Use native TLS when certificate validation is disabled for legacy server compatibility

When "Validate TLS certificates" is disabled, use the OS native TLS stack
(Secure Transport/SChannel/OpenSSL) instead of rustls. This adds support for
TLS 1.0+ connections to legacy servers like IBM WebSphere, which rustls cannot
handle since it only implements TLS 1.2+.

Ref: https://yaak.app/feedback/posts/tls-handshake-eof-when-connecting-to-private-ibm-websphere-endpoint-works-when-s

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.claude/commands/release/generate-release-notes.md

@@ -37,6 +37,7 @@ The skill generates markdown-formatted release notes following this structure:
 
 **IMPORTANT**: Always add a blank lines around the markdown code fence and output the markdown code block last
 **IMPORTANT**: PRs by `@gschier` should not mention the @username
+**IMPORTANT**: These are app release notes. Exclude CLI-only changes (commits prefixed with `cli:` or only touching `crates-cli/`) since the CLI has its own release process.
 
 ## After Generating Release Notes
 

.codex/skills/release-generate-release-notes/SKILL.md

@@ -32,6 +32,7 @@ Generate formatted markdown release notes for a Yaak tag.
 - Keep a blank line before and after the code fence.
 - Output the markdown code block last.
 - Do not append `by @gschier` for PRs authored by `@gschier`.
+- These are app release notes. Exclude CLI-only changes (commits prefixed with `cli:` or only touching `crates-cli/`) since the CLI has its own release process.
 
 ## Release Creation Prompt
 

.github/workflows/release-app.yml

@@ -95,7 +95,7 @@ jobs:
       - name: Run JS Tests
         run: npm test
       - name: Run Rust Tests
-        run: cargo test --all
+        run: cargo test --all --exclude yaak-cli
 
       - name: Set version
         run: npm run replace-version

Cargo.lock

@@ -173,6 +173,17 @@ version = "1.0.98"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e16d2d3311acee920a9eb8d33b8cbc1787ce4a264e85f964c2404b969bdcd487"
 
+[[package]]
+name = "apollo-parser"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "947e21ff51879f8a40d7519dfe619268de2afba4042a8a43878276de3cb910f0"
+dependencies = [
+ "memchr",
+ "rowan",
+ "thiserror 2.0.17",
+]
+
 [[package]]
 name = "append-only-vec"
 version = "0.1.8"
@@ -1347,6 +1358,12 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "countme"
+version = "3.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7704b5fdd17b18ae31c4c1da5a2e0305a2bf17b5249300a9ee9ed7b72114c636"
+
 [[package]]
 name = "cow-utils"
 version = "0.1.3"
@@ -4556,7 +4573,7 @@ checksum = "75b1853bc34cadaa90aa09f95713d8b77ec0c0d3e2d90ccf7a74216f40d20850"
 dependencies = [
  "flate2",
  "postcard",
- "rustc-hash",
+ "rustc-hash 2.1.1",
  "serde",
  "serde_json",
  "thiserror 2.0.17",
@@ -4599,7 +4616,7 @@ dependencies = [
  "hashbrown 0.16.1",
  "oxc_data_structures",
  "oxc_estree",
- "rustc-hash",
+ "rustc-hash 2.1.1",
  "serde",
 ]
 
@@ -4655,7 +4672,7 @@ dependencies = [
  "oxc_index",
  "oxc_syntax",
  "petgraph 0.8.3",
- "rustc-hash",
+ "rustc-hash 2.1.1",
 ]
 
 [[package]]
@@ -4676,7 +4693,7 @@ dependencies = [
  "oxc_sourcemap",
  "oxc_span",
  "oxc_syntax",
- "rustc-hash",
+ "rustc-hash 2.1.1",
 ]
 
 [[package]]
@@ -4688,7 +4705,7 @@ dependencies = [
  "cow-utils",
  "oxc-browserslist",
  "oxc_syntax",
- "rustc-hash",
+ "rustc-hash 2.1.1",
  "serde",
 ]
 
@@ -4763,7 +4780,7 @@ dependencies = [
  "oxc_ecmascript",
  "oxc_span",
  "oxc_syntax",
- "rustc-hash",
+ "rustc-hash 2.1.1",
 ]
 
 [[package]]
@@ -4780,7 +4797,7 @@ dependencies = [
  "oxc_semantic",
  "oxc_span",
  "oxc_syntax",
- "rustc-hash",
+ "rustc-hash 2.1.1",
 ]
 
 [[package]]
@@ -4805,7 +4822,7 @@ dependencies = [
  "oxc_span",
  "oxc_syntax",
  "oxc_traverse",
- "rustc-hash",
+ "rustc-hash 2.1.1",
 ]
 
 [[package]]
@@ -4827,7 +4844,7 @@ dependencies = [
  "oxc_regular_expression",
  "oxc_span",
  "oxc_syntax",
- "rustc-hash",
+ "rustc-hash 2.1.1",
  "seq-macro",
 ]
 
@@ -4843,7 +4860,7 @@ dependencies = [
  "oxc_diagnostics",
  "oxc_span",
  "phf 0.13.1",
- "rustc-hash",
+ "rustc-hash 2.1.1",
  "unicode-id-start",
 ]
 
@@ -4860,7 +4877,7 @@ dependencies = [
  "once_cell",
  "papaya",
  "pnp",
- "rustc-hash",
+ "rustc-hash 2.1.1",
  "self_cell",
  "serde",
  "serde_json",
@@ -4890,7 +4907,7 @@ dependencies = [
  "oxc_span",
  "oxc_syntax",
  "phf 0.13.1",
- "rustc-hash",
+ "rustc-hash 2.1.1",
  "self_cell",
 ]
 
@@ -4902,7 +4919,7 @@ checksum = "c7f89482522f3cd820817d48ee4ade5b10822060d6e5e4d419f05f6d8bd29d70"
 dependencies = [
  "base64-simd",
  "json-escape-simd",
- "rustc-hash",
+ "rustc-hash 2.1.1",
  "serde",
  "serde_json",
 ]
@@ -4966,7 +4983,7 @@ dependencies = [
  "oxc_span",
  "oxc_syntax",
  "oxc_traverse",
- "rustc-hash",
+ "rustc-hash 2.1.1",
  "serde",
  "serde_json",
  "sha1",
@@ -4991,7 +5008,7 @@ dependencies = [
  "oxc_syntax",
  "oxc_transformer",
  "oxc_traverse",
- "rustc-hash",
+ "rustc-hash 2.1.1",
 ]
 
 [[package]]
@@ -5009,7 +5026,7 @@ dependencies = [
  "oxc_semantic",
  "oxc_span",
  "oxc_syntax",
- "rustc-hash",
+ "rustc-hash 2.1.1",
 ]
 
 [[package]]
@@ -5414,7 +5431,7 @@ dependencies = [
  "nodejs-built-in-modules",
  "pathdiff",
  "radix_trie",
- "rustc-hash",
+ "rustc-hash 2.1.1",
  "serde",
  "serde_json",
  "thiserror 2.0.17",
@@ -5533,6 +5550,18 @@ dependencies = [
  "termtree",
 ]
 
+[[package]]
+name = "pretty_graphql"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ea8c38ecedb3d28a998ea783469a78587f5f984d61226cf071f6979861e9e6a9"
+dependencies = [
+ "apollo-parser",
+ "memchr",
+ "rowan",
+ "tiny_pretty",
+]
+
 [[package]]
 name = "proc-macro-crate"
 version = "1.3.1"
@@ -5713,7 +5742,7 @@ dependencies = [
  "pin-project-lite",
  "quinn-proto",
  "quinn-udp",
- "rustc-hash",
+ "rustc-hash 2.1.1",
  "rustls",
  "socket2 0.5.10",
  "thiserror 2.0.17",
@@ -5733,7 +5762,7 @@ dependencies = [
  "lru-slab",
  "rand 0.9.1",
  "ring",
- "rustc-hash",
+ "rustc-hash 2.1.1",
  "rustls",
  "rustls-pki-types",
  "slab",
@@ -6227,7 +6256,7 @@ dependencies = [
  "rolldown_tracing",
  "rolldown_utils",
  "rolldown_watcher",
- "rustc-hash",
+ "rustc-hash 2.1.1",
  "serde",
  "serde_json",
  "string_wizard",
@@ -6317,7 +6346,7 @@ dependencies = [
  "rolldown_sourcemap",
  "rolldown_std_utils",
  "rolldown_utils",
- "rustc-hash",
+ "rustc-hash 2.1.1",
  "serde",
  "serde_json",
  "simdutf8",
@@ -6335,7 +6364,7 @@ dependencies = [
  "blake3",
  "dashmap",
  "rolldown_debug_action",
- "rustc-hash",
+ "rustc-hash 2.1.1",
  "serde",
  "serde_json",
  "tracing",
@@ -6392,7 +6421,7 @@ dependencies = [
  "rolldown-ariadne",
  "rolldown_utils",
  "ropey",
- "rustc-hash",
+ "rustc-hash 2.1.1",
  "sugar_path",
 ]
 
@@ -6426,7 +6455,7 @@ dependencies = [
  "rolldown_resolver",
  "rolldown_sourcemap",
  "rolldown_utils",
- "rustc-hash",
+ "rustc-hash 2.1.1",
  "serde",
  "serde_json",
  "string_wizard",
@@ -6446,7 +6475,7 @@ dependencies = [
  "rolldown_common",
  "rolldown_plugin",
  "rolldown_utils",
- "rustc-hash",
+ "rustc-hash 2.1.1",
  "serde_json",
  "xxhash-rust",
 ]
@@ -6517,7 +6546,7 @@ dependencies = [
  "oxc",
  "oxc_sourcemap",
  "rolldown_utils",
- "rustc-hash",
+ "rustc-hash 2.1.1",
 ]
 
 [[package]]
@@ -6569,7 +6598,7 @@ dependencies = [
  "regex 1.11.1",
  "regress",
  "rolldown_std_utils",
- "rustc-hash",
+ "rustc-hash 2.1.1",
  "serde_json",
  "simdutf8",
  "sugar_path",
@@ -6599,6 +6628,18 @@ dependencies = [
  "str_indices",
 ]
 
+[[package]]
+name = "rowan"
+version = "0.16.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "417a3a9f582e349834051b8a10c8d71ca88da4211e4093528e36b9845f6b5f21"
+dependencies = [
+ "countme",
+ "hashbrown 0.14.5",
+ "rustc-hash 1.1.0",
+ "text-size",
+]
+
 [[package]]
 name = "rusqlite"
 version = "0.32.1"
@@ -6641,6 +6682,12 @@ dependencies = [
  "serde_json",
 ]
 
+[[package]]
+name = "rustc-hash"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
+
 [[package]]
 name = "rustc-hash"
 version = "2.1.1"
@@ -7453,7 +7500,7 @@ dependencies = [
  "memchr",
  "oxc_index",
  "oxc_sourcemap",
- "rustc-hash",
+ "rustc-hash 2.1.1",
  "serde",
 ]
 
@@ -8154,6 +8201,12 @@ version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8f50febec83f5ee1df3015341d8bd429f2d1cc62bcba7ea2076759d315084683"
 
+[[package]]
+name = "text-size"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f18aa187839b2bdb1ad2fa35ead8c4c2976b64e4363c386d45ac0f7ee85c9233"
+
 [[package]]
 name = "textwrap"
 version = "0.16.2"
@@ -8276,6 +8329,12 @@ dependencies = [
  "crunchy",
 ]
 
+[[package]]
+name = "tiny_pretty"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "650d82e943da333637be9f1567d33d605e76810a26464edfd7ae74f7ef181e95"
+
 [[package]]
 name = "tinystr"
 version = "0.8.1"
@@ -10198,6 +10257,7 @@ dependencies = [
  "md5 0.8.0",
  "mime_guess",
  "openssl-sys",
+ "pretty_graphql",
  "r2d2",
  "r2d2_sqlite",
  "rand 0.9.1",
@@ -10387,6 +10447,7 @@ dependencies = [
  "hyper-util",
  "log 0.4.29",
  "mime_guess",
+ "native-tls",
  "regex 1.11.1",
  "reqwest",
  "serde",
@@ -10399,6 +10460,7 @@ dependencies = [
  "urlencoding",
  "yaak-common",
  "yaak-models",
+ "yaak-templates",
  "yaak-tls",
  "zstd",
 ]

biome.json

@@ -1,5 +1,5 @@
 {
-  "$schema": "https://biomejs.dev/schemas/2.3.11/schema.json",
+  "$schema": "https://biomejs.dev/schemas/2.3.13/schema.json",
   "linter": {
     "enabled": true,
     "rules": {
@@ -48,7 +48,8 @@
       "!src-web/routeTree.gen.ts",
       "!packages/plugin-runtime-types/lib",
       "!**/bindings",
-      "!flatpak"
+      "!flatpak",
+      "!npm"
     ]
   }
 }

crates-cli/yaak-cli/src/context.rs

@@ -36,17 +36,32 @@ pub struct CliContext {
 }
 
 impl CliContext {
-    pub async fn new(
+    pub fn new(data_dir: PathBuf, app_id: &str) -> Self {
-        data_dir: PathBuf,
+        let db_path = data_dir.join("db.sqlite");
-        query_manager: QueryManager,
+        let blob_path = data_dir.join("blobs.sqlite");
-        blob_manager: BlobManager,
+        let (query_manager, blob_manager, _rx) =
-        encryption_manager: Arc<EncryptionManager>,
+            match yaak_models::init_standalone(&db_path, &blob_path) {
-        with_plugins: bool,
+                Ok(v) => v,
-        execution_context: CliExecutionContext,
+                Err(err) => {
-    ) -> Self {
+                    eprintln!("Error: Failed to initialize database: {err}");
-        let plugin_manager = if with_plugins {
+                    std::process::exit(1);
-            let vendored_plugin_dir = data_dir.join("vendored-plugins");
+                }
-            let installed_plugin_dir = data_dir.join("installed-plugins");
+            };
+        let encryption_manager = Arc::new(EncryptionManager::new(query_manager.clone(), app_id));
+
+        Self {
+            data_dir,
+            query_manager,
+            blob_manager,
+            encryption_manager,
+            plugin_manager: None,
+            plugin_event_bridge: Mutex::new(None),
+        }
+    }
+
+    pub async fn init_plugins(&mut self, execution_context: CliExecutionContext) {
+        let vendored_plugin_dir = self.data_dir.join("vendored-plugins");
+        let installed_plugin_dir = self.data_dir.join("installed-plugins");
         let node_bin_path = PathBuf::from("node");
 
         prepare_embedded_vendored_plugins(&vendored_plugin_dir)
@@ -54,7 +69,7 @@ impl CliContext {
 
         let plugin_runtime_main =
             std::env::var("YAAK_PLUGIN_RUNTIME").map(PathBuf::from).unwrap_or_else(|_| {
-                    prepare_embedded_plugin_runtime(&data_dir)
+                prepare_embedded_plugin_runtime(&self.data_dir)
                     .expect("Failed to prepare embedded plugin runtime")
             });
 
@@ -63,46 +78,30 @@ impl CliContext {
             installed_plugin_dir,
             node_bin_path,
             plugin_runtime_main,
-                &query_manager,
+            &self.query_manager,
             &PluginContext::new_empty(),
             false,
         )
         .await
         {
-                Ok(plugin_manager) => Some(Arc::new(plugin_manager)),
+            Ok(plugin_manager) => {
+                let plugin_manager = Arc::new(plugin_manager);
+                let plugin_event_bridge = CliPluginEventBridge::start(
+                    plugin_manager.clone(),
+                    self.query_manager.clone(),
+                    self.blob_manager.clone(),
+                    self.encryption_manager.clone(),
+                    self.data_dir.clone(),
+                    execution_context,
+                )
+                .await;
+                self.plugin_manager = Some(plugin_manager);
+                *self.plugin_event_bridge.lock().await = Some(plugin_event_bridge);
+            }
             Err(err) => {
                 eprintln!("Warning: Failed to initialize plugins: {err}");
-                    None
             }
         }
-        } else {
-            None
-        };
-
-        let plugin_event_bridge = if let Some(plugin_manager) = &plugin_manager {
-            Some(
-                CliPluginEventBridge::start(
-                    plugin_manager.clone(),
-                    query_manager.clone(),
-                    blob_manager.clone(),
-                    encryption_manager.clone(),
-                    data_dir.clone(),
-                    execution_context.clone(),
-                )
-                .await,
-            )
-        } else {
-            None
-        };
-
-        Self {
-            data_dir,
-            query_manager,
-            blob_manager,
-            encryption_manager,
-            plugin_manager,
-            plugin_event_bridge: Mutex::new(plugin_event_bridge),
-        }
     }
 
     pub fn data_dir(&self) -> &Path {

crates-cli/yaak-cli/src/main.rs

@@ -10,10 +10,8 @@ mod version_check;
 use clap::Parser;
 use cli::{Cli, Commands, PluginCommands, RequestCommands};
 use context::{CliContext, CliExecutionContext};
-use std::sync::Arc;
+use std::path::PathBuf;
-use yaak_crypto::manager::EncryptionManager;
 use yaak_models::queries::any_request::AnyRequest;
-use yaak_models::query_manager::QueryManager;
 
 #[tokio::main]
 async fn main() {
@@ -33,23 +31,10 @@ async fn main() {
 
     let app_id = if cfg!(debug_assertions) { "app.yaak.desktop.dev" } else { "app.yaak.desktop" };
 
-    let data_dir = data_dir.unwrap_or_else(|| {
+    let data_dir = data_dir.unwrap_or_else(|| resolve_data_dir(app_id));
-        dirs::data_dir().expect("Could not determine data directory").join(app_id)
-    });
 
     version_check::maybe_check_for_updates().await;
 
