanItem[] {
-  const ancestors: ImportPlanItem[] = [];
-  const seen = new Set<string>();
-  let parentId = item.parentId;
-  while (parentId != null && !seen.has(parentId)) {
-    seen.add(parentId);
-    const parent = byId.get(parentId);
-    if (parent == null) break;
-    ancestors.push(parent);
-    parentId = parent.parentId;
-  }
-  return ancestors;
-}
-
-/**
- * A row of the preview tree. Most are plan items, but the destination workspace and the group the
- * workspace's environments sit in are headings: they aggregate their children and decide nothing
- * themselves.
- */
-type TreeRow =
-  | { kind: "destination"; label: string; isNew: boolean }
-  | { kind: "group"; label: string; icon: IconProps["icon"] }
-  | { kind: "item"; item: ImportPlanItem };
-
-function buildItemTree(items: ImportPlanItem[]): CheckboxTreeNode<TreeRow>[] {
-  const byId = new Map(items.map((i) => [i.modelId, i]));
-  const childrenOf = new Map<string, ImportPlanItem[]>();
-  const roots: ImportPlanItem[] = [];
-  for (const item of items) {
-    if (item.parentId != null && byId.has(item.parentId)) {
-      const siblings = childrenOf.get(item.parentId) ?? [];
-      siblings.push(item);
-      childrenOf.set(item.parentId, siblings);
-    } else {
-      roots.push(item);
-    }
-  }
-
-  const byKind = (list: ImportPlanItem[]) => [
-    ...list.filter((i) => i.model === "environment"),
-    ...list.filter((i) => i.model === "folder"),
-    ...list.filter((i) => i.model !== "environment" && i.model !== "folder"),
-  ];
-
-  const toNode = (item: ImportPlanItem, seen: Set<string>): CheckboxTreeNode<TreeRow> => ({
-    key: item.modelId,
-    data: { kind: "item", item },
-    children: seen.has(item.modelId)
-      ? []
-      : byKind(childrenOf.get(item.modelId) ?? []).map((c) =>
-          toNode(c, new Set([...seen, item.modelId])),
-        ),
-  });
-
-  // The workspace's environments have nothing to sit under — a sub-environment is a sibling of
-  // the base one, not its child — so a heading groups them into one thing to turn on and off.
-  const environments = roots.filter((i) => i.model === "environment");
-  const others = byKind(roots.filter((i) => i.model !== "environment"));
-  const nodes = others.map((r) => toNode(r, new Set()));
-  if (environments.length === 0) return nodes;
-  return [
-    {
-      key: "group:environments",
-      data: { kind: "group", label: "Variables", icon: "variable" },
-      children: environments.map((e) => toNode(e, new Set())),
-    },
-    ...nodes,
-  ];
-}
-
-function collectRows(node: CheckboxTreeNode<TreeRow>): TreeRow[] {
-  return [node.data, ...node.children.flatMap(collectRows)];
-}
-
-/** A folder that isn't there yet, so anything inside it needs it brought in first. */
-function isMissingFolder(item: ImportPlanItem): boolean {
-  return item.model === "folder" && (item.action === "create" || item.action === "ignored");
-}
-
-/**
- * The plan item a row's checkbox decides, if it decides one. An unchanged resource has nothing to
- * decide and a conflict is decided by its own control, so neither takes a checkbox — nor rides
- * along with a parent's.
- */
-function togglableItem(row: TreeRow): ImportPlanItem | null {
-  if (row.kind !== "item") return null;
-  const { item } = row;
-  return item.action === "unchanged" || item.action === "conflict" ? null : item;
-}
-
-function togglableItems(node: CheckboxTreeNode<TreeRow>): ImportPlanItem[] {
-  return collectRows(node)
-    .map(togglableItem)
-    .filter((i) => i != null);
-}
-
-function nodeCheckedStatus(node: CheckboxTreeNode<TreeRow>): boolean | "indeterminate" | "hidden" {
-  const covered = togglableItems(node);
-  if (covered.length === 0) return "hidden";
-  const selected = covered.filter((i) => i.selected).length;
-  if (selected === covered.length) return true;
-  if (selected === 0) return false;
-  return "indeterminate";
-}
-
-function PreviewRow({ label, value }: { label: string; value: string }) {
-  return (
-    <div className="flex items-start justify-between gap-4 px-3 py-2 text-sm">
-      <span className="text-text-subtle">{label}</span>
-      <span className="text-right font-medium">{value}</span>
-    </div>
-  );
-}
@@ -2,9 +2,7 @@ import type {
  Folder,
  GrpcRequest,
  HttpRequest,
-  HttpVersion,
  InheritedBoolSetting,
-  InheritedHttpVersionSetting,
  InheritedIntSetting,
  WebsocketRequest,
  Workspace,
@@ -15,7 +13,6 @@ import {
  modelSupportsSetting,
  type RequestSettingDefinition,
  SETTING_FOLLOW_REDIRECTS,
-  SETTING_HTTP_VERSION,
  SETTING_REQUEST_MESSAGE_SIZE,
  SETTING_REQUEST_TIMEOUT,
  SETTING_SEND_COOKIES,
@@ -24,7 +21,6 @@ import {
 } from "../lib/requestSettings";
 import { Checkbox } from "./core/Checkbox";
 import { PlainInput } from "./core/PlainInput";
-import { Select } from "./core/Select";
 import {
  SettingOverrideRow,
  SettingRow,
@@ -42,21 +38,37 @@ interface Props {
  model: ModelWithSettings;
 }

-type ModelWithSettings = Workspace | Folder | HttpRequest | WebsocketRequest | GrpcRequest;
+type ModelWithSettings =
+  | Workspace
+  | Folder
+  | HttpRequest
+  | WebsocketRequest
+  | GrpcRequest;
 type ModelWithHttpSettings = Workspace | Folder | HttpRequest;
-type ModelWithTlsSettings = Workspace | Folder | HttpRequest | WebsocketRequest | GrpcRequest;
-type ModelWithCookieSettings = Workspace | Folder | HttpRequest | WebsocketRequest;
-type ModelWithMessageSizeSettings = Workspace | Folder | WebsocketRequest | GrpcRequest;
+type ModelWithTlsSettings =
+  | Workspace
+  | Folder
+  | HttpRequest
+  | WebsocketRequest
+  | GrpcRequest;
+type ModelWithCookieSettings =
+  | Workspace
+  | Folder
+  | HttpRequest
+  | WebsocketRequest;
+type ModelWithMessageSizeSettings =
+  | Workspace
+  | Folder
+  | WebsocketRequest
+  | GrpcRequest;
 type BooleanSetting = boolean | InheritedBoolSetting;
 type IntegerSetting = number | InheritedIntSetting;
-type HttpVersionSetting = HttpVersion | InheritedHttpVersionSetting;
 type CookieSettingsPatch = {
  settingSendCookies?: ModelWithCookieSettings["settingSendCookies"];
  settingStoreCookies?: ModelWithCookieSettings["settingStoreCookies"];
 };
 type HttpSettingsPatch = {
  settingFollowRedirects?: ModelWithHttpSettings["settingFollowRedirects"];
-  settingHttpVersion?: ModelWithHttpSettings["settingHttpVersion"];
  settingRequestTimeout?: ModelWithHttpSettings["settingRequestTimeout"];
 };
 type TlsSettingsPatch = {
@@ -66,7 +78,10 @@ type MessageSizeSettingsPatch = {
  settingRequestMessageSize?: ModelWithMessageSizeSettings["settingRequestMessageSize"];
 };

-export function ModelSettingsEditor({ model, showSectionTitles = false }: Props) {
+export function ModelSettingsEditor({
+  model,
+  showSectionTitles = false,
+}: Props) {
  const ancestors = useModelAncestors(model);
  const supportsHttpSettings = modelSupportsHttpSettings(model);
  const supportsCookieSettings = modelSupportsCookieSettings(model);
@@ -139,26 +154,12 @@ export function ModelSettingsEditor({ model, showSectionTitles = false }: Props)
              }
            />
          )}
-          {supportsHttpSettings && (
-            <HttpVersionSettingRow
-              settingDefinition={SETTING_HTTP_VERSION}
-              setting={model.settingHttpVersion}
-              inheritedValue={resolveInheritedValue(
-                ancestors,
-                SETTING_HTTP_VERSION.modelKey,
-                model.settingHttpVersion,
-              )}
-              onChange={(settingHttpVersion) =>
-                patchHttpSettings(model, {
-                  settingHttpVersion,
-                })
-              }
-            />
-          )}
        </SettingsSection>
      )}
      {supportsCookieSettings && (
-        <SettingsSection title={supportsTlsSettings || showSectionTitles ? "Cookies" : null}>
+        <SettingsSection
+          title={supportsTlsSettings || showSectionTitles ? "Cookies" : null}
+        >
          <BooleanSettingRow
            settingDefinition={SETTING_SEND_COOKIES}
            setting={model.settingSendCookies}
@@ -194,7 +195,7 @@ export function ModelSettingsEditor({ model, showSectionTitles = false }: Props)
 }

 export function countOverriddenSettings(model: ModelWithSettings) {
-  const settings: (BooleanSetting | IntegerSetting | HttpVersionSetting)[] = [];
+  const settings: (BooleanSetting | IntegerSetting)[] = [];

  if (modelSupportsCookieSettings(model)) {
    settings.push(model.settingSendCookies, model.settingStoreCookies);
@@ -203,22 +204,22 @@ export function countOverriddenSettings(model: ModelWithSettings) {
  settings.push(model.settingValidateCertificates);

  if (modelSupportsHttpSettings(model)) {
-    settings.push(
-      model.settingFollowRedirects,
-      model.settingRequestTimeout,
-      model.settingHttpVersion,
-    );
+    settings.push(model.settingFollowRedirects, model.settingRequestTimeout);
  }

  if (modelSupportsMessageSizeSettings(model)) {
    settings.push(model.settingRequestMessageSize);
  }

-  return settings.filter((setting) => isInheritedSetting(setting) && setting.enabled === true)
-    .length;
+  return settings.filter(
+    (setting) => isInheritedSetting(setting) && setting.enabled === true,
+  ).length;
 }

-function patchCookieSettings(model: ModelWithCookieSettings, patch: Partial<CookieSettingsPatch>) {
+function patchCookieSettings(
+  model: ModelWithCookieSettings,
+  patch: Partial<CookieSettingsPatch>,
+) {
  switch (model.model) {
    case "workspace":
      return patchModel(model, patch as Partial<Workspace>);
@@ -231,7 +232,10 @@ function patchCookieSettings(model: ModelWithCookieSettings, patch: Partial<Cook
  }
 }

-function patchHttpSettings(model: ModelWithHttpSettings, patch: Partial<HttpSettingsPatch>) {
+function patchHttpSettings(
+  model: ModelWithHttpSettings,
+  patch: Partial<HttpSettingsPatch>,
+) {
  switch (model.model) {
    case "workspace":
      return patchModel(model, patch as Partial<Workspace>);
@@ -242,7 +246,10 @@ function patchHttpSettings(model: ModelWithHttpSettings, patch: Partial<HttpSett
  }
 }

-function patchTlsSettings(model: ModelWithTlsSettings, patch: Partial<TlsSettingsPatch>) {
+function patchTlsSettings(
+  model: ModelWithTlsSettings,
+  patch: Partial<TlsSettingsPatch>,
+) {
  switch (model.model) {
    case "workspace":
      return patchModel(model, patch as Partial<Workspace>);
@@ -273,15 +280,21 @@ function patchMessageSizeSettings(
  }
 }

-function modelSupportsHttpSettings(model: ModelWithSettings): model is ModelWithHttpSettings {
+function modelSupportsHttpSettings(
+  model: ModelWithSettings,
+): model is ModelWithHttpSettings {
  return modelSupportsSetting(model, SETTING_REQUEST_TIMEOUT);
 }

-function modelSupportsCookieSettings(model: ModelWithSettings): model is ModelWithCookieSettings {
+function modelSupportsCookieSettings(
+  model: ModelWithSettings,
+): model is ModelWithCookieSettings {
  return modelSupportsSetting(model, SETTING_SEND_COOKIES);
 }

-function modelSupportsTlsSettings(model: ModelWithSettings): model is ModelWithTlsSettings {
+function modelSupportsTlsSettings(
+  model: ModelWithSettings,
+): model is ModelWithTlsSettings {
  return modelSupportsSetting(model, SETTING_VALIDATE_CERTIFICATES);
 }

@@ -304,7 +317,11 @@ function BooleanSettingRow({
 }) {
  const inherited = isInheritedSetting(setting);
  const overridden = inherited ? setting.enabled === true : false;
-  const value = inherited ? (overridden ? setting.value : inheritedValue) : setting;
+  const value = inherited
+    ? overridden
+      ? setting.value
+      : inheritedValue
+    : setting;

  if (!inherited) {
    return (
@@ -335,63 +352,6 @@ function BooleanSettingRow({
  );
 }

-const HTTP_VERSION_OPTIONS: { label: string; value: HttpVersion }[] = [
-  { label: "Automatic", value: "auto" },
-  { label: "HTTP/1.1", value: "http1" },
-  { label: "HTTP/2", value: "http2" },
-];
-
-function HttpVersionSettingRow({
-  inheritedValue,
-  setting,
-  settingDefinition,
-  onChange,
-}: {
-  inheritedValue: HttpVersion;
-  setting: HttpVersionSetting;
-  settingDefinition: RequestSettingDefinition<"settingHttpVersion">;
-  onChange: (setting: HttpVersionSetting) => void;
-}) {
-  const inherited = isInheritedSetting(setting);
-  const overridden = inherited ? setting.enabled === true : false;
-  const value = inherited ? (overridden ? setting.value : inheritedValue) : setting;
-
-  if (!inherited) {
-    return (
-      <SettingRow title={settingDefinition.title} description={settingDefinition.description}>
-        <Select
-          hideLabel
-          name={settingDefinition.modelKey}
-          label={settingDefinition.title}
-          size="sm"
-          value={value}
-          options={HTTP_VERSION_OPTIONS}
-          onChange={(value) => onChange(value)}
-        />
-      </SettingRow>
-    );
-  }
-
-  return (
-    <SettingOverrideRow
-      title={settingDefinition.title}
-      description={settingDefinition.description}
-      overridden={overridden}
-      onResetOverride={() => onChange({ ...setting, enabled: false })}
-    >
-      <Select
-        hideLabel
-        name={settingDefinition.modelKey}
-        label={settingDefinition.title}
-        size="sm"
-        value={value}
-        options={HTTP_VERSION_OPTIONS}
-        onChange={(value) => onChange({ ...setting, enabled: true, value })}
-      />
-    </SettingOverrideRow>
-  );
-}
-
 function IntegerSettingRow({
  inheritedValue,
  setting,
@@ -405,11 +365,18 @@ function IntegerSettingRow({
 }) {
  const inherited = isInheritedSetting(setting);
  const overridden = inherited ? setting.enabled === true : false;
-  const value = inherited ? (overridden ? setting.value : inheritedValue) : setting;
+  const value = inherited
+    ? overridden
+      ? setting.value
+      : inheritedValue
+    : setting;

  if (!inherited) {
    return (
-      <SettingRow title={settingDefinition.title} description={settingDefinition.description}>
+      <SettingRow
+        title={settingDefinition.title}
+        description={settingDefinition.description}
+      >
        <NumberUnitInput
          name={settingDefinition.modelKey}
          label={settingDefinition.title}
@@ -462,13 +429,20 @@ function MessageSizeSettingRow({
 }) {
  const inherited = isInheritedSetting(setting);
  const overridden = inherited ? setting.enabled === true : false;
-  const value = inherited ? (overridden ? setting.value : inheritedValue) : setting;
+  const value = inherited
+    ? overridden
+      ? setting.value
+      : inheritedValue
+    : setting;
  const displayValue = formatMegabytes(value);
  const placeholder = "0";

  if (!inherited) {
    return (
-      <SettingRow title={settingDefinition.title} description={settingDefinition.description}>
+      <SettingRow
+        title={settingDefinition.title}
+        description={settingDefinition.description}
+      >
        <MessageSizeInput
          name={settingDefinition.modelKey}
          label={settingDefinition.title}
@@ -593,18 +567,13 @@ function resolveInheritedValue(
  key: BooleanWorkspaceSettingKey,
  fallback: BooleanSetting,
 ): boolean;
-function resolveInheritedValue(
-  ancestors: (Folder | Workspace)[],
-  key: "settingHttpVersion",
-  fallback: HttpVersionSetting,
-): HttpVersion;
 function resolveInheritedValue(
  ancestors: (Folder | Workspace)[],
  key: keyof WorkspaceSettings,
-  fallback: BooleanSetting | IntegerSetting | HttpVersionSetting,
+  fallback: BooleanSetting | IntegerSetting,
 ) {
  for (const ancestor of ancestors) {
-    const setting = ancestor[key] as BooleanSetting | IntegerSetting | HttpVersionSetting;
+    const setting = ancestor[key] as BooleanSetting | IntegerSetting;
    if (isInheritedSetting(setting)) {
      if (setting.enabled === true) {
        return setting.value;
@@ -620,7 +589,6 @@ function resolveInheritedValue(
 type WorkspaceSettings = Pick<
  Workspace,
  | "settingFollowRedirects"
-  | "settingHttpVersion"
  | "settingRequestMessageSize"
  | "settingRequestTimeout"
  | "settingSendCookies"
@@ -630,12 +598,14 @@ type WorkspaceSettings = Pick<

 type BooleanWorkspaceSettingKey = Exclude<
  keyof WorkspaceSettings,
-  "settingRequestTimeout" | "settingRequestMessageSize" | "settingHttpVersion"
+  "settingRequestTimeout" | "settingRequestMessageSize"
 >;

 function formatMegabytes(bytes: number) {
  const megabytes = bytes / BYTES_PER_MB;
-  return Number.isInteger(megabytes) ? `${megabytes}` : megabytes.toFixed(3).replace(/\.?0+$/, "");
+  return Number.isInteger(megabytes)
+    ? `${megabytes}`
+    : megabytes.toFixed(3).replace(/\.?0+$/, "");
 }

 function parseMegabytes(value: string) {
@@ -656,5 +626,9 @@ function isValidInteger(value: string) {
 function isValidMegabytes(value: string) {
  if (value === "") return true;
  const megabytes = Number(value);
-  return Number.isFinite(megabytes) && megabytes >= 0 && megabytes <= MAX_MESSAGE_SIZE_MB;
+  return (
+    Number.isFinite(megabytes) &&
+    megabytes >= 0 &&
+    megabytes <= MAX_MESSAGE_SIZE_MB
+  );
 }
@@ -1,3 +1,4 @@
+import { useSearch } from "@tanstack/react-router";
 import { platform } from "@yaakapp-internal/platform";
 import { useLicense } from "@yaakapp-internal/license";
 import { pluginsAtom, settingsAtom } from "@yaakapp-internal/models";
@@ -19,8 +20,6 @@ import { SettingsProxy } from "./SettingsProxy";
 import { SettingsTheme } from "./SettingsTheme";

 interface Props {
-  tab?: SettingsTabWithSubtab | null;
-  /** Set when Settings is in a dialog rather than owning a window. */
  hide?: () => void;
 }

@@ -43,19 +42,25 @@ const tabs = [
  TAB_LICENSE,
 ] as const;
 export type SettingsTab = (typeof tabs)[number];
-export type SettingsTabWithSubtab = SettingsTab | `${SettingsTab}:${string}`;

-export default function Settings({ tab, hide }: Props) {
+export default function Settings({ hide }: Props) {
+  const { tab: tabFromQuery } = useSearch({ from: "/workspaces/$workspaceId/settings" });
  // Parse tab and subtab (e.g., "plugins:installed")
-  const [mainTab, subtab] = tab?.split(":") ?? [];
+  const [mainTab, subtab] = tabFromQuery?.split(":") ?? [];
  const settings = useAtomValue(settingsAtom);
  const plugins = useAtomValue(pluginsAtom);
  const licenseCheck = useLicense();

-  // Close settings window on escape. In a dialog, the dialog handles Escape itself.
+  // Close settings window on escape
  // TODO: Could this be put in a better place? Eg. in Rust key listener when creating the window
  useKeyPressEvent("Escape", async () => {
-    if (hide == null) await platform.window.close();
+    if (hide != null) {
+      // It's being shown in a dialog, so close the dialog
+      hide();
+    } else {
+      // It's being shown in a window, so close the window
+      await platform.window.close();
+    }
  });

  return (
@@ -85,7 +90,7 @@ export default function Settings({ tab, hide }: Props) {
      )}
      <Tabs
        layout="horizontal"
-        defaultValue={mainTab}
+        defaultValue={mainTab || tabFromQuery}
        addBorders
        tabListClassName="min-w-40 bg-surface x-theme-sidebar border-r border-border pl-3"
        label="Settings"
@@ -124,7 +124,7 @@ export function SettingsHotkeys() {
            <HotkeyRow
              key={action}
              action={action}
-              currentKeys={hotkeys[action] ?? []}
+              currentKeys={hotkeys[action]}
              defaultKeys={defaultHotkeys[action]}
              onSave={async (keys) => {
                const newHotkeys = { ...settings.hotkeys };
@@ -59,7 +59,6 @@ export function SyncToFilesystemSetting({
        )}

        <SettingRowDirectory
-          highlightKey="sync_dir"
          title="Local directory sync"
          description="Sync data to a folder for backup and Git integration."
          filePath={value.filePath}
@@ -110,8 +110,6 @@ export function WebsocketRequestPane({ style, fullHeight, className, activeReque
    [activeRequest.url, activeRequest.urlParameters, handleRenamePathPlaceholder],
  );

-  const hasDescription = activeRequest.description.trim().length > 0;
-
  const tabs = useMemo<TabItem[]>(() => {
    return [
      {
@@ -133,10 +131,9 @@ export function WebsocketRequestPane({ style, fullHeight, className, activeReque
      {
        value: TAB_DESCRIPTION,
        label: "Info",
-        rightSlot: hasDescription && <CountBadge count={true} />,
      },
    ];
-  }, [authTab, hasDescription, headersTab, numSettingsOverrides, urlParameterPairs.length]);
+  }, [authTab, headersTab, numSettingsOverrides, urlParameterPairs.length]);

  const { activeResponse } = usePinnedHttpResponse(activeRequestId);
  const { mutate: cancelResponse } = useCancelHttpResponse(activeResponse?.id ?? null);
@@ -25,12 +25,8 @@ interface Props {
  workspaceId: string;
  hide: () => void;
  tab?: WorkspaceSettingsTab;
-  highlight?: WorkspaceSettingsHighlight;
 }

-/** Settings rows that can be pointed out when the dialog opens */
-export type WorkspaceSettingsHighlight = "sync_dir";
-
 const TAB_AUTH = "auth";
 const TAB_DNS = "dns";
 const TAB_HEADERS = "headers";
@@ -46,7 +42,7 @@ export type WorkspaceSettingsTab =

 const DEFAULT_TAB: WorkspaceSettingsTab = TAB_GENERAL;

-export function WorkspaceSettingsDialog({ workspaceId, hide, tab, highlight }: Props) {
+export function WorkspaceSettingsDialog({ workspaceId, hide, tab }: Props) {
  const workspace = useAtomValue(workspacesAtom).find((w) => w.id === workspaceId);
  const workspaceMeta = useAtomValue(workspaceMetasAtom).find((m) => m.workspaceId === workspaceId);
  const authTab = useAuthTab(TAB_AUTH, workspace ?? null);
@@ -108,7 +104,7 @@ export function WorkspaceSettingsDialog({ workspaceId, hide, tab, highlight }: P
        />
      </TabContent>
      <TabContent value={TAB_SETTINGS} className="overflow-y-auto h-full px-4">
-        <SettingsList className="space-y-8 pb-3" highlight={highlight}>
+        <SettingsList className="space-y-8 pb-3">
          <SettingsSection title={null}>
            <SyncToFilesystemSetting
              layout="settings"
@@ -182,23 +178,14 @@ export function WorkspaceSettingsDialog({ workspaceId, hide, tab, highlight }: P
  );
 }

-WorkspaceSettingsDialog.show = (
-  workspaceId: string,
-  tab?: WorkspaceSettingsTab,
-  highlight?: WorkspaceSettingsHighlight,
-) => {
+WorkspaceSettingsDialog.show = (workspaceId: string, tab?: WorkspaceSettingsTab) => {
  showDialog({
    id: "workspace-settings",
    size: "lg",
    className: "h-[calc(100vh-5rem)] max-h-200!",
    noPadding: true,
    render: ({ hide }) => (
-      <WorkspaceSettingsDialog
-        workspaceId={workspaceId}
-        hide={hide}
-        tab={tab}
-        highlight={highlight}
-      />
+      <WorkspaceSettingsDialog workspaceId={workspaceId} hide={hide} tab={tab} />
    ),
  });
 };
@@ -1,114 +0,0 @@
-import { Icon } from "@yaakapp-internal/ui";
-import classNames from "classnames";
-import type { ReactNode } from "react";
-import { useState } from "react";
-import type { CheckboxProps } from "./Checkbox";
-import { Checkbox } from "./Checkbox";
-
-export interface CheckboxTreeNode<T> {
-  key: string;
-  data: T;
-  children: CheckboxTreeNode<T>[];
-}
-
-interface Props<T> {
-  node: CheckboxTreeNode<T>;
-  depth?: number;
-  /** Return "hidden" to render row alignment space instead of a checkbox */
-  checked: (node: CheckboxTreeNode<T>) => CheckboxProps["checked"] | "hidden";
-  onCheck: (node: CheckboxTreeNode<T>, checked: boolean) => void;
-  checkboxTitle?: (node: CheckboxTreeNode<T>) => string;
-  isCheckboxDisabled?: (node: CheckboxTreeNode<T>) => boolean;
-  /** An irrelevant row is hidden unless one of its descendants is relevant */
-  isRelevant: (node: CheckboxTreeNode<T>) => boolean;
-  /** A node that starts collapsed, so a large subtree doesn't crowd out the rest */
-  isCollapsedByDefault?: (node: CheckboxTreeNode<T>) => boolean;
-  renderRow: (node: CheckboxTreeNode<T>) => ReactNode;
-  onSelectRow?: (node: CheckboxTreeNode<T>) => void;
-  canSelectRow?: (node: CheckboxTreeNode<T>) => boolean;
-  isRowSelected?: (node: CheckboxTreeNode<T>) => boolean;
-}
-
-export function CheckboxTree<T>(props: Props<T>) {
-  const { node, depth = 0 } = props;
-  const [collapsed, setCollapsed] = useState<boolean>(
-    () => props.isCollapsedByDefault?.(node) ?? false,
-  );
-  if (!hasRelevantNode(node, props.isRelevant)) return null;
-
-  const checked = props.checked(node);
-  const selected = props.isRowSelected?.(node) ?? false;
-  const selectable = props.onSelectRow != null && (props.canSelectRow?.(node) ?? true);
-  const hasVisibleChildren = node.children.some((c) => hasRelevantNode(c, props.isRelevant));
-  const rowContent = (
-    <div className="flex-1 min-w-0 flex items-center gap-1 px-1 py-0.5 text-left">
-      {props.renderRow(node)}
-    </div>
-  );
-
-  return (
-    <div
-      className={classNames(
-        depth > 0 && "pl-4 ml-2 border-l border-dashed border-border-subtle relative",
-      )}
-    >
-      <div
-        className={classNames(
-          "relative flex gap-1 w-full h-xs items-center",
-          selected ? "text-text" : "text-text-subtle",
-        )}
-      >
-        {selected && (
-          <div className="absolute left-[-100vw] right-0 top-0 bottom-0 bg-surface-active opacity-30 -z-10" />
-        )}
-        {hasVisibleChildren ? (
-          <button
-            type="button"
-            aria-label={collapsed ? "Expand" : "Collapse"}
-            aria-expanded={!collapsed}
-            className="shrink-0 text-text-subtlest hocus:text-text"
-            onClick={() => setCollapsed((v) => !v)}
-          >
-            <Icon size="sm" icon={collapsed ? "chevron_right" : "chevron_down"} />
-          </button>
-        ) : (
-          <span aria-hidden className="w-4 shrink-0" />
-        )}
-        {checked === "hidden" ? (
-          <span aria-hidden className="w-4 mr-0.5 shrink-0" />
-        ) : (
-          <Checkbox
-            checked={checked}
-            title={props.checkboxTitle?.(node) ?? "Toggle"}
-            hideLabel
-            disabled={props.isCheckboxDisabled?.(node)}
-            onChange={(checked) => props.onCheck(node, checked)}
-          />
-        )}
-        {selectable ? (
-          <button
-            type="button"
-            className="flex-1 min-w-0 flex text-left"
-            onClick={() => props.onSelectRow?.(node)}
-          >
-            {rowContent}
-          </button>
-        ) : (
-          rowContent
-        )}
-      </div>
-
-      {!collapsed &&
-        node.children.map((child) => (
-          <CheckboxTree key={child.key} {...props} node={child} depth={depth + 1} />
-        ))}
-    </div>
-  );
-}
-
-function hasRelevantNode<T>(
-  node: CheckboxTreeNode<T>,
-  isRelevant: (node: CheckboxTreeNode<T>) => boolean,
-): boolean {
-  return isRelevant(node) || node.children.some((c) => hasRelevantNode(c, isRelevant));
-}
@@ -10,13 +10,11 @@ export interface DialogProps {
  children: ReactNode;
  open: boolean;
  onClose?: () => void;
-  /** Block dismissal from the backdrop, Escape key, and built-in close button. */
-  disableClose?: boolean;
+  disableBackdropClose?: boolean;
  title?: ReactNode;
  description?: ReactNode;
  className?: string;
  size?: DialogSize;
-  /** Hide the built-in close button without changing backdrop or Escape behavior. */
  hideX?: boolean;
  noPadding?: boolean;
  noScroll?: boolean;
@@ -29,7 +27,7 @@ export function Dialog({
  size = "full",
  open,
  onClose,
-  disableClose,
+  disableBackdropClose,
  title,
  description,
  hideX,
@@ -44,7 +42,7 @@ export function Dialog({
  );

  return (
-    <Overlay open={open} onClose={disableClose ? undefined : onClose} portalName="dialog">
+    <Overlay open={open} onClose={disableBackdropClose ? undefined : onClose} portalName="dialog">
      <div
        role="dialog"
        className={classNames(
@@ -60,7 +58,7 @@ export function Dialog({
          // NOTE: We handle Escape on the element itself so that it doesn't close multiple
          //   dialogs and can be intercepted by children if needed.
          if (e.key === "Escape") {
-            if (!disableClose) onClose?.();
+            onClose?.();
            e.stopPropagation();
            e.preventDefault();
          }
@@ -112,7 +110,7 @@ export function Dialog({
          </div>