-    let db_path = data_dir.join("db.sqlite");
-    let blob_path = data_dir.join("blobs.sqlite");
-    let (query_manager, blob_manager, _rx) =
-        match yaak_models::init_standalone(&db_path, &blob_path) {
-            Ok(v) => v,
-            Err(err) => {
-                eprintln!("Error: Failed to initialize database: {err}");
-                std::process::exit(1);
-            }
-        };
-
     let exit_code = match command {
         Commands::Auth(args) => commands::auth::run(args).await,
         Commands::Plugin(args) => match args.command {
@@ -58,18 +43,8 @@ async fn main() {
             PluginCommands::Generate(args) => commands::plugin::run_generate(args).await,
             PluginCommands::Publish(args) => commands::plugin::run_publish(args).await,
             PluginCommands::Install(install_args) => {
-                let query_manager = query_manager.clone();
+                let mut context = CliContext::new(data_dir.clone(), app_id);
-                let blob_manager = blob_manager.clone();
+                context.init_plugins(CliExecutionContext::default()).await;
-                let execution_context = CliExecutionContext::default();
-                let context = CliContext::new(
-                    data_dir.clone(),
-                    query_manager.clone(),
-                    blob_manager,
-                    Arc::new(EncryptionManager::new(query_manager, app_id)),
-                    true,
-                    execution_context,
-                )
-                .await;
                 let exit_code = commands::plugin::run_install(&context, install_args).await;
                 context.shutdown().await;
                 exit_code
@@ -80,27 +55,15 @@ async fn main() {
         Commands::Generate(args) => commands::plugin::run_generate(args).await,
         Commands::Publish(args) => commands::plugin::run_publish(args).await,
         Commands::Send(args) => {
-            let query_manager = query_manager.clone();
+            let mut context = CliContext::new(data_dir.clone(), app_id);
-            let blob_manager = blob_manager.clone();
+            match resolve_send_execution_context(
-
+                &context,
-            let execution_context_result = resolve_send_execution_context(
-                &query_manager,
                 &args.id,
                 environment.as_deref(),
                 cookie_jar.as_deref(),
-            );
+            ) {
-            match execution_context_result {
                 Ok(execution_context) => {
-                    let context = CliContext::new(
+                    context.init_plugins(execution_context).await;
-                        data_dir.clone(),
-                        query_manager.clone(),
-                        blob_manager,
-                        Arc::new(EncryptionManager::new(query_manager, app_id)),
-                        true,
-                        execution_context,
-                    )
-                    .await;
-
                     let exit_code = commands::send::run(
                         &context,
                         args,
@@ -119,48 +82,22 @@ async fn main() {
             }
         }
         Commands::CookieJar(args) => {
-            let query_manager = query_manager.clone();
+            let context = CliContext::new(data_dir.clone(), app_id);
-            let blob_manager = blob_manager.clone();
-            let execution_context = CliExecutionContext::default();
-
-            let context = CliContext::new(
-                data_dir.clone(),
-                query_manager.clone(),
-                blob_manager,
-                Arc::new(EncryptionManager::new(query_manager, app_id)),
-                false,
-                execution_context,
-            )
-            .await;
             let exit_code = commands::cookie_jar::run(&context, args);
             context.shutdown().await;
             exit_code
         }
         Commands::Workspace(args) => {
-            let query_manager = query_manager.clone();
+            let context = CliContext::new(data_dir.clone(), app_id);
-            let blob_manager = blob_manager.clone();
-            let execution_context = CliExecutionContext::default();
-
-            let context = CliContext::new(
-                data_dir.clone(),
-                query_manager.clone(),
-                blob_manager,
-                Arc::new(EncryptionManager::new(query_manager, app_id)),
-                false,
-                execution_context,
-            )
-            .await;
             let exit_code = commands::workspace::run(&context, args);
             context.shutdown().await;
             exit_code
         }
         Commands::Request(args) => {
-            let query_manager = query_manager.clone();
+            let mut context = CliContext::new(data_dir.clone(), app_id);
-            let blob_manager = blob_manager.clone();
-
             let execution_context_result = match &args.command {
                 RequestCommands::Send { request_id } => resolve_request_execution_context(
-                    &query_manager,
+                    &context,
                     request_id,
                     environment.as_deref(),
                     cookie_jar.as_deref(),
@@ -173,16 +110,9 @@ async fn main() {
                         &args.command,
                         RequestCommands::Send { .. } | RequestCommands::Schema { .. }
                     );
-                    let context = CliContext::new(
+                    if with_plugins {
-                        data_dir.clone(),
+                        context.init_plugins(execution_context).await;
-                        query_manager.clone(),
+                    }
-                        blob_manager,
-                        Arc::new(EncryptionManager::new(query_manager, app_id)),
-                        with_plugins,
-                        execution_context,
-                    )
-                    .await;
-
                     let exit_code = commands::request::run(
                         &context,
                         args,
@@ -201,37 +131,13 @@ async fn main() {
             }
         }
         Commands::Folder(args) => {
-            let query_manager = query_manager.clone();
+            let context = CliContext::new(data_dir.clone(), app_id);
-            let blob_manager = blob_manager.clone();
-            let execution_context = CliExecutionContext::default();
-
-            let context = CliContext::new(
-                data_dir.clone(),
-                query_manager.clone(),
-                blob_manager,
-                Arc::new(EncryptionManager::new(query_manager, app_id)),
-                false,
-                execution_context,
-            )
-            .await;
             let exit_code = commands::folder::run(&context, args);
             context.shutdown().await;
             exit_code
         }
         Commands::Environment(args) => {
-            let query_manager = query_manager.clone();
+            let context = CliContext::new(data_dir.clone(), app_id);
-            let blob_manager = blob_manager.clone();
-            let execution_context = CliExecutionContext::default();
-
-            let context = CliContext::new(
-                data_dir.clone(),
-                query_manager.clone(),
-                blob_manager,
-                Arc::new(EncryptionManager::new(query_manager, app_id)),
-                false,
-                execution_context,
-            )
-            .await;
             let exit_code = commands::environment::run(&context, args);
             context.shutdown().await;
             exit_code
@@ -244,19 +150,18 @@ async fn main() {
 }
 
 fn resolve_send_execution_context(
-    query_manager: &QueryManager,
+    context: &CliContext,
     id: &str,
     environment: Option<&str>,
     explicit_cookie_jar_id: Option<&str>,
 ) -> Result<CliExecutionContext, String> {
-    if let Ok(request) = query_manager.connect().get_any_request(id) {
+    if let Ok(request) = context.db().get_any_request(id) {
         let (request_id, workspace_id) = match request {
             AnyRequest::HttpRequest(r) => (Some(r.id), r.workspace_id),
             AnyRequest::GrpcRequest(r) => (Some(r.id), r.workspace_id),
             AnyRequest::WebsocketRequest(r) => (Some(r.id), r.workspace_id),
         };
-        let cookie_jar_id =
+        let cookie_jar_id = resolve_cookie_jar_id(context, &workspace_id, explicit_cookie_jar_id)?;
-            resolve_cookie_jar_id(query_manager, &workspace_id, explicit_cookie_jar_id)?;
         return Ok(CliExecutionContext {
             request_id,
             workspace_id: Some(workspace_id),
@@ -265,9 +170,9 @@ fn resolve_send_execution_context(
         });
     }
 
-    if let Ok(folder) = query_manager.connect().get_folder(id) {
+    if let Ok(folder) = context.db().get_folder(id) {
         let cookie_jar_id =
-            resolve_cookie_jar_id(query_manager, &folder.workspace_id, explicit_cookie_jar_id)?;
+            resolve_cookie_jar_id(context, &folder.workspace_id, explicit_cookie_jar_id)?;
         return Ok(CliExecutionContext {
             request_id: None,
             workspace_id: Some(folder.workspace_id),
@@ -276,9 +181,8 @@ fn resolve_send_execution_context(
         });
     }
 
-    if let Ok(workspace) = query_manager.connect().get_workspace(id) {
+    if let Ok(workspace) = context.db().get_workspace(id) {
-        let cookie_jar_id =
+        let cookie_jar_id = resolve_cookie_jar_id(context, &workspace.id, explicit_cookie_jar_id)?;
-            resolve_cookie_jar_id(query_manager, &workspace.id, explicit_cookie_jar_id)?;
         return Ok(CliExecutionContext {
             request_id: None,
             workspace_id: Some(workspace.id),
@@ -291,13 +195,13 @@ fn resolve_send_execution_context(
 }
 
 fn resolve_request_execution_context(
-    query_manager: &QueryManager,
+    context: &CliContext,
     request_id: &str,
     environment: Option<&str>,
     explicit_cookie_jar_id: Option<&str>,
 ) -> Result<CliExecutionContext, String> {
-    let request = query_manager
+    let request = context
-        .connect()
+        .db()
         .get_any_request(request_id)
         .map_err(|e| format!("Failed to get request: {e}"))?;
 
@@ -306,8 +210,7 @@ fn resolve_request_execution_context(
         AnyRequest::GrpcRequest(r) => r.workspace_id,
         AnyRequest::WebsocketRequest(r) => r.workspace_id,
     };
-    let cookie_jar_id =
+    let cookie_jar_id = resolve_cookie_jar_id(context, &workspace_id, explicit_cookie_jar_id)?;
-        resolve_cookie_jar_id(query_manager, &workspace_id, explicit_cookie_jar_id)?;
 
     Ok(CliExecutionContext {
         request_id: Some(request_id.to_string()),
@@ -318,7 +221,7 @@ fn resolve_request_execution_context(
 }
 
 fn resolve_cookie_jar_id(
-    query_manager: &QueryManager,
+    context: &CliContext,
     workspace_id: &str,
     explicit_cookie_jar_id: Option<&str>,
 ) -> Result<Option<String>, String> {
@@ -326,8 +229,8 @@ fn resolve_cookie_jar_id(
         return Ok(Some(cookie_jar_id.to_string()));
     }
 
-    let default_cookie_jar = query_manager
+    let default_cookie_jar = context
-        .connect()
+        .db()
         .list_cookie_jars(workspace_id)
         .map_err(|e| format!("Failed to list cookie jars: {e}"))?
         .into_iter()
@@ -335,3 +238,46 @@ fn resolve_cookie_jar_id(
         .map(|jar| jar.id);
     Ok(default_cookie_jar)
 }
+
+fn resolve_data_dir(app_id: &str) -> PathBuf {
+    if let Some(dir) = wsl_data_dir(app_id) {
+        return dir;
+    }
+    dirs::data_dir().expect("Could not determine data directory").join(app_id)
+}
+
+/// Detect WSL and resolve the Windows AppData\Roaming path for the Yaak data directory.
+fn wsl_data_dir(app_id: &str) -> Option<PathBuf> {
+    if !cfg!(target_os = "linux") {
+        return None;
+    }
+
+    let proc_version = std::fs::read_to_string("/proc/version").ok()?;
+    let is_wsl = proc_version.to_lowercase().contains("microsoft");
+    if !is_wsl {
+        return None;
+    }
+
+    // We're in WSL, so try to resolve the Yaak app's data directory in Windows
+
+    // Get the Windows %APPDATA% path via cmd.exe
+    let appdata_output =
+        std::process::Command::new("cmd.exe").args(["/C", "echo", "%APPDATA%"]).output().ok()?;
+
+    let win_path = String::from_utf8(appdata_output.stdout).ok()?.trim().to_string();
+    if win_path.is_empty() || win_path == "%APPDATA%" {
+        return None;
+    }
+
+    // Convert Windows path to WSL path using wslpath (handles custom mount points)
+    let wslpath_output = std::process::Command::new("wslpath").arg(&win_path).output().ok()?;
+
+    let wsl_appdata = String::from_utf8(wslpath_output.stdout).ok()?.trim().to_string();
+    if wsl_appdata.is_empty() {
+        return None;
+    }
+
+    let wsl_path = PathBuf::from(wsl_appdata).join(app_id);
+
+    if wsl_path.exists() { Some(wsl_path) } else { None }
+}

crates-cli/yaak-cli/src/plugin_events.rs

@@ -3,7 +3,7 @@ use arboard::Clipboard;
 use console::Term;
 use inquire::{Confirm, Editor, Password, PasswordDisplayMode, Select, Text};
 use serde_json::Value;
-use std::collections::{BTreeMap, HashMap};
+use std::collections::HashMap;
 use std::io::IsTerminal;
 use std::path::PathBuf;
 use std::sync::Arc;
@@ -11,11 +11,12 @@ use tokio::task::JoinHandle;
 use yaak::plugin_events::{
     GroupedPluginEvent, HostRequest, SharedPluginEventContext, handle_shared_plugin_event,
 };
-use yaak::render::render_http_request;
+use yaak::render::{render_grpc_request, render_http_request};
 use yaak::send::{SendHttpRequestWithPluginsParams, send_http_request_with_plugins};
 use yaak_crypto::manager::EncryptionManager;
 use yaak_models::blob_manager::BlobManager;
-use yaak_models::models::{Environment, GrpcRequest, HttpRequestHeader};
+use yaak_models::models::Environment;
+use yaak_models::queries::any_request::AnyRequest;
 use yaak_models::query_manager::QueryManager;
 use yaak_models::render::make_vars_hashmap;
 use yaak_models::util::UpdateSource;
@@ -28,7 +29,7 @@ use yaak_plugins::events::{
 };
 use yaak_plugins::manager::PluginManager;
 use yaak_plugins::template_callback::PluginTemplateCallback;
-use yaak_templates::{RenderOptions, TemplateCallback, parse_and_render, render_json_value_raw};
+use yaak_templates::{RenderOptions, TemplateCallback, render_json_value_raw};
 
 pub struct CliPluginEventBridge {
     rx_id: String,
@@ -268,7 +269,7 @@ async fn build_plugin_reply(
                 );
                 let render_options = RenderOptions::throw();
 
-                match render_grpc_request_for_cli(
+                match render_grpc_request(
                     &grpc_request,
                     environment_chain,
                     &template_callback,
@@ -361,10 +362,19 @@ async fn build_plugin_reply(
                     ..event.context.clone()
                 };
 
+                let folder_id = execution_context.request_id.as_ref().and_then(|rid| {
+                    match host_context.query_manager.connect().get_any_request(rid) {
+                        Ok(AnyRequest::HttpRequest(r)) => r.folder_id,
+                        Ok(AnyRequest::GrpcRequest(r)) => r.folder_id,
+                        Ok(AnyRequest::WebsocketRequest(r)) => r.folder_id,
+                        Err(_) => None,
+                    }
+                });
+
                 let environment_chain =
                     match host_context.query_manager.connect().resolve_environments(
                         &workspace_id,
-                        None,
+                        folder_id.as_deref(),
                         execution_context.environment_id.as_deref(),
                     ) {
                         Ok(chain) => chain,
@@ -522,60 +532,6 @@ async fn render_json_value_for_cli<T: TemplateCallback>(
     render_json_value_raw(value, vars, cb, opt).await
 }
 
-async fn render_grpc_request_for_cli<T: TemplateCallback>(
-    grpc_request: &GrpcRequest,
-    environment_chain: Vec<Environment>,
-    cb: &T,
-    opt: &RenderOptions,
-) -> yaak_templates::error::Result<GrpcRequest> {
-    let vars = &make_vars_hashmap(environment_chain);
-
-    let mut metadata = Vec::new();
-    for p in grpc_request.metadata.clone() {
-        if !p.enabled {
-            continue;
-        }
-        metadata.push(HttpRequestHeader {
-            enabled: p.enabled,
-            name: parse_and_render(p.name.as_str(), vars, cb, opt).await?,
-            value: parse_and_render(p.value.as_str(), vars, cb, opt).await?,
-            id: p.id,
-        })
-    }
-
-    let authentication = {
-        let mut disabled = false;
-        let mut auth = BTreeMap::new();
-        match grpc_request.authentication.get("disabled") {
-            Some(Value::Bool(true)) => {
-                disabled = true;
-            }
-            Some(Value::String(tmpl)) => {
-                disabled = parse_and_render(tmpl.as_str(), vars, cb, opt)
-                    .await
-                    .unwrap_or_default()
-                    .is_empty();
-            }
-            _ => {}
-        }
-        if disabled {
-            auth.insert("disabled".to_string(), Value::Bool(true));
-        } else {
-            for (k, v) in grpc_request.authentication.clone() {
-                if k == "disabled" {
-                    auth.insert(k, Value::Bool(false));
-                } else {
-                    auth.insert(k, render_json_value_raw(v, vars, cb, opt).await?);
-                }
-            }
-        }
-        auth
-    };
-
-    let url = parse_and_render(grpc_request.url.as_str(), vars, cb, opt).await?;
-
-    Ok(GrpcRequest { url, metadata, authentication, ..grpc_request.to_owned() })
-}
 
 fn parse_cookie_name_value(raw_cookie: &str) -> Option<(String, String)> {
     let first_part = raw_cookie.split(';').next()?.trim();

crates-tauri/yaak-app/Cargo.toml

@@ -30,6 +30,7 @@ eventsource-client = { git = "https://github.com/yaakapp/rust-eventsource-client
 http = { version = "1.2.0", default-features = false }
 log = { workspace = true }
 md5 = "0.8.0"
+pretty_graphql = "0.2"
 r2d2 = "0.8.10"
 r2d2_sqlite = "0.25.0"
 mime_guess = "2.0.5"

crates-tauri/yaak-app/src/lib.rs

@@ -34,6 +34,7 @@ use tokio::time;
 use yaak_common::command::new_checked_command;
 use yaak_crypto::manager::EncryptionManager;
 use yaak_grpc::manager::{GrpcConfig, GrpcHandle};
+use yaak_templates::strip_json_comments::strip_json_comments;
 use yaak_grpc::{Code, ServiceDefinition, serialize_message};
 use yaak_mac_window::AppHandleMacWindowExt;
 use yaak_models::models::{
@@ -433,6 +434,7 @@ async fn cmd_grpc_go<R: Runtime>(
                             result.expect("Failed to render template")
                         })
                     });
+                    let msg = strip_json_comments(&msg);
                     in_msg_tx.try_send(msg.clone()).unwrap();
                 }
                 Ok(IncomingMsg::Commit) => {
@@ -468,6 +470,7 @@ async fn cmd_grpc_go<R: Runtime>(
             &RenderOptions { error_behavior: RenderErrorBehavior::Throw },
         )
         .await?;
+        let msg = strip_json_comments(&msg);
 
         app_handle.db().upsert_grpc_event(
             &GrpcEvent {
@@ -869,6 +872,14 @@ async fn cmd_format_json(text: &str) -> YaakResult<String> {
     Ok(format_json(text, "  "))
 }
 
+#[tauri::command]
+async fn cmd_format_graphql(text: &str) -> YaakResult<String> {
+    match pretty_graphql::format_text(text, &Default::default()) {
+        Ok(formatted) => Ok(formatted),
+        Err(_) => Ok(text.to_string()),
+    }
+}
+
 #[tauri::command]
 async fn cmd_http_response_body<R: Runtime>(
     window: WebviewWindow<R>,
@@ -1372,13 +1383,12 @@ async fn cmd_reload_plugins<R: Runtime>(
     app_handle: AppHandle<R>,
     window: WebviewWindow<R>,
     plugin_manager: State<'_, PluginManager>,
-) -> YaakResult<()> {
+) -> YaakResult<Vec<(String, String)>> {
     let plugins = app_handle.db().list_plugins()?;
     let plugin_context =
         PluginContext::new(Some(window.label().to_string()), window.workspace_id());
-    let _errors = plugin_manager.initialize_all_plugins(plugins, &plugin_context).await;
+    let errors = plugin_manager.initialize_all_plugins(plugins, &plugin_context).await;
-    // Note: errors are returned but we don't show toasts here since this is a manual reload
+    Ok(errors)
-    Ok(())
 }
 
 #[tauri::command]
@@ -1638,6 +1648,7 @@ pub fn run() {
             cmd_http_request_body,
             cmd_http_response_body,
             cmd_format_json,
+            cmd_format_graphql,
             cmd_get_http_authentication_summaries,
             cmd_get_http_authentication_config,
             cmd_get_sse_events,
@@ -1719,6 +1730,7 @@ pub fn run() {
             git_ext::cmd_git_rm_remote,
             //
             // Plugin commands
+            plugins_ext::cmd_plugin_init_errors,
             plugins_ext::cmd_plugins_install_from_directory,
             plugins_ext::cmd_plugins_search,
             plugins_ext::cmd_plugins_install,

crates-tauri/yaak-app/src/plugins_ext.rs

@@ -198,6 +198,13 @@ pub async fn cmd_plugins_uninstall<R: Runtime>(
     Ok(delete_and_uninstall(plugin_manager, &query_manager, &plugin_context, plugin_id).await?)
 }
 
+#[command]
+pub async fn cmd_plugin_init_errors(
+    plugin_manager: State<'_, PluginManager>,
+) -> Result<Vec<(String, String)>> {
+    Ok(plugin_manager.take_init_errors().await)
+}
+
 #[command]
 pub async fn cmd_plugins_updates<R: Runtime>(
     app_handle: AppHandle<R>,
@@ -306,7 +313,7 @@ pub fn init<R: Runtime>() -> TauriPlugin<R> {
                     dev_mode,
                 )
                 .await
-                .expect("Failed to initialize plugins");
+                .expect("Failed to start plugin runtime");
 
                 app_handle_clone.manage(manager);
             });

crates-tauri/yaak-app/src/render.rs

@@ -1,8 +1,6 @@
-use log::info;
 use serde_json::Value;
-use std::collections::BTreeMap;
+pub use yaak::render::{render_grpc_request, render_http_request};
-pub use yaak::render::render_http_request;
+use yaak_models::models::Environment;
-use yaak_models::models::{Environment, GrpcRequest, HttpRequestHeader};
 use yaak_models::render::make_vars_hashmap;
 use yaak_templates::{RenderOptions, TemplateCallback, parse_and_render, render_json_value_raw};
 
@@ -25,61 +23,3 @@ pub async fn render_json_value<T: TemplateCallback>(
     let vars = &make_vars_hashmap(environment_chain);
     render_json_value_raw(value, vars, cb, opt).await
 }
-
-pub async fn render_grpc_request<T: TemplateCallback>(
-    r: &GrpcRequest,
-    environment_chain: Vec<Environment>,
-    cb: &T,
-    opt: &RenderOptions,
-) -> yaak_templates::error::Result<GrpcRequest> {
-    let vars = &make_vars_hashmap(environment_chain);
-
-    let mut metadata = Vec::new();
-    for p in r.metadata.clone() {
-        if !p.enabled {
-            continue;
-        }
-        metadata.push(HttpRequestHeader {
-            enabled: p.enabled,
-            name: parse_and_render(p.name.as_str(), vars, cb, &opt).await?,
-            value: parse_and_render(p.value.as_str(), vars, cb, &opt).await?,
-            id: p.id,
-        })
-    }
-
-    let authentication = {
-        let mut disabled = false;
-        let mut auth = BTreeMap::new();
-        match r.authentication.get("disabled") {
-            Some(Value::Bool(true)) => {
-                disabled = true;
-            }
-            Some(Value::String(tmpl)) => {
-                disabled = parse_and_render(tmpl.as_str(), vars, cb, &opt)
-                    .await
-                    .unwrap_or_default()
-                    .is_empty();
-                info!(
-                    "Rendering authentication.disabled as a template: {disabled} from \"{tmpl}\""
-                );
-            }
-            _ => {}
-        }
-        if disabled {
-            auth.insert("disabled".to_string(), Value::Bool(true));
-        } else {
-            for (k, v) in r.authentication.clone() {
-                if k == "disabled" {
-                    auth.insert(k, Value::Bool(false));
-                } else {
-                    auth.insert(k, render_json_value_raw(v, vars, cb, &opt).await?);
-                }
-            }
-        }
-        auth
-    };
-
-    let url = parse_and_render(r.url.as_str(), vars, cb, &opt).await?;
-
-    Ok(GrpcRequest { url, metadata, authentication, ..r.to_owned() })
-}

crates-tauri/yaak-app/src/ws_ext.rs

@@ -24,6 +24,7 @@ use yaak_models::util::UpdateSource;
 use yaak_plugins::events::{CallHttpAuthenticationRequest, HttpHeader, RenderPurpose};
 use yaak_plugins::manager::PluginManager;
 use yaak_plugins::template_callback::PluginTemplateCallback;
+use yaak_templates::strip_json_comments::maybe_strip_json_comments;
 use yaak_templates::{RenderErrorBehavior, RenderOptions};
 use yaak_tls::find_client_certificate;
 use yaak_ws::{WebsocketManager, render_websocket_request};
@@ -72,8 +73,10 @@ pub async fn cmd_ws_send<R: Runtime>(
     )
     .await?;
 
+    let message = maybe_strip_json_comments(&request.message);
+
     let mut ws_manager = ws_manager.lock().await;
-    ws_manager.send(&connection.id, Message::Text(request.message.clone().into())).await?;
+    ws_manager.send(&connection.id, Message::Text(message.clone().into())).await?;
 
     app_handle.db().upsert_websocket_event(
         &WebsocketEvent {
@@ -82,7 +85,7 @@ pub async fn cmd_ws_send<R: Runtime>(
             workspace_id: connection.workspace_id.clone(),
             is_server: false,
             message_type: WebsocketEventType::Text,
-            message: request.message.into(),
+            message: message.into(),
             ..Default::default()
         },
         &UpdateSource::from_window_label(window.label()),

crates-tauri/yaak-mac-window/src/mac.rs

@@ -12,6 +12,11 @@ unsafe impl Sync for UnsafeWindowHandle {}
 
 const WINDOW_CONTROL_PAD_X: f64 = 13.0;
 const WINDOW_CONTROL_PAD_Y: f64 = 18.0;
+/// Extra pixels to add to the title bar height when the default title bar is
+/// already as tall as button_height + PAD_Y (i.e. macOS Tahoe 26+, where the
+/// default is 32px and 14 + 18 = 32). On pre-Tahoe this is unused because the
+/// default title bar is shorter than button_height + PAD_Y.
+const TITLEBAR_EXTRA_HEIGHT: f64 = 4.0;
 const MAIN_WINDOW_PREFIX: &str = "main_";
 
 pub(crate) fn update_window_title<R: Runtime>(window: Window<R>, title: String) {
@@ -95,12 +100,29 @@ fn position_traffic_lights(ns_window_handle: UnsafeWindowHandle, x: f64, y: f64,
             ns_window.standardWindowButton_(NSWindowButton::NSWindowMiniaturizeButton);
         let zoom = ns_window.standardWindowButton_(NSWindowButton::NSWindowZoomButton);
 
-        let title_bar_container_view = close.superview().superview();
-
         let close_rect: NSRect = msg_send![close, frame];
         let button_height = close_rect.size.height;
 
-        let title_bar_frame_height = button_height + y;
+        let title_bar_container_view = close.superview().superview();
+
+        // Capture the OS default title bar height on the first call, before
+        // we've modified it. This avoids the height growing on repeated calls.
+        use std::sync::OnceLock;
+        static DEFAULT_TITLEBAR_HEIGHT: OnceLock<f64> = OnceLock::new();
+        let default_height =
+            *DEFAULT_TITLEBAR_HEIGHT.get_or_init(|| NSView::frame(title_bar_container_view).size.height);
+
+        // On pre-Tahoe, button_height + y is larger than the default title bar
+        // height, so the resize works as before. On Tahoe (26+), the default is
+        // already 32px and button_height + y = 32, so nothing changes. In that
+        // case, add TITLEBAR_EXTRA_HEIGHT extra pixels to push the buttons down.
+        let desired = button_height + y;
+        let title_bar_frame_height = if desired > default_height {
+            desired
+        } else {
+            default_height + TITLEBAR_EXTRA_HEIGHT
+        };
+
         let mut title_bar_rect = NSView::frame(title_bar_container_view);
         title_bar_rect.size.height = title_bar_frame_height;
         title_bar_rect.origin.y = NSView::frame(ns_window).size.height - title_bar_frame_height;

crates/yaak-common/src/serde.rs

@@ -21,3 +21,10 @@ pub fn get_str_map<'a>(v: &'a BTreeMap<String, Value>, key: &str) -> &'a str {
         Some(v) => v.as_str().unwrap_or_default(),
     }
 }
+
+pub fn get_bool_map(v: &BTreeMap<String, Value>, key: &str, fallback: bool) -> bool {
+    match v.get(key) {
+        None => fallback,
+        Some(v) => v.as_bool().unwrap_or(fallback),
+    }
+}

crates/yaak-http/Cargo.toml

@@ -18,8 +18,9 @@ zstd = "0.13"
 hyper-util = { version = "0.1.17", default-features = false, features = ["client-legacy"] }
 log = { workspace = true }
 mime_guess = "2.0.5"
+native-tls = "0.2"
 regex = "1.11.1"
-reqwest = { workspace = true, features = ["rustls-tls-manual-roots-no-provider", "socks", "http2", "stream"] }
+reqwest = { workspace = true, features = ["rustls-tls-manual-roots-no-provider", "native-tls", "socks", "http2", "stream"] }
 serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true }
 thiserror = { workspace = true }
@@ -29,4 +30,5 @@ tower-service = "0.3.3"
 urlencoding = "2.1.3"
 yaak-common = { workspace = true }
 yaak-models = { workspace = true }
+yaak-templates = { workspace = true }
 yaak-tls = { workspace = true }

crates/yaak-http/src/client.rs

@@ -6,6 +6,56 @@ use std::sync::Arc;
 use yaak_models::models::DnsOverride;
 use yaak_tls::{ClientCertificateConfig, get_tls_config};
 
+/// Build a native-tls connector for maximum compatibility when certificate
+/// validation is disabled. Unlike rustls, native-tls uses the OS TLS stack
+/// (Secure Transport on macOS, SChannel on Windows, OpenSSL on Linux) which
+/// supports TLS 1.0+ for legacy servers.
+fn build_native_tls_connector(
+    client_cert: Option<ClientCertificateConfig>,
+) -> Result<native_tls::TlsConnector> {
+    let mut builder = native_tls::TlsConnector::builder();
+    builder.danger_accept_invalid_certs(true);
+    builder.danger_accept_invalid_hostnames(true);
+    builder.min_protocol_version(Some(native_tls::Protocol::Tlsv10));
+
+    if let Some(identity) = build_native_tls_identity(client_cert)? {
+        builder.identity(identity);
+    }
+
+    Ok(builder.build()?)
+}
+
+fn build_native_tls_identity(
+    client_cert: Option<ClientCertificateConfig>,
+) -> Result<Option<native_tls::Identity>> {
+    let config = match client_cert {
+        None => return Ok(None),
+        Some(c) => c,
+    };
+
+    // Try PFX/PKCS12 first
+    if let Some(pfx_path) = &config.pfx_file {
+        if !pfx_path.is_empty() {
+            let pfx_data = std::fs::read(pfx_path)?;
+            let password = config.passphrase.as_deref().unwrap_or("");
+            let identity = native_tls::Identity::from_pkcs12(&pfx_data, password)?;
+            return Ok(Some(identity));
+        }
+    }
+
+    // Try CRT + KEY files
+    if let (Some(crt_path), Some(key_path)) = (&config.crt_file, &config.key_file) {
+        if !crt_path.is_empty() && !key_path.is_empty() {
+            let crt_data = std::fs::read(crt_path)?;
+            let key_data = std::fs::read(key_path)?;
+            let identity = native_tls::Identity::from_pkcs8(&crt_data, &key_data)?;
+            return Ok(Some(identity));
+        }
+    }
+
+    Ok(None)
+}
+
 #[derive(Clone)]
 pub struct HttpConnectionProxySettingAuth {
     pub user: String,
@@ -51,10 +101,17 @@ impl HttpConnectionOptions {
             // This is needed so we can emit DNS timing events for each request
             .pool_max_idle_per_host(0);
 
-        // Configure TLS with optional client certificate
+        // Configure TLS
-        let config =
+        if self.validate_certificates {
-            get_tls_config(self.validate_certificates, true, self.client_certificate.clone())?;
+            // Use rustls with platform certificate verification (TLS 1.2+ only)
+            let config = get_tls_config(true, true, self.client_certificate.clone())?;
             client = client.use_preconfigured_tls(config);
+        } else {
+            // Use native TLS for maximum compatibility (supports TLS 1.0+)
+            let connector =
+                build_native_tls_connector(self.client_certificate.clone())?;
+            client = client.use_preconfigured_tls(connector);
+        }
 
         // Configure DNS resolver - keep a reference to configure per-request
         let resolver = LocalhostResolver::new(self.dns_overrides.clone());

crates/yaak-http/src/error.rs

@@ -9,6 +9,12 @@ pub enum Error {
     #[error(transparent)]
     TlsError(#[from] yaak_tls::error::Error),
 
+    #[error("Native TLS error: {0}")]
+    NativeTlsError(#[from] native_tls::Error),
+
+    #[error("IO error: {0}")]
+    IoError(#[from] std::io::Error),
+
     #[error("Request failed with {0:?}")]
     RequestError(String),
 

crates/yaak-http/src/sender.rs

@@ -30,6 +30,8 @@ pub enum HttpResponseEvent {
         url: String,
         status: u16,
         behavior: RedirectBehavior,
+        dropped_body: bool,
+        dropped_headers: Vec<String>,
     },
     SendUrl {
         method: String,
@@ -67,12 +69,28 @@ impl Display for HttpResponseEvent {
         match self {
             HttpResponseEvent::Setting(name, value) => write!(f, "* Setting {}={}", name, value),
             HttpResponseEvent::Info(s) => write!(f, "* {}", s),
-            HttpResponseEvent::Redirect { url, status, behavior } => {
+            HttpResponseEvent::Redirect {
+                url,
+                status,
+                behavior,
+                dropped_body,
+                dropped_headers,
+            } => {
                 let behavior_str = match behavior {
                     RedirectBehavior::Preserve => "preserve",
                     RedirectBehavior::DropBody => "drop body",
                 };
-                write!(f, "* Redirect {} -> {} ({})", status, url, behavior_str)
+                let body_str = if *dropped_body { ", body dropped" } else { "" };
+                let headers_str = if dropped_headers.is_empty() {
+                    String::new()
+                } else {
+                    format!(", headers dropped: {}", dropped_headers.join(", "))
+                };
+                write!(
+                    f,
+                    "* Redirect {} -> {} ({}{}{})",
+                    status, url, behavior_str, body_str, headers_str
+                )
             }
             HttpResponseEvent::SendUrl {
                 method,
@@ -130,13 +148,21 @@ impl From<HttpResponseEvent> for yaak_models::models::HttpResponseEventData {
         match event {
             HttpResponseEvent::Setting(name, value) => D::Setting { name, value },
             HttpResponseEvent::Info(message) => D::Info { message },
-            HttpResponseEvent::Redirect { url, status, behavior } => D::Redirect {
+            HttpResponseEvent::Redirect {
+                url,
+                status,
+                behavior,
+                dropped_body,
+                dropped_headers,
+            } => D::Redirect {
                 url,
                 status,
                 behavior: match behavior {
                     RedirectBehavior::Preserve => "preserve".to_string(),
                     RedirectBehavior::DropBody => "drop_body".to_string(),
                 },
+                dropped_body,
+                dropped_headers,
             },
             HttpResponseEvent::SendUrl {
                 method,

crates/yaak-http/src/transaction.rs

@@ -1,7 +1,7 @@
 use crate::cookies::CookieStore;
 use crate::error::Result;
 use crate::sender::{HttpResponse, HttpResponseEvent, HttpSender, RedirectBehavior};
-use crate::types::SendableHttpRequest;
+use crate::types::{SendableBody, SendableHttpRequest};
 use log::debug;
 use tokio::sync::mpsc;
 use tokio::sync::watch::Receiver;
@@ -87,6 +87,11 @@ impl<S: HttpSender> HttpTransaction<S> {
             };
 
             // Build request for this iteration
+            let preserved_body = match &current_body {
+                Some(SendableBody::Bytes(b)) => Some(SendableBody::Bytes(b.clone())),
+                _ => None,
+            };
+            let request_had_body = current_body.is_some();
             let req = SendableHttpRequest {
                 url: current_url.clone(),
                 method: current_method.clone(),
@@ -182,8 +187,6 @@ impl<S: HttpSender> HttpTransaction<S> {
                 format!("{}/{}", base_path, location)
             };
 
-            Self::remove_sensitive_headers(&mut current_headers, &previous_url, &current_url);
-
             // Determine redirect behavior based on status code and method
             let behavior = if status == 303 {
                 // 303 See Other always changes to GET
@@ -197,11 +200,8 @@ impl<S: HttpSender> HttpTransaction<S> {
                 RedirectBehavior::Preserve
             };
 
-            send_event(HttpResponseEvent::Redirect {
+            let mut dropped_headers =
-                url: current_url.clone(),
+                Self::remove_sensitive_headers(&mut current_headers, &previous_url, &current_url);
-                status,
-                behavior: behavior.clone(),
-            });
 
             // Handle method changes for certain redirect codes
             if matches!(behavior, RedirectBehavior::DropBody) {
@@ -211,13 +211,40 @@ impl<S: HttpSender> HttpTransaction<S> {
                 // Remove content-related headers
                 current_headers.retain(|h| {
                     let name_lower = h.0.to_lowercase();
-                    !name_lower.starts_with("content-") && name_lower != "transfer-encoding"
+                    let should_drop =
+                        name_lower.starts_with("content-") || name_lower == "transfer-encoding";
+                    if should_drop {
+                        Self::push_header_if_missing(&mut dropped_headers, &h.0);
+                    }
+                    !should_drop
                 });
             }
 
-            // Reset body for next iteration (since it was moved in the send call)
+            // Restore body for Preserve redirects (307/308), drop for others.
-            // For redirects that change method to GET or for all redirects since body was consumed
+            // Stream bodies can't be replayed (same limitation as reqwest).
-            current_body = None;
+            current_body = if matches!(behavior, RedirectBehavior::Preserve) {
+                if request_had_body && preserved_body.is_none() {
+                    // Stream body was consumed and can't be replayed (same as reqwest)
+                    return Err(crate::error::Error::RequestError(
+                        "Cannot follow redirect: request body was a stream and cannot be resent"
+                            .to_string(),
+                    ));
+                }
+                preserved_body
+            } else {
+                None
+            };
+
+            // Body was dropped if the request had one but we can't resend it
+            let dropped_body = request_had_body && current_body.is_none();
+
+            send_event(HttpResponseEvent::Redirect {
+                url: current_url.clone(),
+                status,
+                behavior: behavior.clone(),
+                dropped_body,
+                dropped_headers,
+            });
 
             redirect_count += 1;
         }
@@ -231,7 +258,8 @@ impl<S: HttpSender> HttpTransaction<S> {
         headers: &mut Vec<(String, String)>,
         previous_url: &str,
         next_url: &str,
-    ) {
+    ) -> Vec<String> {
+        let mut dropped_headers = Vec::new();
         let previous_host = Url::parse(previous_url).ok().and_then(|u| {
             u.host_str().map(|h| format!("{}:{}", h, u.port_or_known_default().unwrap_or(0)))
         });
@@ -241,13 +269,24 @@ impl<S: HttpSender> HttpTransaction<S> {
         if previous_host != next_host {
             headers.retain(|h| {
                 let name_lower = h.0.to_lowercase();
-                name_lower != "authorization"
+                let should_drop = name_lower == "authorization"
-                    && name_lower != "cookie"
+                    || name_lower == "cookie"
-                    && name_lower != "cookie2"
+                    || name_lower == "cookie2"
-                    && name_lower != "proxy-authorization"
+                    || name_lower == "proxy-authorization"
-                    && name_lower != "www-authenticate"
+                    || name_lower == "www-authenticate";
+                if should_drop {
+                    Self::push_header_if_missing(&mut dropped_headers, &h.0);
+                }
+                !should_drop
             });
         }
+        dropped_headers
+    }
+
+    fn push_header_if_missing(headers: &mut Vec<String>, name: &str) {
+        if !headers.iter().any(|h| h.eq_ignore_ascii_case(name)) {
+            headers.push(name.to_string());
+        }
     }
 
     /// Check if a status code indicates a redirect

crates/yaak-http/src/types.rs

@@ -9,8 +9,9 @@ use std::collections::BTreeMap;
 use std::pin::Pin;
 use std::time::Duration;
 use tokio::io::AsyncRead;
-use yaak_common::serde::{get_bool, get_str, get_str_map};
+use yaak_common::serde::{get_bool, get_bool_map, get_str, get_str_map};
 use yaak_models::models::HttpRequest;
+use yaak_templates::strip_json_comments::{maybe_strip_json_comments, strip_json_comments};
 
 pub(crate) const MULTIPART_BOUNDARY: &str = "------YaakFormBoundary";
 