          {/*Put close at the end so that it's the last thing to be tabbed to*/}
-          {!disableClose && !hideX && (
+          {!hideX && (
            <div className="ml-auto absolute right-1 top-1">
              <IconButton
                className="opacity-70 hover:opacity-100"
@@ -2,12 +2,11 @@ import type { Color } from "@yaakapp-internal/plugins";
 import type { BannerProps } from "@yaakapp-internal/ui";
 import { Banner } from "@yaakapp-internal/ui";
 import classNames from "classnames";
-import type { MouseEvent, ReactNode } from "react";
+import type { MouseEvent } from "react";
 import { useEffect } from "react";
 import { useKeyValue } from "../../hooks/useKeyValue";
 import type { ButtonProps } from "./Button";
 import { Button } from "./Button";
-import { IconButton } from "./IconButton";

 type DismissibleBannerSize = "sm" | "xs";

@@ -19,21 +18,17 @@ export function DismissibleBanner({
  onDismiss,
  onShow,
  actions,
-  variant = "banner",
  ...props
 }: BannerProps & {
  id: string;
  size?: DismissibleBannerSize;
  onDismiss?: () => void | Promise<void>;
  onShow?: () => void | Promise<void>;
-  /** A tip dismisses with an X in the corner instead of a text button */
-  variant?: "banner" | "tip";
  actions?: {
    label: string;
    onClick: () => void;
    color?: Color;
    variant?: ButtonProps["variant"];
-    rightSlot?: ReactNode;
  }[];
 }) {
  const {
@@ -61,69 +56,54 @@ export function DismissibleBanner({
    event.preventDefault();
    event.stopPropagation();
  };
-  const dismiss = (event: MouseEvent) => {
-    stopParentClick(event);
-    setDismissed(true).catch(console.error);
-    Promise.resolve(onDismiss?.()).catch(console.error);
-  };
-  const isTip = variant === "tip";
-  const hasActionRow = !isTip || (actions?.length ?? 0) > 0;

  return (
    <Banner
-      className={classNames(className, "relative", size === "xs" && "!px-2 !py-2 text-xs")}
+      className={classNames(
+        className,
+        "relative",
+        size === "xs" && "!px-2 !py-2 text-xs",
+      )}
      {...props}
    >
-      <div className={classNames("@container", isTip && "relative")}>
-        {isTip && (
-          <IconButton
-            icon="x"
-            size="2xs"
-            iconSize="sm"
-            title="Dismiss message"
-            className="absolute! -top-0.5 -right-1 @[34rem]:top-1/2 @[34rem]:-translate-y-1/2 opacity-50 hover:opacity-100"
-            onClick={dismiss}
-          />
-        )}
+      <div className="@container">
        <div
          className={classNames(
            "grid @[34rem]:grid-cols-[minmax(0,1fr)_auto] @[34rem]:items-center",
-            isTip && "@[34rem]:pr-5",
            size === "xs" ? "gap-1.5 @[34rem]:gap-2" : "gap-2 @[34rem]:gap-3",
          )}
        >
-          {isTip ? <div className="pr-5 @[34rem]:pr-0">{children}</div> : children}
-          {hasActionRow && (
-            <div className="flex flex-col gap-1.5 @[16rem]:flex-row @[16rem]:flex-wrap @[16rem]:justify-end">
-              {!isTip && (
-                <Button
-                  variant="border"
-                  color={props.color}
-                  size={actionSize}
-                  onClick={dismiss}
-                  title="Dismiss message"
-                >
-                  Dismiss
-                </Button>
-              )}
-              {actions?.map((a) => (
-                <Button
-                  key={a.label}
-                  rightSlot={a.rightSlot}
-                  variant={a.variant ?? "border"}
-                  color={a.color ?? props.color}
-                  size={actionSize}
-                  onClick={(event) => {
-                    stopParentClick(event);
-                    a.onClick();
-                  }}
-                  title={a.label}
-                >
-                  {a.label}
-                </Button>
-              ))}
-            </div>
-          )}
+          {children}
+          <div className="flex flex-wrap gap-1.5 @[34rem]:justify-end">
+            <Button
+              variant="border"
+              color={props.color}
+              size={actionSize}
+              onClick={(event) => {
+                stopParentClick(event);
+                setDismissed(true).catch(console.error);
+                Promise.resolve(onDismiss?.()).catch(console.error);
+              }}
+              title="Dismiss message"
+            >
+              Dismiss
+            </Button>
+            {actions?.map((a) => (
+              <Button
+                key={a.label}
+                variant={a.variant ?? "border"}
+                color={a.color ?? props.color}
+                size={actionSize}
+                onClick={(event) => {
+                  stopParentClick(event);
+                  a.onClick();
+                }}
+                title={a.label}
+              >
+                {a.label}
+              </Button>
+            ))}
+          </div>
        </div>
      </div>
    </Banner>
@@ -601,8 +601,6 @@ function getExtensions({
    EditorView.contentAttributes.of({
      autocapitalize: "off",
      autocorrect: "off",
-      // Keeps macOS Writing Tools from offering to write code for us
-      writingsuggestions: "false",
    }),
    EditorView.domEventHandlers({
      focus: () => {
@@ -1,29 +1,9 @@
 import type { Diagnostic } from "@codemirror/lint";
 import type { EditorView } from "@codemirror/view";
-import { type ParseError, parse, printParseErrorCode } from "jsonc-parser";
+import { parse as jsonLintParse } from "@prantlf/jsonlint";

 const TEMPLATE_SYNTAX_REGEX = /\$\{\[[\s\S]*?]}/g;

-// jsonc-parser reports error codes, so these are the words the editor shows for them
-const MESSAGES: Record<string, string> = {
-  InvalidSymbol: "Invalid symbol",
-  InvalidNumberFormat: "Invalid number format",
-  PropertyNameExpected: "Property name expected",
-  ValueExpected: "Value expected",
-  ColonExpected: "Colon expected",
-  CommaExpected: "Comma expected",
-  CloseBraceExpected: "Closing brace expected",
-  CloseBracketExpected: "Closing bracket expected",
-  EndOfFileExpected: "End of file expected",
-  InvalidCommentToken: "Comments are not allowed",
-  UnexpectedEndOfComment: "Unexpected end of comment",
-  UnexpectedEndOfString: "Unexpected end of string",
-  UnexpectedEndOfNumber: "Unexpected end of number",
-  InvalidUnicode: "Invalid unicode sequence",
-  InvalidEscapeCharacter: "Invalid escape character",
-  InvalidCharacter: "Invalid character",
-};
-
 interface JsonLintOptions {
  allowComments?: boolean;
  allowTrailingCommas?: boolean;
@@ -31,28 +11,34 @@ interface JsonLintOptions {

 export function jsonParseLinter(options?: JsonLintOptions) {
  return (view: EditorView): Diagnostic[] => {
-    const doc = view.state.doc.toString();
-    // We need lint to not break on stuff like {"foo:" ${[ ... ]}} so we'll replace all template
-    // syntax with repeating `1` characters, so it's valid JSON and the position is still correct.
-    const escapedDoc = doc.replace(TEMPLATE_SYNTAX_REGEX, (m) => "1".repeat(m.length));
+    try {
+      const doc = view.state.doc.toString();
+      // We need lint to not break on stuff like {"foo:" ${[ ... ]}} so we'll replace all template
+      // syntax with repeating `1` characters, so it's valid JSON and the position is still correct.
+      const escapedDoc = doc.replace(TEMPLATE_SYNTAX_REGEX, (m) => "1".repeat(m.length));
+      jsonLintParse(escapedDoc, {
+        mode: (options?.allowComments ?? true) ? "cjson" : "json",
+        ignoreTrailingCommas: options?.allowTrailingCommas ?? false,
+      });
+      // oxlint-disable-next-line no-explicit-any
+    } catch (err: any) {
+      if (!("location" in err)) {
+        return [];
+      }

-    const errors: ParseError[] = [];
-    parse(escapedDoc, errors, {
-      allowTrailingComma: options?.allowTrailingCommas ?? false,
-      disallowComments: !(options?.allowComments ?? true),
-    });
-
-    // Later errors are mostly consequences of the first one, so only that one is shown
-    const error = errors[0];
-    if (error == null) return [];
-
-    return [
-      {
-        from: error.offset,
-        to: error.offset + error.length,
-        severity: "error",
-        message: MESSAGES[printParseErrorCode(error.error)] ?? "Invalid JSON",
-      },
-    ];
+      // const line = location?.start?.line;
+      // const column = location?.start?.column;
+      if (err.location.start.offset) {
+        return [
+          {
+            from: err.location.start.offset,
+            to: err.location.start.offset,
+            severity: "error",
+            message: err.message,
+          },
+        ];
+      }
+    }
+    return [];
  };
 }
@@ -1,202 +0,0 @@
-import { SearchQuery } from "@codemirror/search";
-import { EditorState } from "@codemirror/state";
-import { describe, expect, test } from "vite-plus/test";
-import {
-  currentMatch,
-  literalSearch,
-  MAX_COUNT,
-  MatchCounter,
-  normalizeDoc,
-  normalizeSearch,
-  scanNormalized,
-  scanQuery,
-} from "./searchMatchCount";
-
-type QueryConfig = ConstructorParameters<typeof SearchQuery>[0];
-
-const stateOf = (doc: string) => EditorState.create({ doc });
-
-/**
- * The matches the counter finds, having checked them against the search panel's own cursor.
- *
- * The cursor decides which ranges the editor highlights and which one `find next` lands on, so
- * a count that doesn't agree with it is a wrong count, however fast it was to produce.
- */
-function matchesOf(doc: string, config: QueryConfig) {
-  const state = stateOf(doc);
-  const query = new SearchQuery(config);
-  const matches = new MatchCounter().matches(state, query);
-  expect(matches).toEqual(scanQuery(state, query));
-  return matches;
-}
-
-const countOf = (doc: string, config: QueryConfig) => matchesOf(doc, config).length;
-
-describe("counting", () => {
-  test("counts every match, whatever the case", () => {
-    expect(countOf("one Two three two", { search: "two" })).toBe(2);
-    expect(countOf("one Two three two", { search: "two", caseSensitive: true })).toBe(1);
-  });
-
-  test("skips matches overlapping an earlier one", () => {
-    expect(countOf("aaaaa", { search: "aa" })).toBe(2);
-    expect(countOf("ababa", { search: "aba" })).toBe(1);
-  });
-
-  test("treats a query as text, not as a pattern", () => {
-    expect(countOf("a.b axb", { search: "a.b" })).toBe(1);
-  });
-
-  test("unquotes escapes unless the query is literal", () => {
-    expect(countOf("one\ntwo\nthree", { search: "\\n" })).toBe(2);
-    expect(countOf("one\\ntwo", { search: "\\n", literal: true })).toBe(1);
-  });
-
-  test("counts regexp and whole word queries through the cursor", () => {
-    expect(literalSearch(new SearchQuery({ search: "a", regexp: true }))).toBe(null);
-    expect(literalSearch(new SearchQuery({ search: "a", wholeWord: true }))).toBe(null);
-    expect(countOf("a1 b2 c3", { search: "[a-z]\\d", regexp: true })).toBe(3);
-    expect(countOf("cat cats cat", { search: "cat", wholeWord: true })).toBe(2);
-  });
-
-  test("stops counting at the cap", () => {
-    expect(countOf("x".repeat(MAX_COUNT + 100), { search: "x" })).toBe(MAX_COUNT + 1);
-  });
-
-  test("reports where the matches are", () => {
-    expect(matchesOf("ab..ab", { search: "ab" })).toEqual([
-      { from: 0, to: 2 },
-      { from: 4, to: 6 },
-    ]);
-  });
-
-  test("finds nothing to match with an empty needle", () => {
-    expect(scanNormalized(normalizeDoc("abc", false), "")).toEqual([]);
-  });
-});
-
-describe("normalization", () => {
-  test("finds what a character decomposes into", () => {
-    // The é is one character holding an `e`, and the match covers the whole of it
-    expect(matchesOf("café", { search: "e" })).toEqual([{ from: 3, to: 4 }]);
-    expect(matchesOf("ﬁle", { search: "fi" })).toEqual([{ from: 0, to: 1 }]);
-    expect(matchesOf("a…b", { search: "..." })).toEqual([{ from: 1, to: 2 }]);
-    expect(countOf("one two", { search: "one two" })).toBe(1);
-    expect(countOf("ｆｕｌｌ width", { search: "full" })).toBe(1);
-  });
-
-  test("matches a decomposed query against composed text, and the reverse", () => {
-    expect(countOf("café", { search: "café" })).toBe(1);
-    expect(countOf("café", { search: "café" })).toBe(1);
-    expect(countOf("café", { search: "café" })).toBe(1);
-  });
-
-  test("keeps offsets straight after an expansion", () => {
-    expect(matchesOf("é.é.end", { search: "end" })).toEqual([{ from: 4, to: 7 }]);
-    expect(matchesOf("ﬁﬁﬁ stop", { search: "stop" })).toEqual([{ from: 4, to: 8 }]);
-  });
-
-  test("normalizes the query whole, the document by character", () => {
-    expect(normalizeSearch("CAFÉ", false)).toBe("café");
-    expect(normalizeSearch("CAFÉ", true)).toBe("CAFÉ");
-    // Whole-string NFKD would fold this to a final sigma, which the cursor never does
-    expect(normalizeDoc("ΟΔΟΣ", false).text).toBe("οδοσ");
-  });
-
-  test("leaves a document that normalizes to itself untouched", () => {
-    const { text, expansions } = normalizeDoc("plain 日本 🎉 text", false);
-    expect(text).toBe("plain 日本 🎉 text");
-    expect(expansions).toEqual([]);
-  });
-});
-
-describe("current match", () => {
-  const matches = [
-    { from: 0, to: 2 },
-    { from: 4, to: 6 },
-    { from: 8, to: 10 },
-  ];
-
-  test("counts from one, and reports 0 off a match", () => {
-    expect(currentMatch(matches, { from: 4, to: 6 })).toBe(2);
-    expect(currentMatch(matches, { from: 8, to: 10 })).toBe(3);
-    expect(currentMatch(matches, { from: 5, to: 5 })).toBe(2);
-    expect(currentMatch(matches, { from: 2, to: 3 })).toBe(0);
-    expect(currentMatch(matches, { from: 4, to: 7 })).toBe(0);
-    expect(currentMatch([], { from: 0, to: 0 })).toBe(0);
-  });
-
-  test("moving the selection doesn't scan again", () => {
-    const state = stateOf("a1 b2 c3");
-    const query = new SearchQuery({ search: "\\d", regexp: true });
-    const counter = new MatchCounter();
-    const found = counter.matches(state, query);
-
-    // The document a selection-only transaction leaves behind is the one already scanned
-    const moved = state.update({ selection: { anchor: 4, head: 5 } }).state;
-    expect(counter.matches(moved, query)).toBe(found);
-    expect(currentMatch(found, moved.selection.main)).toBe(2);
-  });
-});
-
-/**
- * The mapping from normalized offsets back to document offsets is the part of this that can go
- * quietly wrong, and only on input nobody thinks to write a case for. So generate the input.
- */
-describe("against the cursor, on awkward text", () => {
-  const ALPHABET = [
-    ..."abcABC .\\\n".split(""),
-    "é",
-    "é",
-    "ﬁ",
-    "…",
-    " ",
-    "İ",
-    "Σ",
-    "ς",
-    "日",
-    "🎉",
-    "Ⅻ",
-    "ｆ",
-    "①",
-    "́",
-  ];
-
-  /** Seeded, so a failure is the same failure next run */
-  function random(seed: number) {
-    let state = seed;
-    return () => {
-      state = (state * 1664525 + 1013904223) >>> 0;
-      return state / 2 ** 32;
-    };
-  }
-
-  for (const caseSensitive of [false, true]) {
-    test(`agrees on every generated document (caseSensitive: ${caseSensitive})`, () => {
-      const next = random(caseSensitive ? 20260831 : 7);
-
-      for (let round = 0; round < 400; round++) {
-        const doc = Array.from(
-          { length: 2 + Math.floor(next() * 60) },
-          () => ALPHABET[Math.floor(next() * ALPHABET.length)]!,
-        ).join("");
-
-        // Half the queries are lifted out of the document, so matches are actually found
-        const start = Math.floor(next() * doc.length);
-        const search =
-          next() < 0.5
-            ? doc.slice(start, start + 1 + Math.floor(next() * 3))
-            : Array.from(
-                { length: 1 + Math.floor(next() * 2) },
-                () => ALPHABET[Math.floor(next() * ALPHABET.length)]!,
-              ).join("");
-        if (search === "") continue;
-
-        const state = stateOf(doc);
-        const query = new SearchQuery({ search, caseSensitive });
-        const where = `doc=${JSON.stringify(doc)} search=${JSON.stringify(search)}`;
-        expect(new MatchCounter().matches(state, query), where).toEqual(scanQuery(state, query));
-      }
-    });
-  }
-});
@@ -1,232 +1,7 @@
-import { getSearchQuery, type SearchQuery, searchPanelOpen } from "@codemirror/search";
-import type { EditorState, Extension, Text } from "@codemirror/state";
+import { getSearchQuery, searchPanelOpen } from "@codemirror/search";
+import type { Extension } from "@codemirror/state";
 import { type EditorView, ViewPlugin, type ViewUpdate } from "@codemirror/view";

-/** Matches are counted no further than this, since an exact total stops being useful long before */
-export const MAX_COUNT = 9999;
-
-/** What normalizing rewrites: anything outside ASCII, plus the case it folds */
-const REWRITTEN = /\P{ASCII}|[A-Z]+/gu;
-const REWRITTEN_CASE_SENSITIVE = /\P{ASCII}/gu;
-
-export interface Match {
-  from: number;
-  to: number;
-}
-
-/** A character whose normalized form is a different length, shifting every offset past it */
-interface Expansion {
-  normFrom: number;
-  normTo: number;
-  docFrom: number;
-  docTo: number;
-}
-
-/** A document as SearchCursor compares it, with what's needed to get back to real offsets */
-export interface NormalizedDoc {
-  text: string;
-  expansions: Expansion[];
-}
-
-/**
- * Rewrites a document the way SearchCursor does — NFKD, then a case fold unless the search is
- * case-sensitive — in a single pass rather than one call per code point.
- *
- * The cursor spends 90% of its time asking ICU about one character at a time, which is what
- * makes counting matches in a large response slow. Doing it a character at a time still matters
- * for the result, since it keeps NFKD from reordering marks across characters, so the
- * granularity stays and only the repeated work goes: each distinct character is normalized once
- * and the answer reused, and ASCII runs never reach ICU at all.
- */
-export function normalizeDoc(text: string, caseSensitive: boolean): NormalizedDoc {
-  const rewritten = new Map<string, string>();
-  const expansions: Expansion[] = [];
-  let shift = 0;
-
-  const normalized = text.replace(
-    caseSensitive ? REWRITTEN_CASE_SENSITIVE : REWRITTEN,
-    (chunk: string, at: number) => {
-      // An ASCII run only ever folds case, which can't change its length
-      if (chunk.charCodeAt(0) < 0x80) return chunk.toLowerCase();
-
-      let out = rewritten.get(chunk);
-      if (out === undefined) {
-        out = chunk.normalize("NFKD");
-        if (!caseSensitive) out = out.toLowerCase();
-        rewritten.set(chunk, out);
-      }
-
-      if (out.length !== chunk.length) {
-        expansions.push({
-          normFrom: at + shift,
-          normTo: at + shift + out.length,
-          docFrom: at,
-          docTo: at + chunk.length,
-        });
-        shift += out.length - chunk.length;
-      }
-
-      return out;
-    },
-  );
-
-  return { text: normalized, expansions };
-}
-
-/** The query as SearchCursor compares it, which it normalizes whole rather than by character */
-export function normalizeSearch(search: string, caseSensitive: boolean): string {
-  const normalized = search.normalize("NFKD");
-  return caseSensitive ? normalized : normalized.toLowerCase();
-}
-
-/** Every occurrence of `needle`, skipping matches that overlap an earlier one */
-export function scanNormalized(doc: NormalizedDoc, needle: string): Match[] {
-  const matches: Match[] = [];
-  if (needle === "") return matches;
-
-  const { text } = doc;
-  let pos = text.indexOf(needle);
-  while (pos >= 0) {
-    let end = pos + needle.length;
-    // However the query was cut, a match ends on a whole code point, as the cursor's do
-    if (isLowSurrogate(text.charCodeAt(end))) end++;
-
-    matches.push({ from: docStart(doc, pos), to: docEnd(doc, end) });
-    if (matches.length > MAX_COUNT) break;
-
-    pos = text.indexOf(needle, resumeAfter(doc, end));
-  }
-
-  return matches;
-}
-
-/** The same through the query's own cursor, which handles regexps and whole words */
-export function scanQuery(state: EditorState, query: SearchQuery): Match[] {
-  const matches: Match[] = [];
-  const cursor = query.getCursor(state);
-
-  for (let result = cursor.next(); !result.done; result = cursor.next()) {
-    matches.push({ from: result.value.from, to: result.value.to });
-    if (matches.length > MAX_COUNT) break;
-  }
-
-  return matches;
-}
-
-const isLowSurrogate = (code: number) => code >= 0xdc00 && code <= 0xdfff;
-
-/** The last character expansion beginning at or before `offset`, if there is one */
-function expansionAt({ expansions }: NormalizedDoc, offset: number): Expansion | null {
-  let low = 0;
-  let high = expansions.length - 1;
-  let found: Expansion | null = null;
-
-  while (low <= high) {
-    const mid = (low + high) >> 1;
-    if (expansions[mid]!.normFrom <= offset) {
-      found = expansions[mid]!;
-      low = mid + 1;
-    } else {
-      high = mid - 1;
-    }
-  }
-
-  return found;
-}
-
-function docStart(doc: NormalizedDoc, offset: number): number {
-  const expansion = expansionAt(doc, offset);
-  if (expansion == null) return offset;
-  // A match starting inside a character's expansion starts at the character
-  return offset < expansion.normTo
-    ? expansion.docFrom
-    : offset - (expansion.normTo - expansion.docTo);
-}
-
-/**
- * Where scanning picks up after a match ending at `offset`.
- *
- * The cursor moves through the document a character at a time, so once a match ends inside a
- * character's expansion the rest of that expansion is behind it — "…" holds three dots but only
- * ever counts as one match of ".".
- */
-function resumeAfter(doc: NormalizedDoc, offset: number): number {
-  const expansion = expansionAt(doc, offset);
-  return expansion != null && offset > expansion.normFrom && offset < expansion.normTo
-    ? expansion.normTo
-    : offset;
-}
-
-function docEnd(doc: NormalizedDoc, offset: number): number {
-  const expansion = expansionAt(doc, offset);
-  if (expansion == null) return offset;
-  if (offset <= expansion.normFrom) return expansion.docFrom;
-  // A match ending inside a character's expansion covers the whole character
-  return offset < expansion.normTo
-    ? expansion.docTo
-    : offset - (expansion.normTo - expansion.docTo);
-}
-
-/** Position of the match holding the selection, counting from one, or 0 when it isn't on one */
-export function currentMatch(matches: Match[], selection: { from: number; to: number }): number {
-  let index = 0;
-  for (const match of matches) {
-    index++;
-    if (match.from <= selection.from && match.to >= selection.to) return index;
-  }
-  return 0;
-}
-
-/** The text a plain query looks for, or null when only the cursor can answer it */
-export function literalSearch(query: SearchQuery): string | null {
-  if (query.regexp || query.wholeWord || query.test != null) return null;
-  // Mirrors SearchQuery's own unquoting, which the published type doesn't expose
-  return query.literal
-    ? query.search
-    : query.search.replace(/\\([nrt\\])/g, (_, ch) =>
-        ch === "n" ? "\n" : ch === "r" ? "\r" : ch === "t" ? "\t" : "\\",
-      );
-}
-
-/**
- * Finds the matches for the search panel, keeping the normalized document and the matches it
- * last found, so neither moving the selection nor typing another character starts over.
- */
-export class MatchCounter {
-  private doc: { doc: Text; caseSensitive: boolean; normalized: NormalizedDoc } | null = null;
-  private last: { doc: Text; query: SearchQuery; matches: Match[] } | null = null;
-
-  matches(state: EditorState, query: SearchQuery): Match[] {
-    const last = this.last;
-    if (last != null && last.doc === state.doc && last.query.eq(query)) {
-      return last.matches;
-    }
-
-    const matches = this.scan(state, query);
-    this.last = { doc: state.doc, query, matches };
-    return matches;
-  }
-
-  private scan(state: EditorState, query: SearchQuery): Match[] {
-    const search = literalSearch(query);
-    if (search == null) return scanQuery(state, query);
-
-    const doc = this.normalizedDoc(state.doc, query.caseSensitive);
-    return scanNormalized(doc, normalizeSearch(search, query.caseSensitive));
-  }
-
-  private normalizedDoc(doc: Text, caseSensitive: boolean): NormalizedDoc {
-    const cached = this.doc;
-    if (cached != null && cached.doc === doc && cached.caseSensitive === caseSensitive) {
-      return cached.normalized;
-    }
-
-    const normalized = normalizeDoc(doc.toString(), caseSensitive);
-    this.doc = { doc, caseSensitive, normalized };
-    return normalized;
-  }
-}
-
 /**
 * A CodeMirror extension that displays the total number of search matches
 * inside the built-in search panel.
@@ -235,7 +10,6 @@ export function searchMatchCount(): Extension {
  return ViewPlugin.fromClass(
    class {
      private countEl: HTMLElement | null = null;
-      private counter = new MatchCounter();

      constructor(private view: EditorView) {
        this.updateCount();
@@ -264,21 +38,38 @@ export function searchMatchCount(): Extension {
        }

        this.ensureCountEl();
-        if (this.countEl == null) return;

        if (!query.search) {
-          this.countEl.textContent = "0/0";
+          if (this.countEl) {
+            this.countEl.textContent = "0/0";
+          }
          return;
        }

-        const matches = this.counter.matches(state, query);
-        if (matches.length > MAX_COUNT) {
-          this.countEl.textContent = `${MAX_COUNT}+`;
-        } else if (matches.length === 0) {
-          this.countEl.textContent = "0/0";
-        } else {
-          const current = currentMatch(matches, state.selection.main);
-          this.countEl.textContent = `${current}/${matches.length}`;
+        const selection = state.selection.main;
+        let count = 0;
+        let currentIndex = 0;
+        const MAX_COUNT = 9999;
+        const cursor = query.getCursor(state);
+        for (let result = cursor.next(); !result.done; result = cursor.next()) {
+          count++;
+          const match = result.value;
+          if (match.from <= selection.from && match.to >= selection.to) {
+            currentIndex = count;
+          }
+          if (count > MAX_COUNT) break;
+        }
+
+        if (this.countEl) {
+          if (count > MAX_COUNT) {
+            this.countEl.textContent = `${MAX_COUNT}+`;
+          } else if (count === 0) {
+            this.countEl.textContent = "0/0";
+          } else if (currentIndex > 0) {
+            this.countEl.textContent = `${currentIndex}/${count}`;
+          } else {
+            this.countEl.textContent = `0/${count}`;
+          }
        }
      }

@@ -1,78 +0,0 @@
-import { platform } from "@yaakapp-internal/platform";
-import { Icon } from "@yaakapp-internal/ui";
-import type { ReactNode } from "react";
-import { setKeyValue } from "../../lib/keyValueStore";
-import { DismissibleBanner } from "./DismissibleBanner";
-
-interface Props {
-  /** Stable id; the dismissal is remembered under it. */
-  id: string;
-  children: ReactNode;
-  docsUrl?: string;
-  action?: { label: string; onClick: () => void | Promise<void> };
-  onDismiss?: () => void;
-  className?: string;
-}
-
-/**
- * A one-time nudge toward a feature the user hasn't found yet. Dismissed once, gone for good.
- */
-export function FeatureHint({ id, children, docsUrl, action, onDismiss, className }: Props) {
-  const actions = [
-    ...(action ? [{ ...action, variant: "solid" as const, color: "info" as const }] : []),
-    ...(action != null && docsUrl != null
-      ? [
-          {
-            label: "Docs",
-            rightSlot: <Icon icon="external_link" size="xs" className="opacity-60" />,
-            onClick: () => platform.openUrl(docsUrl).catch(console.error),
-          },
-        ]
-      : []),
-  ];
-  return (
-    <DismissibleBanner
-      id={`feature-hint:${id}`}
-      variant="tip"
-      color="info"
-      size="xs"
-      onDismiss={onDismiss}
-      className={className}
-      actions={actions}
-    >
-      <div className="flex items-start gap-2 text-xs">
-        <Icon icon="sparkles" size="xs" className="hidden @[16rem]:block mt-0.5 shrink-0" />
-        <div className="min-w-0">
-          {children}
-          {action == null && docsUrl != null && (
-            <>
-              {" "}
-              (
-              <button
-                type="button"
-                className="group inline-flex items-center gap-0.5 underline hover:text-info cursor-pointer! [&_*]:cursor-pointer!"
-                onClick={() => platform.openUrl(docsUrl).catch(console.error)}
-              >
-                docs
-                <Icon
-                  icon="external_link"
-                  size="xs"
-                  className="opacity-80 group-hover:opacity-100"
-                />
-              </button>
-              )
-            </>
-          )}
-        </div>
-      </div>
-    </DismissibleBanner>
-  );
-}
-
-export function dismissFeatureHint(id: string) {
-  return setKeyValue({
-    namespace: "global",
-    key: ["dismiss-banner", `feature-hint:${id}`],
-    value: true,
-  });
-}
@@ -113,15 +113,7 @@ function toPairData({ commitName: _commitName, ...pair }: EditablePairWithId): P
 /** Max number of pairs to show before prompting the user to reveal the rest */
 const MAX_INITIAL_PAIRS = 30;