@@ -134,16 +135,69 @@ pub fn append_query_params(url: &str, params: Vec<(String, String)>) -> String {
     result
 }
 
+fn strip_query_params(url: &str, names: &[&str]) -> String {
+    // Split off fragment
+    let (base_and_query, fragment) = if let Some(hash_pos) = url.find('#') {
+        (&url[..hash_pos], Some(&url[hash_pos..]))
+    } else {
+        (url, None)
+    };
+
+    let result = if let Some(q_pos) = base_and_query.find('?') {
+        let base = &base_and_query[..q_pos];
+        let query = &base_and_query[q_pos + 1..];
+        let filtered: Vec<&str> = query
+            .split('&')
+            .filter(|pair| {
+                let key = pair.split('=').next().unwrap_or("");
+                let decoded = urlencoding::decode(key).unwrap_or_default();
+                !names.contains(&decoded.as_ref())
+            })
+            .collect();
+        if filtered.is_empty() {
+            base.to_string()
+        } else {
+            format!("{}?{}", base, filtered.join("&"))
+        }
+    } else {
+        base_and_query.to_string()
+    };
+
+    match fragment {
+        Some(f) => format!("{}{}", result, f),
+        None => result,
+    }
+}
+
 fn build_url(r: &HttpRequest) -> String {
     let (url_string, params) = apply_path_placeholders(&ensure_proto(&r.url), &r.url_parameters);
-    append_query_params(
+    let mut url = append_query_params(
         &url_string,
         params
             .iter()
             .filter(|p| p.enabled && !p.name.is_empty())
             .map(|p| (p.name.clone(), p.value.clone()))
             .collect(),
-    )
+    );
+
+    // GraphQL GET requests encode query/variables as URL query parameters
+    if r.method.to_lowercase() == "get" && r.body_type.as_deref() == Some("graphql") {
+        url = append_graphql_query_params(&url, &r.body);
+    }
+
+    url
+}
+
+fn append_graphql_query_params(url: &str, body: &BTreeMap<String, serde_json::Value>) -> String {
+    let query = get_str_map(body, "query").to_string();
+    let variables = strip_json_comments(&get_str_map(body, "variables"));
+    let mut params = vec![("query".to_string(), query)];
+    if !variables.trim().is_empty() {
+        params.push(("variables".to_string(), variables));
+    }
+    // Strip existing query/variables params to avoid duplicates
+    let url = strip_query_params(url, &["query", "variables"]);
+    append_query_params(&url, params)
 }
 
 fn build_headers(r: &HttpRequest) -> Vec<(String, String)> {
@@ -177,7 +231,7 @@ async fn build_body(
             (build_form_body(&body), Some("application/x-www-form-urlencoded".to_string()))
         }
         "multipart/form-data" => build_multipart_body(&body, &headers).await?,
-        _ if body.contains_key("text") => (build_text_body(&body), None),
+        _ if body.contains_key("text") => (build_text_body(&body, body_type), None),
         t => {
             warn!("Unsupported body type: {}", t);
             (None, None)
@@ -252,13 +306,20 @@ async fn build_binary_body(
     }))
 }
 
-fn build_text_body(body: &BTreeMap<String, serde_json::Value>) -> Option<SendableBodyWithMeta> {
+fn build_text_body(body: &BTreeMap<String, serde_json::Value>, body_type: &str) -> Option<SendableBodyWithMeta> {
     let text = get_str_map(body, "text");
     if text.is_empty() {
-        None
+        return None;
-    } else {
-        Some(SendableBodyWithMeta::Bytes(Bytes::from(text.to_string())))
     }
+
+    let send_comments = get_bool_map(body, "sendJsonComments", false);
+    let text = if !send_comments && body_type == "application/json" {
+        maybe_strip_json_comments(text)
+    } else {
+        text.to_string()
+    };
+
+    Some(SendableBodyWithMeta::Bytes(Bytes::from(text)))
 }
 
 fn build_graphql_body(
@@ -266,7 +327,7 @@ fn build_graphql_body(
     body: &BTreeMap<String, serde_json::Value>,
 ) -> Option<SendableBodyWithMeta> {
     let query = get_str_map(body, "query");
-    let variables = get_str_map(body, "variables");
+    let variables = strip_json_comments(&get_str_map(body, "variables"));
 
     if method.to_lowercase() == "get" {
         // GraphQL GET requests use query parameters, not a body
@@ -684,7 +745,7 @@ mod tests {
         let mut body = BTreeMap::new();
         body.insert("text".to_string(), json!("Hello, World!"));
 
-        let result = build_text_body(&body);
+        let result = build_text_body(&body, "application/json");
         match result {
             Some(SendableBodyWithMeta::Bytes(bytes)) => {
                 assert_eq!(bytes, Bytes::from("Hello, World!"))
@@ -698,7 +759,7 @@ mod tests {
         let mut body = BTreeMap::new();
         body.insert("text".to_string(), json!(""));
 
-        let result = build_text_body(&body);
+        let result = build_text_body(&body, "application/json");
         assert!(result.is_none());
     }
 
@@ -706,10 +767,57 @@ mod tests {
     async fn test_text_body_missing() {
         let body = BTreeMap::new();
 
-        let result = build_text_body(&body);
+        let result = build_text_body(&body, "application/json");
         assert!(result.is_none());
     }
 
+    #[tokio::test]
+    async fn test_text_body_strips_json_comments_by_default() {
+        let mut body = BTreeMap::new();
+        body.insert("text".to_string(), json!("{\n  // comment\n  \"foo\": \"bar\"\n}"));
+
+        let result = build_text_body(&body, "application/json");
+        match result {
+            Some(SendableBodyWithMeta::Bytes(bytes)) => {
+                let text = String::from_utf8_lossy(&bytes);
+                assert!(!text.contains("// comment"));
+                assert!(text.contains("\"foo\": \"bar\""));
+            }
+            _ => panic!("Expected Some(SendableBody::Bytes)"),
+        }
+    }
+
+    #[tokio::test]
+    async fn test_text_body_send_json_comments_when_opted_in() {
+        let mut body = BTreeMap::new();
+        body.insert("text".to_string(), json!("{\n  // comment\n  \"foo\": \"bar\"\n}"));
+        body.insert("sendJsonComments".to_string(), json!(true));
+
+        let result = build_text_body(&body, "application/json");
+        match result {
+            Some(SendableBodyWithMeta::Bytes(bytes)) => {
+                let text = String::from_utf8_lossy(&bytes);
+                assert!(text.contains("// comment"));
+            }
+            _ => panic!("Expected Some(SendableBody::Bytes)"),
+        }
+    }
+
+    #[tokio::test]
+    async fn test_text_body_no_strip_for_non_json() {
+        let mut body = BTreeMap::new();
+        body.insert("text".to_string(), json!("// not json\nsome text"));
+
+        let result = build_text_body(&body, "text/plain");
+        match result {
+            Some(SendableBodyWithMeta::Bytes(bytes)) => {
+                let text = String::from_utf8_lossy(&bytes);
+                assert!(text.contains("// not json"));
+            }
+            _ => panic!("Expected Some(SendableBody::Bytes)"),
+        }
+    }
+
     #[tokio::test]
     async fn test_form_urlencoded_body() -> Result<()> {
         let mut body = BTreeMap::new();

crates/yaak-models/bindings/gen_models.ts

@@ -49,7 +49,7 @@ export type HttpResponseEvent = { model: "http_response_event", id: string, crea
  * This mirrors `yaak_http::sender::HttpResponseEvent` but with serde support.
  * The `From` impl is in yaak-http to avoid circular dependencies.
  */
-export type HttpResponseEventData = { "type": "setting", name: string, value: string, } | { "type": "info", message: string, } | { "type": "redirect", url: string, status: number, behavior: string, } | { "type": "send_url", method: string, scheme: string, username: string, password: string, host: string, port: number, path: string, query: string, fragment: string, } | { "type": "receive_url", version: string, status: string, } | { "type": "header_up", name: string, value: string, } | { "type": "header_down", name: string, value: string, } | { "type": "chunk_sent", bytes: number, } | { "type": "chunk_received", bytes: number, } | { "type": "dns_resolved", hostname: string, addresses: Array<string>, duration: bigint, overridden: boolean, };
+export type HttpResponseEventData = { "type": "setting", name: string, value: string, } | { "type": "info", message: string, } | { "type": "redirect", url: string, status: number, behavior: string, dropped_body: boolean, dropped_headers: Array<string>, } | { "type": "send_url", method: string, scheme: string, username: string, password: string, host: string, port: number, path: string, query: string, fragment: string, } | { "type": "receive_url", version: string, status: string, } | { "type": "header_up", name: string, value: string, } | { "type": "header_down", name: string, value: string, } | { "type": "chunk_sent", bytes: number, } | { "type": "chunk_received", bytes: number, } | { "type": "dns_resolved", hostname: string, addresses: Array<string>, duration: bigint, overridden: boolean, };
 
 export type HttpResponseHeader = { name: string, value: string, };
 

crates/yaak-models/src/models.rs

@@ -1499,6 +1499,10 @@ pub enum HttpResponseEventData {
         url: String,
         status: u16,
         behavior: String,
+        #[serde(default)]
+        dropped_body: bool,
+        #[serde(default)]
+        dropped_headers: Vec<String>,
     },
     SendUrl {
         method: String,

crates/yaak-plugins/bindings/gen_models.ts

@@ -62,7 +62,7 @@ export type HttpResponseEvent = { model: "http_response_event", id: string, crea
  * This mirrors `yaak_http::sender::HttpResponseEvent` but with serde support.
  * The `From` impl is in yaak-http to avoid circular dependencies.
  */
-export type HttpResponseEventData = { "type": "setting", name: string, value: string, } | { "type": "info", message: string, } | { "type": "redirect", url: string, status: number, behavior: string, } | { "type": "send_url", method: string, scheme: string, username: string, password: string, host: string, port: number, path: string, query: string, fragment: string, } | { "type": "receive_url", version: string, status: string, } | { "type": "header_up", name: string, value: string, } | { "type": "header_down", name: string, value: string, } | { "type": "chunk_sent", bytes: number, } | { "type": "chunk_received", bytes: number, } | { "type": "dns_resolved", hostname: string, addresses: Array<string>, duration: bigint, overridden: boolean, };
+export type HttpResponseEventData = { "type": "setting", name: string, value: string, } | { "type": "info", message: string, } | { "type": "redirect", url: string, status: number, behavior: string, dropped_body: boolean, dropped_headers: Array<string>, } | { "type": "send_url", method: string, scheme: string, username: string, password: string, host: string, port: number, path: string, query: string, fragment: string, } | { "type": "receive_url", version: string, status: string, } | { "type": "header_up", name: string, value: string, } | { "type": "header_down", name: string, value: string, } | { "type": "chunk_sent", bytes: number, } | { "type": "chunk_received", bytes: number, } | { "type": "dns_resolved", hostname: string, addresses: Array<string>, duration: bigint, overridden: boolean, };
 
 export type HttpResponseHeader = { name: string, value: string, };
 

crates/yaak-plugins/src/manager.rs

@@ -50,6 +50,8 @@ pub struct PluginManager {
     vendored_plugin_dir: PathBuf,
     pub(crate) installed_plugin_dir: PathBuf,
     dev_mode: bool,
+    /// Errors from plugin initialization, retrievable once via `take_init_errors`.
+    init_errors: Arc<Mutex<Vec<(String, String)>>>,
 }
 
 /// Callback for plugin initialization events (e.g., toast notifications)
@@ -93,6 +95,7 @@ impl PluginManager {
             vendored_plugin_dir,
             installed_plugin_dir,
             dev_mode,
+            init_errors: Default::default(),
         };
 
         // Forward events to subscribers
@@ -183,17 +186,21 @@ impl PluginManager {
 
         let init_errors = plugin_manager.initialize_all_plugins(plugins, plugin_context).await;
         if !init_errors.is_empty() {
-            let joined = init_errors
+            for (dir, err) in &init_errors {
-                .into_iter()
+                warn!("Plugin failed to initialize: {dir}: {err}");
-                .map(|(dir, err)| format!("{dir}: {err}"))
+            }
-                .collect::<Vec<_>>()
+            *plugin_manager.init_errors.lock().await = init_errors;
-                .join("; ");
-            return Err(PluginErr(format!("Failed to initialize plugin(s): {joined}")));
         }
 
         Ok(plugin_manager)
     }
 
+    /// Take any initialization errors, clearing them from the manager.
+    /// Returns a list of `(plugin_directory, error_message)` pairs.
+    pub async fn take_init_errors(&self) -> Vec<(String, String)> {
+        std::mem::take(&mut *self.init_errors.lock().await)
+    }
+
     /// Get the vendored plugin directory path (resolves dev mode path if applicable)
     pub fn get_plugins_dir(&self) -> PathBuf {
         if self.dev_mode {

crates/yaak-templates/src/format_json.rs

@@ -11,6 +11,7 @@ pub fn format_json(text: &str, tab: &str) -> String {
     let mut new_json = "".to_string();
     let mut depth = 0;
     let mut state = FormatState::None;
+    let mut saw_newline_in_whitespace = false;
 
     loop {
         let rest_of_chars = chars.clone();
@@ -61,6 +62,62 @@ pub fn format_json(text: &str, tab: &str) -> String {
             continue;
         }
 
+        // Handle line comments (//)
+        if current_char == '/' && chars.peek() == Some(&'/') {
+            chars.next(); // Skip second /
+            // Collect the rest of the comment until newline
+            let mut comment = String::from("//");
+            loop {
+                match chars.peek() {
+                    Some(&'\n') | None => break,
+                    Some(_) => comment.push(chars.next().unwrap()),
+                }
+            }
+            // Check if the comma handler already added \n + indent
+            let trimmed = new_json.trim_end_matches(|c: char| c == ' ' || c == '\t');
+            if trimmed.ends_with(",\n") && !saw_newline_in_whitespace {
+                // Trailing comment on the same line as comma (e.g. "foo",// comment)
+                new_json.truncate(trimmed.len() - 1);
+                new_json.push(' ');
+            } else if !trimmed.ends_with('\n') && !new_json.is_empty() {
+                // Trailing comment after a value (no newline before us)
+                new_json.push(' ');
+            }
+            new_json.push_str(&comment);
+            new_json.push('\n');
+            new_json.push_str(tab.to_string().repeat(depth).as_str());
+            saw_newline_in_whitespace = false;
+            continue;
+        }
+
+        // Handle block comments (/* ... */)
+        if current_char == '/' && chars.peek() == Some(&'*') {
+            chars.next(); // Skip *
+            let mut comment = String::from("/*");
+            loop {
+                match chars.next() {
+                    None => break,
+                    Some('*') if chars.peek() == Some(&'/') => {
+                        chars.next(); // Skip /
+                        comment.push_str("*/");
+                        break;
+                    }
+                    Some(c) => comment.push(c),
+                }
+            }
+            // If we're not already on a fresh line, add newline + indent before comment
+            let trimmed = new_json.trim_end_matches(|c: char| c == ' ' || c == '\t');
+            if !trimmed.is_empty() && !trimmed.ends_with('\n') {
+                new_json.push('\n');
+                new_json.push_str(tab.to_string().repeat(depth).as_str());
+            }
+            new_json.push_str(&comment);
+            // After block comment, add newline + indent for the next content
+            new_json.push('\n');
+            new_json.push_str(tab.to_string().repeat(depth).as_str());
+            continue;
+        }
+
         match current_char {
             ',' => {
                 new_json.push(current_char);
@@ -125,20 +182,37 @@ pub fn format_json(text: &str, tab: &str) -> String {
                     || current_char == '\t'
                     || current_char == '\r'
                 {
+                    if current_char == '\n' {
+                        saw_newline_in_whitespace = true;
+                    }
                     // Don't add these
                 } else {
+                    saw_newline_in_whitespace = false;
                     new_json.push(current_char);
                 }
             }
         }
     }
 
-    // Replace only lines containing whitespace with nothing
+    // Filter out whitespace-only lines, but preserve empty lines inside block comments
-    new_json
+    let mut result_lines: Vec<&str> = Vec::new();
-        .lines()
+    let mut in_block_comment = false;
-        .filter(|line| !line.trim().is_empty()) // Filter out whitespace-only lines
+    for line in new_json.lines() {
-        .collect::<Vec<&str>>() // Collect the non-empty lines into a vector
+        if in_block_comment {
-        .join("\n") // Join the lines back into a single string
+            result_lines.push(line);
+            if line.contains("*/") {
+                in_block_comment = false;
+            }
+        } else {
+            if line.contains("/*") && !line.contains("*/") {
+                in_block_comment = true;
+            }
+            if !line.trim().is_empty() {
+                result_lines.push(line);
+            }
+        }
+    }
+    result_lines.iter().map(|line| line.trim_end()).collect::<Vec<&str>>().join("\n")
 }
 
 #[cfg(test)]
@@ -297,6 +371,161 @@ mod tests {
             r#"
 {}
 }
+"#
+            .trim()
+        );
+    }
+
+    #[test]
+    fn test_line_comment_between_keys() {
+        assert_eq!(
+            format_json(
+                r#"{"foo":"bar",// a comment
+"baz":"qux"}"#,
+                "  "
+            ),
+            r#"
+{
+  "foo": "bar", // a comment
+  "baz": "qux"
+}
+"#
+            .trim()
+        );
+    }
+
+    #[test]
+    fn test_line_comment_at_end() {
+        assert_eq!(
+            format_json(
+                r#"{"foo":"bar" // trailing
+}"#,
+                "  "
+            ),
+            r#"
+{
+  "foo": "bar" // trailing
+}
+"#
+            .trim()
+        );
+    }
+
+    #[test]
+    fn test_block_comment() {
+        assert_eq!(
+            format_json(r#"{"foo":"bar",/* comment */"baz":"qux"}"#, "  "),
+            r#"
+{
+  "foo": "bar",
+  /* comment */
+  "baz": "qux"
+}
+"#
+            .trim()
+        );
+    }
+
+    #[test]
+    fn test_comment_in_array() {
+        assert_eq!(
+            format_json(
+                r#"[1,// item comment
+2,3]"#,
+                "  "
+            ),
+            r#"
+[
+  1, // item comment
+  2,
+  3
+]
+"#
+            .trim()
+        );
+    }
+
+    #[test]
+    fn test_comment_only_line() {
+        assert_eq!(
+            format_json(
+                r#"{
+  // this is a standalone comment
+  "foo": "bar"
+}"#,
+                "  "
+            ),
+            r#"
+{
+  // this is a standalone comment
+  "foo": "bar"
+}
+"#
+            .trim()
+        );
+    }
+
+    #[test]
+    fn test_multiline_block_comment() {
+        assert_eq!(
+            format_json(
+                r#"{
+  "foo": "bar"
+  /**
+   Hello World!
+
+   Hi there
+   */
+}"#,
+                "  "
+            ),
+            r#"
+{
+  "foo": "bar"
+  /**
+   Hello World!
+
+   Hi there
+   */
+}
+"#
+            .trim()
+        );
+    }
+
+    // NOTE: trailing whitespace on output lines is trimmed by the formatter.
+    // We can't easily add a test for this because raw string literals get
+    // trailing whitespace stripped by the editor/linter.
+
+    #[test]
+    fn test_comment_inside_string_ignored() {
+        assert_eq!(
+            format_json(r#"{"foo":"// not a comment","bar":"/* also not */"}"#, "  "),
+            r#"
+{
+  "foo": "// not a comment",
+  "bar": "/* also not */"
+}
+"#
+            .trim()
+        );
+    }
+
+    #[test]
+    fn test_comment_on_line_after_comma() {
+        assert_eq!(
+            format_json(
+                r#"{
+  "a": "aaa",
+  // "b": "bbb"
+}"#,
+                "  "
+            ),
+            r#"
+{
+  "a": "aaa",
+  // "b": "bbb"
+}
 "#
             .trim()
         );

crates/yaak-templates/src/lib.rs

@@ -1,6 +1,7 @@
 pub mod error;
 pub mod escape;
 pub mod format_json;
+pub mod strip_json_comments;
 pub mod parser;
 pub mod renderer;
 pub mod wasm;

crates/yaak-templates/src/strip_json_comments.rs

@@ -0,0 +1,318 @@
+/// Strips JSON comments only if the result is valid JSON. If stripping comments
+/// produces invalid JSON, the original text is returned unchanged.
+pub fn maybe_strip_json_comments(text: &str) -> String {
+    let stripped = strip_json_comments(text);
+    if serde_json::from_str::<serde_json::Value>(&stripped).is_ok() {
+        stripped
+    } else {
+        text.to_string()
+    }
+}
+
+/// Strips comments from JSONC, preserving the original formatting as much as possible.
+///
+/// - Trailing comments on a line are removed (along with preceding whitespace)
+/// - Whole-line comments are removed, including the line itself
+/// - Block comments are removed, including any lines that become empty
+/// - Comments inside strings and template tags are left alone
+pub fn strip_json_comments(text: &str) -> String {
+    let mut chars = text.chars().peekable();
+    let mut result = String::with_capacity(text.len());
+    let mut in_string = false;
+    let mut in_template_tag = false;
+
+    loop {
+        let current_char = match chars.next() {
+            None => break,
+            Some(c) => c,
+        };
+
+        // Handle JSON strings
+        if in_string {
+            result.push(current_char);
+            match current_char {
+                '"' => in_string = false,
+                '\\' => {
+                    if let Some(c) = chars.next() {
+                        result.push(c);
+                    }
+                }
+                _ => {}
+            }
+            continue;
+        }
+
+        // Handle template tags
+        if in_template_tag {
+            result.push(current_char);
+            if current_char == ']' && chars.peek() == Some(&'}') {
+                result.push(chars.next().unwrap());
+                in_template_tag = false;
+            }
+            continue;
+        }
+
+        // Check for template tag start
+        if current_char == '$' && chars.peek() == Some(&'{') {
+            let mut lookahead = chars.clone();
+            lookahead.next(); // skip {
+            if lookahead.peek() == Some(&'[') {
+                in_template_tag = true;
+                result.push(current_char);
+                result.push(chars.next().unwrap()); // {
+                result.push(chars.next().unwrap()); // [
+                continue;
+            }
+        }
+
+        // Check for line comment
+        if current_char == '/' && chars.peek() == Some(&'/') {
+            chars.next(); // skip second /
+            // Consume until newline
+            loop {
+                match chars.peek() {
+                    Some(&'\n') | None => break,
+                    Some(_) => {
+                        chars.next();
+                    }
+                }
+            }
+            // Trim trailing whitespace that preceded the comment
+            let trimmed_len = result.trim_end_matches(|c: char| c == ' ' || c == '\t').len();
+            result.truncate(trimmed_len);
+            continue;
+        }
+
+        // Check for block comment
+        if current_char == '/' && chars.peek() == Some(&'*') {
+            chars.next(); // skip *
+            // Consume until */
+            loop {
+                match chars.next() {
+                    None => break,
+                    Some('*') if chars.peek() == Some(&'/') => {
+                        chars.next(); // skip /
+                        break;
+                    }
+                    Some(_) => {}
+                }
+            }
+            // Trim trailing whitespace that preceded the comment
+            let trimmed_len = result.trim_end_matches(|c: char| c == ' ' || c == '\t').len();
+            result.truncate(trimmed_len);
+            // Skip whitespace/newline after the block comment if the next line is content
+            // (this handles the case where the block comment is on its own line)
+            continue;
+        }
+
+        if current_char == '"' {
+            in_string = true;
+        }
+
+        result.push(current_char);
+    }
+
+    // Remove lines that are now empty (were comment-only lines)
+    let result = result
+        .lines()
+        .filter(|line| !line.trim().is_empty())
+        .collect::<Vec<&str>>()
+        .join("\n");
+
+    // Remove trailing commas before } or ]
+    strip_trailing_commas(&result)
+}
+
+/// Removes trailing commas before closing braces/brackets, respecting strings.
+fn strip_trailing_commas(text: &str) -> String {
+    let mut result = String::with_capacity(text.len());
+    let chars: Vec<char> = text.chars().collect();
+    let mut i = 0;
+    let mut in_string = false;
+
+    while i < chars.len() {
+        let ch = chars[i];
+
+        if in_string {
+            result.push(ch);
+            match ch {
+                '"' => in_string = false,
+                '\\' => {
+                    i += 1;
+                    if i < chars.len() {
+                        result.push(chars[i]);
+                    }
+                }
+                _ => {}
+            }
+            i += 1;
+            continue;
+        }
+
+        if ch == '"' {
+            in_string = true;
+            result.push(ch);
+            i += 1;
+            continue;
+        }
+
+        if ch == ',' {
+            // Look ahead past whitespace/newlines for } or ]
+            let mut j = i + 1;
+            while j < chars.len() && chars[j].is_whitespace() {
+                j += 1;
+            }
+            if j < chars.len() && (chars[j] == '}' || chars[j] == ']') {
+                // Skip the comma
+                i += 1;
+                continue;
+            }
+        }
+
+        result.push(ch);
+        i += 1;
+    }
+
+    result
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::strip_json_comments::strip_json_comments;
+
+    #[test]
+    fn test_no_comments() {
+        let input = r#"{
+  "foo": "bar",
+  "baz": 123
+}"#;
+        assert_eq!(strip_json_comments(input), input);
+    }
+
+    #[test]
+    fn test_trailing_line_comment() {
+        assert_eq!(
+            strip_json_comments(r#"{
+  "foo": "bar", // this is a comment
+  "baz": 123
+}"#),
+            r#"{
+  "foo": "bar",
+  "baz": 123
+}"#
+        );
+    }
+
+    #[test]
+    fn test_whole_line_comment() {
+        assert_eq!(
+            strip_json_comments(r#"{
+  // this is a comment
+  "foo": "bar"
+}"#),
+            r#"{
+  "foo": "bar"
+}"#
+        );
+    }
+
+    #[test]
+    fn test_inline_block_comment() {
+        assert_eq!(
+            strip_json_comments(r#"{
+  "foo": /* a comment */ "bar"
+}"#),
+            r#"{
+  "foo": "bar"
+}"#
+        );
+    }
+
+    #[test]
+    fn test_whole_line_block_comment() {
+        assert_eq!(
+            strip_json_comments(r#"{
+  /* a comment */
+  "foo": "bar"
+}"#),
+            r#"{
+  "foo": "bar"
+}"#
+        );
+    }
+
+    #[test]
+    fn test_multiline_block_comment() {
+        assert_eq!(
+            strip_json_comments(r#"{
+  /**
+   * Hello World!
+   */
+  "foo": "bar"
+}"#),
+            r#"{
+  "foo": "bar"
+}"#
+        );
+    }
+
+    #[test]
+    fn test_comment_inside_string_preserved() {
+        let input = r#"{
+  "foo": "// not a comment",
+  "bar": "/* also not */"
+}"#;
+        assert_eq!(strip_json_comments(input), input);
+    }
+
+    #[test]
+    fn test_comment_inside_template_tag_preserved() {
+        let input = r#"{
+  "foo": ${[ fn("// hi", "/* hey */") ]}
+}"#;
+        assert_eq!(strip_json_comments(input), input);
+    }
+
+    #[test]
+    fn test_multiple_comments() {
+        assert_eq!(
+            strip_json_comments(r#"{
+  // first comment
+  "foo": "bar", // trailing
+  /* block */
+  "baz": 123
+}"#),
+            r#"{
+  "foo": "bar",
+  "baz": 123
+}"#
+        );
+    }
+
+    #[test]
+    fn test_trailing_comma_after_comment_removed() {
+        assert_eq!(
+            strip_json_comments(r#"{
+  "a": "aaa",
+  // "b": "bbb"
+}"#),
+            r#"{
+  "a": "aaa"
+}"#
+        );
+    }
+
+    #[test]
+    fn test_trailing_comma_in_array() {
+        assert_eq!(
+            strip_json_comments(r#"[1, 2, /* 3 */]"#),
+            r#"[1, 2]"#
+        );
+    }
+
+    #[test]
+    fn test_comma_inside_string_preserved() {
+        let input = r#"{"a": "hello,}"#;
+        assert_eq!(strip_json_comments(input), input);
+    }
+}

crates/yaak/src/render.rs

@@ -2,7 +2,7 @@ use log::info;
 use serde_json::Value;
 use std::collections::BTreeMap;
 use yaak_http::path_placeholders::apply_path_placeholders;
-use yaak_models::models::{Environment, HttpRequest, HttpRequestHeader, HttpUrlParameter};
+use yaak_models::models::{Environment, GrpcRequest, HttpRequest, HttpRequestHeader, HttpUrlParameter};
 use yaak_models::render::make_vars_hashmap;
 use yaak_templates::{RenderOptions, TemplateCallback, parse_and_render, render_json_value_raw};
 
@@ -89,6 +89,64 @@ pub async fn render_http_request<T: TemplateCallback>(
     Ok(HttpRequest { url, url_parameters, headers, body, authentication, ..request.to_owned() })
 }
 
+pub async fn render_grpc_request<T: TemplateCallback>(
+    r: &GrpcRequest,
+    environment_chain: Vec<Environment>,
+    cb: &T,
+    opt: &RenderOptions,
+) -> yaak_templates::error::Result<GrpcRequest> {
+    let vars = &make_vars_hashmap(environment_chain);
+
+    let mut metadata = Vec::new();
+    for p in r.metadata.clone() {
+        if !p.enabled {
+            continue;
+        }
+        metadata.push(HttpRequestHeader {
+            enabled: p.enabled,
+            name: parse_and_render(p.name.as_str(), vars, cb, opt).await?,
+            value: parse_and_render(p.value.as_str(), vars, cb, opt).await?,
+            id: p.id,
+        })
+    }
+
+    let authentication = {
+        let mut disabled = false;
+        let mut auth = BTreeMap::new();
+        match r.authentication.get("disabled") {
+            Some(Value::Bool(true)) => {
+                disabled = true;
+            }
+            Some(Value::String(tmpl)) => {
+                disabled = parse_and_render(tmpl.as_str(), vars, cb, opt)
+                    .await
+                    .unwrap_or_default()
+                    .is_empty();
+                info!(
+                    "Rendering authentication.disabled as a template: {disabled} from \"{tmpl}\""
+                );
+            }
+            _ => {}
+        }
+        if disabled {
+            auth.insert("disabled".to_string(), Value::Bool(true));
+        } else {
+            for (k, v) in r.authentication.clone() {
+                if k == "disabled" {
+                    auth.insert(k, Value::Bool(false));
+                } else {
+                    auth.insert(k, render_json_value_raw(v, vars, cb, opt).await?);
+                }
+            }
+        }
+        auth
+    };
+
+    let url = parse_and_render(r.url.as_str(), vars, cb, opt).await?;
+
+    Ok(GrpcRequest { url, metadata, authentication, ..r.to_owned() })
+}
+
 fn strip_disabled_form_entries(v: Value) -> Value {
     match v {
         Value::Array(items) => Value::Array(