-// Keyed on `stateKey` so no state survives a change of owner. Row ids alone can't tell owners
-// apart — two pair sets can share ids (eg. one duplicated from the other), and the same-rows
-// fast path below would swap in the new data without rebuilding the row editors, leaving any
-// still-focused input showing the old owner's text.
-export function PairEditor(props: PairEditorProps) {
-  return <PairEditorInner key={props.stateKey} {...props} />;
-}
-
-function PairEditorInner({
+export function PairEditor({
  allowFileValues,
  allowMultilineValues,
  className,
@@ -205,7 +205,6 @@ export const PlainInput = forwardRef<{ focus: () => void }, PlainInputProps>(fun
            autoComplete="off"
            autoCapitalize="off"
            autoCorrect="off"
-            writingsuggestions="false"
            inputMode={inputMode}
            onChange={(e) => handleChange(e.target.value)}
            onPaste={(e) => onPaste?.(e.clipboardData.getData("Text"))}
@@ -6,7 +6,6 @@ import { useStateWithDeps } from "../../hooks/useStateWithDeps";
 import { generateId } from "../../lib/generateId";
 import { Button } from "./Button";
 import { IconButton, type IconButtonProps } from "./IconButton";
-import { IconTooltip } from "./IconTooltip";
 import { Label } from "./Label";

 interface Props<T extends string> {
@@ -37,15 +36,11 @@ export function SegmentedControl<T extends string>({
  const containerRef = useRef<HTMLDivElement>(null);
  const id = useRef(`input-${generateId()}`);

-  // A visually hidden label has nowhere to show the help, so the last option carries it
-  const inlineHelp =
-    hideLabel && help ? <IconTooltip tabIndex={-1} content={help} iconSize="xs" /> : null;
-
  return (
    <div className="w-full grid">
      <Label
        htmlFor={id.current}
-        help={hideLabel ? undefined : help}
+        help={help}
        visuallyHidden={hideLabel}
        className={classNames(labelClassName)}
      >
@@ -83,10 +78,9 @@ export function SegmentedControl<T extends string>({
          }
        }}
      >
-        {options.map((o, i) => {
+        {options.map((o) => {
          const isSelected = selectedValue === o.value;
          const isActive = value === o.value;
-          const rightSlot = i === options.length - 1 ? inlineHelp : null;
          if (o.icon == null) {
            return (
              <Button
@@ -101,7 +95,6 @@ export function SegmentedControl<T extends string>({
                  isActive && "text-text!",
                  "focus:ring-1 focus:ring-border-focus",
                )}
-                rightSlot={rightSlot}
                onClick={() => onChange(o.value)}
              >
                {o.label}
@@ -124,7 +117,6 @@ export function SegmentedControl<T extends string>({
                )}
                title={o.label}
                icon={o.icon}
-                rightSlot={rightSlot}
                onClick={() => onChange(o.value)}
              />
            );
@@ -119,13 +119,9 @@ export function Select<T extends string>({
          )}
        >
          <Button
-            className={classNames(
-              "w-full text-sm font-mono",
-              disabled && "border-dotted",
-              isInvalidSelection && "border-danger",
-            )}
+            className="w-full text-sm font-mono"
            justify="start"
-            variant="input"
+            variant="border"
            size={size}
            leftSlot={leftSlot}
            disabled={disabled}
@@ -2,7 +2,6 @@ import type { AnyModel } from "@yaakapp-internal/models";
 import { patchModel } from "@yaakapp-internal/models";
 import classNames from "classnames";
 import type { ReactNode } from "react";
-import { createContext, useContext, useEffect, useRef, useState } from "react";
 import { CopyIconButton } from "../CopyIconButton";
 import { Checkbox } from "./Checkbox";
 import { IconButton, type IconButtonProps } from "./IconButton";
@@ -20,31 +19,11 @@ type SettingRowBaseProps = {
  controlClassName?: string;
  description?: ReactNode;
  disabled?: boolean;
-  /** Matched against the surrounding `SettingsList` highlight to point this row out when it opens */
-  highlightKey?: string;
  title: ReactNode;
 };

-const SettingsHighlightContext = createContext<string | null>(null);
-
-const FOCUSABLE =
-  "button:not([disabled]), input:not([disabled]), select:not([disabled]), textarea:not([disabled]), [tabindex]:not([tabindex='-1'])";
-
-export function SettingsList({
-  children,
-  className,
-  highlight = null,
-}: {
-  children: ReactNode;
-  className?: string;
-  /** The `highlightKey` of a row to scroll to, focus, and briefly highlight */
-  highlight?: string | null;
-}) {
-  return (
-    <SettingsHighlightContext.Provider value={highlight}>
-      <div className={classNames("w-full", className)}>{children}</div>
-    </SettingsHighlightContext.Provider>
-  );
+export function SettingsList({ children, className }: { children: ReactNode; className?: string }) {
+  return <div className={classNames("w-full", className)}>{children}</div>;
 }

 export function SettingsSection({
@@ -79,37 +58,17 @@ export function SettingRow({
  controlClassName,
  description,
  disabled,
-  highlightKey,
  title,
 }: {
  children: ReactNode;
 } & SettingRowBaseProps) {
-  const highlight = useContext(SettingsHighlightContext);
-  const isHighlighted = highlightKey != null && highlightKey === highlight;
-  const [flashing, setFlashing] = useState(isHighlighted);
-  const rowRef = useRef<HTMLDivElement>(null);
-  const controlRef = useRef<HTMLDivElement>(null);
-
-  useEffect(() => {
-    if (!isHighlighted) return;
-    rowRef.current?.scrollIntoView({ block: "nearest" });
-    controlRef.current?.querySelector<HTMLElement>(FOCUSABLE)?.focus();
-  }, [isHighlighted]);
-
  return (
    <div
-      ref={rowRef}
      aria-disabled={disabled || undefined}
-      onAnimationEnd={(event) => {
-        if (event.target === event.currentTarget) setFlashing(false);
-      }}
      className={classNames(
        className,
        "@container border-b border-border-subtle py-4",
        disabled && "opacity-disabled",
-        // Drawn on a layer so the tint gets even padding and stops short of the row's border
-        flashing &&
-          "relative isolate before:absolute before:-inset-x-3 before:inset-y-1 before:-z-10 before:rounded-lg before:animate-settingHighlight",
      )}
    >
      <div
@@ -125,7 +84,6 @@ export function SettingRow({
          )}
        </div>
        <div
-          ref={controlRef}
          className={classNames(
            "flex min-w-0 items-center justify-start @[40rem]:justify-end",
            controlClassName,
@@ -21,8 +21,6 @@ import { CommercialUseBanner } from "../CommercialUseBanner";
 import { Button } from "../core/Button";
 import type { CheckboxProps } from "../core/Checkbox";
 import { Checkbox } from "../core/Checkbox";
-import type { CheckboxTreeNode } from "../core/CheckboxTree";
-import { CheckboxTree } from "../core/CheckboxTree";
 import { DiffViewer } from "../core/Editor/DiffViewer";
 import { Input } from "../core/Input";
 import { Separator } from "../core/Separator";
@@ -45,7 +43,10 @@ interface CommitTreeNode {

 export function GitCommitDialog({ syncDir, onDone, workspace }: Props) {
  const callbacks = useGitCallbacks(syncDir);
-  const [{ status }, { commit, commitAndPush, add, unstage, restore }] = useGit(syncDir, callbacks);
+  const [{ status }, { commit, commitAndPush, add, unstage, restore }] = useGit(
+    syncDir,
+    callbacks,
+  );
  const [isPushing, setIsPushing] = useState(false);
  const [commitError, setCommitError] = useState<string | null>(null);
  const [message, setMessage] = useState<string>("");
@@ -142,15 +143,6 @@ export function GitCommitDialog({ syncDir, onDone, workspace }: Props) {
    return next(workspace, []);
  }, [workspace, internalEntries]);

-  const treeNode: CheckboxTreeNode<CommitTreeNode> | null = useMemo(() => {
-    const toTreeNode = (n: CommitTreeNode): CheckboxTreeNode<CommitTreeNode> => ({
-      key: n.status.relaPath + n.status.status + n.status.staged,
-      data: n,
-      children: n.children.map(toTreeNode),
-    });
-    return tree == null ? null : toTreeNode(tree);
-  }, [tree]);
-
  const checkNode = useCallback(
    (treeNode: CommitTreeNode) => {
      const checked = nodeCheckedStatus(treeNode);
@@ -198,7 +190,7 @@ export function GitCommitDialog({ syncDir, onDone, workspace }: Props) {
    [restore],
  );

-  if (tree == null || treeNode == null) {
+  if (tree == null) {
    return null;
  }

@@ -229,18 +221,12 @@ export function GitCommitDialog({ syncDir, onDone, workspace }: Props) {
                  style={innerStyle}
                  className="h-full overflow-y-auto pb-3 pr-0.5 transform-cpu"
                >
-                  <CheckboxTree
-                    node={treeNode}
-                    checked={(n) => nodeCheckedStatus(n.data)}
-                    onCheck={(n) => checkNode(n.data)}
-                    checkboxTitle={(n) =>
-                      nodeCheckedStatus(n.data) ? "Unstage change" : "Stage change"
-                    }
-                    isRelevant={(n) => n.data.status.status !== "current"}
-                    canSelectRow={(n) => n.data.status.status !== "current"}
-                    onSelectRow={(n) => handleSelectChild(n.data.status)}
-                    isRowSelected={(n) => selectedEntry?.relaPath === n.data.status.relaPath}
-                    renderRow={(n) => <CommitTreeRow node={n.data} />}
+                  <TreeNodeChildren
+                    node={tree}
+                    depth={0}
+                    onCheck={checkNode}
+                    onSelect={handleSelectChild}
+                    selectedPath={selectedEntry?.relaPath ?? null}
                  />
                  {externalEntries.find((e) => e.status !== "current") && (
                    <>
@@ -258,7 +244,10 @@ export function GitCommitDialog({ syncDir, onDone, workspace }: Props) {
                </div>
              )}
              secondSlot={({ style: innerStyle }) => (
-                <div style={innerStyle} className="grid grid-rows-[minmax(0,1fr)_auto] gap-3 pb-2">
+                <div
+                  style={innerStyle}
+                  className="grid grid-rows-[minmax(0,1fr)_auto] gap-3 pb-2"
+                >
                  <Input
                    className="text-base! font-sans rounded-md"
                    placeholder="Commit message..."
@@ -312,39 +301,96 @@ export function GitCommitDialog({ syncDir, onDone, workspace }: Props) {
  );
 }

-function CommitTreeRow({ node }: { node: CommitTreeNode }) {
+function TreeNodeChildren({
+  node,
+  depth,
+  onCheck,
+  onSelect,
+  selectedPath,
+}: {
+  node: CommitTreeNode | null;
+  depth: number;
+  onCheck: (node: CommitTreeNode, checked: boolean) => void;
+  onSelect: (entry: GitStatusEntry) => void;
+  selectedPath: string | null;
+}) {
+  if (node === null) return null;
+  if (!isNodeRelevant(node)) return null;
+
+  const checked = nodeCheckedStatus(node);
+  const isSelected = selectedPath === node.status.relaPath;
+
  return (
-    <>
-      {node.model.model !== "http_request" &&
-      node.model.model !== "grpc_request" &&
-      node.model.model !== "websocket_request" ? (
-        <Icon
-          color="secondary"
-          icon={
-            node.model.model === "folder"
-              ? "folder"
-              : node.model.model === "environment"
-                ? "variable"
-                : "house"
-          }
+    <div
+      className={classNames(
+        depth > 0 && "pl-4 ml-2 border-l border-dashed border-border-subtle relative",
+      )}
+    >
+      <div
+        className={classNames(
+          "relative flex gap-1 w-full h-xs items-center",
+          isSelected ? "text-text" : "text-text-subtle",
+        )}
+      >
+        {isSelected && (
+          <div className="absolute left-[-100vw] right-0 top-0 bottom-0 bg-surface-active opacity-30 -z-10" />
+        )}
+        <Checkbox
+          checked={checked}
+          title={checked ? "Unstage change" : "Stage change"}
+          hideLabel
+          onChange={(checked) => onCheck(node, checked)}
        />
-      ) : (
-        <span aria-hidden className="w-4" />
-      )}
-      <div className="truncate flex-1">{resolvedModelName(node.model)}</div>
-      {node.status.status !== "current" && (
-        <InlineCode
-          className={classNames(
-            "py-0 bg-transparent w-24 text-center shrink-0",
-            node.status.status === "modified" && "text-info",
-            node.status.status === "untracked" && "text-success",
-            node.status.status === "removed" && "text-danger",
-          )}
+        <button
+          type="button"
+          className={classNames("flex-1 min-w-0 flex items-center gap-1 px-1 py-0.5 text-left")}
+          onClick={() => node.status.status !== "current" && onSelect(node.status)}
        >
-          {node.status.status}
-        </InlineCode>
-      )}
-    </>
+          {node.model.model !== "http_request" &&
+          node.model.model !== "grpc_request" &&
+          node.model.model !== "websocket_request" ? (
+            <Icon
+              color="secondary"
+              icon={
+                node.model.model === "folder"
+                  ? "folder"
+                  : node.model.model === "environment"
+                    ? "variable"
+                    : "house"
+              }
+            />
+          ) : (
+            <span aria-hidden className="w-4" />
+          )}
+          <div className="truncate flex-1">{resolvedModelName(node.model)}</div>
+          {node.status.status !== "current" && (
+            <InlineCode
+              className={classNames(
+                "py-0 bg-transparent w-24 text-center shrink-0",
+                node.status.status === "modified" && "text-info",
+                node.status.status === "untracked" && "text-success",
+                node.status.status === "removed" && "text-danger",
+              )}
+            >
+              {node.status.status}
+            </InlineCode>
+          )}
+        </button>
+      </div>
+
+      {node.children.map((childNode) => {
+        return (
+          <TreeNodeChildren
+            key={childNode.status.relaPath + childNode.status.status + childNode.status.staged}
+            node={childNode}
+            depth={depth + 1}
+            onCheck={onCheck}
+            onSelect={onSelect}
+            selectedPath={selectedPath}
+          />
+        );
+      })}
+    </div>
  );
 }

@@ -449,6 +495,15 @@ function setCheckedAndChildren(
  if (toUnstage.length > 0) unstage({ relaPaths: toUnstage });
 }

+function isNodeRelevant(node: CommitTreeNode): boolean {
+  if (node.status.status !== "current") {
+    return true;
+  }
+
+  // Recursively check children
+  return node.children.some((c) => isNodeRelevant(c));
+}
+
 function DiffPanel({
  entry,
  onDiscardChanges,
@@ -471,11 +526,13 @@ function DiffPanel({
          size="2xs"
          variant="border"
          onClick={() => onDiscardChanges(entry)}
-        >
-          Discard Changes
-        </Button>
+        >Discard Changes</Button>
      </div>
-      <DiffViewer original={prevYaml ?? ""} modified={nextYaml ?? ""} className="flex-1 min-h-0" />
+      <DiffViewer
+        original={prevYaml ?? ""}
+        modified={nextYaml ?? ""}
+        className="flex-1 min-h-0"
+      />
    </div>
  );
 }
@@ -1,8 +1,10 @@
 import { useGitBranchInfo, useGitMutations } from "@yaakapp-internal/git";
+import type { WorkspaceMeta } from "@yaakapp-internal/models";
 import classNames from "classnames";
 import { useAtomValue } from "jotai";
 import type { HTMLAttributes } from "react";
 import { forwardRef, useCallback, useMemo } from "react";
+import { openWorkspaceSettings } from "../../commands/openWorkspaceSettings";
 import { activeWorkspaceAtom, activeWorkspaceMetaAtom } from "../../hooks/useActiveWorkspace";
 import { useKeyValue } from "../../hooks/useKeyValue";
 import { useRandomKey } from "../../hooks/useRandomKey";
@@ -16,7 +18,6 @@ import { showErrorToast, showToast } from "../../lib/toast";
 import type { DropdownItem } from "../core/Dropdown";
 import { Dropdown } from "../core/Dropdown";
 import { Banner, Icon, InlineCode } from "@yaakapp-internal/ui";
-import { SyncWorkspaceHint } from "../hints/SyncWorkspaceHint";
 import { useGitCallbacks } from "./callbacks";
 import { GitCommitDialog } from "./GitCommitDialog";
 import { GitRemotesDialog } from "./GitRemotesDialog";
@@ -30,7 +31,7 @@ export function GitDropdown() {
  if (workspaceMeta == null) return null;

  if (workspaceMeta.settingSyncDir == null) {
-    return <SyncWorkspaceHint workspaceId={workspaceMeta.workspaceId} />;
+    return <SetupSyncDropdown workspaceMeta={workspaceMeta} />;
  }

  return <SyncDropdownWithSyncDir syncDir={workspaceMeta.settingSyncDir} />;
@@ -566,6 +567,64 @@ const GitMenuButton = forwardRef<HTMLButtonElement, HTMLAttributes<HTMLButtonEle
  },
 );

+function SetupSyncDropdown({ workspaceMeta }: { workspaceMeta: WorkspaceMeta }) {
+  const { value: hidden, set: setHidden } = useKeyValue<Record<string, boolean>>({
+    key: "setup_sync",
+    fallback: {},
+  });
+
+  if (hidden == null || hidden[workspaceMeta.workspaceId]) {
+    return null;
+  }
+
+  const banner = (
+    <Banner color="info">
+      When enabled, workspace data syncs to the chosen folder as text files, ideal for backup and
+      Git collaboration.
+    </Banner>
+  );
+
+  return (
+    <Dropdown
+      fullWidth
+      items={[
+        {
+          type: "content",
+          label: banner,
+        },
+        {
+          color: "success",
+          label: "Open Workspace Settings",
+          leftSlot: <Icon icon="settings" />,
+          onSelect: () => openWorkspaceSettings("settings"),
+        },
+        { type: "separator" },
+        {
+          label: "Hide This Message",
+          leftSlot: <Icon icon="eye_closed" />,
+          async onSelect() {
+            const confirmed = await showConfirm({
+              id: "hide-sync-menu-prompt",
+              title: "Hide Setup Message",
+              description: "You can configure filesystem sync or Git it in the workspace settings",
+            });
+            if (confirmed) {
+              await setHidden((prev) => ({ ...prev, [workspaceMeta.workspaceId]: true }));
+            }
+          },
+        },
+      ]}
+    >
+      <GitMenuButton>
+        <div className="text-sm text-text-subtle grid grid-cols-[auto_minmax(0,1fr)] items-center gap-2">
+          <Icon icon="wrench" />
+          <div className="truncate">Setup FS Sync or Git</div>
+        </div>
+      </GitMenuButton>
+    </Dropdown>
+  );
+}
+
 function SetupGitDropdown({
  workspaceId,
  initRepo,
@@ -86,8 +86,10 @@ export async function promptDivergedStrategy({
    showDialog({
      id: "git-diverged",
      title: "Branches Diverged",
+      hideX: true,
      size: "sm",
-      disableClose: true,
+      disableBackdropClose: true,
+      onClose: () => resolve("cancel"),
      render: ({ hide }) =>
        DivergedDialog({
          remote,
@@ -1,29 +0,0 @@
-import type { HttpResponse } from "@yaakapp-internal/models";
-import { httpRequestsAtom } from "@yaakapp-internal/models";
-import { InlineCode } from "@yaakapp-internal/ui";
-import { useAtomValue } from "jotai";
-import { FeatureHint } from "../core/FeatureHint";
-
-const MIN_REQUESTS = 2;
-const DOCS_URL = "https://yaak.app/docs/templating/request-chaining-scripting";
-
-interface Props {
-  response: HttpResponse;
-  mimeType: string | null;
-}
-
-/** A successful JSON response, in a workspace with somewhere to send its values. */
-export function ChainingHint({ response, mimeType }: Props) {
-  const requestCount = useAtomValue(httpRequestsAtom).length;
-  const status = response.status ?? 0;
-  const isJson = mimeType != null && /json/i.test(mimeType);
-  if (response.state !== "closed" || status < 200 || status >= 300) return null;
-  if (!isJson || requestCount < MIN_REQUESTS) return null;
-
-  return (
-    <FeatureHint id="chaining" className="mx-3 mt-1 shrink-0" docsUrl={DOCS_URL}>
-      Need a value from here in another request? Press <InlineCode>Ctrl+Space</InlineCode> in any
-      field and pick <InlineCode>response()</InlineCode> to pull it out with a JSONPath
-    </FeatureHint>
-  );
-}
@@ -1,44 +0,0 @@
-import { useEnvironmentsBreakdown } from "../../hooks/useEnvironmentsBreakdown";
-import {
-  addVariableToBaseEnvironment,
-  isTemplate,
-  variableTemplate,
-} from "../../lib/addVariableToBaseEnvironment";
-import { dismissFeatureHint, FeatureHint } from "../core/FeatureHint";
-
-const HINT_ID = "secret-variable";
-const DOCS_URL = "https://yaak.app/docs/templating/environments-and-variables";
-
-interface Props {
-  /** Becomes the variable name, so it should describe the value (eg. "password", "token") */
-  name: string;
-  value: string;
-  onReplace: (template: string) => void;
-}
-
-/**
- * A literal secret typed straight into an auth field. Offer to move it to a variable so the
- * request references it instead of holding it.
- */
-export function SecretVariableHint({ name, value, onReplace }: Props) {
-  const { baseEnvironment } = useEnvironmentsBreakdown();
-  if (value.trim() === "" || isTemplate(value) || baseEnvironment == null) return null;
-
-  return (
-    <FeatureHint
-      id={HINT_ID}
-      docsUrl={DOCS_URL}
-      action={{
-        label: "Move to Variable",
-        onClick: async () => {
-          const finalName = await addVariableToBaseEnvironment(baseEnvironment, name, value);
-          onReplace(variableTemplate(finalName));
-          await dismissFeatureHint(HINT_ID);
-        },
-      }}
-    >
-      Typing this in by hand? Store it in a variable to reuse it across requests and swap it per
-      environment.
-    </FeatureHint>
-  );
-}
@@ -1,73 +0,0 @@
-import { httpRequestsAtom, patchModel } from "@yaakapp-internal/models";
-import { InlineCode } from "@yaakapp-internal/ui";
-import { useAtomValue } from "jotai";
-import { useMemo } from "react";
-import { useEnvironmentsBreakdown } from "../../hooks/useEnvironmentsBreakdown";
-import {
-  addVariableToBaseEnvironment,
-  isTemplate,
-  variableTemplate,
-} from "../../lib/addVariableToBaseEnvironment";
-import { FeatureHint } from "../core/FeatureHint";
-
-const MIN_SHARED_REQUESTS = 3;
-const DOCS_URL = "https://yaak.app/docs/templating/environments-and-variables";
-
-/**
- * Once a few requests spell out the same literal origin, offer to hoist it into a variable and
- * rewrite them all at once.
- */
-export function SharedOriginHint() {
-  const requests = useAtomValue(httpRequestsAtom);
-  const { baseEnvironment } = useEnvironmentsBreakdown();
-
-  const shared = useMemo(() => {
-    const byOrigin = new Map<string, typeof requests>();
-    for (const r of requests) {
-      if (isTemplate(r.url)) continue;
-      const origin = literalOrigin(r.url);
-      if (origin == null) continue;
-      byOrigin.set(origin, [...(byOrigin.get(origin) ?? []), r]);
-    }
-    let best: { origin: string; requests: typeof requests } | null = null;
-    for (const [origin, group] of byOrigin) {
-      if (group.length >= MIN_SHARED_REQUESTS && group.length > (best?.requests.length ?? 0)) {
-        best = { origin, requests: group };
-      }
-    }
-    return best;
-  }, [requests]);
-
-  if (shared == null || baseEnvironment == null) return null;
-
-  const { origin } = shared;
-  const count = shared.requests.length;
-
-  return (
-    <FeatureHint
-      id={`shared-origin:${origin}`}
-      className="mt-1"
-      docsUrl={DOCS_URL}
-      action={{
-        label: "Use a Variable",
-        onClick: async () => {
-          const name = await addVariableToBaseEnvironment(baseEnvironment, "base_url", origin);
-          const template = variableTemplate(name);
-          await Promise.all(
-            shared.requests.map((r) =>
-              patchModel(r, { url: template + r.url.slice(origin.length) }),
-            ),
-          );
-        },
-      }}
-    >
-      {count} requests start with <InlineCode>{origin}</InlineCode>. Put it in a variable and switch
-      hosts by switching environments.
-    </FeatureHint>
-  );
-}
-
-function literalOrigin(url: string): string | null {
-  const m = /^(https?:\/\/[^/?#\s]+)/i.exec(url.trim());
-  return m?.[1] ?? null;
-}
@@ -1,44 +0,0 @@
-import { VStack } from "@yaakapp-internal/ui";
-import { openWorkspaceSettings } from "../../commands/openWorkspaceSettings";
-import { useKeyValue } from "../../hooks/useKeyValue";
-import { showToast } from "../../lib/toast";
-import { FeatureHint } from "../core/FeatureHint";
-
-const DOCS_URL = "https://yaak.app/docs/collaboration/local-directory-git-sync";
-
-/** What the sidebar's Git slot shows while the workspace only lives in the app's database. */
-export function SyncWorkspaceHint({ workspaceId }: { workspaceId: string }) {
-  // Hidden from the menu this replaced, so honor it
-  const { value: legacyHidden } = useKeyValue<Record<string, boolean>>({
-    key: "setup_sync",
-    fallback: {},
-  });
-
-  if (legacyHidden == null || legacyHidden[workspaceId]) return null;
-
-  return (
-    <FeatureHint
-      id={`sync-workspace:${workspaceId}`}
-      className="mx-2 mb-2!"
-      docsUrl={DOCS_URL}
-      action={{ label: "Configure", onClick: () => openWorkspaceSettings("settings", "sync_dir") }}
-      onDismiss={showSyncLocationToast}
-    >
-      Sync this workspace to a folder of plain files to back it up or track it with Git.
-    </FeatureHint>
-  );
-}
-
-function showSyncLocationToast() {
-  showToast({
-    id: "sync-hint-dismissed",
-    color: "info",
-    timeout: 8000,
-    message: (
-      <VStack>
-        <h2 className="font-semibold">Sync whenever you're ready</h2>
-        <p className="text-text-subtle text-sm">Directory sync and Git are in Workspace Settings</p>
-      </VStack>
-    ),
-  });
-}
@@ -1,32 +0,0 @@
-import type { ReactNode } from "react";
-import { renderToStaticMarkup } from "react-dom/server";
-import { describe, expect, test, vi } from "vite-plus/test";
-import { CsvViewerInner } from "./CsvViewer";
-
-vi.mock("@yaakapp-internal/ui", () => ({
-  Table: ({ children }: { children: ReactNode }) => <table>{children}</table>,
-  TableBody: ({ children }: { children: ReactNode }) => <tbody>{children}</tbody>,
-  TableCell: ({ children }: { children: ReactNode }) => <td>{children}</td>,
-  TableHead: ({ children }: { children: ReactNode }) => <thead>{children}</thead>,
-  TableHeaderCell: ({ children }: { children: ReactNode }) => <th>{children}</th>,
-  TableRow: ({ children }: { children: ReactNode }) => <tr>{children}</tr>,
-}));
-
-describe("CsvViewer", () => {
-  test("renders columns that extend beyond the first row", () => {
-    const markup = renderToStaticMarkup(
-      <CsvViewerInner
-        text={[
-          "startDate,2026-02-03T00:00-03:00",
-          "endDate,2026-02-03T23:59:59-03:00",
-          "id,Fecha de inicio,Nombre,Estado,Perfil de puesto,ID de sucursal,Sucursal,Fecha de fin,ID de usuario",
-          "391118210,2026-02-03 12:58:55,atencion1,Disponible,ATD,3549,sucursal,2026-02-03 12:59:08,42041",
-        ].join("\n")}
-      />,
-    );
-
-    expect(markup).toContain("ID de usuario");
-    expect(markup).toContain("42041");
-    expect(markup.match(/<td>/g)).toHaveLength(20);
-  });
-});
@@ -26,33 +26,27 @@ export function CsvViewer({ text, className }: Props) {
 export function CsvViewerInner({ text, className }: { text: string | null; className?: string }) {
  const parsed = useMemo(() => {
    if (text == null) return null;
-    return Papa.parse<string[]>(text, { skipEmptyLines: true });
+    return Papa.parse<Record<string, string>>(text, { header: true, skipEmptyLines: true });
  }, [text]);

  if (parsed === null) return null;

-  const header = parsed.data[0] ?? [];
-  const rows = parsed.data.slice(1);
-  const columnCount = parsed.data.reduce((count, row) => Math.max(count, row.length), 0);
-  const columnIndexes = Array.from({ length: columnCount }, (_, index) => index);
-
  return (
    <div className="overflow-auto h-full">
      <Table className={classNames(className, "text-sm")}>
        <TableHead>
          <TableRow>
-            {columnIndexes.map((columnIndex) => (
-              <TableHeaderCell key={columnIndex}>{header[columnIndex] ?? ""}</TableHeaderCell>
+            {parsed.meta.fields?.map((field) => (
+              <TableHeaderCell key={field}>{field}</TableHeaderCell>
            ))}
          </TableRow>
        </TableHead>
        <TableBody>
-          {rows.map((row, i) => (
+          {parsed.data.map((row, i) => (
            // oxlint-disable-next-line react/no-array-index-key
            <TableRow key={i}>
-              {row.map((cell, columnIndex) => (
-                // oxlint-disable-next-line react/no-array-index-key
-                <TableCell key={columnIndex}>{cell}</TableCell>
+              {parsed.meta.fields?.map((key) => (
+                <TableCell key={key}>{row[key] ?? ""}</TableCell>
              ))}
            </TableRow>
          ))}
@@ -112,12 +112,9 @@ export const hotkeysAtom = atom((get) => {
  // Merge default hotkeys with custom hotkeys from settings
  // Custom hotkeys override defaults for the same action
  // An empty array means the hotkey is intentionally disabled
-  const merged: Partial<Record<HotkeyAction, string[]>> = {};
-  for (const action of hotkeyActions) {
-    merged[action] = defaultHotkeys[action];
-  }
+  const merged: Record<HotkeyAction, string[]> = { ...defaultHotkeys };
  for (const [action, keys] of Object.entries(customHotkeys)) {
-    if (action in merged && Array.isArray(keys)) {
+    if (action in defaultHotkeys && Array.isArray(keys)) {
      merged[action as HotkeyAction] = keys;
    }
  }
@@ -125,7 +122,7 @@ export const hotkeysAtom = atom((get) => {
 });

 /** Helper function to get current hotkeys from the store */
-function getHotkeys(): Partial<Record<HotkeyAction, string[]>> {
+function getHotkeys(): Record<HotkeyAction, string[]> {
  return jotaiStore.get(hotkeysAtom);
 }

@@ -168,25 +165,16 @@ const layoutInsensitiveKeys = [
  "Space",
 ];

-/** Zoom is the browser's own on these keys, so the app has no such action there. */
-const ZOOM_ACTIONS: HotkeyAction[] = ["app.zoom_in", "app.zoom_out", "app.zoom_reset"];
-
-/**
- * The actions this host actually has. An action left out of here has no keys in
- * `hotkeysAtom`, so it never matches and never claims the keystroke.
- */
 export const hotkeyActions: HotkeyAction[] = (
  Object.keys(defaultHotkeys) as (keyof typeof defaultHotkeys)[]
-)
-  .filter((a) => platform.capabilities.interfaceZoom || !ZOOM_ACTIONS.includes(a))
-  .sort((a, b) => {
-    const scopeA = a.split(".")[0] || "";
-    const scopeB = b.split(".")[0] || "";
-    if (scopeA !== scopeB) {
-      return scopeA.localeCompare(scopeB);
-    }
-    return hotkeyLabels[a].localeCompare(hotkeyLabels[b]);
-  });
+).sort((a, b) => {
+  const scopeA = a.split(".")[0] || "";
+  const scopeB = b.split(".")[0] || "";
+  if (scopeA !== scopeB) {
+    return scopeA.localeCompare(scopeB);
+  }
+  return hotkeyLabels[a].localeCompare(hotkeyLabels[b]);
+});

 export type HotKeyOptions = {
  enable?: boolean | (() => boolean);
@@ -345,9 +333,7 @@ export function formatHotkeyString(trigger: string): string[] {
      } else if (p === "Alt") {
        labelParts.push("⌥");
      } else if (p === "Enter") {
-        // U+21A9 has an emoji presentation, which Chromium's font fallback picks
-        // (a blue glyph among monochrome ones). U+FE0E forces the text form.
-        labelParts.push("↩︎");
+        labelParts.push("↩");
      } else if (p === "Tab") {
        labelParts.push("⇥");
      } else if (p === "Backspace") {
@@ -1,31 +0,0 @@
-import type { Environment } from "@yaakapp-internal/models";
-import { patchModel } from "@yaakapp-internal/models";
-import { generateId } from "./generateId";
-
-/** Adds a variable, suffixing the name if it's taken, and returns the name that was used. */
-export async function addVariableToBaseEnvironment(
-  environment: Environment,
-  name: string,
-  value: string,
-): Promise<string> {
-  const taken = new Set(environment.variables.map((v) => v.name));
-  let finalName = name;
-  for (let i = 2; taken.has(finalName); i++) {
-    finalName = `${name}_${i}`;
-  }
-  await patchModel(environment, {
-    variables: [
-      ...environment.variables,
-      { id: generateId(), name: finalName, value, enabled: true },
-    ],
-  });
-  return finalName;
-}
-
-export function variableTemplate(name: string) {
-  return `\${[ ${name} ]}`;
-}
-
-export function isTemplate(value: string) {
-  return value.includes("${[");
-}
@@ -14,8 +14,9 @@ export function showAlert({ id, title, body, size = "sm" }: AlertArgs) {
  showDialog({
    id,
    title,
+    hideX: true,
    size,
-    disableClose: true,
+    disableBackdropClose: true, // Prevent accidental dismisses
    render: ({ hide }) => Alert({ onHide: hide, body }),
  });
 }
@@ -18,8 +18,9 @@ export async function showConfirm({
  return new Promise((onResult: ConfirmProps["onResult"]) => {
    showDialog({
      ...extraProps,
+      hideX: true,
      size,
-      disableClose: true,
+      disableBackdropClose: true, // Prevent accidental dismisses
      render: ({ hide }) => Confirm({ onHide: hide, color, onResult, confirmText, requireTyping }),
    });
  });
@@ -1,34 +1,14 @@
-import {
-  type BatchUpsertResult,
-  type ImportDestination,
-  type ImportPlan,
-  type ImportSource,
-  workspacesAtom,
-} from "@yaakapp-internal/models";
+import type { BatchUpsertResult } from "@yaakapp-internal/models";
 import { FormattedError, VStack } from "@yaakapp-internal/ui";
 import { Button } from "../components/core/Button";
 import { ImportDataDialog } from "../components/ImportDataDialog";
-import { activeFolderAtom } from "../hooks/useActiveFolder";
-import { activeWorkspaceAtom } from "../hooks/useActiveWorkspace";
 import { createFastMutation } from "../hooks/useFastMutation";
 import { showAlert } from "./alert";
 import { showDialog } from "./dialog";
-import { jotaiStore } from "./jotai";
 import { pluralizeCount } from "./pluralize";
 import { router } from "./router";
 import { rpc } from "./rpc";

-// Stable identities so the dialog's effects don't re-run (and cancel in-flight
-// fetches) every time the dialog container re-renders.
-const planFile = (filePath: string, destination: ImportDestination) =>
-  rpc<ImportPlan>("cmd_import_data", { filePath, destination });
-const planUrl = (url: string, destination: ImportDestination) =>
-  rpc<ImportPlan>("cmd_import_url", { url, destination });
-const listSources = (workspaceId: string) =>
-  rpc<ImportSource[]>("cmd_list_import_sources", { workspaceId });
-const findSourcesForOrigin = (args: { filePath?: string; url?: string }) =>
-  rpc<ImportSource[]>("cmd_import_sources_for_origin", args);
-
 export const importData = createFastMutation({
  mutationKey: ["import_data"],
  onError: (err: string) => {
@@ -41,41 +21,29 @@ export const importData = createFastMutation({
  },
  mutationFn: async () => {
    return new Promise<void>((resolve, reject) => {
-      const currentWorkspace = jotaiStore.get(activeWorkspaceAtom);
-      const workspaces = jotaiStore.get(workspacesAtom);
-      const selectedFolder = jotaiStore.get(activeFolderAtom);
      showDialog({
        id: "import",
        title: "Import Data",
-        size: "lg",
-        disableClose: true,
+        size: "sm",
        render: ({ hide }) => {
-          const cancel = () => {
-            hide();
-            resolve();
-          };
-          const fail = (err: unknown) => {
-            hide();
-            reject(err);
-          };
-          const commit = async (plan: ImportPlan) => {
-            const imported = await rpc<BatchUpsertResult>("cmd_commit_import", { plan });
-            hide();
-            await finishImport(imported);
-            resolve();
+          const importAndHide = async (runImport: () => Promise<BatchUpsertResult>) => {
+            try {
+              await finishImport(await runImport());
+              resolve();
+            } catch (err) {
+              reject(err);
+            } finally {
+              hide();
+            }
          };
          return (
            <ImportDataDialog
-              currentWorkspace={currentWorkspace}
-              workspaces={workspaces}
-              selectedFolder={selectedFolder}
-              planFile={planFile}
-              planUrl={planUrl}
-              listSources={listSources}
-              findSourcesForOrigin={findSourcesForOrigin}
-              commit={commit}
-              cancel={cancel}
-              onError={fail}
+              importFile={(filePath) =>
+                importAndHide(() => rpc<BatchUpsertResult>("cmd_import_data", { filePath }))
+              }
+              importUrl={(url) =>
+                importAndHide(() => rpc<BatchUpsertResult>("cmd_import_url", { url }))
+              }
            />
          );
        },
@@ -12,7 +12,7 @@ import type {
  UpdateResponse,
  YaakNotification,
 } from "@yaakapp-internal/tauri-client";
-import { HStack, Icon, InlineCode, VStack } from "@yaakapp-internal/ui";
+import { HStack, Icon, VStack } from "@yaakapp-internal/ui";
 import { openSettings } from "../commands/openSettings";
 import { Button } from "../components/core/Button";
 import { ButtonInfiniteLoading } from "../components/core/ButtonInfiniteLoading";
@@ -180,65 +180,9 @@ function showUpdateInstalledToast(version: string) {

 async function showUpdateAvailableToast(updateInfo: UpdateInfo) {
  const UPDATE_TOAST_ID = "update-info";
-  const { version, replyEventId, downloaded, install } = updateInfo;
+  const { version, replyEventId, downloaded } = updateInfo;

-  jotaiStore.set(updateAvailableAtom, { version, downloaded, install });
-
-  const whatsNewButton = (
-    <Button
-      size="xs"
-      color="info"
-      variant="border"
-      rightSlot={<Icon icon="external_link" />}
-      onClick={async () => {
-        await platform.openUrl(`https://yaak.app/changelog/${version}`);
-      }}
-    >
-      What&apos;s New
-    </Button>
-  );
-
-  if (install !== "integrated") {
-    // Nothing to reply to here; the backend only told us so we can say how to update
-    const flatpak = install === "flatpak";
-    showToast({
-      id: UPDATE_TOAST_ID,
-      color: "info",
-      timeout: null,
-      message: (
-        <VStack>
-          <h2 className="font-semibold">Yaak {version} is available</h2>
-          <p className="text-text-subtle text-sm">
-            {flatpak ? (
-              <>
-                Update with <InlineCode>flatpak update</InlineCode> or your software center.
-              </>
-            ) : (
-              "Download the new version to upgrade."
-            )}
-          </p>
-        </VStack>
-      ),
-      action: () => (
-        <HStack space={1.5}>
-          {!flatpak && (
-            <Button
-              size="xs"
-              color="info"
-              rightSlot={<Icon icon="external_link" />}
-              onClick={async () => {
-                await platform.openUrl("https://yaak.app/download");
-              }}
-            >
-              Download
-            </Button>
-          )}
-          {whatsNewButton}
-        </HStack>
-      ),
-    });
-    return;
-  }
+  jotaiStore.set(updateAvailableAtom, { version, downloaded });

  // Acknowledge the event, so we don't time out and try the fallback update logic
  await platform.emit(replyEventId, { type: "ack" } satisfies UpdateResponse);
@@ -271,7 +215,17 @@ async function showUpdateAvailableToast(updateInfo: UpdateInfo) {
        >
          {downloaded ? "Install Now" : "Download and Install"}
        </ButtonInfiniteLoading>
-        {whatsNewButton}
+        <Button
+          size="xs"
+          color="info"
+          variant="border"
+          rightSlot={<Icon icon="external_link" />}
+          onClick={async () => {
+            await platform.openUrl(`https://yaak.app/changelog/${version}`);
+          }}
+        >
+          What&apos;s New
+        </Button>
      </HStack>
    ),
  });
@@ -1,251 +0,0 @@
-import { describe, expect, test } from "vite-plus/test";
-import type { JsonSchema } from "./jsonSchemaExample";
-import { buildExampleFromSchema } from "./jsonSchemaExample";
-
-describe("buildExampleFromSchema", () => {
-  test("fills scalar fields with placeholders", () => {
-    const schema: JsonSchema = {
-      type: "object",
-      properties: {
-        name: { type: "string" },
-        age: { type: "number", format: "int32" },
-        active: { type: "boolean" },
-        data: { type: "string", format: "byte" },
-      },
-    };
-
-    expect(buildExampleFromSchema(schema)).toEqual({
-      name: "",
-      age: 0,
-      active: false,
-      data: "",
-    });
-  });
-
-  test("encodes 64-bit integers as strings", () => {
-    const schema: JsonSchema = {
-      type: "object",
-      properties: {
-        id: { type: "string", format: "int64" },
-        count: { type: "string", format: "uint64" },
-        offset: { type: "string", format: "sfixed64" },
-      },
-    };
-
-    expect(buildExampleFromSchema(schema)).toEqual({ id: "0", count: "0", offset: "0" });
-  });
-
-  test("fills date-time with a parseable timestamp", () => {
-    const schema: JsonSchema = {
-      type: "object",
-      properties: { createdAt: { type: "string", format: "date-time" } },
-    };
-
-    const example = buildExampleFromSchema(schema) as { createdAt: string };
-    expect(Number.isNaN(Date.parse(example.createdAt))).toBe(false);
-  });
-
-  test("fills a duration with a value that parses", () => {
-    const schema: JsonSchema = {
-      type: "object",
-      properties: { timeout: { type: "string", format: "duration" } },
-    };
-
-    // An empty string fails protobuf's Duration parsing, so the message wouldn't send
-    expect(buildExampleFromSchema(schema)).toEqual({ timeout: "0s" });
-  });
-
-  test("expands nested messages through $defs", () => {
-    const schema: JsonSchema = {
-      type: "object",
-      properties: { user: { $ref: "#/$defs/example.User" } },
-      $defs: {
-        "example.User": {
-          type: "object",
-          properties: {
-            name: { type: "string" },
-            address: { $ref: "#/$defs/example.Address" },
-          },
-        },
-        "example.Address": {
-          type: "object",
-          properties: { city: { type: "string" } },
-        },
-      },
-    };
-
-    expect(buildExampleFromSchema(schema)).toEqual({
-      user: { name: "", address: { city: "" } },
-    });
-  });
-
-  test("gives repeated fields a single placeholder item", () => {
-    const schema: JsonSchema = {
-      type: "object",
-      properties: {
-        tags: { type: "array", items: { type: "string" } },
-        users: { type: "array", items: { $ref: "#/$defs/example.User" } },
-        unknown: { type: "array" },
-      },
-      $defs: {
-        "example.User": { type: "object", properties: { name: { type: "string" } } },
-      },
-    };
-
-    expect(buildExampleFromSchema(schema)).toEqual({
-      tags: [""],
-      users: [{ name: "" }],
-      unknown: [],
-    });
-  });
-
-  test("uses the first value of an enum", () => {
-    const schema: JsonSchema = {
-      type: "object",
-      properties: {
-        status: { type: "string", enum: ["STATUS_UNSPECIFIED", "STATUS_ACTIVE"] },
-        empty: { type: "string", enum: [] },
-      },
-    };
-
-    expect(buildExampleFromSchema(schema)).toEqual({ status: "STATUS_UNSPECIFIED", empty: "" });
-  });
-
-  test("gives maps a single placeholder entry", () => {
-    const schema: JsonSchema = {
-      type: "object",
-      properties: {
-        labels: { type: "object", additionalProperties: { type: "string" } },
-        users: { type: "object", additionalProperties: { $ref: "#/$defs/example.User" } },
-      },
-      $defs: {
-        "example.User": { type: "object", properties: { name: { type: "string" } } },
-      },
-    };
-
-    expect(buildExampleFromSchema(schema)).toEqual({
-      labels: { key: "" },
-      users: { key: { name: "" } },
-    });
-  });
-
-  test("stops at the root self-reference", () => {
-    const schema: JsonSchema = {
-      type: "object",
-      properties: {
-        value: { type: "string" },
-        children: { type: "array", items: { $ref: "#" } },
-      },
-    };
-
-    expect(buildExampleFromSchema(schema)).toEqual({ value: "", children: [{}] });
-  });
-
-  test("stops at a cycle between messages", () => {
-    const schema: JsonSchema = {
-      type: "object",
-      properties: { node: { $ref: "#/$defs/example.Node" } },
-      $defs: {
-        "example.Node": {
-          type: "object",
-          properties: {
-            name: { type: "string" },
-            parent: { $ref: "#/$defs/example.Node" },
-            leaf: { $ref: "#/$defs/example.Leaf" },
-          },
-        },
-        "example.Leaf": {
-          type: "object",
-          properties: { node: { $ref: "#/$defs/example.Node" } },
-        },
-      },
-    };
-
-    expect(buildExampleFromSchema(schema)).toEqual({
-      node: { name: "", parent: {}, leaf: { node: {} } },
-    });
-  });
-
-  test("expands the same message twice when it is not on the same path", () => {
-    const schema: JsonSchema = {
-      type: "object",
-      properties: {
-        from: { $ref: "#/$defs/example.User" },
-        to: { $ref: "#/$defs/example.User" },
-      },
-      $defs: {
-        "example.User": { type: "object", properties: { name: { type: "string" } } },
-      },
-    };
-
-    expect(buildExampleFromSchema(schema)).toEqual({ from: { name: "" }, to: { name: "" } });
-  });
-
-  test("fills every branch of a flattened oneof", () => {
-    const schema: JsonSchema = {
-      type: "object",
-      properties: {
-        id: { type: "string" },
-        text: { type: "string" },
-        image: { $ref: "#/$defs/example.Image" },
-      },
-      $defs: {
-        "example.Image": { type: "object", properties: { url: { type: "string" } } },
-      },
-    };
-
-    expect(buildExampleFromSchema(schema)).toEqual({
-      id: "",
-      text: "",
-      image: { url: "" },
-    });
-  });
-
-  test("stops expanding once the node budget runs out", () => {
-    // Every level references the next one twice, so an unbounded walk would build 2^depth
-    // nodes without ever repeating a ref on the same path.
-    const depth = 16;
-    const $defs: Record<string, JsonSchema> = { [`d${depth}`]: { type: "string" } };
-    for (let i = 0; i < depth; i++) {
-      $defs[`d${i}`] = {
-        type: "object",
-        properties: {
-          a: { $ref: `#/$defs/d${i + 1}` },
-          b: { $ref: `#/$defs/d${i + 1}` },
-        },
-      };
-    }
-
-    const example = buildExampleFromSchema({
-      type: "object",
-      properties: { root: { $ref: "#/$defs/d0" } },
-      $defs,
-    });
-
-    // 2 ** 16 nodes unbounded; the budget holds it to a couple of thousand
-    expect(countNodes(example)).toBeLessThan(10_000);
-  });
-
-  test("handles messages without a known type", () => {
-    const schema: JsonSchema = {
-      type: "object",
-      properties: {
-        empty: {},
-        struct: { type: "object" },
-        missing: { $ref: "#/$defs/example.Nope" },
-      },
-    };
-
-    expect(buildExampleFromSchema(schema)).toEqual({ empty: null, struct: {}, missing: {} });
-  });
-});
-
-function countNodes(value: unknown): number {
-  if (Array.isArray(value)) {
-    return 1 + value.reduce((total: number, v) => total + countNodes(v), 0);
-  }
-  if (value !== null && typeof value === "object") {
-    return 1 + Object.values(value).reduce((total: number, v) => total + countNodes(v), 0);
-  }
-  return 1;
-}
@@ -1,121 +0,0 @@
-/**
- * Subset of JSON Schema emitted by the gRPC reflection layer for a method's
- * input message. See `message_to_json_schema` in the `yaak-grpc` crate.
- */
-export type JsonSchema = {
-  type?: string;
-  format?: string;
-  properties?: Record<string, JsonSchema>;
-  items?: JsonSchema;
-  additionalProperties?: JsonSchema;
-  enum?: unknown[];
-  $defs?: Record<string, JsonSchema>;
-  $ref?: string;
-};
-
-const DEFS_PREFIX = "#/$defs/";
-const ROOT_REF = "#";
-
-// Protobuf 64-bit integers are encoded as strings in the JSON mapping
-const STRING_NUMBER_FORMATS = ["int64", "uint64", "sint64", "fixed64", "sfixed64"];
-
-// Refs on sibling branches each expand their own subtree, so a schema that references the
-// same messages repeatedly can produce exponentially many nodes without ever cycling.
-const MAX_NODES = 5000;
-
-type Budget = { remaining: number };
-
-/** Build a sample message with placeholder values for every field in the schema */
-export function buildExampleFromSchema(schema: JsonSchema): unknown {
-  // The root is already being built, so a `#` ref anywhere below it is a cycle
-  return buildValue(schema, schema, new Set([ROOT_REF]), { remaining: MAX_NODES });
-}
-
-function buildValue(
-  schema: JsonSchema,
-  root: JsonSchema,
-  refPath: Set<string>,
-  budget: Budget,
-): unknown {
-  if (schema == null || typeof schema !== "object" || budget.remaining <= 0) {
-    return null;
-  }
-
-  budget.remaining -= 1;
-
-  if (typeof schema.$ref === "string") {
-    if (refPath.has(schema.$ref)) {
-      return {};
-    }
-    const resolved = resolveRef(schema.$ref, root);
-    if (resolved == null) {
-      return {};
-    }
-    return buildValue(resolved, root, new Set(refPath).add(schema.$ref), budget);
-  }
-
-  if (Array.isArray(schema.enum)) {
-    return schema.enum[0] ?? "";
-  }
-
-  switch (schema.type) {
-    case "object":
-      return buildObject(schema, root, refPath, budget);
-    case "array":
-      return schema.items == null ? [] : [buildValue(schema.items, root, refPath, budget)];
-    case "string":
-      return buildString(schema.format);
-    case "number":
-      return 0;
-    case "boolean":
-      return false;
-    default:
-      return null;
-  }
-}
-
-function buildObject(
-  schema: JsonSchema,
-  root: JsonSchema,
-  refPath: Set<string>,
-  budget: Budget,
-): unknown {
-  if (schema.properties != null && typeof schema.properties === "object") {
-    const example: Record<string, unknown> = {};
-    for (const [name, propertySchema] of Object.entries(schema.properties)) {
-      example[name] = buildValue(propertySchema, root, refPath, budget);
-    }
-    return example;
-  }
-
-  // Maps have no properties, only a value schema
-  if (schema.additionalProperties != null) {
-    return { key: buildValue(schema.additionalProperties, root, refPath, budget) };
-  }
-
-  return {};
-}
-
-function buildString(format: string | undefined): string {
-  if (format === "date-time") {
-    return new Date().toISOString();
-  }
-  // Duration JSON is a decimal string with an `s` suffix, and an empty one fails to parse
-  if (format === "duration") {
-    return "0s";
-  }
-  if (format != null && STRING_NUMBER_FORMATS.includes(format)) {
-    return "0";
-  }
-  return "";
-}
-
-function resolveRef(ref: string, root: JsonSchema): JsonSchema | null {
-  if (ref === ROOT_REF) {
-    return root;
-  }
-  if (!ref.startsWith(DEFS_PREFIX)) {
-    return null;
-  }
-  return root.$defs?.[ref.slice(DEFS_PREFIX.length)] ?? null;
-}
@@ -25,8 +25,13 @@ export async function showPromptForm({
      id,
      title,
      description,
+      hideX: true,
      size: size ?? "sm",
-      disableClose: true,
+      disableBackdropClose: true, // Prevent accidental dismisses
+      onClose: () => {
+        // Click backdrop, close, or escape
+        resolve(null);
+      },
      render: ({ hide }) =>
        Prompt({
          onCancel: () => {
@@ -5,7 +5,6 @@ type ModelType = AnyModel["model"];
 type WorkspaceRequestSettings = Pick<
  Workspace,
  | "settingFollowRedirects"
-  | "settingHttpVersion"
  | "settingRequestMessageSize"
  | "settingRequestTimeout"
  | "settingSendCookies"
@@ -19,7 +18,9 @@ type ModelTypeWithSetting<K extends RequestSettingKey> = {
  [M in ModelType]: K extends keyof ModelForType<M> ? M : never;
 }[ModelType];

-export type RequestSettingDefinition<K extends RequestSettingKey = RequestSettingKey> = {
+export type RequestSettingDefinition<
+  K extends RequestSettingKey = RequestSettingKey,
+> = {
  defaultValue: WorkspaceRequestSettings[K];
  description: string;
  modelKey: K;
@@ -45,7 +46,8 @@ export const SETTING_REQUEST_TIMEOUT = defineRequestSetting({

 export const SETTING_REQUEST_MESSAGE_SIZE = defineRequestSetting({
  defaultValue: 64 * 1024 * 1024,
-  description: "Maximum gRPC or WebSocket message size in MB. Set to 0 to disable.",
+  description:
+    "Maximum gRPC or WebSocket message size in MB. Set to 0 to disable.",
  modelKey: "settingRequestMessageSize",
  models: ["workspace", "folder", "websocket_request", "grpc_request"],
  title: "Message Size Limit",
@@ -55,7 +57,13 @@ export const SETTING_VALIDATE_CERTIFICATES = defineRequestSetting({
  defaultValue: true,
  description: "When disabled, skip validation of server certificates.",
  modelKey: "settingValidateCertificates",
-  models: ["workspace", "folder", "http_request", "websocket_request", "grpc_request"],
+  models: [
+    "workspace",
+    "folder",
+    "http_request",
+    "websocket_request",
+    "grpc_request",
+  ],
  title: "Validate TLS certificates",
 });

@@ -67,17 +75,10 @@ export const SETTING_FOLLOW_REDIRECTS = defineRequestSetting({
  title: "Follow redirects",
 });

-export const SETTING_HTTP_VERSION = defineRequestSetting({
-  defaultValue: "auto",
-  description: "Force HTTP/1.1 or HTTP/2 for servers that don't negotiate the version correctly.",
-  modelKey: "settingHttpVersion",
-  models: ["workspace", "folder", "http_request"],
-  title: "HTTP version",
-});
-
 export const SETTING_SEND_COOKIES = defineRequestSetting({
  defaultValue: true,
-  description: "Attach matching cookies from the active cookie jar to outgoing requests.",
+  description:
+    "Attach matching cookies from the active cookie jar to outgoing requests.",
  modelKey: "settingSendCookies",
  models: ["workspace", "folder", "http_request", "websocket_request"],
  title: "Automatically send cookies",
@@ -85,7 +86,8 @@ export const SETTING_SEND_COOKIES = defineRequestSetting({

 export const SETTING_STORE_COOKIES = defineRequestSetting({
  defaultValue: true,
-  description: "Save cookies from Set-Cookie response headers to the active cookie jar.",
+  description:
+    "Save cookies from Set-Cookie response headers to the active cookie jar.",
  modelKey: "settingStoreCookies",
  models: ["workspace", "folder", "http_request", "websocket_request"],
  title: "Automatically store cookies",
@@ -23,6 +23,7 @@
    "@lezer/highlight": "^1.1.3",
    "@lezer/lr": "^1.3.3",
    "@mjackson/multipart-parser": "^0.10.1",
+    "@prantlf/jsonlint": "^16.0.0",
    "@replit/codemirror-emacs": "^6.1.0",
    "@replit/codemirror-vim": "^6.3.0",
    "@replit/codemirror-vscode-keymap": "^6.0.2",
@@ -53,7 +54,6 @@
    "jotai": "^2.18.0",
    "jotai-family": "^1.0.1",
    "js-md5": "^0.8.3",
-    "jsonc-parser": "^3.3.1",
    "lucide-react": "^0.525.0",
    "mime": "^4.0.4",
    "motion": "^12.4.7",
@@ -93,12 +93,14 @@
    "@yaakapp-internal/theme": "^1.0.0",
    "@yaakapp-internal/ui": "^1.0.0",
    "babel-plugin-react-compiler": "^1.0.0",
+    "decompress": "^4.2.1",
    "internal-ip": "^8.0.0",
    "rollup": "^4.60.3",
-    "vite": "npm:@voidzero-dev/vite-plus-core@^0.2.9",
+    "vite": "npm:@voidzero-dev/vite-plus-core@^0.2.1",
    "vite-plugin-static-copy": "^3.3.0",
    "vite-plugin-svgr": "^4.5.0",
+    "vite-plugin-top-level-await": "^1.5.0",
    "vite-plugin-wasm": "^3.5.0",
-    "vite-plus": "^0.3.0"
+    "vite-plus": "^0.2.1"
  }
 }
@@ -1,8 +0,0 @@
-import "react";
-
-declare module "react" {
-  interface HTMLAttributes<T> {
-    // Not in @types/react yet; opts editable elements out of macOS Writing Tools
-    writingsuggestions?: "true" | "false";
-  }
-}
@@ -46,9 +46,9 @@ const WorkspacesWorkspaceIdRequestsRequestIdRoute =

 export interface FileRoutesByFullPath {
  '/': typeof IndexRoute
-  '/workspaces/': typeof WorkspacesIndexRoute
+  '/workspaces': typeof WorkspacesIndexRoute
  '/workspaces/$workspaceId/settings': typeof WorkspacesWorkspaceIdSettingsRoute
-  '/workspaces/$workspaceId/': typeof WorkspacesWorkspaceIdIndexRoute
+  '/workspaces/$workspaceId': typeof WorkspacesWorkspaceIdIndexRoute
  '/workspaces/$workspaceId/requests/$requestId': typeof WorkspacesWorkspaceIdRequestsRequestIdRoute
 }
 export interface FileRoutesByTo {
@@ -70,9 +70,9 @@ export interface FileRouteTypes {
  fileRoutesByFullPath: FileRoutesByFullPath
  fullPaths:
    | '/'
-    | '/workspaces/'
+    | '/workspaces'
    | '/workspaces/$workspaceId/settings'
-    | '/workspaces/$workspaceId/'
+    | '/workspaces/$workspaceId'
    | '/workspaces/$workspaceId/requests/$requestId'
  fileRoutesByTo: FileRoutesByTo
  to:
@@ -110,14 +110,14 @@ declare module '@tanstack/react-router' {
    '/workspaces/': {
      id: '/workspaces/'
      path: '/workspaces'
-      fullPath: '/workspaces/'
+      fullPath: '/workspaces'
      preLoaderRoute: typeof WorkspacesIndexRouteImport
      parentRoute: typeof rootRouteImport
    }
    '/workspaces/$workspaceId/': {
      id: '/workspaces/$workspaceId/'
      path: '/workspaces/$workspaceId'
-      fullPath: '/workspaces/$workspaceId/'
+      fullPath: '/workspaces/$workspaceId'
      preLoaderRoute: typeof WorkspacesWorkspaceIdIndexRouteImport
      parentRoute: typeof rootRouteImport
    }
@@ -14,6 +14,5 @@ export const Route = createFileRoute("/workspaces/$workspaceId/settings")({
 });

 function RouteComponent() {
-  const { tab } = Route.useSearch();
-  return <Settings tab={tab} />;
+  return <Settings />;
 }
@@ -6,6 +6,7 @@ import path from "node:path";
 import { defineConfig, normalizePath } from "vite-plus";
 import { viteStaticCopy } from "vite-plugin-static-copy";
 import svgr from "vite-plugin-svgr";
+import topLevelAwait from "vite-plugin-top-level-await";
 import wasm from "vite-plugin-wasm";

 const require = createRequire(import.meta.url);
@@ -42,11 +43,10 @@ export default defineConfig(async () => {
          : {},
    },
    // The browser host runs the model layer in a worker; that bundle needs the
-    // same wasm handling as the main one. Top-level await needs no transform
-    // because the build targets esnext.
+    // same wasm and top-level-await handling as the main one.
    worker: {
      format: "es" as const,
-      plugins: () => [wasm()],
+      plugins: () => [wasm(), topLevelAwait()],
    },
    plugins: [
      wasm(),
@@ -58,6 +58,7 @@ export default defineConfig(async () => {
      }),
      svgr(),
      react(),
+      topLevelAwait(),
      viteStaticCopy({
        targets: [
          { src: cMapsDir, dest: "" },
@@ -31,7 +31,7 @@
    "@vitejs/plugin-react": "^6.0.1",
    "babel-plugin-react-compiler": "^1.0.0",
    "typescript": "^5.8.3",
-    "vite": "npm:@voidzero-dev/vite-plus-core@^0.2.9",
-    "vite-plus": "^0.3.0"
+    "vite": "npm:@voidzero-dev/vite-plus-core@^0.2.1",
+    "vite-plus": "^0.2.1"
  }
 }
@@ -39,13 +39,12 @@ tokio = { workspace = true, features = [
 ] }
 walkdir = "2"
 webbrowser = "1"
-zip = "7"
+zip = "4"
 yaak = { workspace = true }
 yaak-api = { workspace = true }
 yaak-core = { workspace = true }
 yaak-crypto = { workspace = true }
 yaak-http = { workspace = true }
-yaak-lifecycle = { workspace = true }
 yaak-models = { workspace = true }
 yaak-plugins = { workspace = true }
 yaak-templates = { workspace = true }
@@ -1,12 +1,19 @@
 ---
 name: use-yaak
 description: >
-  Use when the user mentions Yaak, a Yaak workspace, or the `yaak` command, or
-  asks to call, hit, or smoke test HTTP/REST endpoints, save or organize API
-  requests for reuse or manual testing, configure auth on saved requests, import
-  an OpenAPI spec, a Postman or Insomnia collection, or a cURL command, or run
-  saved requests across environments. Prefer over one-off `curl` when requests
-  should be saved, reused, shared, or run as a set.
+  Build and run HTTP API requests with the Yaak CLI (`yaak`): create workspaces,
+  folders, environments and variables, author HTTP requests, configure
+  authentication (OAuth 2.0, bearer tokens, API keys, basic, JWT, AWS SigV4),
+  send them individually or a whole folder/workspace at once, chain one
+  request's response into the next, and import existing APIs from OpenAPI,
+  Postman, Insomnia, or cURL. Use this skill whenever the user mentions Yaak, a
+  Yaak workspace, or the `yaak` command, and also when they ask to try, hit,
+  call, exercise, or smoke test an HTTP or REST endpoint, to save or organize
+  API requests for reuse, to set up API requests for manual testing, to add auth
+  to a saved request, to turn an OpenAPI or Postman collection into runnable
+  requests, or to run a saved request suite against staging versus production.
+  Prefer this over one-off `curl` commands whenever the requests should be
+  saved, reused, shared, or run as a set.
 allowed-tools: Bash(yaak:*), Bash(which:*), Bash(command:*), Bash(npm:*), Bash(npx:*)
 ---

@@ -27,7 +34,7 @@ only for publishing plugins to the Yaak registry.
 Two consequences worth holding onto. Requests you create are permanent user data
 in an app they use, not scratch files, so name them the way the user would and
 clean up anything created just to test. And because the app is right there, the
-CLI is usually the wrong place to _read_ a response in detail; it is the right
+CLI is usually the wrong place to *read* a response in detail; it is the right
 place to build, organize, and run requests.