package-lock.json

@@ -1480,9 +1480,9 @@
       }
     },
     "node_modules/@hono/node-server": {
-      "version": "1.19.9",
+      "version": "1.19.10",
-      "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-1.19.9.tgz",
+      "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-1.19.10.tgz",
-      "integrity": "sha512-vHL6w3ecZsky+8P5MD+eFfaGTyCeOHUIFYMGpQGbrBTSmNNoxv0if69rEZ5giu36weC5saFuznL411gRX7bJDw==",
+      "integrity": "sha512-hZ7nOssGqRgyV3FVVQdfi+U4q02uB23bpnYpdvNXkYTRRyWx84b7yf1ans+dnJ/7h41sGL3CeQTfO+ZGxuO+Iw==",
       "license": "MIT",
       "engines": {
         "node": ">=18.14.1"
@@ -2584,6 +2584,16 @@
         "ebnf": "^1.9.1"
       }
     },
+    "node_modules/@shopify/lang-jsonc": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/@shopify/lang-jsonc/-/lang-jsonc-1.0.1.tgz",
+      "integrity": "sha512-KrBrRFhvr1qJiZBODAtqbL1u1e67UR3plBN79Z8nd5TQAAzpx66jS4zs7Ss9M22ygGrpWFhyhSoNVlp5VCYktQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@lezer/highlight": "^1.0.0",
+        "@lezer/lr": "^1.3.7"
+      }
+    },
     "node_modules/@svgr/babel-plugin-add-jsx-attribute": {
       "version": "8.0.0",
       "resolved": "https://registry.npmjs.org/@svgr/babel-plugin-add-jsx-attribute/-/babel-plugin-add-jsx-attribute-8.0.0.tgz",
@@ -5330,105 +5340,6 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/cliui": {
-      "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/cliui/-/cliui-6.0.0.tgz",
-      "integrity": "sha512-t6wbgtoCXvAzst7QgXxJYqPt0usEfbgQdftEPbLL/cvv6HPE5VgvqCuAIDR0NgU52ds6rFwqrgakNLrHEjCbrQ==",
-      "license": "ISC",
-      "dependencies": {
-        "string-width": "^4.2.0",
-        "strip-ansi": "^6.0.0",
-        "wrap-ansi": "^6.2.0"
-      }
-    },
-    "node_modules/cliui/node_modules/ansi-regex": {
-      "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
-      "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/cliui/node_modules/ansi-styles": {
-      "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
-      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
-      "license": "MIT",
-      "dependencies": {
-        "color-convert": "^2.0.1"
-      },
-      "engines": {
-        "node": ">=8"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
-      }
-    },
-    "node_modules/cliui/node_modules/color-convert": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
-      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
-      "license": "MIT",
-      "dependencies": {
-        "color-name": "~1.1.4"
-      },
-      "engines": {
-        "node": ">=7.0.0"
-      }
-    },
-    "node_modules/cliui/node_modules/color-name": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
-      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
-      "license": "MIT"
-    },
-    "node_modules/cliui/node_modules/emoji-regex": {
-      "version": "8.0.0",
-      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz",
-      "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==",
-      "license": "MIT"
-    },
-    "node_modules/cliui/node_modules/string-width": {
-      "version": "4.2.3",
-      "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
-      "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
-      "license": "MIT",
-      "dependencies": {
-        "emoji-regex": "^8.0.0",
-        "is-fullwidth-code-point": "^3.0.0",
-        "strip-ansi": "^6.0.1"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/cliui/node_modules/strip-ansi": {
-      "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
-      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
-      "license": "MIT",
-      "dependencies": {
-        "ansi-regex": "^5.0.1"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/cliui/node_modules/wrap-ansi": {
-      "version": "6.2.0",
-      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-6.2.0.tgz",
-      "integrity": "sha512-r6lPcBGxZXlIcymEu7InxDMhdW0KDxpLgoFLcguasxCaJ/SOIZwINatK9KY/tf+ZrlywOKU0UDj3ATXUBfxJXA==",
-      "license": "MIT",
-      "dependencies": {
-        "ansi-styles": "^4.0.0",
-        "string-width": "^4.1.0",
-        "strip-ansi": "^6.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
     "node_modules/clone-regexp": {
       "version": "3.0.0",
       "resolved": "https://registry.npmjs.org/clone-regexp/-/clone-regexp-3.0.0.tgz",
@@ -6047,15 +5958,6 @@
         }
       }
     },
-    "node_modules/decamelize": {
-      "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/decamelize/-/decamelize-1.2.0.tgz",
-      "integrity": "sha512-z2S+W9X73hAUUki+N+9Za2lBlun89zigOyGrsax+KUQ6wKW4ZoWpEYBkGhQjwAjjDCkWxhY0VKEhk8wzY7F5cA==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
     "node_modules/decode-named-character-reference": {
       "version": "1.2.0",
       "resolved": "https://registry.npmjs.org/decode-named-character-reference/-/decode-named-character-reference-1.2.0.tgz",
@@ -7200,19 +7102,6 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/find-up": {
-      "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/find-up/-/find-up-4.1.0.tgz",
-      "integrity": "sha512-PpOwAdQ/YlXQ2vj8a3h8IipDuYRi3wceVQQGYWxNINccq40Anw7BlsEXCMbt1Zt+OLA6Fq9suIpIWD0OsnISlw==",
-      "license": "MIT",
-      "dependencies": {
-        "locate-path": "^5.0.0",
-        "path-exists": "^4.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
     "node_modules/focus-trap": {
       "version": "7.7.1",
       "resolved": "https://registry.npmjs.org/focus-trap/-/focus-trap-7.7.1.tgz",
@@ -7305,30 +7194,6 @@
         "node": ">=0.4.x"
       }
     },
-    "node_modules/format-graphql": {
-      "version": "1.5.0",
-      "resolved": "https://registry.npmjs.org/format-graphql/-/format-graphql-1.5.0.tgz",
-      "integrity": "sha512-ZZWcjwJ1IMdnW9l3CeYccC/J7skqOB18tY3autO5OUQuGVZpQu6Es3SThRm25SfiMeZO1+UbzIqnGbjAURu/UA==",
-      "dependencies": {
-        "graphql": "^15.1.0",
-        "yargs": "^15.3.1"
-      },
-      "bin": {
-        "format-graphql": "dist/bin/index.js"
-      },
-      "engines": {
-        "node": ">=10.0"
-      }
-    },
-    "node_modules/format-graphql/node_modules/graphql": {
-      "version": "15.10.1",
-      "resolved": "https://registry.npmjs.org/graphql/-/graphql-15.10.1.tgz",
-      "integrity": "sha512-BL/Xd/T9baO6NFzoMpiMD7YUZ62R6viR5tp/MULVEnbYJXZA//kRNW7J0j1w/wXArgL0sCxhDfK5dczSKn3+cg==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 10.x"
-      }
-    },
     "node_modules/forwarded": {
       "version": "0.2.0",
       "resolved": "https://registry.npmjs.org/forwarded/-/forwarded-0.2.0.tgz",
@@ -8008,9 +7873,9 @@
       }
     },
     "node_modules/hono": {
-      "version": "4.11.10",
+      "version": "4.12.4",
-      "resolved": "https://registry.npmjs.org/hono/-/hono-4.11.10.tgz",
+      "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.4.tgz",
-      "integrity": "sha512-kyWP5PAiMooEvGrA9jcD3IXF7ATu8+o7B3KCbPXid5se52NPqnOpM/r9qeW2heMnOekF4kqR1fXJqCYeCLKrZg==",
+      "integrity": "sha512-ooiZW1Xy8rQ4oELQ++otI2T9DsKpV0M6c6cO6JGx4RTfav9poFFLlet9UMXHZnoM1yG0HWGlQLswBGX3RZmHtg==",
       "license": "MIT",
       "engines": {
         "node": ">=16.9.0"
@@ -9271,18 +9136,6 @@
         "node": ">=4"
       }
     },
-    "node_modules/locate-path": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/locate-path/-/locate-path-5.0.0.tgz",
-      "integrity": "sha512-t7hw9pI+WvuwNJXwk5zVHpyhIqzg2qTlklJOf0mVxGSbe3Fp2VieZcduNYjaLDoy6p9uGpQEGWG87WpMKlNq8g==",
-      "license": "MIT",
-      "dependencies": {
-        "p-locate": "^4.1.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
     "node_modules/lodash": {
       "version": "4.17.21",
       "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz",
@@ -11605,33 +11458,6 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/p-limit": {
-      "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/p-limit/-/p-limit-2.3.0.tgz",
-      "integrity": "sha512-//88mFWSJx8lxCzwdAABTJL2MyWB12+eIY7MDL2SqLmAkeKU9qxRvWuSyTjm3FUmpBEMuFfckAIqEaVGUDxb6w==",
-      "license": "MIT",
-      "dependencies": {
-        "p-try": "^2.0.0"
-      },
-      "engines": {
-        "node": ">=6"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/p-locate": {
-      "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/p-locate/-/p-locate-4.1.0.tgz",
-      "integrity": "sha512-R79ZZ/0wAxKGu3oYMlz8jy/kbhsNrS7SKZ7PxEHBgJ5+F2mtFW2fK2cOtBh1cHYkQsbzFV7I+EoRKe6Yt0oK7A==",
-      "license": "MIT",
-      "dependencies": {
-        "p-limit": "^2.2.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
     "node_modules/p-map": {
       "version": "7.0.4",
       "resolved": "https://registry.npmjs.org/p-map/-/p-map-7.0.4.tgz",
@@ -11658,15 +11484,6 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/p-try": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/p-try/-/p-try-2.2.0.tgz",
-      "integrity": "sha512-R4nPAVTAU0B9D35/Gk3uJf/7XYbQcyohSKdvAxIRSNghFl4e71hVoGnBNQz9cWaXxO2I10KTC+3jMdvvoKw6dQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=6"
-      }
-    },
     "node_modules/package-json-from-dist": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/package-json-from-dist/-/package-json-from-dist-1.0.1.tgz",
@@ -11760,15 +11577,6 @@
       "integrity": "sha512-b7uo2UCUOYZcnF/3ID0lulOJi/bafxa1xPe7ZPsammBSpjSWQkjNxlt635YGS2MiR9GjvuXCtz2emr3jbsz98g==",
       "license": "MIT"
     },
-    "node_modules/path-exists": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/path-exists/-/path-exists-4.0.0.tgz",
-      "integrity": "sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=8"
-      }
-    },
     "node_modules/path-key": {
       "version": "3.1.1",
       "resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz",
@@ -12883,12 +12691,6 @@
         "node": ">=0.10.0"
       }
     },
-    "node_modules/require-main-filename": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/require-main-filename/-/require-main-filename-2.0.0.tgz",
-      "integrity": "sha512-NKN5kMDylKuldxYLSUfrbo5Tuzh4hd+2E8NPPX02mZtn1VuREQToYe/ZdlJy+J3uCpfaiGF05e7B8W0iXbQHmg==",
-      "license": "ISC"
-    },
     "node_modules/resize-observer-polyfill": {
       "version": "1.5.1",
       "resolved": "https://registry.npmjs.org/resize-observer-polyfill/-/resize-observer-polyfill-1.5.1.tgz",
@@ -13356,12 +13158,6 @@
         "url": "https://opencollective.com/express"
       }
     },
-    "node_modules/set-blocking": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/set-blocking/-/set-blocking-2.0.0.tgz",
-      "integrity": "sha512-KiKBS8AnWGEyLzofFfmvKwpdPzqiy16LvQfK3yv/fVH7Bj13/wl3JSR1J+rfgRE9q7xUJK4qvgS8raSOeLUehw==",
-      "license": "ISC"
-    },
     "node_modules/set-function-length": {
       "version": "1.2.2",
       "resolved": "https://registry.npmjs.org/set-function-length/-/set-function-length-1.2.2.tgz",
@@ -15601,12 +15397,6 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
-    "node_modules/which-module": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/which-module/-/which-module-2.0.1.tgz",
-      "integrity": "sha512-iBdZ57RDvnOR9AGBhML2vFZf7h8vmBjhoaZqODJBFWHVtKkDmKuHai3cx5PgVMrX5YDNp27AofYbAwctSS+vhQ==",
-      "license": "ISC"
-    },
     "node_modules/which-typed-array": {
       "version": "1.1.19",
       "resolved": "https://registry.npmjs.org/which-typed-array/-/which-typed-array-1.1.19.tgz",
@@ -15822,12 +15612,6 @@
         "node": ">=0.4"
       }
     },
-    "node_modules/y18n": {
-      "version": "4.0.3",
-      "resolved": "https://registry.npmjs.org/y18n/-/y18n-4.0.3.tgz",
-      "integrity": "sha512-JKhqTOwSrqNA1NY5lSztJ1GrBiUodLMmIZuLiDaMRJ+itFd+ABVE8XBjOvIWL+rSqNDC74LCSFmlb/U4UZ4hJQ==",
-      "license": "ISC"
-    },
     "node_modules/yallist": {
       "version": "3.1.1",
       "resolved": "https://registry.npmjs.org/yallist/-/yallist-3.1.1.tgz",
@@ -15850,91 +15634,6 @@
         "url": "https://github.com/sponsors/eemeli"
       }
     },
-    "node_modules/yargs": {
-      "version": "15.4.1",
-      "resolved": "https://registry.npmjs.org/yargs/-/yargs-15.4.1.tgz",
-      "integrity": "sha512-aePbxDmcYW++PaqBsJ+HYUFwCdv4LVvdnhBy78E57PIor8/OVvhMrADFFEDh8DHDFRv/O9i3lPhsENjO7QX0+A==",
-      "license": "MIT",
-      "dependencies": {
-        "cliui": "^6.0.0",
-        "decamelize": "^1.2.0",
-        "find-up": "^4.1.0",
-        "get-caller-file": "^2.0.1",
-        "require-directory": "^2.1.1",
-        "require-main-filename": "^2.0.0",
-        "set-blocking": "^2.0.0",
-        "string-width": "^4.2.0",
-        "which-module": "^2.0.0",
-        "y18n": "^4.0.0",
-        "yargs-parser": "^18.1.2"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/yargs-parser": {
-      "version": "18.1.3",
-      "resolved": "https://registry.npmjs.org/yargs-parser/-/yargs-parser-18.1.3.tgz",
-      "integrity": "sha512-o50j0JeToy/4K6OZcaQmW6lyXXKhq7csREXcDwk2omFPJEwUNOVtJKvmDr9EI1fAJZUyZcRF7kxGBWmRXudrCQ==",
-      "license": "ISC",
-      "dependencies": {
-        "camelcase": "^5.0.0",
-        "decamelize": "^1.2.0"
-      },
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/yargs-parser/node_modules/camelcase": {
-      "version": "5.3.1",
-      "resolved": "https://registry.npmjs.org/camelcase/-/camelcase-5.3.1.tgz",
-      "integrity": "sha512-L28STB170nwWS63UjtlEOE3dldQApaJXZkOI1uMFfzf3rRuPegHaHesyee+YxQ+W6SvRDQV6UrdOdRiR153wJg==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/yargs/node_modules/ansi-regex": {
-      "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
-      "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/yargs/node_modules/emoji-regex": {
-      "version": "8.0.0",
-      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz",
-      "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==",
-      "license": "MIT"
-    },
-    "node_modules/yargs/node_modules/string-width": {
-      "version": "4.2.3",
-      "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
-      "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
-      "license": "MIT",
-      "dependencies": {
-        "emoji-regex": "^8.0.0",
-        "is-fullwidth-code-point": "^3.0.0",
-        "strip-ansi": "^6.0.1"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/yargs/node_modules/strip-ansi": {
-      "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
-      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
-      "license": "MIT",
-      "dependencies": {
-        "ansi-regex": "^5.0.1"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
     "node_modules/yauzl": {
       "version": "2.10.0",
       "resolved": "https://registry.npmjs.org/yauzl/-/yauzl-2.10.0.tgz",
@@ -16064,9 +15763,9 @@
       "version": "0.2.1",
       "dependencies": {
         "@hono/mcp": "^0.2.3",
-        "@hono/node-server": "^1.19.7",
+        "@hono/node-server": "^1.19.10",
         "@modelcontextprotocol/sdk": "^1.26.0",
-        "hono": "^4.11.10",
+        "hono": "^4.12.4",
         "zod": "^3.25.76"
       },
       "devDependencies": {
@@ -16323,6 +16022,7 @@
         "@replit/codemirror-emacs": "^6.1.0",
         "@replit/codemirror-vim": "^6.3.0",
         "@replit/codemirror-vscode-keymap": "^6.0.2",
+        "@shopify/lang-jsonc": "^1.0.1",
         "@tanstack/react-query": "^5.90.5",
         "@tanstack/react-router": "^1.133.13",
         "@tanstack/react-virtual": "^3.13.12",
@@ -16342,7 +16042,6 @@
         "deep-equal": "^2.2.3",
         "eventemitter3": "^5.0.1",
         "focus-trap-react": "^11.0.4",
-        "format-graphql": "^1.5.0",
         "fuzzbunny": "^1.0.1",
         "hexy": "^0.3.5",
         "history": "^5.3.0",

packages/plugin-runtime-types/src/bindings/gen_models.ts

@@ -18,7 +18,12 @@ export type EditorKeymap = "default" | "vim" | "vscode" | "emacs";
 
 export type EncryptedKey = { encryptedKey: string, };
 
-export type Environment = { model: "environment", id: string, workspaceId: string, createdAt: string, updatedAt: string, name: string, public: boolean, parentModel: string, parentId: string | null, variables: Array<EnvironmentVariable>, color: string | null, sortPriority: number, };
+export type Environment = { model: "environment", id: string, workspaceId: string, createdAt: string, updatedAt: string, name: string, public: boolean, parentModel: string, parentId: string | null, 
+/**
+ * Variables defined in this environment scope.
+ * Child environments override parent variables by name.
+ */
+variables: Array<EnvironmentVariable>, color: string | null, sortPriority: number, };
 
 export type EnvironmentVariable = { enabled?: boolean, name: string, value: string, id?: string, };
 
@@ -34,9 +39,17 @@ export type GrpcEvent = { model: "grpc_event", id: string, createdAt: string, up
 
 export type GrpcEventType = "info" | "error" | "client_message" | "server_message" | "connection_start" | "connection_end";
 
-export type GrpcRequest = { model: "grpc_request", id: string, createdAt: string, updatedAt: string, workspaceId: string, folderId: string | null, authenticationType: string | null, authentication: Record<string, any>, description: string, message: string, metadata: Array<HttpRequestHeader>, method: string | null, name: string, service: string | null, sortPriority: number, url: string, };
+export type GrpcRequest = { model: "grpc_request", id: string, createdAt: string, updatedAt: string, workspaceId: string, folderId: string | null, authenticationType: string | null, authentication: Record<string, any>, description: string, message: string, metadata: Array<HttpRequestHeader>, method: string | null, name: string, service: string | null, sortPriority: number, 
+/**
+ * Server URL (http for plaintext or https for secure)
+ */
+url: string, };
 
-export type HttpRequest = { model: "http_request", id: string, createdAt: string, updatedAt: string, workspaceId: string, folderId: string | null, authentication: Record<string, any>, authenticationType: string | null, body: Record<string, any>, bodyType: string | null, description: string, headers: Array<HttpRequestHeader>, method: string, name: string, sortPriority: number, url: string, urlParameters: Array<HttpUrlParameter>, };
+export type HttpRequest = { model: "http_request", id: string, createdAt: string, updatedAt: string, workspaceId: string, folderId: string | null, authentication: Record<string, any>, authenticationType: string | null, body: Record<string, any>, bodyType: string | null, description: string, headers: Array<HttpRequestHeader>, method: string, name: string, sortPriority: number, url: string, 
+/**
+ * URL parameters used for both path placeholders (`:id`) and query string entries.
+ */
+urlParameters: Array<HttpUrlParameter>, };
 
 export type HttpRequestHeader = { enabled?: boolean, name: string, value: string, id?: string, };
 
@@ -49,17 +62,24 @@ export type HttpResponseEvent = { model: "http_response_event", id: string, crea
  * This mirrors `yaak_http::sender::HttpResponseEvent` but with serde support.
  * The `From` impl is in yaak-http to avoid circular dependencies.
  */
-export type HttpResponseEventData = { "type": "setting", name: string, value: string, } | { "type": "info", message: string, } | { "type": "redirect", url: string, status: number, behavior: string, } | { "type": "send_url", method: string, scheme: string, username: string, password: string, host: string, port: number, path: string, query: string, fragment: string, } | { "type": "receive_url", version: string, status: string, } | { "type": "header_up", name: string, value: string, } | { "type": "header_down", name: string, value: string, } | { "type": "chunk_sent", bytes: number, } | { "type": "chunk_received", bytes: number, } | { "type": "dns_resolved", hostname: string, addresses: Array<string>, duration: bigint, overridden: boolean, };
+export type HttpResponseEventData = { "type": "setting", name: string, value: string, } | { "type": "info", message: string, } | { "type": "redirect", url: string, status: number, behavior: string, dropped_body: boolean, dropped_headers: Array<string>, } | { "type": "send_url", method: string, scheme: string, username: string, password: string, host: string, port: number, path: string, query: string, fragment: string, } | { "type": "receive_url", version: string, status: string, } | { "type": "header_up", name: string, value: string, } | { "type": "header_down", name: string, value: string, } | { "type": "chunk_sent", bytes: number, } | { "type": "chunk_received", bytes: number, } | { "type": "dns_resolved", hostname: string, addresses: Array<string>, duration: bigint, overridden: boolean, };
 
 export type HttpResponseHeader = { name: string, value: string, };
 
 export type HttpResponseState = "initialized" | "connected" | "closed";
 
-export type HttpUrlParameter = { enabled?: boolean, name: string, value: string, id?: string, };
+export type HttpUrlParameter = { enabled?: boolean, 
+/**
+ * Colon-prefixed parameters are treated as path parameters if they match, like `/users/:id`
+ * Other entries are appended as query parameters
+ */
+name: string, value: string, id?: string, };
 
 export type KeyValue = { model: "key_value", id: string, createdAt: string, updatedAt: string, key: string, namespace: string, value: string, };
 
-export type Plugin = { model: "plugin", id: string, createdAt: string, updatedAt: string, checkedAt: string | null, directory: string, enabled: boolean, url: string | null, };
+export type Plugin = { model: "plugin", id: string, createdAt: string, updatedAt: string, checkedAt: string | null, directory: string, enabled: boolean, url: string | null, source: PluginSource, };
+
+export type PluginSource = "bundled" | "filesystem" | "registry";
 
 export type ProxySetting = { "type": "enabled", http: string, https: string, auth: ProxySettingAuth | null, bypass: string, disabled: boolean, } | { "type": "disabled" };
 
@@ -77,7 +97,11 @@ export type WebsocketEvent = { model: "websocket_event", id: string, createdAt:
 
 export type WebsocketEventType = "binary" | "close" | "frame" | "open" | "ping" | "pong" | "text";
 
-export type WebsocketRequest = { model: "websocket_request", id: string, createdAt: string, updatedAt: string, workspaceId: string, folderId: string | null, authentication: Record<string, any>, authenticationType: string | null, description: string, headers: Array<HttpRequestHeader>, message: string, name: string, sortPriority: number, url: string, urlParameters: Array<HttpUrlParameter>, };
+export type WebsocketRequest = { model: "websocket_request", id: string, createdAt: string, updatedAt: string, workspaceId: string, folderId: string | null, authentication: Record<string, any>, authenticationType: string | null, description: string, headers: Array<HttpRequestHeader>, message: string, name: string, sortPriority: number, url: string, 
+/**
+ * URL parameters used for both path placeholders (`:id`) and query string entries.
+ */
+urlParameters: Array<HttpUrlParameter>, };
 
 export type Workspace = { model: "workspace", id: string, createdAt: string, updatedAt: string, authentication: Record<string, any>, authenticationType: string | null, description: string, headers: Array<HttpRequestHeader>, name: string, encryptionKeyChallenge: string | null, settingValidateCertificates: boolean, settingFollowRedirects: boolean, settingRequestTimeout: number, settingDnsOverrides: Array<DnsOverride>, };
 

plugins-external/mcp-server/package.json

@@ -16,9 +16,9 @@
   },
   "dependencies": {
     "@hono/mcp": "^0.2.3",
-    "@hono/node-server": "^1.19.7",
+    "@hono/node-server": "^1.19.10",
     "@modelcontextprotocol/sdk": "^1.26.0",
-    "hono": "^4.11.10",
+    "hono": "^4.12.4",
     "zod": "^3.25.76"
   },
   "devDependencies": {

plugins/auth-oauth2/src/callbackServer.ts

@@ -2,7 +2,7 @@ import type { IncomingMessage, ServerResponse } from 'node:http';
 import http from 'node:http';
 import type { Context } from '@yaakapp/api';
 
-export const HOSTED_CALLBACK_URL = 'https://oauth.yaak.app/redirect';
+export const HOSTED_CALLBACK_URL_BASE = 'https://oauth.yaak.app/redirect';
 export const DEFAULT_LOCALHOST_PORT = 8765;
 const CALLBACK_TIMEOUT_MS = 5 * 60 * 1000; // 5 minutes
 
@@ -176,12 +176,15 @@ export function startCallbackServer(options: {
 
 /**
  * Build the redirect URI for the hosted callback page.
- * The hosted page will redirect to the local server with the OAuth response.
+ * The port is encoded in the URL path so the hosted page can redirect
+ * to the local server without relying on query params (which some OAuth
+ * providers strip). The default port is omitted for a cleaner URL.
  */
-export function buildHostedCallbackRedirectUri(localPort: number, localPath: string): string {
+export function buildHostedCallbackRedirectUri(localPort: number): string {
-  const localRedirectUri = `http://127.0.0.1:${localPort}${localPath}`;
+  if (localPort === DEFAULT_LOCALHOST_PORT) {
-  // The hosted callback page will read params and redirect to the local server
+    return HOSTED_CALLBACK_URL_BASE;
-  return `${HOSTED_CALLBACK_URL}?redirect_to=${encodeURIComponent(localRedirectUri)}`;
+  }
+  return `${HOSTED_CALLBACK_URL_BASE}/${localPort}`;
 }
 
 /**
@@ -213,14 +216,9 @@ export async function getRedirectUrlViaExternalBrowser(
 ): Promise<{ callbackUrl: string; redirectUri: string }> {
   const { callbackType, callbackPort } = options;
 
-  // Determine port based on callback type:
+  const port = callbackPort ?? DEFAULT_LOCALHOST_PORT;
-  // - localhost: use specified port or default stable port
-  // - hosted: use random port (0) since hosted page redirects to local
-  const port = callbackType === 'localhost' ? (callbackPort ?? DEFAULT_LOCALHOST_PORT) : 0;
 
-  console.log(
+  console.log(`[oauth2] Starting callback server (type: ${callbackType}, port: ${port})`);
-    `[oauth2] Starting callback server (type: ${callbackType}, port: ${port || 'random'})`,
-  );
 
   const server = await startCallbackServer({
     port,
@@ -232,7 +230,7 @@ export async function getRedirectUrlViaExternalBrowser(
     let oauthRedirectUri: string;
 
     if (callbackType === 'hosted') {
-      oauthRedirectUri = buildHostedCallbackRedirectUri(server.port, '/callback');
+      oauthRedirectUri = buildHostedCallbackRedirectUri(server.port);
       console.log('[oauth2] Using hosted callback redirect:', oauthRedirectUri);
     } else {
       oauthRedirectUri = server.redirectUri;

plugins/auth-oauth2/src/index.ts

@@ -6,7 +6,11 @@ import type {
   PluginDefinition,
 } from '@yaakapp/api';
 import type { Algorithm } from 'jsonwebtoken';
-import { DEFAULT_LOCALHOST_PORT, HOSTED_CALLBACK_URL, stopActiveServer } from './callbackServer';
+import {
+  buildHostedCallbackRedirectUri,
+  DEFAULT_LOCALHOST_PORT,
+  stopActiveServer,
+} from './callbackServer';
 import {
   type CallbackType,
   DEFAULT_PKCE_METHOD,
@@ -300,8 +304,7 @@ export const plugin: PluginDefinition = {
                 optional: true,
                 dynamic: hiddenIfNot(
                   ['authorization_code', 'implicit'],
-                  ({ useExternalBrowser, callbackType }) =>
+                  ({ useExternalBrowser }) => !!useExternalBrowser,
-                    !!useExternalBrowser && callbackType === 'localhost',
                 ),
               },
             ],
@@ -328,11 +331,11 @@ export const plugin: PluginDefinition = {
                   }
 
                   // Compute the redirect URI based on callback type
+                  const port = intArg(values, 'callbackPort') || DEFAULT_LOCALHOST_PORT;
                   let redirectUri: string;
                   if (callbackType === 'hosted') {
-                    redirectUri = HOSTED_CALLBACK_URL;
+                    redirectUri = buildHostedCallbackRedirectUri(port);
                   } else {
-                    const port = intArg(values, 'callbackPort') || DEFAULT_LOCALHOST_PORT;
                     redirectUri = `http://127.0.0.1:${port}/callback`;
                   }
 

src-web/components/GrpcEditor.tsx

@@ -1,4 +1,4 @@
-import { jsonLanguage } from '@codemirror/lang-json';
+import { jsoncLanguage } from '@shopify/lang-jsonc';
 import { linter } from '@codemirror/lint';
 import type { EditorView } from '@codemirror/view';
 import type { GrpcRequest } from '@yaakapp-internal/models';
@@ -115,7 +115,7 @@ export function GrpcEditor({
         delay: 200,
         needsRefresh: handleRefresh,
       }),
-      jsonLanguage.data.of({
+      jsoncLanguage.data.of({
         autocomplete: jsonCompletion(),
       }),
       stateExtensions({}),

src-web/components/HeaderSize.tsx

@@ -40,7 +40,7 @@ export function HeaderSize({
     } else if (type() === 'macos') {
       if (!isFullscreen) {
         // Add large padding for window controls
-        s.paddingLeft = 72 / settings.interfaceScale;
+        s.paddingLeft = 76 / settings.interfaceScale;
       }
     } else if (!ignoreControlsSpacing && !settings.hideWindowControls) {
       s.paddingRight = WINDOW_CONTROLS_WIDTH;

src-web/components/HttpRequestPane.tsx

@@ -48,6 +48,7 @@ import { FormMultipartEditor } from './FormMultipartEditor';
 import { FormUrlencodedEditor } from './FormUrlencodedEditor';
 import { HeadersEditor } from './HeadersEditor';
 import { HttpAuthenticationEditor } from './HttpAuthenticationEditor';
+import { JsonBodyEditor } from './JsonBodyEditor';
 import { MarkdownEditor } from './MarkdownEditor';
 import { RequestMethodDropdown } from './RequestMethodDropdown';
 import { UrlBar } from './UrlBar';
@@ -257,7 +258,7 @@ export function HttpRequestPane({ style, fullHeight, className, activeRequest }:
   );
 
   const handleBodyTextChange = useCallback(
-    (text: string) => patchModel(activeRequest, { body: { text } }),
+    (text: string) => patchModel(activeRequest, { body: { ...activeRequest.body, text } }),
     [activeRequest],
   );
 
@@ -370,16 +371,10 @@ export function HttpRequestPane({ style, fullHeight, className, activeRequest }:
             <TabContent value={TAB_BODY}>
               <ConfirmLargeRequestBody request={activeRequest}>
                 {activeRequest.bodyType === BODY_TYPE_JSON ? (
-                  <Editor
+                  <JsonBodyEditor
                     forceUpdateKey={forceUpdateKey}
-                    autocompleteFunctions
-                    autocompleteVariables
-                    placeholder="..."
                     heightMode={fullHeight ? 'full' : 'auto'}
-                    defaultValue={`${activeRequest.body?.text ?? ''}`}
+                    request={activeRequest}
-                    language="json"
-                    onChange={handleBodyTextChange}
-                    stateKey={`json.${activeRequest.id}`}
                   />
                 ) : activeRequest.bodyType === BODY_TYPE_XML ? (
                   <Editor

src-web/components/HttpResponsePane.tsx

@@ -1,4 +1,4 @@
-import type { HttpResponse } from '@yaakapp-internal/models';
+import type { HttpResponse, HttpResponseEvent } from '@yaakapp-internal/models';
 import classNames from 'classnames';
 import type { ComponentType, CSSProperties } from 'react';
 import { lazy, Suspense, useMemo } from 'react';
@@ -18,11 +18,14 @@ import { CountBadge } from './core/CountBadge';
 import { HotkeyList } from './core/HotkeyList';
 import { HttpResponseDurationTag } from './core/HttpResponseDurationTag';
 import { HttpStatusTag } from './core/HttpStatusTag';
+import { Icon } from './core/Icon';
 import { LoadingIcon } from './core/LoadingIcon';
+import { PillButton } from './core/PillButton';
 import { SizeTag } from './core/SizeTag';
 import { HStack, VStack } from './core/Stacks';
 import type { TabItem } from './core/Tabs/Tabs';
 import { TabContent, Tabs } from './core/Tabs/Tabs';
+import { Tooltip } from './core/Tooltip';
 import { EmptyStateText } from './EmptyStateText';
 import { ErrorBoundary } from './ErrorBoundary';
 import { HttpResponseTimeline } from './HttpResponseTimeline';
@@ -57,6 +60,11 @@ const TAB_TIMELINE = 'timeline';
 
 export type TimelineViewMode = 'timeline' | 'text';
 
+interface RedirectDropWarning {
+  droppedBodyCount: number;
+  droppedHeaders: string[];
+}
+
 export function HttpResponsePane({ style, className, activeRequestId }: Props) {
   const { activeResponse, setPinnedResponseId, responses } = usePinnedHttpResponse(activeRequestId);
   const [viewMode, setViewMode] = useResponseViewMode(activeResponse?.requestId);
@@ -65,6 +73,12 @@ export function HttpResponsePane({ style, className, activeRequestId }: Props) {
   const mimeType = contentType == null ? null : getMimeTypeFromContentType(contentType).essence;
 
   const responseEvents = useHttpResponseEvents(activeResponse);
+  const redirectDropWarning = useMemo(
+    () => getRedirectDropWarning(responseEvents.data),
+    [responseEvents.data],
+  );
+  const shouldShowRedirectDropWarning =
+    activeResponse?.state === 'closed' && redirectDropWarning != null;
 
   const cookieCounts = useMemo(() => getCookieCounts(responseEvents.data), [responseEvents.data]);
 
@@ -162,14 +176,14 @@ export function HttpResponsePane({ style, className, activeRequestId }: Props) {
             )}
           >
             {activeResponse && (
-              <HStack
+              <div
-                space={2}
-                alignItems="center"
                 className={classNames(
+                  'grid grid-cols-[auto_minmax(4rem,1fr)_auto]',
                   'cursor-default select-none',
                   'whitespace-nowrap w-full pl-3 overflow-x-auto font-mono text-sm hide-scrollbars',
                 )}
               >
+                <HStack space={2} className="w-full flex-shrink-0">
                   {activeResponse.state !== 'closed' && <LoadingIcon size="sm" />}
                   <HttpStatusTag showReason response={activeResponse} />
                   <span>&bull;</span>
@@ -179,15 +193,60 @@ export function HttpResponsePane({ style, className, activeRequestId }: Props) {
                     contentLength={activeResponse.contentLength ?? 0}
                     contentLengthCompressed={activeResponse.contentLengthCompressed}
                   />
-
+                </HStack>
-                <div className="ml-auto">
+                {shouldShowRedirectDropWarning ? (
+                  <Tooltip
+                    tabIndex={0}
+                    className="my-auto pl-3 flex-shrink-0 max-w-full justify-self-end overflow-hidden"
+                    content={
+                      <VStack alignItems="start" space={1} className="text-xs">
+                        <span className="font-medium text-warning">
+                          Redirect changed this request
+                        </span>
+                        {redirectDropWarning.droppedBodyCount > 0 && (
+                          <span>
+                            Body dropped on {redirectDropWarning.droppedBodyCount}{' '}
+                            {redirectDropWarning.droppedBodyCount === 1
+                              ? 'redirect hop'
+                              : 'redirect hops'}
+                          </span>
+                        )}
+                        {redirectDropWarning.droppedHeaders.length > 0 && (
+                          <span>
+                            Headers dropped:{' '}
+                            <span className="font-mono">
+                              {redirectDropWarning.droppedHeaders.join(', ')}
+                            </span>
+                          </span>
+                        )}
+                        <span className="text-text-subtle">See Timeline for details.</span>
+                      </VStack>
+                    }
+                  >
+                    <span className="inline-flex min-w-0">
+                      <PillButton
+                        color="warning"
+                        className="font-sans text-sm !flex-shrink max-w-full"
+                        innerClassName="flex items-center"
+                        leftSlot={<Icon icon="alert_triangle" size="xs" color="warning" />}
+                      >
+                        <span className="truncate">
+                          {getRedirectWarningLabel(redirectDropWarning)}
+                        </span>
+                      </PillButton>
+                    </span>
+                  </Tooltip>
+                ) : (
+                  <span />
+                )}
+                <div className="justify-self-end flex-shrink-0">
                   <RecentHttpResponsesDropdown
                     responses={responses}
                     activeResponse={activeResponse}
                     onPinnedResponseId={setPinnedResponseId}
                   />
                 </div>
-              </HStack>
+              </div>
             )}
           </HStack>
 
@@ -274,6 +333,54 @@ export function HttpResponsePane({ style, className, activeRequestId }: Props) {
   );
 }
 
+function getRedirectDropWarning(
+  events: HttpResponseEvent[] | undefined,
+): RedirectDropWarning | null {
+  if (events == null || events.length === 0) return null;
+
+  let droppedBodyCount = 0;
+  const droppedHeaders = new Set<string>();
+  for (const e of events) {
+    const event = e.event;
+    if (event.type !== 'redirect') {
+      continue;
+    }
+
+    if (event.dropped_body) {
+      droppedBodyCount += 1;
+    }
+    for (const headerName of event.dropped_headers ?? []) {
+      pushHeaderName(droppedHeaders, headerName);
+    }
+  }
+
+  if (droppedBodyCount === 0 && droppedHeaders.size === 0) {
+    return null;
+  }
+
+  return {
+    droppedBodyCount,
+    droppedHeaders: Array.from(droppedHeaders).sort(),
+  };
+}
+
+function pushHeaderName(headers: Set<string>, headerName: string): void {
+  const existing = Array.from(headers).find((h) => h.toLowerCase() === headerName.toLowerCase());
+  if (existing == null) {
+    headers.add(headerName);
+  }
+}
+
+function getRedirectWarningLabel(warning: RedirectDropWarning): string {
+  if (warning.droppedBodyCount > 0 && warning.droppedHeaders.length > 0) {
+    return 'Dropped body and headers';
+  }
+  if (warning.droppedBodyCount > 0) {
+    return 'Dropped body';
+  }
+  return 'Dropped headers';
+}
+
 function EnsureCompleteResponse({
   response,
   Component,

src-web/components/HttpResponseTimeline.tsx

@@ -187,6 +187,7 @@ function EventDetails({
 
     // Redirect - show status, URL, and behavior
     if (e.type === 'redirect') {
+      const droppedHeaders = e.dropped_headers ?? [];
       return (
         <KeyValueRows>
           <KeyValueRow label="Status">
@@ -196,6 +197,10 @@ function EventDetails({
           <KeyValueRow label="Behavior">
             {e.behavior === 'drop_body' ? 'Drop body, change to GET' : 'Preserve method and body'}
           </KeyValueRow>
+          <KeyValueRow label="Body Dropped">{e.dropped_body ? 'Yes' : 'No'}</KeyValueRow>
+          <KeyValueRow label="Headers Dropped">
+            {droppedHeaders.length > 0 ? droppedHeaders.join(', ') : '--'}
+          </KeyValueRow>
         </KeyValueRows>
       );
     }
@@ -268,7 +273,17 @@ function getEventTextParts(event: HttpResponseEventData): EventTextParts {
       return { prefix: '<', text: `${event.name}: ${event.value}` };
     case 'redirect': {
       const behavior = event.behavior === 'drop_body' ? 'drop body' : 'preserve';
-      return { prefix: '*', text: `Redirect ${event.status} -> ${event.url} (${behavior})` };
+      const droppedHeaders = event.dropped_headers ?? [];
+      const dropped = [
+        event.dropped_body ? 'body dropped' : null,
+        droppedHeaders.length > 0 ? `headers dropped: ${droppedHeaders.join(', ')}` : null,
+      ]
+        .filter(Boolean)
+        .join(', ');
+      return {
+        prefix: '*',
+        text: `Redirect ${event.status} -> ${event.url} (${behavior}${dropped ? `, ${dropped}` : ''})`,
+      };
     }
     case 'setting':
       return { prefix: '*', text: `Setting ${event.name}=${event.value}` };
@@ -323,13 +338,23 @@ function getEventDisplay(event: HttpResponseEventData): EventDisplay {
         label: 'Info',
         summary: event.message,
       };
-    case 'redirect':
+    case 'redirect': {
+      const droppedHeaders = event.dropped_headers ?? [];
+      const dropped = [
+        event.dropped_body ? 'drop body' : null,
+        droppedHeaders.length > 0
+          ? `drop ${droppedHeaders.length} ${droppedHeaders.length === 1 ? 'header' : 'headers'}`
+          : null,
+      ]
+        .filter(Boolean)
+        .join(', ');
       return {
         icon: 'arrow_big_right_dash',
         color: 'success',
         label: 'Redirect',
-        summary: `Redirecting ${event.status} ${event.url}${event.behavior === 'drop_body' ? ' (drop body)' : ''}`,
+        summary: `Redirecting ${event.status} ${event.url}${dropped ? ` (${dropped})` : ''}`,
       };
+    }
     case 'send_url':
       return {
         icon: 'arrow_big_up_dash',

src-web/components/JsonBodyEditor.tsx

@@ -0,0 +1,122 @@
+import { linter } from '@codemirror/lint';
+import type { HttpRequest } from '@yaakapp-internal/models';
+import { patchModel } from '@yaakapp-internal/models';
+import { useCallback, useMemo } from 'react';
+import { useKeyValue } from '../hooks/useKeyValue';
+import { textLikelyContainsJsonComments } from '../lib/jsonComments';
+import { Banner } from './core/Banner';
+import type { DropdownItem } from './core/Dropdown';
+import { Dropdown } from './core/Dropdown';
+import type { EditorProps } from './core/Editor/Editor';
+import { jsonParseLinter } from './core/Editor/json-lint';
+import { Editor } from './core/Editor/LazyEditor';
+import { Icon } from './core/Icon';
+import { IconButton } from './core/IconButton';
+import { IconTooltip } from './core/IconTooltip';
+
+interface Props {
+  forceUpdateKey: string;
+  heightMode: EditorProps['heightMode'];
+  request: HttpRequest;
+}
+
+export function JsonBodyEditor({ forceUpdateKey, heightMode, request }: Props) {
+  const handleChange = useCallback(
+    (text: string) => patchModel(request, { body: { ...request.body, text } }),
+    [request],
+  );
+
+  const autoFix = request.body?.sendJsonComments !== true;
+
+  const lintExtension = useMemo(
+    () =>
+      linter(
+        jsonParseLinter(
+          autoFix
+            ? { allowComments: true, allowTrailingCommas: true }
+            : { allowComments: false, allowTrailingCommas: false },
+        ),
+      ),
+    [autoFix],
+  );
+
+  const hasComments = useMemo(
+    () => textLikelyContainsJsonComments(request.body?.text ?? ''),
+    [request.body?.text],
+  );
+
+  const { value: bannerDismissed, set: setBannerDismissed } = useKeyValue<boolean>({
+    namespace: 'no_sync',
+    key: ['json-fix-3', request.workspaceId],
+    fallback: false,
+  });
+
+  const handleToggleAutoFix = useCallback(() => {
+    const newBody = { ...request.body };
+    if (autoFix) {
+      newBody.sendJsonComments = true;
+    } else {
+      delete newBody.sendJsonComments;
+    }
+    patchModel(request, { body: newBody });
+  }, [request, autoFix]);
+
+  const handleDropdownOpen = useCallback(() => {
+    if (!bannerDismissed) {
+      setBannerDismissed(true);
+    }
+  }, [bannerDismissed, setBannerDismissed]);
+
+  const showBanner = hasComments && autoFix && !bannerDismissed;
+
+  const stripMessage = 'Automatically strip comments and trailing commas before sending';
+  const actions = useMemo<EditorProps['actions']>(
+    () => [
+      showBanner && (
+        <Banner color="notice" className="!opacity-100 h-sm !py-0 !px-2 flex items-center text-xs">
+          <p className="inline-flex items-center gap-1 min-w-0">
+            <span className="truncate">Auto-fix enabled</span>
+            <Icon icon="arrow_right" size="sm" className="opacity-disabled" />
+          </p>
+        </Banner>
+      ),
+      <div key="settings" className="!opacity-100 !shadow">
+        <Dropdown
+          onOpen={handleDropdownOpen}
+          items={
+            [
+              {
+                label: 'Automatically Fix JSON',
+                keepOpenOnSelect: true,
+                onSelect: handleToggleAutoFix,
+                rightSlot: <IconTooltip content={stripMessage} />,
+                leftSlot: (
+                  <Icon icon={autoFix ? 'check_square_checked' : 'check_square_unchecked'} />
+                ),
+              },
+            ] satisfies DropdownItem[]
+          }
+        >
+          <IconButton size="sm" variant="border" icon="settings" title="JSON Settings" />
+        </Dropdown>
+      </div>,
+    ],
+    [handleDropdownOpen, handleToggleAutoFix, autoFix, showBanner],
+  );
+
+  return (
+    <Editor
+      forceUpdateKey={forceUpdateKey}
+      autocompleteFunctions
+      autocompleteVariables
+      placeholder="..."
+      heightMode={heightMode}
+      defaultValue={`${request.body?.text ?? ''}`}
+      language="json"
+      onChange={handleChange}
+      stateKey={`json.${request.id}`}
+      actions={actions}
+      lintExtension={lintExtension}
+    />
+  );
+}