 ## The CLI describes itself
@@ -49,11 +49,8 @@ fn schema(pretty: bool) -> CommandResult {
 fn list(ctx: &CliContext, workspace_id: Option<&str>) -> CommandResult {
    let workspace_id = resolve_workspace_id(ctx, workspace_id, "environment list")?;
    let environments = ctx
-        .query_manager()
-        .with_tx(|tx| {
-            tx.ensure_base_environment(&workspace_id)?;
-            tx.list_environments(&workspace_id)
-        })
+        .db()
+        .list_environments_ensure_base(&workspace_id)
        .map_err(|e| format!("Failed to list environments: {e}"))?;

    if environments.is_empty() {
@@ -114,8 +111,8 @@ fn create(
        }

        let created = ctx
-            .query_manager()
-            .with_tx(|tx| tx.upsert_environment(&environment, &UpdateSource::Sync))
+            .db()
+            .upsert_environment(&environment, &UpdateSource::Sync)
            .map_err(|e| format!("Failed to create environment: {e}"))?;

        println!("Created environment: {}", created.id);
@@ -136,8 +133,8 @@ fn create(
    };

    let created = ctx
-        .query_manager()
-        .with_tx(|tx| tx.upsert_environment(&environment, &UpdateSource::Sync))
+        .db()
+        .upsert_environment(&environment, &UpdateSource::Sync)
        .map_err(|e| format!("Failed to create environment: {e}"))?;

    println!("Created environment: {}", created.id);
@@ -155,8 +152,8 @@ fn update(ctx: &CliContext, json: Option<String>, json_input: Option<String>) ->
    let updated = apply_merge_patch(&existing, &patch, &id, "environment update")?;

    let saved = ctx
-        .query_manager()
-        .with_tx(|tx| tx.upsert_environment(&updated, &UpdateSource::Sync))
+        .db()
+        .upsert_environment(&updated, &UpdateSource::Sync)
        .map_err(|e| format!("Failed to update environment: {e}"))?;

    println!("Updated environment: {}", saved.id);
@@ -170,8 +167,8 @@ fn delete(ctx: &CliContext, environment_id: &str, yes: bool) -> CommandResult {
    }

    let deleted = ctx
-        .query_manager()
-        .with_tx(|tx| tx.delete_environment_by_id(environment_id, &UpdateSource::Sync))
+        .db()
+        .delete_environment_by_id(environment_id, &UpdateSource::Sync)
        .map_err(|e| format!("Failed to delete environment: {e}"))?;

    println!("Deleted environment: {}", deleted.id);
@@ -102,8 +102,8 @@ fn create(
        )?;

        let created = ctx
-            .query_manager()
-            .with_tx(|tx| tx.upsert_folder(&folder, &UpdateSource::Sync))
+            .db()
+            .upsert_folder(&folder, &UpdateSource::Sync)
            .map_err(|e| format!("Failed to create folder: {e}"))?;

        println!("Created folder: {}", created.id);
@@ -118,8 +118,8 @@ fn create(
    let folder = Folder { workspace_id, name, ..Default::default() };

    let created = ctx
-        .query_manager()
-        .with_tx(|tx| tx.upsert_folder(&folder, &UpdateSource::Sync))
+        .db()
+        .upsert_folder(&folder, &UpdateSource::Sync)
        .map_err(|e| format!("Failed to create folder: {e}"))?;

    println!("Created folder: {}", created.id);
@@ -135,8 +135,8 @@ fn update(ctx: &CliContext, json: Option<String>, json_input: Option<String>) ->
    let updated = apply_merge_patch(&existing, &patch, &id, "folder update")?;

    let saved = ctx
-        .query_manager()
-        .with_tx(|tx| tx.upsert_folder(&updated, &UpdateSource::Sync))
+        .db()
+        .upsert_folder(&updated, &UpdateSource::Sync)
        .map_err(|e| format!("Failed to update folder: {e}"))?;

    println!("Updated folder: {}", saved.id);
@@ -150,8 +150,8 @@ fn delete(ctx: &CliContext, folder_id: &str, yes: bool) -> CommandResult {
    }

    let deleted = ctx
-        .query_manager()
-        .with_tx(|tx| tx.delete_folder_by_id(folder_id, &UpdateSource::Sync))
+        .db()
+        .delete_folder_by_id(folder_id, &UpdateSource::Sync)
        .map_err(|e| format!("Failed to delete folder: {e}"))?;

    println!("Deleted folder: {}", deleted.id);
@@ -5,20 +5,16 @@ use std::fs;
 use std::io::ErrorKind;
 use yaak::export::{self, ExportDataParams};
 use yaak::import;
-use yaak_models::util::{
-    BatchUpsertResult, ImportDestination, ImportOrigin, ImportPlanAction, ImportPlanItem,
-};
+use yaak_core::WorkspaceContext;
+use yaak_models::util::BatchUpsertResult;
 use yaak_plugins::events::{ImportResources, PluginContext};

 type CommandResult<T = ()> = std::result::Result<T, String>;

 pub async fn run_import(ctx: &CliContext, args: ImportArgs) -> i32 {
    match import(ctx, args).await {
-        Ok((result, items)) => {
+        Ok(result) => {
            println!("Imported {}", format_counts(&result));
-            if let Some(skipped) = format_skipped(&items) {
-                println!("Skipped {skipped}");
-            }
            0
        }
        Err(error) => {
@@ -41,10 +37,7 @@ pub fn run_export(ctx: &CliContext, args: ExportArgs) -> i32 {
    }
 }

-async fn import(
-    ctx: &CliContext,
-    args: ImportArgs,
-) -> CommandResult<(BatchUpsertResult, Vec<ImportPlanItem>)> {
+async fn import(ctx: &CliContext, args: ImportArgs) -> CommandResult<BatchUpsertResult> {
    if let Some(workspace_id) = args.workspace_id.as_deref() {
        ctx.db()
            .get_workspace(workspace_id)
@@ -58,7 +51,6 @@ async fn import(
        .import_data(&plugin_context, &file_contents)
        .await
        .map_err(|e| format!("Failed to import data: {e}"))?;
-    let importer = import_result.importer;
    let resources = import_result.resources;
    let workspace_id = args.workspace_id;
    if workspace_id.is_none() && resources_need_current_workspace(&resources) {
@@ -67,64 +59,15 @@ async fn import(
                .to_string(),
        );
    }
-    let destination = match workspace_id {
-        Some(workspace_id) => {
-            ImportDestination::ExistingWorkspace { workspace_id, folder_id: None }
-        }
-        None => ImportDestination::NewWorkspace,
+    let workspace_context = WorkspaceContext {
+        workspace_id,
+        environment_id: None,
+        cookie_jar_id: None,
+        request_id: None,
    };
-    let plan = import::plan_import_resources(
-        ctx.query_manager(),
-        importer,
-        destination,
-        resources,
-        import_result.source_keys,
-        Some(file_origin(&args.file)),
-    )
-    .map_err(|e| format!("Failed to plan import: {e}"))?;
-    let items = plan.items.clone();
-    let imported = import::commit_import_plan(ctx.query_manager(), plan)
+    let imported = import::import_resources(ctx.query_manager(), workspace_context, resources)
        .map_err(|e| format!("Failed to import data: {e}"))?;
-    Ok((imported, items))
-}
-
-fn file_origin(path: &std::path::Path) -> ImportOrigin {
-    let canonical = fs::canonicalize(path).unwrap_or_else(|_| path.to_path_buf());
-    let label = canonical
-        .file_name()
-        .map(|name| name.to_string_lossy().to_string())
-        .unwrap_or_else(|| path.display().to_string());
-    ImportOrigin { origin: canonical.to_string_lossy().to_string(), label }
-}
-
-/// Summarize what the default selection left untouched during a merging re-import.
-fn format_skipped(items: &[ImportPlanItem]) -> Option<String> {
-    let count = |action: ImportPlanAction| items.iter().filter(|i| i.action == action).count();
-    let plural = |n: usize| if n == 1 { "" } else { "s" };
-
-    let mut parts = Vec::new();
-    let deletions = count(ImportPlanAction::Delete);
-    if deletions > 0 {
-        parts.push(format!("{deletions} removed from source (not deleted locally)"));
-    }
-    let conflicts = count(ImportPlanAction::Conflict);
-    if conflicts > 0 {
-        parts.push(format!("{conflicts} conflict{} (kept local changes)", plural(conflicts)));
-    }
-    let keep_local = count(ImportPlanAction::KeepLocal);
-    if keep_local > 0 {
-        parts.push(format!("{keep_local} with local edits"));
-    }
-    let ignored = count(ImportPlanAction::Ignored);
-    if ignored > 0 {
-        parts.push(format!("{ignored} ignored"));
-    }
-    let unchanged = count(ImportPlanAction::Unchanged);
-    if unchanged > 0 {
-        parts.push(format!("{unchanged} unchanged"));
-    }
-
-    if parts.is_empty() { None } else { Some(parts.join(", ")) }
+    Ok(imported)
 }

 fn export(ctx: &CliContext, args: ExportArgs) -> CommandResult<usize> {
@@ -181,11 +181,7 @@ async fn dev(args: PluginPathArg) -> CommandResult {
                    ui::info(&format!("Rebuilding plugin {display_path}"));
                }
                WatcherEvent::Event(BundleEvent::BundleEnd(_)) => {
-                    // Assets are staged on every rebuild, so a changed asset or
-                    // declaration is picked up without restarting.
-                    let result = copy_build_assets(&watch_root)
-                        .and_then(|()| generate_plugin_metadata(&watch_root));
-                    match result {
+                    match generate_plugin_metadata(&watch_root) {
                        Ok(()) => ui::success(&format!(
                            "Generated plugin metadata at {}",
                            watch_root.join("build/metadata.json").display()
@@ -348,19 +344,17 @@ async fn install_from_directory(context: &CliContext, source: &str) -> CommandRe
    ui::info(&format!("Installing plugin from directory {}", plugin_dir.display()));

    let plugin = context
-        .query_manager()
-        .with_tx(|tx| {
-            tx.upsert_plugin(
-                &Plugin {
-                    directory: plugin_dir_str,
-                    url: None,
-                    enabled: true,
-                    source: PluginSource::Filesystem,
-                    ..Default::default()
-                },
-                &UpdateSource::Background,
-            )
-        })
+        .db()
+        .upsert_plugin(
+            &Plugin {
+                directory: plugin_dir_str,
+                url: None,
+                enabled: true,
+                source: PluginSource::Filesystem,
+                ..Default::default()
+            },
+            &UpdateSource::Background,
+        )
        .map_err(|err| format!("Failed to save plugin in database: {err}"))?;

    let plugin_context = PluginContext::new(Some("cli".to_string()), None);
@@ -414,7 +408,6 @@ struct PublishResponse {

 async fn build_plugin_bundle(plugin_dir: &Path) -> CommandResult<Vec<String>> {
    prepare_build_output_dir(plugin_dir)?;
-    copy_build_assets(plugin_dir)?;
    let mut bundler = Bundler::new(bundler_options(plugin_dir, false))
        .map_err(|err| format!("Failed to initialize Rolldown: {err}"))?;
    let output = bundler.write().await.map_err(|err| format!("Plugin build failed:\n{err}"))?;
@@ -505,63 +498,6 @@ fn prepare_build_output_dir(plugin_dir: &Path) -> CommandResult {
        .map_err(|e| format!("Failed to create build directory {}: {e}", build_dir.display()))
 }

-#[derive(Deserialize, Default)]
-struct PluginManifest {
-    #[serde(default)]
-    yaak: PluginManifestConfig,
-}
-
-#[derive(Deserialize, Default)]
-struct PluginManifestConfig {
-    /// Files to place beside the bundle, as paths relative to the plugin
-    /// directory. Publishing ships everything in `build/`, so these travel with
-    /// the plugin.
-    #[serde(default, rename = "buildAssets")]
-    build_assets: Vec<String>,
-}
-
-/// Copy the plugin's declared assets into `build/`.
-///
-/// This runs after the directory is cleared and before the bundle is written,
-/// because a bundle may read an asset from its own directory at import time and
-/// metadata generation imports the bundle.
-fn copy_build_assets(plugin_dir: &Path) -> CommandResult {
-    let manifest_path = plugin_dir.join("package.json");
-    let manifest: PluginManifest = serde_json::from_str(
-        &fs::read_to_string(&manifest_path)
-            .map_err(|e| format!("Failed to read {}: {e}", manifest_path.display()))?,
-    )
-    .map_err(|e| format!("Failed to parse {}: {e}", manifest_path.display()))?;
-
-    let build_dir = plugin_dir.join("build");
-    let mut names = HashSet::new();
-    for asset in manifest.yaak.build_assets {
-        let src = plugin_dir.join(&asset);
-        let name = src
-            .file_name()
-            .ok_or_else(|| format!("yaak.buildAssets entry is not a file path: {asset}"))?;
-        // A copy that later gets overwritten would pass the build and fail on
-        // load, so anything the build itself writes, or a second asset with
-        // the same name, is rejected up front. Names are compared without
-        // case, because a plugin is installed on case-insensitive filesystems
-        // wherever it was built.
-        let key = name.to_string_lossy().to_lowercase();
-        if key == "index.js" || key == "metadata.json" {
-            return Err(format!("Build asset {asset} would be overwritten by the build output"));
-        }
-        if !names.insert(key) {
-            return Err(format!("Two build assets share the name {}", name.display()));
-        }
-        if !src.is_file() {
-            return Err(format!("Build asset does not exist: {}", src.display()));
-        }
-        fs::copy(&src, build_dir.join(name))
-            .map_err(|e| format!("Failed to copy build asset {}: {e}", src.display()))?;
-    }
-
-    Ok(())
-}
-
 fn bundler_options(plugin_dir: &Path, watch: bool) -> BundlerOptions {
    BundlerOptions {
        input: Some(vec![InputItem { import: "./src/index.ts".to_string(), ..Default::default() }]),
@@ -814,10 +750,7 @@ describe("Example Plugin", () => {

 #[cfg(test)]
 mod tests {
-    use super::{
-        copy_build_assets, create_publish_archive, generate_plugin_metadata,
-        prepare_build_output_dir,
-    };
+    use super::{create_publish_archive, generate_plugin_metadata};
    use serde_json::Value;
    use std::collections::HashSet;
    use std::fs;
@@ -862,97 +795,6 @@ mod tests {
        assert!(!names.contains("ignored/secret.txt"));
    }

-    #[test]
-    fn prepare_build_output_dir_clears_stale_output() {
-        let dir = TempDir::new().expect("temp dir");
-        let root = dir.path();
-        let build = root.join("build");
-        fs::create_dir_all(&build).expect("create build");
-        fs::write(build.join("index.js"), "stale").expect("write index.js");
-        fs::write(build.join("left-behind.js"), "stale").expect("write extra");
-
-        prepare_build_output_dir(root).expect("prepare build dir");
-
-        // Publishing ships everything under build/, so nothing may survive.
-        assert!(build.is_dir());
-        assert_eq!(fs::read_dir(&build).expect("read build").count(), 0);
-    }
-
-    #[test]
-    fn copy_build_assets_places_declared_files_beside_the_bundle() {
-        let dir = TempDir::new().expect("temp dir");
-        let root = dir.path();
-        fs::create_dir_all(root.join("build")).expect("create build");
-        fs::create_dir_all(root.join("vendor")).expect("create vendor");
-        fs::write(root.join("vendor/core_bg.wasm"), "asset").expect("write asset");
-        fs::write(root.join("package.json"), r#"{"yaak":{"buildAssets":["vendor/core_bg.wasm"]}}"#)
-            .expect("write package.json");
-
-        copy_build_assets(root).expect("copy assets");
-
-        assert_eq!(
-            fs::read_to_string(root.join("build/core_bg.wasm")).expect("read copied asset"),
-            "asset"
-        );
-    }
-
-    #[test]
-    fn copy_build_assets_is_a_noop_without_declarations() {
-        let dir = TempDir::new().expect("temp dir");
-        let root = dir.path();
-        fs::create_dir_all(root.join("build")).expect("create build");
-        fs::write(root.join("package.json"), r#"{"name":"demo"}"#).expect("write package.json");
-
-        copy_build_assets(root).expect("copy assets");
-
-        assert_eq!(fs::read_dir(root.join("build")).expect("read build").count(), 0);
-    }
-
-    #[test]
-    fn copy_build_assets_rejects_names_the_build_writes() {
-        let dir = TempDir::new().expect("temp dir");
-        let root = dir.path();
-        fs::create_dir_all(root.join("build")).expect("create build");
-        fs::write(root.join("index.js"), "asset").expect("write asset");
-        fs::write(root.join("package.json"), r#"{"yaak":{"buildAssets":["index.js"]}}"#)
-            .expect("write package.json");
-
-        let err = copy_build_assets(root).expect_err("reserved name should fail");
-        assert!(err.contains("overwritten by the build output"), "unexpected error: {err}");
-    }
-
-    #[test]
-    fn copy_build_assets_rejects_duplicate_names() {
-        let dir = TempDir::new().expect("temp dir");
-        let root = dir.path();
-        fs::create_dir_all(root.join("build")).expect("create build");
-        fs::create_dir_all(root.join("a")).expect("create a");
-        fs::create_dir_all(root.join("b")).expect("create b");
-        // Differ only by case: one file on macOS and Windows.
-        fs::write(root.join("a/core.wasm"), "one").expect("write a");
-        fs::write(root.join("b/Core.wasm"), "two").expect("write b");
-        fs::write(
-            root.join("package.json"),
-            r#"{"yaak":{"buildAssets":["a/core.wasm","b/Core.wasm"]}}"#,
-        )
-        .expect("write package.json");
-
-        let err = copy_build_assets(root).expect_err("duplicate name should fail");
-        assert!(err.contains("share the name"), "unexpected error: {err}");
-    }
-
-    #[test]
-    fn copy_build_assets_fails_on_a_missing_asset() {
-        let dir = TempDir::new().expect("temp dir");
-        let root = dir.path();
-        fs::create_dir_all(root.join("build")).expect("create build");
-        fs::write(root.join("package.json"), r#"{"yaak":{"buildAssets":["nope.wasm"]}}"#)
-            .expect("write package.json");
-
-        let err = copy_build_assets(root).expect_err("missing asset should fail");
-        assert!(err.contains("Build asset does not exist"), "unexpected error: {err}");
-    }
-
    #[test]
    fn generate_plugin_metadata_detects_api_types() {
        let dir = TempDir::new().expect("temp dir");
@@ -424,8 +424,8 @@ fn create(
        )?;

        let created = ctx
-            .query_manager()
-            .with_tx(|tx| tx.upsert_http_request(&request, &UpdateSource::Sync))
+            .db()
+            .upsert_http_request(&request, &UpdateSource::Sync)
            .map_err(|e| format!("Failed to create request: {e}"))?;

        println!("Created request: {}", created.id);
@@ -435,16 +435,19 @@ fn create(
    let workspace_id = resolve_workspace_id(ctx, workspace_id_arg.as_deref(), "request create")?;
    let name = name.unwrap_or_default();
    let url = url.unwrap_or_default();
-    let mut request = HttpRequest { workspace_id, name, url, ..Default::default() };
-    // Only override the method when one was given; `HttpRequest::default()` is the
-    // single place the fallback ("GET") is defined.
-    if let Some(method) = method {
-        request.method = method.to_uppercase();
-    }
+    let method = method.unwrap_or_else(|| "GET".to_string());
+
+    let request = HttpRequest {
+        workspace_id,
+        name,
+        method: method.to_uppercase(),
+        url,
+        ..Default::default()
+    };

    let created = ctx
-        .query_manager()
-        .with_tx(|tx| tx.upsert_http_request(&request, &UpdateSource::Sync))
+        .db()
+        .upsert_http_request(&request, &UpdateSource::Sync)
        .map_err(|e| format!("Failed to create request: {e}"))?;

    println!("Created request: {}", created.id);
@@ -463,8 +466,8 @@ fn update(ctx: &CliContext, json: Option<String>, json_input: Option<String>) ->
    let updated = apply_merge_patch(&existing, &patch, &id, "request update")?;

    let saved = ctx
-        .query_manager()
-        .with_tx(|tx| tx.upsert_http_request(&updated, &UpdateSource::Sync))
+        .db()
+        .upsert_http_request(&updated, &UpdateSource::Sync)
        .map_err(|e| format!("Failed to update request: {e}"))?;

    println!("Updated request: {}", saved.id);
@@ -487,8 +490,8 @@ fn delete(ctx: &CliContext, request_id: &str, yes: bool) -> CommandResult {
    }

    let deleted = ctx
-        .query_manager()
-        .with_tx(|tx| tx.delete_http_request_by_id(request_id, &UpdateSource::Sync))
+        .db()
+        .delete_http_request_by_id(request_id, &UpdateSource::Sync)
        .map_err(|e| format!("Failed to delete request: {e}"))?;
    println!("Deleted request: {}", deleted.id);
    Ok(())
@@ -118,8 +118,8 @@ fn delete(ctx: &CliContext, id: &str, yes: bool) -> CommandResult {
            return Ok(());
        }
        let count = ctx
-            .query_manager()
-            .with_tx(|tx| tx.delete_all_http_responses_for_request(id, &UpdateSource::Sync))
+            .db()
+            .delete_all_http_responses_for_request(id, &UpdateSource::Sync)
            .map_err(|e| format!("Failed to delete responses: {e}"))?;
        println!("Deleted {count} responses for request {id}");
        return Ok(());
@@ -131,10 +131,8 @@ fn delete(ctx: &CliContext, id: &str, yes: bool) -> CommandResult {
        return Ok(());
    }
    let count = ctx
-        .query_manager()
-        .with_tx(|tx| {
-            tx.delete_all_http_responses_for_workspace(&workspace_id, &UpdateSource::Sync)
-        })
+        .db()
+        .delete_all_http_responses_for_workspace(&workspace_id, &UpdateSource::Sync)
        .map_err(|e| format!("Failed to delete responses: {e}"))?;
    println!("Deleted {count} responses for workspace {workspace_id}");
    Ok(())
@@ -84,8 +84,8 @@ fn create(
            .map_err(|e| format!("Failed to parse workspace create JSON: {e}"))?;

        let created = ctx
-            .query_manager()
-            .with_tx(|tx| tx.upsert_workspace(&workspace, &UpdateSource::Sync))
+            .db()
+            .upsert_workspace(&workspace, &UpdateSource::Sync)
            .map_err(|e| format!("Failed to create workspace: {e}"))?;
        println!("Created workspace: {}", created.id);
        return Ok(());
@@ -97,8 +97,8 @@ fn create(

    let workspace = Workspace { name, ..Default::default() };
    let created = ctx
-        .query_manager()
-        .with_tx(|tx| tx.upsert_workspace(&workspace, &UpdateSource::Sync))
+        .db()
+        .upsert_workspace(&workspace, &UpdateSource::Sync)
        .map_err(|e| format!("Failed to create workspace: {e}"))?;
    println!("Created workspace: {}", created.id);
    Ok(())
@@ -115,8 +115,8 @@ fn update(ctx: &CliContext, json: Option<String>, json_input: Option<String>) ->
    let updated = apply_merge_patch(&existing, &patch, &id, "workspace update")?;

    let saved = ctx
-        .query_manager()
-        .with_tx(|tx| tx.upsert_workspace(&updated, &UpdateSource::Sync))
+        .db()
+        .upsert_workspace(&updated, &UpdateSource::Sync)
        .map_err(|e| format!("Failed to update workspace: {e}"))?;

    println!("Updated workspace: {}", saved.id);
@@ -130,10 +130,8 @@ fn delete(ctx: &CliContext, workspace_id: &str, yes: bool) -> CommandResult {
    }

    let deleted = ctx
-        .query_manager()
-        .with_tx(|tx| {
-            tx.delete_workspace_by_id(workspace_id, &UpdateSource::Sync, ctx.blob_manager())
-        })
+        .db()
+        .delete_workspace_by_id(workspace_id, &UpdateSource::Sync, ctx.blob_manager())
        .map_err(|e| format!("Failed to delete workspace: {e}"))?;
    println!("Deleted workspace: {}", deleted.id);
    Ok(())
@@ -49,12 +49,6 @@ impl CliContext {
                    std::process::exit(1);
                }
            };
-
-        // Guest: the desktop may have this DB open, so only what's safe beside a live session
-        let _ = query_manager.with_tx(|tx| {
-            yaak_lifecycle::on_launch(&yaak_lifecycle::Host::guest(), tx, &blob_manager)
-        });
-
        let encryption_manager = Arc::new(EncryptionManager::new(query_manager.clone(), app_id));

        Self {
@@ -13,6 +13,7 @@ use tokio::task::JoinHandle;
 use yaak::plugin_events::{
    GroupedPluginEvent, HostRequest, SharedPluginEventContext, handle_shared_plugin_event,
 };
+use yaak::render::{render_grpc_request, render_http_request};
 use yaak::response_body::FileResponseBodyStore;
 use yaak::send::{SendHttpRequestWithPluginsParams, send_http_request_with_plugins};
 use yaak_crypto::manager::EncryptionManager;
@@ -23,7 +24,6 @@ use yaak_models::models::Environment;
 use yaak_models::queries::any_request::AnyRequest;
 use yaak_models::query_manager::QueryManager;
 use yaak_models::render::make_vars_hashmap;
-use yaak_models::render::{render_grpc_request, render_http_request};
 use yaak_models::util::UpdateSource;
 use yaak_plugins::events::{
    EmptyPayload, ErrorResponse, FormInput, GetCookieValueResponse, InternalEvent,
@@ -40,7 +40,8 @@ pub fn seed_workspace(data_dir: &Path, workspace_id: &str) {
    };

    query_manager(data_dir)
-        .with_tx(|tx| tx.upsert_workspace(&workspace, &UpdateSource::Sync))
+        .connect()
+        .upsert_workspace(&workspace, &UpdateSource::Sync)
        .expect("Failed to seed workspace");
 }

@@ -55,7 +56,8 @@ pub fn seed_request(data_dir: &Path, workspace_id: &str, request_id: &str) {
    };

    query_manager(data_dir)
-        .with_tx(|tx| tx.upsert_http_request(&request, &UpdateSource::Sync))
+        .connect()
+        .upsert_http_request(&request, &UpdateSource::Sync)
        .expect("Failed to seed request");
 }

@@ -68,7 +70,8 @@ pub fn seed_folder(data_dir: &Path, workspace_id: &str, folder_id: &str) {
    };

    query_manager(data_dir)
-        .with_tx(|tx| tx.upsert_folder(&folder, &UpdateSource::Sync))
+        .connect()
+        .upsert_folder(&folder, &UpdateSource::Sync)
        .expect("Failed to seed folder");
 }

@@ -82,7 +85,8 @@ pub fn seed_grpc_request(data_dir: &Path, workspace_id: &str, request_id: &str)
    };

    query_manager(data_dir)
-        .with_tx(|tx| tx.upsert_grpc_request(&request, &UpdateSource::Sync))
+        .connect()
+        .upsert_grpc_request(&request, &UpdateSource::Sync)
        .expect("Failed to seed gRPC request");
 }

@@ -96,6 +100,7 @@ pub fn seed_websocket_request(data_dir: &Path, workspace_id: &str, request_id: &
    };

    query_manager(data_dir)
-        .with_tx(|tx| tx.upsert_websocket_request(&request, &UpdateSource::Sync))
+        .connect()
+        .upsert_websocket_request(&request, &UpdateSource::Sync)
        .expect("Failed to seed WebSocket request");
 }
@@ -4,7 +4,6 @@ use common::{cli_cmd, parse_created_id, query_manager, seed_request};
 use predicates::str::contains;
 use serde_json::Value;
 use tempfile::TempDir;
-use yaak_models::util::UpdateSource;

 #[test]
 fn export_writes_yaak_workspace_file() {
@@ -82,21 +81,14 @@ fn import_reads_yaak_workspace_file() {

    let query_manager = query_manager(data_dir);
    let db = query_manager.connect();
-    let workspaces = db.list_workspaces().expect("list imported workspaces");
-    let workspace = workspaces
-        .iter()
-        .find(|workspace| workspace.name == "Imported Workspace")
-        .expect("workspace imported");
-    assert_ne!(workspace.id, "wrk_import");
-
-    let requests = db.list_http_requests(&workspace.id).expect("list imported requests");
-    let request = requests
-        .iter()
-        .find(|request| request.name == "Imported Request")
-        .expect("request imported");
-    assert_ne!(request.id, "req_import");
-    assert_eq!(request.workspace_id, workspace.id);
-    assert_eq!(request.url, "https://example.com");
+    assert_eq!(
+        db.get_workspace("wrk_import").expect("workspace imported").name,
+        "Imported Workspace"
+    );
+    assert_eq!(
+        db.get_http_request("req_import").expect("request imported").url,
+        "https://example.com"
+    );
 }

 fn write_postman_environment_fixture(path: &std::path::Path) {
@@ -161,164 +153,10 @@ fn import_postman_environment_uses_workspace_id() {

    let query_manager = query_manager(data_dir);
    let db = query_manager.connect();
-    let environments = db.list_environments(&workspace_id).expect("list imported environments");
+    let environments =
+        db.list_environments_ensure_base(&workspace_id).expect("list imported environments");

    let imported_environment =
        environments.iter().find(|e| e.name == "Local").expect("postman environment imported");
    assert_eq!(imported_environment.workspace_id, workspace_id);
 }
-
-fn write_linked_fixture(path: &std::path::Path, requests: &[(&str, &str, &str)]) {
-    let requests = requests
-        .iter()
-        .map(|(id, name, url)| {
-            format!(
-                r#"{{ "model": "http_request", "id": "{id}", "workspaceId": "wrk_link",
-                     "name": "{name}", "method": "GET", "url": "{url}" }}"#
-            )
-        })
-        .collect::<Vec<_>>()
-        .join(",");
-    std::fs::write(
-        path,
-        format!(
-            r#"{{
-  "yaakVersion": "test",
-  "yaakSchema": 4,
-  "resources": {{
-    "workspaces": [{{ "model": "workspace", "id": "wrk_link", "name": "Linked Workspace" }}],
-    "httpRequests": [{requests}]
-  }}
-}}"#
-        ),
-    )
-    .expect("write linked fixture");
-}
-
-#[test]
-fn re_import_merges_into_linked_workspace() {
-    let temp_dir = TempDir::new().expect("Failed to create temp dir");
-    let data_dir = temp_dir.path();
-    let import_path = temp_dir.path().join("linked.json");
-
-    write_linked_fixture(
-        &import_path,
-        &[
-            ("req_a", "Request A", "https://example.com/a"),
-            ("req_b", "Request B", "https://example.com/b"),
-        ],
-    );
-    cli_cmd(data_dir)
-        .args([
-            "import",
-            import_path.to_str().expect("import path is utf-8"),
-        ])
-        .assert()
-        .success()
-        .stdout(contains("Imported 1 workspace, 2 HTTP requests"));
-
-    let workspace_id = {
-        let query_manager = query_manager(data_dir);
-        let db = query_manager.connect();
-        db.list_workspaces()
-            .expect("list workspaces")
-            .into_iter()
-            .find(|w| w.name == "Linked Workspace")
-            .expect("workspace imported")
-            .id
-    };
-
-    // The source doc changes A, drops B, and adds C. The default selection applies the
-    // update and the create but leaves the removal as an offer.
-    write_linked_fixture(
-        &import_path,
-        &[
-            ("req_a", "Request A", "https://example.com/a-v2"),
-            ("req_c", "Request C", "https://example.com/c"),
-        ],
-    );
-    cli_cmd(data_dir)
-        .args([
-            "import",
-            import_path.to_str().expect("import path is utf-8"),
-            "--workspace-id",
-            &workspace_id,
-        ])
-        .assert()
-        .success()
-        .stdout(contains("Imported 2 HTTP requests"))
-        .stdout(contains("Skipped 1 removed from source"));
-
-    let query_manager = query_manager(data_dir);
-    let db = query_manager.connect();
-    let requests = db.list_http_requests(&workspace_id).expect("list requests");
-    assert_eq!(requests.len(), 3, "merge must not duplicate: {requests:?}");
-    assert_eq!(
-        requests.iter().find(|r| r.name == "Request A").expect("request A").url,
-        "https://example.com/a-v2"
-    );
-    assert!(requests.iter().any(|r| r.name == "Request B"), "removal must not auto-apply");
-    assert!(requests.iter().any(|r| r.name == "Request C"));
-}
-
-#[test]
-fn re_import_leaves_deleted_resources_alone() {
-    let temp_dir = TempDir::new().expect("Failed to create temp dir");
-    let data_dir = temp_dir.path();
-    let import_path = temp_dir.path().join("linked.json");
-
-    write_linked_fixture(
-        &import_path,
-        &[
-            ("req_a", "Request A", "https://example.com/a"),
-            ("req_b", "Request B", "https://example.com/b"),
-        ],
-    );
-    cli_cmd(data_dir)
-        .args([
-            "import",
-            import_path.to_str().expect("import path is utf-8"),
-        ])
-        .assert()
-        .success();
-
-    let workspace_id = {
-        let query_manager = query_manager(data_dir);
-        let db = query_manager.connect();
-        let workspace_id = db
-            .list_workspaces()
-            .expect("list workspaces")
-            .into_iter()
-            .find(|w| w.name == "Linked Workspace")
-            .expect("workspace imported")
-            .id;
-        let request_b = db
-            .list_http_requests(&workspace_id)
-            .expect("list requests")
-            .into_iter()
-            .find(|r| r.name == "Request B")
-            .expect("request B imported");
-        drop(db);
-        query_manager
-            .with_tx(|tx| tx.delete_http_request_by_id(&request_b.id, &UpdateSource::Sync))
-            .expect("delete request B");
-        workspace_id
-    };
-
-    cli_cmd(data_dir)
-        .args([
-            "import",
-            import_path.to_str().expect("import path is utf-8"),
-            "--workspace-id",
-            &workspace_id,
-        ])
-        .assert()
-        .success()
-        .stdout(contains("Skipped 1 ignored"));
-
-    let query_manager = query_manager(data_dir);
-    let requests =
-        query_manager.connect().list_http_requests(&workspace_id).expect("list requests");
-    assert_eq!(requests.len(), 1, "a deleted request must not come back: {requests:?}");
-    assert_eq!(requests[0].name, "Request A");
-}
@@ -25,7 +25,8 @@ fn top_level_send_folder_sends_http_requests_and_prints_summary() {
        ..Default::default()
    };
    query_manager(data_dir)
-        .with_tx(|tx| tx.upsert_http_request(&request, &UpdateSource::Sync))
+        .connect()
+        .upsert_http_request(&request, &UpdateSource::Sync)
        .expect("Failed to seed folder request");

    cli_cmd(data_dir)
@@ -1,36 +0,0 @@
-[package]
-name = "yaak-web"
-version = "0.1.0"
-edition = "2024"
-publish = false
-description = "The server behind Yaak in the browser: executes sends, and can serve the app"
-
-# The send engine (yaak-http) and the model types it speaks (yaak-models, for
-# HttpRequest / Cookie / HttpResponseEventData). Deliberately NOT yaak (the
-# render + storage orchestration), yaak-plugins, or the RPC router: this binary
-# opens no database, runs no plugins, and renders nothing. yaak-models comes
-# along only because yaak-http's types are its types; nothing here calls into
-# its query layer.
-
-[[bin]]
-name = "yaak-web"
-path = "src/main.rs"
-
-[dependencies]
-async-trait = "0.1"
-axum = "0.7"
-base64 = "0.22.1"
-bytes = "1.11.1"
-clap = { version = "4.5", features = ["derive", "env"] }
-env_logger = "0.11"
-futures-util = "0.3"
-log = { workspace = true }
-serde = { workspace = true, features = ["derive"] }
-serde_json = { workspace = true }
-tokio = { workspace = true, features = ["rt-multi-thread", "macros", "signal", "sync", "io-util", "time", "net"] }
-tower-http = { version = "0.6", features = ["compression-gzip", "compression-zstd", "cors", "fs"] }
-ts-rs = { workspace = true }
-url = "2"
-uuid = { version = "1", features = ["v4"] }
-yaak-http = { workspace = true }
-yaak-models = { workspace = true }
@@ -1,219 +0,0 @@
-# yaak-web
-
-The network half of Yaak in a browser — and, with `--serve`, the half that
-hands the browser the app in the first place.
-
-A tab can't see an HTTP response the way a desktop app can: CORS hides most
-headers (2 of 8 in a typical response), redirects are followed silently, and
-there is no timeline. So the tab renders the request and posts it here, and this
-process puts it on the network with the desktop's own engine (`yaak-http`) and
-streams back everything that happened — every header, every redirect hop, DNS
-timing, the body — for the tab to store.
-
-It is a **stateless executor**. It keeps nothing: no database, no files, no
-sessions, no cookies between calls. Every byte it sees comes from the tab in the
-request, and every byte it returns is stored by the tab. Restart it any time.
-
-## Self-hosting it
-
-One container, no configuration, nothing behind it:
-
-```shell
-docker run -p 8080:8080 ghcr.io/mountain-loop/yaak-web
-```
-
-Open <http://localhost:8080>. The image carries the built web client and this
-binary, which serves it — so the app and its sends are on one origin, and the
-tab's send URL is a path (`/v1/http/send`) rather than an address anyone has to
-configure. The image is `linux/amd64` and `linux/arm64`, built from
-`Dockerfile.web` at the repo root.
-
-Your data lives in your browser (SQLite compiled to wasm, in IndexedDB), not in
-the container. The container is stateless: nothing is written to disk, so
-upgrading is `docker pull` and nothing else.
-
-Two settings are worth knowing about:
-
-```shell
-docker run -p 8080:8080 \
-  -e YAAK_WEB_ALLOW_PRIVATE_NETWORKS=true \
-  -e YAAK_WEB_RATE_LIMIT_PER_MINUTE=0 \
-  ghcr.io/mountain-loop/yaak-web
-```
-
- **`YAAK_WEB_ALLOW_PRIVATE_NETWORKS=true`** lets sends reach loopback,
-  private and link-local addresses. Off by default, and it should stay off on
-  anything strangers can reach — see [What it refuses](#what-it-refuses-and-why).
-  Turn it on for an instance on your own network, where calling the API on the
-  next machine is the whole point. Note that "private" is relative to the
-  *container*: `127.0.0.1` is the container itself, and reaching the Docker
-  host means `host.docker.internal` (or `--network host`).
- **`YAAK_WEB_RATE_LIMIT_PER_MINUTE`** defaults to 120 sends per client IP,
-  which suits a public instance and not a team of your own; `0` disables it.
-
-Behind a reverse proxy, add `YAAK_WEB_TRUST_FORWARDED_FOR=true` so the rate
-limit sees real client addresses instead of its own — and only then, since
-otherwise anyone can spoof the header. If the reverse proxy buffers responses,
-tell it not to: sends are streamed, and the `X-Accel-Buffering: no` header this
-binary sets is honoured by nginx-shaped ones.
-
-## Running it from source
-
-```shell
-cargo run -p yaak-web -- --serve dist/apps/yaak-client
-```
-
-after a `YAAK_TARGET=web SKIP_WASM_BUILD=1 npx vp -C apps/yaak-client build`.
-Without `--serve` it is the send executor alone, which is what the frontend
-dev server wants:
-
-```shell
-cargo run -p yaak-web
-YAAK_TARGET=web npm run dev --workspace @yaakapp/yaak-client
-```
-
-A dev build looks for the server at `http://127.0.0.1:9227` (the Vite server is a
-different origin and serves no `/v1`); a production build sends to its own
-origin unless `VITE_YAAK_WEB_URL` was set when it was built.
-
-## Configuration
-
-Every flag has a `YAAK_WEB_*` environment variable, so a container needs no
-arguments; `--help` lists them all.
-
-| Flag | Default | What |
-| --- | --- | --- |
-| `--serve` | off | Also serve a built web client from this directory, on the same origin. |
-| `--bind` | `127.0.0.1:9227` | Listen address. The image sets `0.0.0.0:8080`. |
-| `--allow-private-networks` | off | Allow sends to loopback, private and link-local addresses. |
-| `--allowed-origins` | `*` | CORS origins, comma-separated. Unused when the app is served from here: same origin, no CORS. |
-| `--max-request-bytes` | 16 MiB | Largest rendered request accepted from the tab. |
-| `--max-response-bytes` | 64 MiB | Largest upstream body relayed before the send is cut off. |
-| `--max-timeout-secs` | 60 | Ceiling on a send's timeout; a request asking for more (or none) gets this. |
-| `--rate-limit-per-minute` | 120 | Sends per client IP per minute; 0 disables. |
-| `--max-concurrent` | 256 | Sends in flight at once. |
-| `--trust-forwarded-for` | off | Take the client IP from `X-Forwarded-For`. Only behind a load balancer that sets it. |
-
-## Serving the app
-
-`--serve DIR` puts a file server behind the API routes: `/v1/*` is matched
-first, everything else comes from `DIR`, and a path with no file behind it gets
-`index.html` so the app's own routes survive a refresh. Responses are compressed
-(gzip or zstd) on the fly. `/assets/*` is cached forever — Vite content-hashes
-those names — and everything else is `no-cache`, so a new deploy arrives on the
-next reload.
-
-Serving files changes nothing about sending: the same rendered request, the same
-destination policy, the same stateless executor. It exists so that a
-self-hosted Yaak is one thing to run rather than two.
-
-## Split deployments
-
-The app and the sender can still be separate services — one CDN-hosted bundle and
-one server elsewhere, or one server shared by several fronts. Then the bundle has
-to be told where to send, at build time:
-
-```shell
-docker build -f Dockerfile.web \
-  --build-arg VITE_YAAK_WEB_URL=https://send.example.com .
-```
-
-and the server needs the CORS origins its callers use, since the requests are no
-longer same-origin:
-
-```shell
-docker run -p 8080:8080 \
-  -e YAAK_WEB_ALLOWED_ORIGINS=https://yaak.example.com \
-  ghcr.io/mountain-loop/yaak-web \
-  yaak-web
-```
-
-The trailing `yaak-web` is a command override: the same image run without
-`--serve`, so it executes sends and serves no app.
-
-## What it refuses, and why
-
-A hosted sender is, by construction, a machine that makes HTTP requests on
-behalf of strangers. Left alone that is an open relay into whatever network it
-sits on. So by default it refuses to connect to:
-
- loopback (`127/8`, `::1`), private (`10/8`, `172.16/12`, `192.168/16`,
-  `fc00::/7`), link-local (`169.254/16` — where cloud metadata lives — and
-  `fe80::/10`), carrier-grade NAT, multicast, reserved and unspecified ranges,
-  IPv4 addresses carried inside IPv6 forms (`::ffff:a.b.c.d`, the well-known
-  NAT64 prefix, 6to4), and the whole NAT64 local-use range;
- anything not `http://` or `https://`.
-
-The check runs **on the resolved addresses, after DNS**, for every hop of a
-redirect chain, so a public hostname that points at an internal address is
-caught, and so is a `Location:` header that points at one. It also refuses body
-types that would read files on its own disk (`binary`, multipart file
-fields), since no browser tab could legitimately mean those.
-
-Refusals are logged with the reason. On a public instance (`web.yaak.app`, or
-anything else strangers can reach) this must stay on: the machine's private
-network is the host's, not the user's, so a `localhost` or LAN API is not the
-user's to reach through it — the desktop app is what reaches those. On an
-instance you run for yourself, that reasoning is inverted, and
-`--allow-private-networks` inverts the policy with it. It allows every range
-above, including `169.254.169.254`, so use it only where the network on the
-other side is one the users are entitled to.
-
-There is no authentication either way: an instance is anonymous, protected by
-the per-client rate limit and the destination policy. Anything more (a shared
-token, per-user quotas) is a later slice and would sit in front of `send_http`
-in `main.rs`. Put TLS in front of a public instance.
-
-## The wire
-
-`POST /v1/http/send` with a JSON body:
-
-```json
-{
-  "request":  { "url": "https://…", "method": "GET", "headers": […], "body": {…}, "bodyType": null, "urlParameters": […] },
-  "settings": { "validateCertificates": true, "followRedirects": true, "timeoutMs": 0, "sendCookies": true, "storeCookies": true },
-  "cookies":  [ … ] 
-}
-```
-
-`request` is a Yaak `HttpRequest` in the desktop's own model shape with every
-template already rendered by the tab; the server builds the URL, headers and
-body from it exactly the way the desktop does after rendering. `cookies` is the
-jar's contents (or `null` for no jar).
-
-The reply is `application/x-ndjson`, one JSON frame per line, in the order things
-happened:
-
-| `type` | When | Carries |
-| --- | --- | --- |
-| `event` | as the engine produces them | one timeline event, in the desktop's `http_response_event.event` shape |
-| `response` | once, when the final hop's headers arrive | status, all headers, request headers as sent, remote address, HTTP version, timing |
-| `body` | as the body is read | a decompressed chunk, base64 |
-| `done` | last, on success | elapsed, byte counts, and the cookie jar as the send left it |
-| `error` | last, on failure | the reason, and any cookies collected before the failure |
-
-Refusals that happen before anything is sent (a blocked destination, a bad body,
-rate limit, capacity) are plain HTTP errors (`403`, `400`, `429`, `503`) with
-`{"error": "…"}`, not streams.
-
-Why a streamed HTTP response and not a WebSocket: one `POST` is stateless by
-construction, cancellable by closing the connection, readable with `curl`, and
-needs no upgrade handling on either side. A WebSocket only earns its keep when
-traffic is bidirectional, which a single send is not.
-
-The TypeScript side of this contract is generated from `src/wire.rs` by ts-rs
-into `bindings/` (run `cargo test -p yaak-web` after changing a frame)
-and published to the tab as `@yaakapp-internal/web`, so a change to the
-wire on one side is a type error on the other.
-
-`GET /v1/health` reports the version and the effective limits.
-
-## What comes later
-
-Not built, by design, but the router is shaped for it: a WebSocket relay
-(`/v1/ws/relay`) and a gRPC relay (`/v1/grpc/relay`) would be long-lived,
-bidirectional endpoints on the same binary, behind the same destination policy
-and limits. They differ from this endpoint in holding per-connection
-in-memory state while a connection is open (never persisted), which brings
-connection limits and a larger abuse surface — the reason they are separate
-work.
@@ -1,135 +0,0 @@
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-
-export type Cookie = {
-  name: string;
-  value: string;
-  domain: CookieDomain;
-  expires: CookieExpires;
-  path: string;
-  secure: boolean;
-  httpOnly: boolean;
-  sameSite: CookieSameSite | null;
-};
-
-export type CookieDomain = { HostOnly: string } | { Suffix: string } | "NotPresent" | "Empty";
-
-export type CookieExpires = { AtUtc: string } | "SessionEnd";
-
-export type CookieSameSite = "Strict" | "Lax" | "None";
-
-export type HttpRequest = {
-  model: "http_request";
-  id: string;
-  createdAt: string;
-  updatedAt: string;
-  workspaceId: string;
-  folderId: string | null;
-  authentication: Record<string, any>;
-  authenticationType: string | null;
-  body: Record<string, any>;
-  bodyType: string | null;
-  description: string;
-  headers: Array<HttpRequestHeader>;
-  method: string;
-  name: string;
-  sortPriority: number;
-  url: string;
-  /**
-   * URL parameters used for both path placeholders (`:id`) and query string entries.
-   */
-  urlParameters: Array<HttpUrlParameter>;
-  settingSendCookies: InheritedBoolSetting;
-  settingStoreCookies: InheritedBoolSetting;
-  settingValidateCertificates: InheritedBoolSetting;
-  settingFollowRedirects: InheritedBoolSetting;
-  settingRequestTimeout: InheritedIntSetting;
-  settingHttpVersion: InheritedHttpVersionSetting;
-};
-
-export type HttpRequestHeader = { enabled?: boolean; name: string; value: string; id?: string };
-
-/**
- * Serializable representation of HTTP response events for DB storage.
- * This mirrors `yaak_http::sender::HttpResponseEvent` but with serde support.
- * The `From` impl is in yaak-http to avoid circular dependencies.
- */
-export type HttpResponseEventData =
-  | {
-      type: "setting";
-      name: string;
-      value: string;
-      source_model?: string;
-      source_id?: string;
-      source_name?: string;
-    }
-  | { type: "info"; message: string }
-  | {
-      type: "redirect";
-      url: string;
-      status: number;
-      behavior: string;
-      dropped_body: boolean;
-      dropped_headers: Array<string>;
-    }
-  | {
-      type: "send_url";
-      method: string;
-      scheme: string;
-      username: string;
-      password: string;
-      host: string;
-      port: number;
-      path: string;
-      query: string;
-      fragment: string;
-    }
-  | { type: "receive_url"; version: string; status: string }
-  | { type: "header_up"; name: string; value: string }
-  | { type: "header_down"; name: string; value: string }
-  | { type: "chunk_sent"; bytes: number }
-  | { type: "chunk_received"; bytes: number }
-  | {
-      type: "dns_resolved";
-      hostname: string;
-      addresses: Array<string>;
-      duration: bigint;
-      overridden: boolean;
-    };
-
-export type HttpResponseHeader = { name: string; value: string };
-
-/**
- * The resolved send settings, values only: what an executor has to obey, with the sources
- * (which model each came from) left behind in [`ResolvedHttpRequestSettings`]. This is what
- * crosses from a tab to the Yaak server, and what the server reads.
- */
-export type HttpSendSettings = {
-  validateCertificates: boolean;
-  followRedirects: boolean;
-  /**
-   * Milliseconds. Zero or negative means no timeout.
-   */
-  timeoutMs: number;
-  sendCookies: boolean;
-  storeCookies: boolean;
-  httpVersion: HttpVersion;
-};
-
-export type HttpUrlParameter = {
-  enabled?: boolean;
-  /**
-   * Colon-prefixed parameters are treated as path parameters if they match, like `/users/:id`
-   * Other entries are appended as query parameters
-   */
-  name: string;
-  value: string;
-  id?: string;
-};
-
-export type HttpVersion = "auto" | "http1" | "http2";
-
-export type InheritedBoolSetting = { enabled?: boolean; value: boolean };
-
-export type InheritedHttpVersionSetting = { enabled?: boolean; value: HttpVersion };
-
-export type InheritedIntSetting = { enabled?: boolean; value: number };
@@ -1,64 +0,0 @@
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { Cookie, HttpRequest, HttpResponseEventData, HttpResponseHeader, HttpSendSettings } from "./gen_models";
-
-/**
- * One line of the reply stream. Tags are snake_case like the timeline event tags; fields are
- * camelCase like every model the tab stores.
- */
-export type Frame = { "type": "event", event: HttpResponseEventData, } | { "type": "response", status: number, statusReason: string | null, 
-/**
- * The URL that answered, after redirects.
- */
-url: string, remoteAddr: string | null, version: string | null, headers: Array<HttpResponseHeader>, 
-/**
- * The headers that were actually sent on the final hop, cookies and all.
- */
-requestHeaders: Array<HttpResponseHeader>, 
-/**
- * `Content-Length` as declared by the server, if it declared one.
- */
-contentLength: number | null, 
-/**
- * Milliseconds from the start of the send to the response head.
- */
-elapsedHeaders: number, 
-/**
- * Milliseconds spent in DNS on the last lookup, or zero.
- */
-elapsedDns: number, } | { "type": "body", data: string, } | { "type": "done", 
-/**
- * Milliseconds from the start of the send to the end of the body.
- */
-elapsed: number, 
-/**
- * Bytes of body relayed, after decompression.
- */
-contentLength: number, 
-/**
- * Bytes on the wire as declared by the server, or the relayed size when unknown.
- */
-contentLengthCompressed: number, 
-/**
- * The jar as the send left it, for the tab to persist. `None` when the tab sent none.
- */
-cookies: Array<Cookie> | null, } | { "type": "error", message: string, cookies: Array<Cookie> | null, };
-
-/**
- * The body of `POST /v1/http/send`.
- */
-export type SendRequest = { 
-/**
- * The request to send, in the desktop's own model shape but with every template already
- * rendered by the tab. The server builds the URL, headers and body from it exactly the way
- * the desktop does after rendering.
- */
-request: HttpRequest, 
-/**
- * The resolved settings, values only. Where they came from is the tab's to record in
- * its timeline; the server only needs to obey them.
- */
-settings: HttpSendSettings, 
-/**
- * The cookies to start with. `None` means no jar at all: nothing sent, nothing kept.
- */
-cookies: Array<Cookie> | null, };
@@ -1,4 +0,0 @@
-// The server's wire contract, generated by ts-rs from src/wire.rs
-// (`cargo test -p yaak-web`). The tab imports these so a change to a
-// frame on the Rust side is a type error in packages/platform/src/web.
-export type { Frame, SendRequest } from "./bindings/gen_web";
@@ -1,6 +0,0 @@
-{
-  "name": "@yaakapp-internal/web",
-  "version": "1.0.0",
-  "private": true,
-  "main": "index.ts"
-}
@@ -1,67 +0,0 @@
-use clap::Parser;
-use std::net::SocketAddr;
-use std::path::PathBuf;
-
-/// The server behind Yaak running in a browser.
-///
-/// The tab renders the request and owns the data; this binary puts the bytes on the network
-/// and streams back what came back, and with `--serve` hands the browser the app as well.
-/// Nothing is written to disk or a database.
-#[derive(Parser, Debug, Clone)]
-#[command(name = "yaak-web", version, about, long_about = None)]
-pub struct Config {
-    /// Address to listen on. 127.0.0.1 for a local instance; 0.0.0.0 inside a container.
-    #[arg(long, env = "YAAK_WEB_BIND", default_value = "127.0.0.1:9227")]
-    pub bind: SocketAddr,
-
-    /// Also serve a built web client from this directory, on the same origin as the API.
-    /// Unknown paths fall back to `index.html` so the app's own routes work on a refresh.
-    /// Without this the binary is only the send executor.
-    #[arg(long, env = "YAAK_WEB_SERVE", value_name = "DIR")]
-    pub serve: Option<PathBuf>,
-
-    /// Allow sends to loopback, private and link-local addresses. Off by default, because a
-    /// server reachable by strangers is an open relay into the network it sits on. Turn it on
-    /// only for an instance whose users are meant to reach that network — a self-hosted one
-    /// on a LAN, where the point is to call the API on the next machine.
-    #[arg(long, env = "YAAK_WEB_ALLOW_PRIVATE_NETWORKS", default_value_t = false)]
-    pub allow_private_networks: bool,
-
-    /// Browser origins allowed to call this server (CORS), comma-separated. `*` allows any.
-    /// A local dev instance wants the Vite origin; a hosted instance wants its own web origin.
-    #[arg(
-        long,
-        env = "YAAK_WEB_ALLOWED_ORIGINS",
-        default_value = "*",
-        value_delimiter = ','
-    )]
-    pub allowed_origins: Vec<String>,
-
-    /// Largest request the server accepts from the tab (the rendered request JSON, body included).
-    #[arg(long, env = "YAAK_WEB_MAX_REQUEST_BYTES", default_value_t = 16 * 1024 * 1024)]
-    pub max_request_bytes: usize,
-
-    /// Largest upstream response body the server will relay before cutting the send off.
-    #[arg(long, env = "YAAK_WEB_MAX_RESPONSE_BYTES", default_value_t = 64 * 1024 * 1024)]
-    pub max_response_bytes: usize,
-
-    /// Ceiling on a send's timeout, in seconds. A request asking for longer (or for no timeout)
-    /// gets this instead.
-    #[arg(long, env = "YAAK_WEB_MAX_TIMEOUT_SECS", default_value_t = 60)]
-    pub max_timeout_secs: u64,
-
-    /// Sends allowed per client IP per minute. 0 disables the limit. This and the concurrency
-    /// cap are the whole of what protects an instance: there is no authentication.
-    #[arg(long, env = "YAAK_WEB_RATE_LIMIT_PER_MINUTE", default_value_t = 120)]
-    pub rate_limit_per_minute: u32,
-
-    /// Sends in flight at once across all clients.
-    #[arg(long, env = "YAAK_WEB_MAX_CONCURRENT", default_value_t = 256)]
-    pub max_concurrent: usize,
-
-    /// Take the client IP from `X-Forwarded-For` (first hop) instead of the socket. Only turn
-    /// this on behind a load balancer that sets the header; otherwise anyone can spoof their way
-    /// past the rate limit.
-    #[arg(long, env = "YAAK_WEB_TRUST_FORWARDED_FOR", default_value_t = false)]
-    pub trust_forwarded_for: bool,
-}
@@ -1,271 +0,0 @@
-//! Where a send may go.
-//!
-//! A hosted sender is, by construction, a machine that makes HTTP requests on
-//! behalf of strangers. Left alone that is an open relay into whatever network
-//! it sits on: cloud metadata endpoints, internal admin panels, the database
-//! next door. So every destination is checked twice — once on the URL before a
-//! hop is attempted (literal IPs, host allow/deny lists) and once on the
-//! addresses a hostname actually resolves to, right before the connection is
-//! made. The second check is the one that matters for a hostname pointing at
-//! an internal address, and it runs on every redirect hop because the engine
-//! resolves every hop.
-
-use async_trait::async_trait;
-use log::warn;
-use std::net::{IpAddr, Ipv4Addr, Ipv6Addr};
-use std::sync::Arc;
-use tokio::sync::mpsc;
-use url::Url;
-use yaak_http::dns::AddressFilter;
-use yaak_http::sender::{HttpResponse, HttpResponseEvent, HttpSender};
-use yaak_http::types::SendableHttpRequest;
-
-/// The destination policy, shared by every send: public addresses only, unless the operator
-/// has said otherwise. A hosted server's "private network" is the cloud's, not the user's, so
-/// the default is public-only; a self-hosted instance on a LAN can be told that its private
-/// network *is* the user's, which is what `--allow-private-networks` means.
-#[derive(Clone, Default)]
-pub struct DestinationPolicy {
-    allow_private: bool,
-}
-
-impl DestinationPolicy {
-    pub fn new(allow_private: bool) -> Self {
-        Self { allow_private }
-    }
-
-    /// Check a URL before a hop is attempted: scheme and literal IPs. A hostname that passes
-    /// here still has its resolved addresses checked by [`Self::address_filter`].
-    pub fn check_url(&self, raw: &str) -> Result<(), String> {
-        let url = Url::parse(raw).map_err(|e| format!("Invalid URL {raw:?}: {e}"))?;
-        match url.scheme() {
-            "http" | "https" => {}
-            other => return Err(format!("Refusing to send over {other:?}; only http and https")),
-        }
-        let host = url.host_str().ok_or_else(|| format!("URL {raw:?} has no host"))?;
-        let host = host.trim_matches(|c| c == '[' || c == ']');
-
-        // A literal IP never reaches the resolver, so it is checked here. Hostnames are checked
-        // where their addresses become known.
-        if let Ok(ip) = host.parse::<IpAddr>() {
-            self.check_ip(ip)?;
-        }
-        Ok(())
-    }
-
-    /// The veto the engine's resolver applies to every address a hostname resolves to.
-    pub fn address_filter(&self) -> AddressFilter {
-        let policy = self.clone();
-        Arc::new(move |ip| policy.check_ip(ip))
-    }
-
-    pub fn check_ip(&self, ip: IpAddr) -> Result<(), String> {
-        if self.allow_private {
-            return Ok(());
-        }
-        match non_public_reason(ip) {
-            Some(reason) => Err(format!(
-                "Refusing to connect to {ip}: {reason}. This server only sends to public addresses"
-            )),
-            None => Ok(()),
-        }
-    }
-}
-
-/// Why an address is not a public internet address, or `None` if it is one.
-///
-/// Every range here is one a hosted relay must never be talked into reaching: the machine
-/// itself, the network it sits on, and the link-local range where cloud metadata services
-/// (169.254.169.254) live. IPv4 addresses carried inside fixed-layout IPv6 forms — IPv4-mapped,
-/// the well-known NAT64 prefix, 6to4 — are unwrapped and judged as IPv4, since that is where
-/// the packets end up; the NAT64 local-use range is refused outright. This is the stable-Rust
-/// stand-in for `IpAddr::is_global`, which is still behind `#![feature(ip)]`; a network-specific
-/// NAT64 prefix is not knowable here.
-pub fn non_public_reason(ip: IpAddr) -> Option<&'static str> {
-    match ip {
-        IpAddr::V4(v4) => non_public_v4(v4),
-        IpAddr::V6(v6) => {
-            if let Some(v4) = v6.to_ipv4_mapped() {
-                return non_public_v4(v4);
-            }
-            if let Some(v4) = embedded_v4(&v6) {
-                return non_public_v4(v4);
-            }
-            if v6.is_loopback() {
-                Some("loopback")
-            } else if v6.is_unspecified() {
-                Some("unspecified")
-            } else if v6.is_unique_local() {
-                Some("unique local (fc00::/7)")
-            } else if v6.is_unicast_link_local() {
-                Some("link-local (fe80::/10)")
-            } else if v6.is_multicast() {
-                Some("multicast")
-            } else if v6.segments()[..3] == [0x64, 0xff9b, 1] {
-                Some("NAT64 local-use (64:ff9b:1::/48)")
-            } else if v6.segments()[..4] == [0x100, 0, 0, 0] {
-                Some("discard-only (100::/64)")
-            } else if (v6.segments()[0] & 0xffc0) == 0xfec0 {
-                Some("site-local (fec0::/10)")
-            } else if v6.segments()[0] == 0x2001 && v6.segments()[1] == 0x0db8 {
-                Some("documentation (2001:db8::/32)")
-            } else {
-                None
-            }
-        }
-    }
-}
-
-fn non_public_v4(v4: Ipv4Addr) -> Option<&'static str> {
-    let o = v4.octets();
-    if v4.is_loopback() {
-        Some("loopback (127.0.0.0/8)")
-    } else if v4.is_private() {
-        Some("private (10/8, 172.16/12, 192.168/16)")
-    } else if v4.is_link_local() {
-        Some("link-local (169.254.0.0/16, where cloud metadata lives)")
-    } else if v4.is_unspecified() || o[0] == 0 {
-        Some("this network (0.0.0.0/8)")
-    } else if o[0] == 100 && (o[1] & 0xc0) == 64 {
-        Some("carrier-grade NAT (100.64.0.0/10)")
-    } else if v4.is_broadcast() {
-        Some("broadcast")
-    } else if v4.is_multicast() {
-        Some("multicast (224.0.0.0/4)")
-    } else if o[0] >= 240 {
-        Some("reserved (240.0.0.0/4)")
-    } else if v4.is_documentation() {
-        Some("documentation")
-    } else if o[0] == 192 && o[1] == 0 && o[2] == 0 {
-        Some("IETF protocol assignments (192.0.0.0/24)")
-    } else if o[0] == 198 && (o[1] & 0xfe) == 18 {
-        Some("benchmarking (198.18.0.0/15)")
-    } else {
-        None
-    }
-}
-
-/// The IPv4 address an IPv6 address stands for, when it is one of the fixed-layout translation
-/// forms: the NAT64 well-known prefix (64:ff9b::/96) or 6to4 (2002::/16, IPv4 in the next 32
-/// bits). The NAT64 local-use range (64:ff9b:1::/48) is a pool operators carve their own
-/// prefix from, at a length only they know, so it is refused wholesale in [`non_public_reason`]
-/// rather than decoded — the same call `std`'s (still unstable) `Ipv6Addr::is_global` makes.
-fn embedded_v4(v6: &Ipv6Addr) -> Option<Ipv4Addr> {
-    let s = v6.segments();
-    let o = v6.octets();
-    if s[0] == 0x64 && s[1] == 0xff9b && s[2..6].iter().all(|x| *x == 0) {
-        return Some(Ipv4Addr::new(o[12], o[13], o[14], o[15]));
-    }
-    if s[0] == 0x2002 {
-        return Some(Ipv4Addr::new(o[2], o[3], o[4], o[5]));
-    }
-    None
-}
-
-/// An [`HttpSender`] that checks each hop's URL against the policy before delegating.
-///
-/// The engine's redirect loop calls the sender once per hop with the hop's URL, so wrapping
-/// the sender is what makes `Location:` headers subject to the same rules as the first URL —
-/// including a redirect to a literal internal IP, which the resolver would never see.
-pub struct GuardedSender<S> {
-    inner: S,
-    policy: DestinationPolicy,
-}
-
-impl<S: HttpSender> GuardedSender<S> {
-    pub fn new(inner: S, policy: DestinationPolicy) -> Self {
-        Self { inner, policy }
-    }
-}
-
-#[async_trait]
-impl<S: HttpSender> HttpSender for GuardedSender<S> {
-    async fn send(
-        &self,
-        request: SendableHttpRequest,
-        event_tx: mpsc::Sender<HttpResponseEvent>,
-    ) -> yaak_http::error::Result<HttpResponse> {
-        if let Err(reason) = self.policy.check_url(&request.url) {
-            warn!("Refused {} {}: {reason}", request.method, request.url);
-            return Err(yaak_http::error::Error::RequestError(reason));
-        }
-        self.inner.send(request, event_tx).await
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    fn ip(s: &str) -> IpAddr {
-        s.parse().unwrap()
-    }
-
-    #[test]
-    fn refuses_the_ranges_a_relay_must_never_reach() {
-        for addr in [
-            "127.0.0.1",
-            "127.9.9.9",
-            "10.0.0.1",
-            "172.16.0.1",
-            "172.31.255.255",
-            "192.168.1.1",
-            "169.254.169.254",
-            "169.254.0.1",
-            "0.0.0.0",
-            "100.64.0.1",
-            "255.255.255.255",
-            "224.0.0.1",
-            "240.0.0.1",
-            "::1",
-            "::",
-            "fc00::1",
-            "fd12::1",
-            "fe80::1",
-            "::ffff:127.0.0.1",
-            "::ffff:169.254.169.254",
-            "64:ff9b::7f00:1",
-            "ff02::1",
-        ] {
-            assert!(non_public_reason(ip(addr)).is_some(), "{addr} should be refused");
-        }
-    }
-
-    #[test]
-    fn allows_public_addresses() {
-        for addr in [
-            "1.1.1.1",
-            "8.8.8.8",
-            "93.184.216.34",
-            "172.32.0.1",
-            "2606:4700:4700::1111",
-        ] {
-            assert!(non_public_reason(ip(addr)).is_none(), "{addr} should be allowed");
-        }
-    }
-
-    #[test]
-    fn literal_private_addresses_in_urls_are_refused() {
-        let policy = DestinationPolicy::new(false);
-        assert!(policy.check_url("http://127.0.0.1/").is_err());
-        assert!(policy.check_url("http://[::1]/").is_err());
-        assert!(policy.check_url("http://169.254.169.254/latest/meta-data").is_err());
-    }
-
-    #[test]
-    fn allow_private_networks_opens_the_local_ranges_but_not_other_schemes() {
-        let policy = DestinationPolicy::new(true);
-        assert!(policy.check_url("http://127.0.0.1/").is_ok());
-        assert!(policy.check_ip(ip("10.0.0.1")).is_ok());
-        assert!(policy.check_ip(ip("169.254.169.254")).is_ok());
-        assert!(policy.check_url("file:///etc/passwd").is_err());
-    }
-
-    #[test]
-    fn only_http_schemes() {
-        let policy = DestinationPolicy::new(false);
-        assert!(policy.check_url("ftp://example.com/").is_err());
-        assert!(policy.check_url("file:///etc/passwd").is_err());
-        assert!(policy.check_url("https://example.com/").is_ok());
-    }
-}
@@ -1,90 +0,0 @@
-//! Per-client rate limiting, kept deliberately small.
-//!
-//! One token bucket per client IP, refilled continuously, in a mutex-guarded
-//! map that is swept of idle entries as it goes. Good enough to keep one
-//! caller from monopolising a hosted instance; not a substitute for whatever
-//! sits in front of it in production.
-
-use std::collections::HashMap;
-use std::net::IpAddr;
-use std::sync::Mutex;
-use std::time::{Duration, Instant};
-
-pub struct RateLimiter {
-    per_minute: u32,
-    buckets: Mutex<HashMap<IpAddr, Bucket>>,
-}
-
-struct Bucket {
-    tokens: f64,
-    last: Instant,
-}
-
-impl RateLimiter {
-    /// `per_minute == 0` disables limiting.
-    pub fn new(per_minute: u32) -> Self {
-        Self { per_minute, buckets: Mutex::new(HashMap::new()) }
-    }
-
-    /// Take one token for `client`, or say how long until one is available.
-    pub fn check(&self, client: IpAddr) -> Result<(), Duration> {
-        if self.per_minute == 0 {
-            return Ok(());
-        }
-        let capacity = self.per_minute as f64;
-        let per_second = capacity / 60.0;
-        let now = Instant::now();
-
-        let mut buckets = self.buckets.lock().unwrap_or_else(|e| e.into_inner());
-
-        // Sweep buckets that have been idle long enough to be full again; there is nothing
-        // to remember about them.
-        if buckets.len() > 1024 {
-            buckets.retain(|_, b| now.duration_since(b.last).as_secs_f64() * per_second < capacity);
-        }
-
-        let bucket = buckets.entry(client).or_insert(Bucket { tokens: capacity, last: now });
-        let elapsed = now.duration_since(bucket.last).as_secs_f64();
-        bucket.tokens = (bucket.tokens + elapsed * per_second).min(capacity);
-        bucket.last = now;
-
-        if bucket.tokens >= 1.0 {
-            bucket.tokens -= 1.0;
-            Ok(())
-        } else {
-            let wait = (1.0 - bucket.tokens) / per_second;
-            Err(Duration::from_secs_f64(wait.max(0.001)))
-        }
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn a_full_bucket_then_a_wait() {
-        let limiter = RateLimiter::new(3);
-        let ip: IpAddr = "203.0.113.5".parse().unwrap();
-        assert!(limiter.check(ip).is_ok());
-        assert!(limiter.check(ip).is_ok());
-        assert!(limiter.check(ip).is_ok());
-        let wait = limiter.check(ip).expect_err("fourth call in a burst should wait");
-        assert!(wait > Duration::ZERO && wait <= Duration::from_secs(20));
-    }
-
-    #[test]
-    fn clients_are_independent_and_zero_disables() {
-        let limiter = RateLimiter::new(1);
-        let a: IpAddr = "203.0.113.5".parse().unwrap();
-        let b: IpAddr = "203.0.113.6".parse().unwrap();
-        assert!(limiter.check(a).is_ok());
-        assert!(limiter.check(a).is_err());
-        assert!(limiter.check(b).is_ok());
-
-        let unlimited = RateLimiter::new(0);
-        for _ in 0..1000 {
-            assert!(unlimited.check(a).is_ok());
-        }
-    }
-}
@@ -1,248 +0,0 @@
-//! yaak-web: the network half of Yaak in a browser.
-//!
-//! A tab can't see a response the way a desktop app can — CORS hides most
-//! headers, redirects are followed silently, there is no timeline. So the tab
-//! renders the request and hands it here; this process puts it on the network
-//! with the desktop's own engine and streams back everything that happened,
-//! for the tab to store. It keeps nothing: no database, no files, no session.
-//!
-//! One binary, configured by flags or `YAAK_WEB_*` environment variables.
-//! See README.md for running and deploying it, and `guard.rs` for what it
-//! refuses to talk to.
-
-mod config;
-mod guard;
-mod limits;
-mod send;
-mod wire;
-
-use axum::Router;
-use axum::body::Body;
-use axum::extract::{ConnectInfo, DefaultBodyLimit, Request, State};
-use axum::http::{HeaderMap, HeaderValue, Method, StatusCode, header};
-use axum::middleware::{self, Next};
-use axum::response::{IntoResponse, Json, Response};
-use axum::routing::{get, post};
-use clap::Parser;
-use config::Config;
-use guard::DestinationPolicy;
-use limits::RateLimiter;
-use log::{info, warn};
-use send::{Refusal, SendLimits};
-use serde_json::json;
-use std::net::{IpAddr, SocketAddr};
-use std::path::Path;
-use std::sync::Arc;
-use std::time::{Duration, Instant};
-use tokio::sync::Semaphore;
-use tower_http::compression::CompressionLayer;
-use tower_http::cors::{AllowOrigin, CorsLayer};
-use tower_http::services::{ServeDir, ServeFile};
-use wire::SendRequest;
-
-#[derive(Clone)]
-struct AppState {
-    config: Arc<Config>,
-    limits: Arc<SendLimits>,
-    rate_limiter: Arc<RateLimiter>,
-    in_flight: Arc<Semaphore>,
-}
-
-#[tokio::main]
-async fn main() {
-    env_logger::Builder::from_env(env_logger::Env::default().default_filter_or("info")).init();
-    let config = Config::parse();
-
-    let policy = DestinationPolicy::new(config.allow_private_networks);
-    if config.allow_private_networks {
-        warn!(
-            "Sends to loopback, private and link-local addresses are ALLOWED. Only run this way \
-             on an instance strangers cannot reach"
-        );
-    }
-    let state = AppState {
-        limits: Arc::new(SendLimits {
-            policy,
-            max_response_bytes: config.max_response_bytes,
-            max_timeout: Duration::from_secs(config.max_timeout_secs),
-        }),
-        rate_limiter: Arc::new(RateLimiter::new(config.rate_limit_per_minute)),
-        in_flight: Arc::new(Semaphore::new(config.max_concurrent)),
-        config: Arc::new(config),
-    };
-
-    let cors = CorsLayer::new()
-        .allow_methods([Method::GET, Method::POST, Method::OPTIONS])
-        .allow_headers([header::CONTENT_TYPE])
-        .allow_origin(allowed_origins(&state.config.allowed_origins));
-
-    let api = Router::new()
-        .route("/v1/health", get(health))
-        // A WebSocket or gRPC relay would sit beside this as `/v1/ws/relay` and `/v1/grpc/relay`
-        // on the same router, behind the same policy, limits and auth. Not built; see README.
-        .route("/v1/http/send", post(send_http))
-        .layer(DefaultBodyLimit::max(state.config.max_request_bytes))
-        .layer(cors)
-        .with_state(state.clone());
-
-    let app = match &state.config.serve {
-        Some(dir) => {
-            info!("Serving the web client from {}", dir.display());
-            api.merge(web_router(dir))
-        }
-        None => api,
-    };
-
-    let bind = state.config.bind;
-    let listener = tokio::net::TcpListener::bind(bind).await.unwrap_or_else(|e| {
-        eprintln!("Failed to bind {bind}: {e}");
-        std::process::exit(1);
-    });
-    info!(
-        "yaak-web listening on http://{bind} (rate limit: {}/min)",
-        state.config.rate_limit_per_minute,
-    );
-
-    axum::serve(listener, app.into_make_service_with_connect_info::<SocketAddr>())
-        .with_graceful_shutdown(async {
-            let _ = tokio::signal::ctrl_c().await;
-            info!("Shutting down");
-        })
-        .await
-        .expect("server error");
-}
-
-/// The built web client, served on the same origin as the API.
-///
-/// This is what makes a single container zero-configuration: the tab's send URL is a path on
-/// the page's own origin, so there is no CORS, no second service and no URL to bake in. It is
-/// only a file server — a send behaves exactly as it does without this flag.
-///
-/// Merged as a fallback, so the `/v1` routes are matched first and a request that matches no
-/// file at all gets `index.html` (the app routes client-side; a deep link must survive a
-/// refresh).
-fn web_router(dir: &Path) -> Router {
-    let index = ServeFile::new(dir.join("index.html"));
-    Router::new()
-        // `fallback`, not `not_found_service`: the app's own routes are real pages, so
-        // index.html is served with the 200 the browser expects, not a 404 carrying HTML.
-        .fallback_service(ServeDir::new(dir).fallback(index))
-        .layer(middleware::from_fn(cache_control))
-        .layer(CompressionLayer::new())
-}
-
-/// Vite gives everything in `/assets` a content-hashed name, so those can be cached forever.
-/// Everything else — `index.html` above all, including the copy served for an unknown path —
-/// must be revalidated, or a browser keeps serving the deploy before last.
-async fn cache_control(req: Request, next: Next) -> Response {
-    let hashed_name = req.uri().path().starts_with("/assets/");
-    let mut res = next.run(req).await;
-    if !res.status().is_success() {
-        return res;
-    }
-    let is_html = res
-        .headers()
-        .get(header::CONTENT_TYPE)
-        .and_then(|v| v.to_str().ok())
-        .is_some_and(|v| v.starts_with("text/html"));
-    let value =
-        if hashed_name && !is_html { "public, max-age=31536000, immutable" } else { "no-cache" };
-    res.headers_mut().insert(header::CACHE_CONTROL, HeaderValue::from_static(value));
-    res
-}
-
-fn allowed_origins(origins: &[String]) -> AllowOrigin {
-    if origins.iter().any(|o| o.trim() == "*") {
-        return AllowOrigin::any();
-    }
-    let parsed: Vec<HeaderValue> =
-        origins.iter().filter_map(|o| HeaderValue::from_str(o.trim()).ok()).collect();
-    AllowOrigin::list(parsed)
-}
-
-async fn health(State(state): State<AppState>) -> impl IntoResponse {
-    Json(json!({
-        "ok": true,
-        "version": env!("CARGO_PKG_VERSION"),
-        "maxResponseBytes": state.config.max_response_bytes,
-        "maxTimeoutSecs": state.config.max_timeout_secs,
-    }))
-}
-
-fn error_response(status: StatusCode, message: impl Into<String>) -> Response {
-    let message = message.into();
-    (status, Json(json!({ "error": message }))).into_response()
-}
-
-/// The client's address for rate limiting: the socket peer, or the first `X-Forwarded-For`
-/// hop when the operator has said the header can be trusted.
-fn client_ip(config: &Config, headers: &HeaderMap, peer: SocketAddr) -> IpAddr {
-    if config.trust_forwarded_for
-        && let Some(forwarded) = headers.get("x-forwarded-for").and_then(|v| v.to_str().ok())
-        && let Some(first) = forwarded.split(',').next()
-        && let Ok(ip) = first.trim().parse::<IpAddr>()
-    {
-        return ip;
-    }
-    peer.ip()
-}
-
-async fn send_http(
-    State(state): State<AppState>,
-    ConnectInfo(peer): ConnectInfo<SocketAddr>,
-    headers: HeaderMap,
-    Json(body): Json<SendRequest>,
-) -> Response {
-    let ip = client_ip(&state.config, &headers, peer);
-    if let Err(wait) = state.rate_limiter.check(ip) {
-        warn!("Rate limited {ip}");
-        let mut res = error_response(
-            StatusCode::TOO_MANY_REQUESTS,
-            format!("Rate limit reached; try again in {}s", wait.as_secs().max(1)),
-        );
-        res.headers_mut().insert(header::RETRY_AFTER, HeaderValue::from(wait.as_secs().max(1)));
-        return res;
-    }
-
-    let Ok(permit) = state.in_flight.clone().try_acquire_owned() else {
-        warn!("At capacity; refusing {ip}");
-        return error_response(StatusCode::SERVICE_UNAVAILABLE, "This server is at capacity");
-    };
-
-    let prepared = match send::prepare(state.limits.clone(), body).await {
-        Ok(p) => p,
-        Err(Refusal::Unsupported(m)) => return error_response(StatusCode::BAD_REQUEST, m),
-        Err(Refusal::Invalid(m)) => return error_response(StatusCode::BAD_REQUEST, m),
-        Err(Refusal::Destination(m)) => {
-            warn!("Refused send from {ip}: {m}");
-            return error_response(StatusCode::FORBIDDEN, m);
-        }
-    };
-
-    let description = prepared.describe();
-    info!("{ip} -> {description}");
-    let started = Instant::now();
-
-    let (tx, rx) = tokio::sync::mpsc::channel(send::FRAME_CHANNEL_CAPACITY);
-    tokio::spawn(async move {
-        prepared.run(tx).await;
-        send::log_outcome(&description, started, "finished");
-        drop(permit);
-    });
-
-    let stream = tokio_stream_from(rx);
-    Response::builder()
-        .status(StatusCode::OK)
-        .header(header::CONTENT_TYPE, "application/x-ndjson")
-        .header(header::CACHE_CONTROL, "no-store")
-        // Some reverse proxies buffer streamed responses unless told not to
-        .header("x-accel-buffering", "no")
-        .body(Body::from_stream(stream))
-        .expect("valid response")
-}
-
-fn tokio_stream_from<T: Send + 'static>(
-    mut rx: tokio::sync::mpsc::Receiver<T>,
-) -> impl futures_util::Stream<Item = T> + Send + 'static {
-    futures_util::stream::poll_fn(move |cx| rx.poll_recv(cx))
-}
@@ -1,358 +0,0 @@
-//! The one thing this binary does: execute a rendered request and stream back what happened.
-//!
-//! This is the "execute" half of the desktop's `send_http_request` — the part after rendering
-//! and before storage — driven through the same `HttpTransaction` the desktop drives, with the
-//! same redirect loop, cookie jar, decompression and timeline events. Everything the desktop
-//! would write to its database is written to the reply stream instead, and the tab stores it.
-
-use crate::guard::{DestinationPolicy, GuardedSender};
-use crate::wire::{Frame, SendRequest};
-use base64::Engine;
-use bytes::Bytes;
-use log::{info, warn};
-use std::convert::Infallible;
-use std::sync::Arc;
-use std::sync::atomic::{AtomicU64, Ordering};
-use std::time::{Duration, Instant};
-use tokio::io::AsyncReadExt;
-use tokio::sync::{mpsc, watch};
-use yaak_http::client::{HttpConnectionOptions, HttpConnectionProxySetting};
-use yaak_http::cookies::CookieStore;
-use yaak_http::sender::{HttpResponseEvent, ReqwestSender};
-use yaak_http::transaction::HttpTransaction;
-use yaak_http::types::{SendableHttpRequest, SendableHttpRequestOptions};
-use yaak_models::models::HttpResponseHeader;
-
-/// How many frames may sit unread by the client before body reading pauses. Backpressure, so a
-/// slow tab slows the upstream read rather than filling memory.
-pub const FRAME_CHANNEL_CAPACITY: usize = 64;
-const EVENT_CHANNEL_CAPACITY: usize = 256;
-const BODY_READ_CHUNK: usize = 64 * 1024;
-
-/// What a send needs from the process, beyond the request itself.
-pub struct SendLimits {
-    pub policy: DestinationPolicy,
-    pub max_response_bytes: usize,
-    pub max_timeout: Duration,
-}
-
-/// Why a send was refused before anything was put on the network. Distinct from a failure
-/// mid-stream: these become a plain HTTP error, not a stream with an error frame.
-#[derive(Debug)]
-pub enum Refusal {
-    /// The request asks for something a browser-originated send cannot mean.
-    Unsupported(String),
-    /// The destination is not one this server will talk to.
-    Destination(String),
-    /// The request could not be turned into something sendable.
-    Invalid(String),
-}
-
-pub type FrameSender = mpsc::Sender<Result<Bytes, Infallible>>;
-
-/// Check and prepare a send, then hand back the task that runs it. Refusals happen here, before
-/// the caller has committed to a streaming response.
-pub async fn prepare(limits: Arc<SendLimits>, send: SendRequest) -> Result<PreparedSend, Refusal> {
-    let request = send.request;
-
-    // The engine reads files for these body types. There are no files here that a browser tab
-    // could legitimately mean, and letting a request name a path on this machine would be a
-    // local file read for anyone who can reach the server.
-    if request.body_type.as_deref() == Some("binary") {
-        return Err(Refusal::Unsupported(
-            "Binary file bodies can't be sent from the browser: the server has no access to your files"
-                .to_string(),
-        ));
-    }
-    if request.body_type.as_deref() == Some("multipart/form-data") {
-        let names_a_file =
-            request.body.get("form").and_then(|f| f.as_array()).is_some_and(|entries| {
-                entries.iter().any(|e| {
-                    e.get("enabled").and_then(|v| v.as_bool()).unwrap_or(true)
-                        && e.get("file").and_then(|v| v.as_str()).is_some_and(|f| !f.is_empty())
-                })
-            });
-        if names_a_file {
-            return Err(Refusal::Unsupported(
-                "Multipart file fields can't be sent from the browser: the server has no access to your files"
-                    .to_string(),
-            ));
-        }
-    }
-
-    // The tab's requested timeout, capped. Zero means "none", which here means the cap.
-    let requested = if send.settings.timeout_ms > 0 {
-        Some(Duration::from_millis(send.settings.timeout_ms as u64))
-    } else {
-        None
-    };
-    let timeout = requested.map_or(limits.max_timeout, |t| t.min(limits.max_timeout));
-    let timeout_capped = requested.is_none_or(|t| t > limits.max_timeout);
-
-    let sendable = SendableHttpRequest::from_http_request(
-        &request,
-        SendableHttpRequestOptions {
-            timeout: Some(timeout),
-            follow_redirects: send.settings.follow_redirects,
-        },
-    )
-    .await
-    .map_err(|e| Refusal::Invalid(e.to_string()))?;
-
-    // The first hop, checked up front so a bad destination is a clean refusal rather than a
-    // stream that opens and immediately errors. Every later hop is checked by GuardedSender.
-    limits.policy.check_url(&sendable.url).map_err(Refusal::Destination)?;
-
-    Ok(PreparedSend {
-        limits,
-        sendable,
-        settings: send.settings,
-        cookies: send.cookies,
-        timeout,
-        timeout_capped,
-    })
-}
-
-pub struct PreparedSend {
-    limits: Arc<SendLimits>,
-    sendable: SendableHttpRequest,
-    settings: yaak_models::models::HttpSendSettings,
-    cookies: Option<Vec<yaak_models::models::Cookie>>,
-    timeout: Duration,
-    timeout_capped: bool,
-}
-
-impl PreparedSend {
-    pub fn describe(&self) -> String {
-        format!("{} {}", self.sendable.method, self.sendable.url)
-    }
-
-    /// Run the send, writing frames to `frames` until the terminal frame. Returns when the
-    /// stream is complete or the client has gone away.
-    pub async fn run(mut self, frames: FrameSender) {
-        let cookie_store = self.cookies.take().map(CookieStore::from_cookies);
-        let store_for_result = cookie_store.clone();
-        let outcome = self.execute(frames.clone(), cookie_store).await;
-
-        let cookies = store_for_result.as_ref().map(|s| s.get_all_cookies());
-        let terminal = match outcome {
-            Ok(done) => Frame::Done {
-                elapsed: done.elapsed,
-                content_length: done.content_length,
-                content_length_compressed: done.content_length_compressed,
-                cookies,
-            },
-            Err(message) => Frame::Error { message, cookies },
-        };
-        let _ = write_frame(&frames, &terminal).await;
-    }
-
-    async fn execute(
-        self,
-        frames: FrameSender,
-        cookie_store: Option<CookieStore>,
-    ) -> Result<DoneStats, String> {
-        let limits = self.limits;
-
-        let (client, resolver) = HttpConnectionOptions {
-            id: uuid::Uuid::new_v4().to_string(),
-            validate_certificates: self.settings.validate_certificates,
-            http_version: self.settings.http_version,
-            // The proxy connects directly. Going through a system proxy would move DNS, and
-            // therefore the address check, somewhere this process can't see.
-            proxy: HttpConnectionProxySetting::Disabled,
-            client_certificate: None,
-            dns_overrides: Vec::new(),
-            address_filter: Some(limits.policy.address_filter()),
-        }
-        .build_client()
-        .map_err(|e| format!("Failed to build HTTP client: {e}"))?;
-
-        // Timeline events go into the same frame stream as everything else, as they happen.
-        // The desktop persists them from a task like this one; here the task serialises them.
-        let (event_tx, mut event_rx) = mpsc::channel::<HttpResponseEvent>(EVENT_CHANNEL_CAPACITY);
-        resolver.set_event_sender(Some(event_tx.clone())).await;
-        let dns_elapsed = Arc::new(AtomicU64::new(0));
-        let event_frames = frames.clone();
-        let event_dns = dns_elapsed.clone();
-        let event_task = tokio::spawn(async move {
-            while let Some(event) = event_rx.recv().await {
-                if let HttpResponseEvent::DnsResolved { duration, .. } = &event {
-                    event_dns.store(*duration, Ordering::Relaxed);
-                }
-                let frame = Frame::Event { event: event.into() };
-                if write_frame(&event_frames, &frame).await.is_err() {
-                    break;
-                }
-            }
-        });
-
-        // Cancellation: the client hanging up, or the overall deadline. The deadline exists
-        // because a per-hop timeout times each hop separately; ten slow redirects must not add
-        // up to ten timeouts.
-        let (cancel_tx, cancel_rx) = watch::channel(false);
-        let deadline = self.timeout * 2 + Duration::from_secs(5);
-        let deadline_cancel = cancel_tx.clone();
-        let deadline_task = tokio::spawn(async move {
-            tokio::time::sleep(deadline).await;
-            let _ = deadline_cancel.send(true);
-        });
-        let hangup_frames = frames.clone();
-        let hangup_task = tokio::spawn(async move {
-            hangup_frames.closed().await;
-            let _ = cancel_tx.send(true);
-        });
-
-        if self.timeout_capped {
-            let _ = event_tx.try_send(HttpResponseEvent::Info(format!(
-                "Timeout set to {:?} (this server's ceiling)",
-                self.timeout
-            )));
-        }
-
-        let sender = GuardedSender::new(ReqwestSender::with_client(client), limits.policy.clone());
-        let transaction = match cookie_store {
-            Some(store) => HttpTransaction::with_cookie_behavior(
-                sender,
-                store,
-                self.settings.send_cookies,
-                self.settings.store_cookies,
-            ),
-            None => HttpTransaction::new(sender),
-        };
-
-        let started_at = Instant::now();
-        let result = transaction
-            .execute_with_cancellation(self.sendable, cancel_rx.clone(), event_tx.clone())
-            .await;
-        resolver.set_event_sender(None).await;
-
-        let mut response = match result {
-            Ok(response) => response,
-            Err(err) => {
-                drop(event_tx);
-                let _ = event_task.await;
-                deadline_task.abort();
-                hangup_task.abort();
-                return Err(describe_error(&err));
-            }
-        };
-
-        let elapsed_headers = started_at.elapsed().as_millis() as u64;
-        let head = Frame::Response {
-            status: response.status,
-            status_reason: response.status_reason.clone(),
-            url: response.url.clone(),
-            remote_addr: response.remote_addr.clone(),
-            version: response.version.clone(),
-            headers: to_wire_headers(&response.headers),
-            request_headers: to_wire_headers(&response.request_headers),
-            content_length: response.content_length,
-            elapsed_headers,
-            elapsed_dns: dns_elapsed.load(Ordering::Relaxed),
-        };
-        write_frame(&frames, &head).await.map_err(|_| "Client went away".to_string())?;
-
-        let declared_length = response.content_length;
-        let mut body = response
-            .into_body_stream()
-            .map_err(|e| format!("Failed to read response body: {e}"))?;
-        let mut buf = vec![0u8; BODY_READ_CHUNK];
-        let mut total: usize = 0;
-        let mut cancel_rx = cancel_rx;
-        let base64 = base64::engine::general_purpose::STANDARD;
-
-        let read_result: Result<(), String> = loop {
-            if *cancel_rx.borrow() {
-                break Err("Request canceled".to_string());
-            }
-            let read = tokio::select! {
-                biased;
-                _ = cancel_rx.changed() => break Err("Request canceled".to_string()),
-                r = body.read(&mut buf) => r,
-            };
-            match read {
-                Ok(0) => break Ok(()),
-                Ok(n) => {
-                    total += n;
-                    if total > limits.max_response_bytes {
-                        break Err(format!(
-                            "Response body exceeds this server's limit of {} bytes",
-                            limits.max_response_bytes
-                        ));
-                    }
-                    let frame = Frame::Body { data: base64.encode(&buf[..n]) };
-                    if write_frame(&frames, &frame).await.is_err() {
-                        break Err("Client went away".to_string());
-                    }
-                }
-                Err(e) => break Err(format!("Failed to read response body: {e}")),
-            }
-        };
-        drop(body);
-
-        // Let the timeline drain before the terminal frame, so nothing arrives after "done".
-        drop(event_tx);
-        let _ = event_task.await;
-        deadline_task.abort();
-        hangup_task.abort();
-
-        read_result?;
-        Ok(DoneStats {
-            elapsed: started_at.elapsed().as_millis() as u64,
-            content_length: total as u64,
-            content_length_compressed: declared_length.unwrap_or(total as u64),
-        })
-    }
-}
-
-/// A send error as a sentence, not a debug dump.
-///
-/// A connection error from reqwest arrives wrapped several layers deep, and the layer that
-/// says something useful — "Refusing to connect to ::1: loopback" — is the innermost. The
-/// desktop shows the outer `Debug`; a stranger reading its reply deserves the reason.
-fn describe_error(err: &yaak_http::error::Error) -> String {
-    match err {
-        yaak_http::error::Error::Client(e) => {
-            let mut leaf: &dyn std::error::Error = e;
-            while let Some(next) = leaf.source() {
-                leaf = next;
-            }
-            let outer = e.to_string();
-            let inner = leaf.to_string();
-            if inner == outer { outer } else { format!("{outer}: {inner}") }
-        }
-        yaak_http::error::Error::RequestError(message) => format!("Request failed: {message}"),
-        other => other.to_string(),
-    }
-}
-
-struct DoneStats {
-    elapsed: u64,
-    content_length: u64,
-    content_length_compressed: u64,
-}
-
-fn to_wire_headers(headers: &[(String, String)]) -> Vec<HttpResponseHeader> {
-    headers
-        .iter()
-        .map(|(name, value)| HttpResponseHeader { name: name.clone(), value: value.clone() })
-        .collect()
-}
-
-async fn write_frame(frames: &FrameSender, frame: &Frame) -> Result<(), ()> {
-    let mut line = match serde_json::to_vec(frame) {
-        Ok(v) => v,
-        Err(e) => {
-            warn!("Failed to serialize frame: {e}");
-            return Err(());
-        }
-    };
-    line.push(b'\n');
-    frames.send(Ok(Bytes::from(line))).await.map_err(|_| ())
-}
-
-/// Log a finished send at info: destination, outcome, and how long, never the content.
-pub fn log_outcome(description: &str, started: Instant, outcome: &str) {
-    info!("{description} -> {outcome} in {:?}", started.elapsed());
-}
@@ -1,97 +0,0 @@
-//! What crosses the wire between a tab and this server.
-//!
-//! One `POST /v1/http/send` carries a request the tab has already rendered —
-//! templates resolved, inheritance applied — plus the send settings and the
-//! cookies the send starts with. The reply is a stream of newline-delimited
-//! JSON frames: timeline events as they happen, the response head as soon as
-//! headers arrive, body chunks as they are read, and one terminal frame.
-//!
-//! Nothing here names a workspace, a request id, or a response id. The server
-//! does not know what the tab will call this response; it only knows what came
-//! back.
-//!
-//! The TypeScript side of this contract is generated from these types into
-//! `bindings/` (`cargo test -p yaak-web`) and published to the tab as
-//! `@yaakapp-internal/web`, so a change here is a type error there.
-
-use serde::{Deserialize, Serialize};
-use ts_rs::TS;
-use yaak_models::models::{
-    Cookie, HttpRequest, HttpResponseEventData, HttpResponseHeader, HttpSendSettings,
-};
-
-/// The body of `POST /v1/http/send`.
-#[derive(Deserialize, Debug, TS)]
-#[serde(rename_all = "camelCase")]
-#[ts(export, export_to = "gen_web.ts")]
-pub struct SendRequest {
-    /// The request to send, in the desktop's own model shape but with every template already
-    /// rendered by the tab. The server builds the URL, headers and body from it exactly the way
-    /// the desktop does after rendering.
-    pub request: HttpRequest,
-    /// The resolved settings, values only. Where they came from is the tab's to record in
-    /// its timeline; the server only needs to obey them.
-    pub settings: HttpSendSettings,
-    /// The cookies to start with. `None` means no jar at all: nothing sent, nothing kept.
-    #[serde(default)]
-    pub cookies: Option<Vec<Cookie>>,
-}
-
-/// One line of the reply stream. Tags are snake_case like the timeline event tags; fields are
-/// camelCase like every model the tab stores.
-#[derive(Serialize, Debug, TS)]
-#[serde(
-    tag = "type",
-    rename_all = "snake_case",
-    rename_all_fields = "camelCase"
-)]
-#[ts(export, export_to = "gen_web.ts")]
-pub enum Frame {
-    /// A timeline event, in the same shape the desktop stores. Interleaved with everything
-    /// else in the order the engine produced it.
-    Event { event: HttpResponseEventData },
-    /// The response head. Sent once, as soon as the final hop's headers are in — before any of
-    /// the body — so the tab can show status and headers while the body streams.
-    Response {
-        status: u16,
-        status_reason: Option<String>,
-        /// The URL that answered, after redirects.
-        url: String,
-        remote_addr: Option<String>,
-        version: Option<String>,
-        headers: Vec<HttpResponseHeader>,
-        /// The headers that were actually sent on the final hop, cookies and all.
-        request_headers: Vec<HttpResponseHeader>,
-        /// `Content-Length` as declared by the server, if it declared one.
-        #[ts(type = "number | null")]
-        content_length: Option<u64>,
-        /// Milliseconds from the start of the send to the response head.
-        #[ts(type = "number")]
-        elapsed_headers: u64,
-        /// Milliseconds spent in DNS on the last lookup, or zero.
-        #[ts(type = "number")]
-        elapsed_dns: u64,
-    },
-    /// A piece of the response body, decompressed, base64-encoded.
-    Body { data: String },
-    /// The send finished. The last frame on a successful stream.
-    Done {
-        /// Milliseconds from the start of the send to the end of the body.
-        #[ts(type = "number")]
-        elapsed: u64,
-        /// Bytes of body relayed, after decompression.
-        #[ts(type = "number")]
-        content_length: u64,
-        /// Bytes on the wire as declared by the server, or the relayed size when unknown.
-        #[ts(type = "number")]
-        content_length_compressed: u64,
-        /// The jar as the send left it, for the tab to persist. `None` when the tab sent none.
-        cookies: Option<Vec<Cookie>>,
-    },
-    /// The send failed. The last frame on a failed stream. Cookies collected before the failure
-    /// still come back — the transaction may have set some before the hop that failed.
-    Error {
-        message: String,
-        cookies: Option<Vec<Cookie>>,
-    },
-}
@@ -88,7 +88,6 @@ yaak-grpc = { workspace = true }
 yaak-http = { workspace = true }
 yaak-license = { workspace = true, optional = true }
 yaak-mac-window = { workspace = true }
-yaak-lifecycle = { workspace = true }
 yaak-models = { workspace = true }
 yaak-plugins = { workspace = true }
 yaak-sse = { workspace = true }
@@ -1,37 +1,15 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.

-export type PluginUpdateInfo = { name: string; currentVersion: string; latestVersion: string };
+export type PluginUpdateInfo = { name: string, currentVersion: string, latestVersion: string, };

-export type PluginUpdateNotification = { updateCount: number; plugins: Array<PluginUpdateInfo> };
+export type PluginUpdateNotification = { updateCount: number, plugins: Array<PluginUpdateInfo>, };

-export type UpdateInfo = {
-  replyEventId: string;
-  version: string;
-  downloaded: boolean;
-  /**
-   * How this update gets applied. Anything but `Integrated` means the app can't do it
-   * itself and the user is told how to update instead.
-   */
-  install: UpdateInstall;
-};
+export type UpdateInfo = { replyEventId: string, version: string, downloaded: boolean, };

-/**
- * How an update can be applied to this install.
- */
-export type UpdateInstall = "integrated" | "flatpak" | "manual";
-
-export type UpdateResponse = { type: "ack" } | { type: "action"; action: UpdateResponseAction };
+export type UpdateResponse = { "type": "ack" } | { "type": "action", action: UpdateResponseAction, };

 export type UpdateResponseAction = "install" | "skip";

-export type YaakNotification = {
-  timestamp: string;
-  timeout: number | null;
-  id: string;
-  title: string | null;
-  message: string;
-  color: string | null;
-  action: YaakNotificationAction | null;
-};
+export type YaakNotification = { timestamp: string, timeout: number | null, id: string, title: string | null, message: string, color: string | null, action: YaakNotificationAction | null, };

-export type YaakNotificationAction = { label: string; url: string };
+export type YaakNotificationAction = { label: string, url: string, };
@@ -0,0 +1,12 @@
+use crate::PluginContextExt;
+use crate::error::Result;
+use tauri::{Runtime, State, WebviewWindow};
+use yaak_plugins::events::GetThemesResponse;
+use yaak_plugins::manager::PluginManager;
+
+pub(crate) async fn cmd_get_themes<R: Runtime>(
+    window: WebviewWindow<R>,
+    plugin_manager: State<'_, PluginManager>,
+) -> Result<Vec<GetThemesResponse>> {
+    Ok(plugin_manager.get_themes(&window.plugin_context()).await?)
+}
@@ -2,11 +2,13 @@ use std::collections::BTreeMap;

 use crate::PluginContextExt;
 use crate::error::Result;
+use crate::models_ext::QueryManagerExt;
 use KeyAndValueRef::{Ascii, Binary};
-use tauri::{Runtime, WebviewWindow};
+use tauri::{Manager, Runtime, WebviewWindow};
 use yaak_grpc::{KeyAndValueRef, MetadataMap};
 use yaak_models::models::GrpcRequest;
 use yaak_plugins::events::{CallHttpAuthenticationRequest, HttpHeader};
+use yaak_plugins::manager::PluginManager;

 pub(crate) fn metadata_to_map(metadata: MetadataMap) -> BTreeMap<String, String> {
    let mut entries = BTreeMap::new();
@@ -19,12 +21,29 @@ pub(crate) fn metadata_to_map(metadata: MetadataMap) -> BTreeMap<String, String>
    entries
 }

+pub(crate) fn resolve_grpc_request<R: Runtime>(
+    window: &WebviewWindow<R>,
+    request: &GrpcRequest,
+) -> Result<(GrpcRequest, String)> {
+    let mut new_request = request.clone();
+
+    let (authentication_type, authentication, authentication_context_id) =
+        window.db().resolve_auth_for_grpc_request(request)?;
+    new_request.authentication_type = authentication_type;
+    new_request.authentication = authentication;
+
+    let metadata = window.db().resolve_metadata_for_grpc_request(request)?;
+    new_request.metadata = metadata;
+
+    Ok((new_request, authentication_context_id))
+}
+
 pub(crate) async fn build_metadata<R: Runtime>(
    window: &WebviewWindow<R>,
    request: &GrpcRequest,
    authentication_context_id: &str,
 ) -> Result<BTreeMap<String, String>> {
-    let plugin_manager = crate::plugins_ext::plugin_manager(window).await?;
+    let plugin_manager = window.state::<PluginManager>();
    let mut metadata = BTreeMap::new();

    // Add the rest of metadata
@@ -14,6 +14,7 @@ use yaak_http::manager::HttpConnectionManager;
 use yaak_models::models::{CookieJar, Environment, HttpRequest, HttpResponse, HttpResponseState};
 use yaak_models::util::UpdateSource;
 use yaak_plugins::events::PluginContext;
+use yaak_plugins::manager::PluginManager;

 /// Context for managing response state during HTTP transactions.
 /// Handles both persisted responses (stored in DB) and ephemeral responses (in-memory only).
@@ -148,7 +149,7 @@ async fn send_http_request_inner<R: Runtime>(
    response_ctx: &mut ResponseContext<R>,
 ) -> Result<SentHttpRequest> {
    let app_handle = window.app_handle().clone();
-    let plugin_manager = Arc::new(crate::plugins_ext::plugin_manager(&app_handle).await?);
+    let plugin_manager = Arc::new((*app_handle.state::<PluginManager>()).clone());
    let encryption_manager = Arc::new((*app_handle.state::<EncryptionManager>()).clone());
    let connection_manager = app_handle.state::<HttpConnectionManager>();
    let environment_id = environment.map(|e| e.id);
@@ -177,3 +178,20 @@ async fn send_http_request_inner<R: Runtime>(

    Ok(SentHttpRequest { response: result.response, body: result.response_body })
 }
+
+pub fn resolve_http_request<R: Runtime>(
+    window: &WebviewWindow<R>,
+    request: &HttpRequest,
+) -> Result<(HttpRequest, String)> {
+    let mut new_request = request.clone();
+
+    let (authentication_type, authentication, authentication_context_id) =
+        window.db().resolve_auth_for_http_request(request)?;
+    new_request.authentication_type = authentication_type;
+    new_request.authentication = authentication;
+
+    let headers = window.db().resolve_headers_for_http_request(request)?;
+    new_request.headers = headers;
+
+    Ok((new_request, authentication_context_id))
+}
@@ -4,84 +4,53 @@ use crate::models_ext::QueryManagerExt;
 use std::fs::read_to_string;
 use std::io::ErrorKind;
 use tauri::{Manager, Runtime, WebviewWindow};
-use yaak::import::{self, PlanImportDataParams};
+use yaak::import::{self, ImportDataParams};
 use yaak_api::{ApiClientKind, yaak_api_client};
-use yaak_models::util::{BatchUpsertResult, ImportDestination, ImportOrigin, ImportPlan};
+use yaak_core::WorkspaceContext;
+use yaak_models::util::BatchUpsertResult;
+use yaak_plugins::manager::PluginManager;
+use yaak_tauri_utils::window::WorkspaceWindowTrait;

 pub(crate) async fn import_data<R: Runtime>(
    window: &WebviewWindow<R>,
    file_path: &str,
-    origin: Option<ImportOrigin>,
 ) -> Result<BatchUpsertResult> {
    let contents = read_import_file(file_path)?;
-    let plan =
-        plan_import_contents(window, &contents, ImportDestination::NewWorkspace, origin).await?;
-    commit_import(window, plan)
+    import_contents(window, &contents).await
 }

-pub(crate) async fn plan_import_data<R: Runtime>(
-    window: &WebviewWindow<R>,
-    file_path: &str,
-    destination: ImportDestination,
-) -> Result<ImportPlan> {
-    let contents = read_import_file(file_path)?;
-    plan_import_contents(window, &contents, destination, Some(file_origin(file_path))).await
-}
-
-pub(crate) async fn plan_import_url<R: Runtime>(
+pub(crate) async fn import_url<R: Runtime>(
    window: &WebviewWindow<R>,
    url: &str,
-    destination: ImportDestination,
-) -> Result<ImportPlan> {
-    let url = normalize_import_url(url)?;
-    let contents = fetch_import_url(window, &url).await?;
-    plan_import_contents(window, &contents, destination, Some(url_origin(&url))).await
+) -> Result<BatchUpsertResult> {
+    let contents = fetch_import_url(window, url).await?;
+    import_contents(window, &contents).await
 }

-async fn plan_import_contents<R: Runtime>(
+async fn import_contents<R: Runtime>(
    window: &WebviewWindow<R>,
    contents: &str,
-    destination: ImportDestination,
-    origin: Option<ImportOrigin>,
-) -> Result<ImportPlan> {
-    let plugin_manager = crate::plugins_ext::plugin_manager(window).await?;
+) -> Result<BatchUpsertResult> {
+    let plugin_manager = window.state::<PluginManager>();
    let query_manager = window.db_manager();
    let plugin_context = window.plugin_context();
+    let workspace_context = WorkspaceContext {
+        workspace_id: window.workspace_id(),
+        environment_id: window.environment_id(),
+        cookie_jar_id: window.cookie_jar_id(),
+        request_id: None,
+    };

-    Ok(import::plan_import_data(PlanImportDataParams {
+    Ok(import::import_data(ImportDataParams {
        query_manager: &query_manager,
        plugin_manager: &plugin_manager,
        plugin_context: &plugin_context,
-        destination,
+        workspace_context,
        contents,
-        origin,
    })
    .await?)
 }

-/// Canonicalize so re-importing the same file through a different spelling of its path still
-/// matches the linked source.
-pub(crate) fn file_origin(file_path: &str) -> ImportOrigin {
-    let path = std::path::Path::new(file_path);
-    let canonical = std::fs::canonicalize(path).unwrap_or_else(|_| path.to_path_buf());
-    let label = canonical
-        .file_name()
-        .map(|name| name.to_string_lossy().to_string())
-        .unwrap_or_else(|| file_path.to_string());
-    ImportOrigin { origin: canonical.to_string_lossy().to_string(), label }
-}
-
-pub(crate) fn url_origin(url: &str) -> ImportOrigin {
-    ImportOrigin { origin: url.to_string(), label: url.to_string() }
-}
-
-pub(crate) fn commit_import<R: Runtime>(
-    window: &WebviewWindow<R>,
-    plan: ImportPlan,
-) -> Result<BatchUpsertResult> {
-    Ok(import::commit_import_plan(&window.db_manager(), plan)?)
-}
-
 /// Download an importable document (OpenAPI, Postman, Insomnia, …) so it can be fed to the same
 /// pipeline as a file on disk.
 ///
@@ -110,7 +79,7 @@ async fn fetch_import_url<R: Runtime>(window: &WebviewWindow<R>, url: &str) -> R
        .map_err(|err| Error::GenericError(format!("Failed to read response from {url}: {err}")))
 }

-pub(crate) fn normalize_import_url(url: &str) -> Result<String> {
+fn normalize_import_url(url: &str) -> Result<String> {
    let url = url.trim();
    if url.is_empty() {
        return Err(Error::GenericError("Import URL must not be empty".to_string()));
@@ -10,11 +10,12 @@ use tauri::plugin::TauriPlugin;
 use tauri::{Emitter, Manager, Runtime, State};
 use tauri_plugin_dialog::{DialogExt, MessageDialogKind};
 use yaak_models::blob_manager::BlobManager;
-use yaak_models::client_db::{ClientDb, WriteDb};
+use yaak_models::client_db::ClientDb;
 use yaak_models::error::Result;
 use yaak_models::query_manager::QueryManager;
 use yaak_models::util::{ModelPayload, UpdateSource};

+const MODEL_CHANGES_RETENTION_HOURS: i64 = 1;
 const MODEL_CHANGES_POLL_INTERVAL_MS: u64 = 1000;
 const MODEL_CHANGES_POLL_BATCH_SIZE: usize = 200;

@@ -95,7 +96,7 @@ pub trait QueryManagerExt<'a, R> {
    fn db(&'a self) -> ClientDb<'a>;
    fn with_tx<F, T>(&'a self, func: F) -> Result<T>
    where
-        F: FnOnce(&WriteDb) -> Result<T>;
+        F: FnOnce(&ClientDb) -> Result<T>;
 }

 impl<'a, R: Runtime, M: Manager<R>> QueryManagerExt<'a, R> for M {
@@ -110,7 +111,7 @@ impl<'a, R: Runtime, M: Manager<R>> QueryManagerExt<'a, R> for M {

    fn with_tx<F, T>(&'a self, func: F) -> Result<T>
    where
-        F: FnOnce(&WriteDb) -> Result<T>,
+        F: FnOnce(&ClientDb) -> Result<T>,
    {
        let qm = self.state::<QueryManager>();
        qm.inner().with_tx(func)
@@ -151,11 +152,30 @@ pub fn init<R: Runtime>() -> TauriPlugin<R> {
                    }
                };

+            let db = query_manager.connect();
+            if let Err(err) = db.prune_model_changes_older_than_hours(MODEL_CHANGES_RETENTION_HOURS)
+            {
+                error!("Failed to prune model_changes rows on startup: {err:?}");
+            }
            // Only stream writes that happen after this app launch.
            let cursor = ModelChangeCursor::from_launch_time();

            let poll_query_manager = query_manager.clone();

+            // GC response bodies orphaned by cascade deletes, which historically
+            // didn't clean the blob DB or responses directory
+            let gc_query_manager = query_manager.clone();
+            let gc_blob_manager = blob_manager.clone();
+            let gc_responses_dir = app_path.join("responses");
+            tauri::async_runtime::spawn_blocking(move || {
+                let db = gc_query_manager.connect();
+                match db.delete_orphaned_response_bodies(&gc_blob_manager, &gc_responses_dir) {
+                    Ok(0) => {}
+                    Ok(n) => log::info!("Deleted {n} orphaned response bodies"),
+                    Err(e) => error!("Failed to delete orphaned response bodies: {e:?}"),
+                }
+            });
+
            app_handle.manage(query_manager);
            app_handle.manage(blob_manager);

@@ -55,15 +55,12 @@ impl YaakNotifier {
        seen.push(id.to_string());
        debug!("Marked notification as seen {}", id);
        let seen_json = serde_json::to_string(&seen)?;
-        window.with_tx(|tx| {
-            tx.set_key_value_raw(
-                KV_NAMESPACE,
-                KV_KEY,
-                seen_json.as_str(),
-                &UpdateSource::from_window_label(window.label()),
-            );
-            Ok(())
-        })?;
+        window.db().set_key_value_raw(
+            KV_NAMESPACE,
+            KV_KEY,
+            seen_json.as_str(),
+            &UpdateSource::from_window_label(window.label()),
+        );
        Ok(())
    }
Author	SHA1	Message	Date
Gregory Schier	0f8413c441	Read OAuth 2.0 token responses from the send instead of the filesystem Both token requests opened HttpResponse.bodyPath with readFileSync, which ties the plugin to bodies living on a filesystem. The send now hands the body back, so they read it from there and keep working once bodies move into the blob DB and in the browser Worker, where there is no fs to read. text() on a response with no body returns "", which is what the bodyPath check produced, so an empty response still parses to {} rather than throwing.	2026-08-16 10:09:43 -07:00
Gregory Schier	0e14625e62	Hand the body back from send instead of holding it for a lookup Holding an unsaved body against its response id let a plugin stash the id and read it in a later call, which would throw only sometimes and only for ad-hoc sends. Documenting that was never going to be enough. send now returns the response and its body together, so there is nothing to stash: an unsaved body is a value you were handed. ctx.httpResponse .body() goes back to meaning one thing, a saved response read by id, and refuses ids it has no row for. Reading is identical either way, so no caller has to know which kind of send it made.	2026-08-16 10:07:44 -07:00
Gregory Schier	8c72538102	Say on send() that an unsaved response's body is call-scoped	2026-08-16 10:00:35 -07:00
Gregory Schier	ffa6a610b8	Return the body of a send that saved nothing Replaces the response-directory fallback with what the frontend already does for ephemeral sends: the engine hands the body back, because it is the only copy. Guessing at a file named for an id was the store reaching around its own abstraction, and it is exactly what must not survive the move to blob storage. The send reply carries the bytes when the engine returned them, and the runtime holds them for the rest of the call that sent them, so ctx.httpResponse.body() answers for a saved and an unsaved response the same way. Unsaved ones now report a real contentType too, taken from the response the send already handed back.	2026-08-16 09:54:56 -07:00
Gregory Schier	8b031db685	Read bodies of responses the engine never recorded A send with no request behind it — a plugin's ad-hoc ctx.httpRequest.send, GraphQL introspection — gets a generated id and a body file, but no row. Resolving purely through the database refused those, which would have broken auth-oauth2 the moment it moved off readFileSync, since every request it sends is ad-hoc. The store now falls back to the response directory when there is no row, accepting only ids shaped the way the engine generates them. Such a response has no stored headers, so contentType is null and text() decodes as UTF-8 — which is what the filesystem readers did anyway.	2026-08-16 09:35:03 -07:00
Gregory Schier	96c8a95094	Add a plugin API for reading HTTP response bodies Plugins read bodies by response id through ctx.httpResponse.body() instead of opening HttpResponse.bodyPath themselves. The accessors are named after fetch's, minus the single-use semantics, since the bytes are durable and re-reading should work. Underneath is a chunked pull over the existing plugin protocol, so the host can move bodies off the filesystem without plugins noticing. text() now decodes with the response's charset rather than assuming UTF-8, and the buffering accessors refuse past 32 MiB and point at chunks().	2026-08-16 09:20:29 -07:00