src-web/components/Settings/Settings.tsx

@@ -39,9 +39,9 @@ const tabs = [
   TAB_THEME,
   TAB_INTERFACE,
   TAB_SHORTCUTS,
+  TAB_PLUGINS,
   TAB_CERTIFICATES,
   TAB_PROXY,
-  TAB_PLUGINS,
   TAB_LICENSE,
 ] as const;
 export type SettingsTab = (typeof tabs)[number];
@@ -120,7 +120,7 @@ export default function Settings({ hide }: Props) {
               value === TAB_CERTIFICATES ? (
                 <CountBadge count={settings.clientCertificates.length} />
               ) : value === TAB_PLUGINS ? (
-                <CountBadge count={plugins.length} />
+                <CountBadge count={plugins.filter((p) => p.source !== 'bundled').length} />
               ) : value === TAB_PROXY && settings.proxy?.type === 'enabled' ? (
                 <CountBadge count />
               ) : value === TAB_LICENSE && licenseCheck.check.data?.status === 'personal_use' ? (
@@ -141,7 +141,7 @@ export default function Settings({ hide }: Props) {
         <TabContent value={TAB_SHORTCUTS} className="overflow-y-auto h-full px-6 !py-4">
           <SettingsHotkeys />
         </TabContent>
-        <TabContent value={TAB_PLUGINS} className="h-full grid grid-rows-1 px-6 !py-4">
+        <TabContent value={TAB_PLUGINS} className="h-full grid grid-rows-1">
           <SettingsPlugins defaultSubtab={mainTab === TAB_PLUGINS ? subtab : undefined} />
         </TabContent>
         <TabContent value={TAB_PROXY} className="overflow-y-auto h-full px-6 !py-4">

src-web/components/Settings/SettingsLicense.tsx

@@ -13,7 +13,6 @@ import { Link } from '../core/Link';
 import { PlainInput } from '../core/PlainInput';
 import { Separator } from '../core/Separator';
 import { HStack, VStack } from '../core/Stacks';
-import { LocalImage } from '../LocalImage';
 
 export function SettingsLicense() {
   return (

src-web/components/Settings/SettingsPlugins.tsx

@@ -9,6 +9,7 @@ import {
   searchPlugins,
   uninstallPlugin,
 } from '@yaakapp-internal/plugins';
+import classNames from 'classnames';
 import { useAtomValue } from 'jotai';
 import { useState } from 'react';
 import { useDebouncedValue } from '../../hooks/useDebouncedValue';
@@ -49,6 +50,7 @@ export function SettingsPlugins({ defaultSubtab }: SettingsPluginsProps) {
         defaultValue={defaultSubtab}
         label="Plugins"
         addBorders
+        tabListClassName="px-6 pt-2"
         tabs={[
           { label: 'Discover', value: 'search' },
           {
@@ -63,13 +65,13 @@ export function SettingsPlugins({ defaultSubtab }: SettingsPluginsProps) {
           },
         ]}
       >
-        <TabContent value="search">
+        <TabContent value="search" className="px-6">
           <PluginSearch />
         </TabContent>
         <TabContent value="installed" className="pb-0">
           <div className="h-full grid grid-rows-[minmax(0,1fr)_auto]">
-            <InstalledPlugins plugins={installedPlugins} />
+            <InstalledPlugins plugins={installedPlugins} className="px-6" />
-            <footer className="grid grid-cols-[minmax(0,1fr)_auto] -mx-4 py-2 px-4 border-t bg-surface-highlight border-border-subtle min-w-0">
+            <footer className="grid grid-cols-[minmax(0,1fr)_auto] py-2 px-4 border-t bg-surface-highlight border-border-subtle min-w-0">
               <SelectFile
                 size="xs"
                 noun="Plugin"
@@ -111,7 +113,7 @@ export function SettingsPlugins({ defaultSubtab }: SettingsPluginsProps) {
             </footer>
           </div>
         </TabContent>
-        <TabContent value="bundled" className="pb-0">
+        <TabContent value="bundled" className="pb-0 px-6">
           <BundledPlugins plugins={bundledPlugins} />
         </TabContent>
       </Tabs>
@@ -330,9 +332,9 @@ function PluginSearch() {
   );
 }
 
-function InstalledPlugins({ plugins }: { plugins: Plugin[] }) {
+function InstalledPlugins({ plugins, className }: { plugins: Plugin[]; className?: string }) {
   return plugins.length === 0 ? (
-    <div className="pb-4">
+    <div className={classNames(className, 'pb-4')}>
       <EmptyStateText className="text-center">
         Plugins extend the functionality of Yaak.
         <br />
@@ -340,7 +342,7 @@ function InstalledPlugins({ plugins }: { plugins: Plugin[] }) {
       </EmptyStateText>
     </div>
   ) : (
-    <Table scrollable>
+    <Table scrollable className={className}>
       <TableHead>
         <TableRow>
           <TableHeaderCell className="w-0" />

src-web/components/core/Dialog.tsx

@@ -5,7 +5,7 @@ import { useMemo } from 'react';
 import { Overlay } from '../Overlay';
 import { Heading } from './Heading';
 import { IconButton } from './IconButton';
-import { DialogSize } from '@yaakapp-internal/plugins';
+import type { DialogSize } from '@yaakapp-internal/plugins';
 
 export interface DialogProps {
   children: ReactNode;

src-web/components/core/Editor/Editor.tsx

@@ -78,6 +78,7 @@ export interface EditorProps {
   hideGutter?: boolean;
   id?: string;
   language?: EditorLanguage | 'pairs' | 'url' | 'timeline' | null;
+  lintExtension?: Extension;
   graphQLSchema?: GraphQLSchema | null;
   onBlur?: () => void;
   onChange?: (value: string) => void;
@@ -124,6 +125,7 @@ function EditorInner({
   hideGutter,
   graphQLSchema,
   language,
+  lintExtension,
   onBlur,
   onChange,
   onFocus,
@@ -325,13 +327,14 @@ function EditorInner({
   );
 
   // Update the language extension when the language changes
-  // biome-ignore lint/correctness/useExhaustiveDependencies: none
+  // biome-ignore lint/correctness/useExhaustiveDependencies: intentionally limited deps
   useEffect(() => {
     if (cm.current === null) return;
     const { view, languageCompartment } = cm.current;
     const ext = getLanguageExtension({
       useTemplating,
       language,
+      lintExtension,
       hideGutter,
       environmentVariables,
       autocomplete,
@@ -344,6 +347,7 @@ function EditorInner({
     view.dispatch({ effects: languageCompartment.reconfigure(ext) });
   }, [
     language,
+    lintExtension,
     autocomplete,
     environmentVariables,
     onClickFunction,
@@ -357,7 +361,7 @@ function EditorInner({
   ]);
 
   // Initialize the editor when ref mounts
-  // biome-ignore lint/correctness/useExhaustiveDependencies: Only reinitialize when necessary
+  // biome-ignore lint/correctness/useExhaustiveDependencies: only reinitialize when necessary
   const initEditorRef = useCallback(
     function initEditorRef(container: HTMLDivElement | null) {
       if (container === null) {
@@ -371,6 +375,7 @@ function EditorInner({
         const langExt = getLanguageExtension({
           useTemplating,
           language,
+          lintExtension,
           completionOptions,
           autocomplete,
           environmentVariables,

src-web/components/core/Editor/extensions.ts

@@ -8,7 +8,6 @@ import { history, historyKeymap } from '@codemirror/commands';
 import { go } from '@codemirror/lang-go';
 import { java } from '@codemirror/lang-java';
 import { javascript } from '@codemirror/lang-javascript';
-import { json } from '@codemirror/lang-json';
 import { markdown } from '@codemirror/lang-markdown';
 import { php } from '@codemirror/lang-php';
 import { python } from '@codemirror/lang-python';
@@ -34,7 +33,6 @@ import { ruby } from '@codemirror/legacy-modes/mode/ruby';
 import { shell } from '@codemirror/legacy-modes/mode/shell';
 import { swift } from '@codemirror/legacy-modes/mode/swift';
 import { linter, lintGutter, lintKeymap } from '@codemirror/lint';
-
 import { search, searchKeymap } from '@codemirror/search';
 import type { Extension } from '@codemirror/state';
 import { EditorState } from '@codemirror/state';
@@ -50,6 +48,7 @@ import {
   rectangularSelection,
 } from '@codemirror/view';
 import { tags as t } from '@lezer/highlight';
+import { jsonc, jsoncLanguage } from '@shopify/lang-jsonc';
 import { graphql } from 'cm6-graphql';
 import type { GraphQLSchema } from 'graphql';
 import { activeRequestIdAtom } from '../../../hooks/useActiveRequestId';
@@ -61,13 +60,13 @@ import { showGraphQLDocExplorerAtom } from '../../graphql/graphqlAtoms';
 import type { EditorProps } from './Editor';
 import { jsonParseLinter } from './json-lint';
 import { pairs } from './pairs/extension';
+import { searchMatchCount } from './searchMatchCount';
 import { text } from './text/extension';
 import { timeline } from './timeline/extension';
 import type { TwigCompletionOption } from './twig/completion';
 import { twig } from './twig/extension';
 import { pathParametersPlugin } from './twig/pathParameters';
 import { url } from './url/extension';
-import { searchMatchCount } from './searchMatchCount';
 
 export const syntaxHighlightStyle = HighlightStyle.define([
   {
@@ -107,7 +106,7 @@ const syntaxExtensions: Record<
   null | (() => LanguageSupport)
 > = {
   graphql: null,
-  json: json,
+  json: jsonc,
   javascript: javascript,
   // HTML as XML because HTML is oddly slow
   html: xml,
@@ -140,6 +139,7 @@ const closeBracketsFor: (keyof typeof syntaxExtensions)[] = ['json', 'javascript
 export function getLanguageExtension({
   useTemplating,
   language = 'text',
+  lintExtension,
   environmentVariables,
   autocomplete,
   hideGutter,
@@ -156,7 +156,7 @@ export function getLanguageExtension({
   onClickPathParameter: (name: string) => void;
   completionOptions: TwigCompletionOption[];
   graphQLSchema: GraphQLSchema | null;
-} & Pick<EditorProps, 'language' | 'autocomplete' | 'hideGutter'>) {
+} & Pick<EditorProps, 'language' | 'autocomplete' | 'hideGutter' | 'lintExtension'>) {
   const extraExtensions: Extension[] = [];
 
   if (language === 'url') {
@@ -193,7 +193,12 @@ export function getLanguageExtension({
   }
 
   if (language === 'json') {
-    extraExtensions.push(linter(jsonParseLinter()));
+    extraExtensions.push(lintExtension ?? linter(jsonParseLinter()));
+    extraExtensions.push(
+      jsoncLanguage.data.of({
+        commentTokens: { line: '//', block: { open: '/*', close: '*/' } },
+      }),
+    );
     if (!hideGutter) {
       extraExtensions.push(lintGutter());
     }

src-web/components/core/Editor/json-lint.ts

@@ -4,14 +4,22 @@ import { parse as jsonLintParse } from '@prantlf/jsonlint';
 
 const TEMPLATE_SYNTAX_REGEX = /\$\{\[[\s\S]*?]}/g;
 
-export function jsonParseLinter() {
+interface JsonLintOptions {
+  allowComments?: boolean;
+  allowTrailingCommas?: boolean;
+}
+
+export function jsonParseLinter(options?: JsonLintOptions) {
   return (view: EditorView): Diagnostic[] => {
     try {
       const doc = view.state.doc.toString();
       // We need lint to not break on stuff like {"foo:" ${[ ... ]}} so we'll replace all template
       // syntax with repeating `1` characters, so it's valid JSON and the position is still correct.
       const escapedDoc = doc.replace(TEMPLATE_SYNTAX_REGEX, (m) => '1'.repeat(m.length));
-      jsonLintParse(escapedDoc);
+      jsonLintParse(escapedDoc, {
+        mode: (options?.allowComments ?? true) ? 'cjson' : 'json',
+        ignoreTrailingCommas: options?.allowTrailingCommas ?? false,
+      });
       // biome-ignore lint/suspicious/noExplicitAny: none
     } catch (err: any) {
       if (!('location' in err)) {

src-web/components/core/Tooltip.tsx

@@ -20,8 +20,15 @@ const hiddenStyles: CSSProperties = {
   opacity: 0,
 };
 
+type TooltipPosition = 'top' | 'bottom';
+
+interface TooltipOpenState {
+  styles: CSSProperties;
+  position: TooltipPosition;
+}
+
 export function Tooltip({ children, className, content, tabIndex, size = 'md' }: TooltipProps) {
-  const [isOpen, setIsOpen] = useState<CSSProperties>();
+  const [openState, setOpenState] = useState<TooltipOpenState | null>(null);
   const triggerRef = useRef<HTMLButtonElement>(null);
   const tooltipRef = useRef<HTMLDivElement>(null);
   const showTimeout = useRef<NodeJS.Timeout>(undefined);
@@ -29,16 +36,25 @@ export function Tooltip({ children, className, content, tabIndex, size = 'md' }:
   const handleOpenImmediate = () => {
     if (triggerRef.current == null || tooltipRef.current == null) return;
     clearTimeout(showTimeout.current);
-    setIsOpen(undefined);
     const triggerRect = triggerRef.current.getBoundingClientRect();
     const tooltipRect = tooltipRef.current.getBoundingClientRect();
-    const docRect = document.documentElement.getBoundingClientRect();
+    const viewportHeight = document.documentElement.clientHeight;
+
+    const margin = 8;
+    const spaceAbove = Math.max(0, triggerRect.top - margin);
+    const spaceBelow = Math.max(0, viewportHeight - triggerRect.bottom - margin);
+    const preferBottom = spaceAbove < tooltipRect.height + margin && spaceBelow > spaceAbove;
+    const position: TooltipPosition = preferBottom ? 'bottom' : 'top';
+
     const styles: CSSProperties = {
-      bottom: docRect.height - triggerRect.top,
       left: Math.max(0, triggerRect.left + triggerRect.width / 2 - tooltipRect.width / 2),
-      maxHeight: triggerRect.top,
+      maxHeight: position === 'top' ? spaceAbove : spaceBelow,
+      ...(position === 'top'
+        ? { bottom: viewportHeight - triggerRect.top }
+        : { top: triggerRect.bottom }),
     };
-    setIsOpen(styles);
+
+    setOpenState({ styles, position });
   };
 
   const handleOpen = () => {
@@ -48,16 +64,16 @@ export function Tooltip({ children, className, content, tabIndex, size = 'md' }:
 
   const handleClose = () => {
     clearTimeout(showTimeout.current);
-    setIsOpen(undefined);
+    setOpenState(null);
   };
 
   const handleToggleImmediate = () => {
-    if (isOpen) handleClose();
+    if (openState) handleClose();
     else handleOpenImmediate();
   };
 
   const handleKeyDown = (e: KeyboardEvent<HTMLButtonElement>) => {
-    if (isOpen && e.key === 'Escape') {
+    if (openState && e.key === 'Escape') {
       e.preventDefault();
       e.stopPropagation();
       handleClose();
@@ -71,10 +87,10 @@ export function Tooltip({ children, className, content, tabIndex, size = 'md' }:
       <Portal name="tooltip">
         <div
           ref={tooltipRef}
-          style={isOpen ?? hiddenStyles}
+          style={openState?.styles ?? hiddenStyles}
           id={id.current}
           role="tooltip"
-          aria-hidden={!isOpen}
+          aria-hidden={openState == null}
           onMouseEnter={handleOpenImmediate}
           onMouseLeave={handleClose}
           className="p-2 fixed z-50 text-sm transition-opacity grid grid-rows-[minmax(0,1fr)]"
@@ -88,14 +104,17 @@ export function Tooltip({ children, className, content, tabIndex, size = 'md' }:
           >
             {content}
           </div>
-          <Triangle className="text-border mb-2" />
+          <Triangle
+            className="text-border"
+            position={openState?.position === 'bottom' ? 'top' : 'bottom'}
+          />
         </div>
       </Portal>
       {/** biome-ignore lint/a11y/useSemanticElements: Needs to be usable in other buttons */}
       <span
         ref={triggerRef}
         role="button"
-        aria-describedby={isOpen ? id.current : undefined}
+        aria-describedby={openState ? id.current : undefined}
         tabIndex={tabIndex ?? -1}
         className={classNames(className, 'flex-grow-0 flex items-center')}
         onClick={handleToggleImmediate}
@@ -111,7 +130,9 @@ export function Tooltip({ children, className, content, tabIndex, size = 'md' }:
   );
 }
 
-function Triangle({ className }: { className?: string }) {
+function Triangle({ className, position }: { className?: string; position: 'top' | 'bottom' }) {
+  const isBottom = position === 'bottom';
+
   return (
     <svg
       aria-hidden
@@ -120,15 +141,19 @@ function Triangle({ className }: { className?: string }) {
       shapeRendering="crispEdges"
       className={classNames(
         className,
-        'absolute z-50 border-t-[2px] border-surface-highlight',
+        'absolute z-50 left-[calc(50%-0.4rem)] h-[0.5rem] w-[0.8rem]',
-        '-bottom-[calc(0.5rem-3px)] left-[calc(50%-0.4rem)]',
+        isBottom
-        'h-[0.5rem] w-[0.8rem]',
+          ? 'border-t-[2px] border-surface-highlight -bottom-[calc(0.5rem-3px)] mb-2'
+          : 'border-b-[2px] border-surface-highlight -top-[calc(0.5rem-3px)] mt-2',
       )}
     >
       <title>Triangle</title>
-      <polygon className="fill-surface-highlight" points="0,0 30,0 15,10" />
+      <polygon
+        className="fill-surface-highlight"
+        points={isBottom ? '0,0 30,0 15,10' : '0,10 30,10 15,0'}
+      />
       <path
-        d="M0 0 L15 9 L30 0"
+        d={isBottom ? 'M0 0 L15 9 L30 0' : 'M0 10 L15 1 L30 10'}
         fill="none"
         stroke="currentColor"
         strokeWidth="1"

src-web/components/git/GitCommitDialog.tsx

@@ -1,4 +1,4 @@
-import { useCachedNode } from '@dnd-kit/core/dist/hooks/utilities';
+
 import type { GitStatusEntry } from '@yaakapp-internal/git';
 import { useGit } from '@yaakapp-internal/git';
 import type {
@@ -12,7 +12,6 @@ import type {
 import classNames from 'classnames';
 import { useCallback, useMemo, useState } from 'react';
 import { modelToYaml } from '../../lib/diffYaml';
-import { isSubEnvironment } from '../../lib/model_util';
 import { resolvedModelName } from '../../lib/resolvedModelName';
 import { showErrorToast } from '../../lib/toast';
 import { Banner } from '../core/Banner';

src-web/components/git/GitDropdown.tsx

@@ -75,7 +75,7 @@ function SyncDropdownWithSyncDir({ syncDir }: { syncDir: string }) {
 
   const currentBranch = status.data.headRefShorthand;
   const hasChanges = status.data.entries.some((e) => e.status !== 'current');
-  const hasRemotes = (status.data.origins ?? []).length > 0;
+  const _hasRemotes = (status.data.origins ?? []).length > 0;
   const { ahead, behind } = status.data;
 
   const tryCheckout = (branch: string, force: boolean) => {

src-web/components/graphql/GraphQLEditor.tsx

@@ -1,6 +1,5 @@
 import type { HttpRequest } from '@yaakapp-internal/models';
 
-import { formatSdl } from 'format-graphql';
 import { useAtom } from 'jotai';
 import { useCallback, useMemo } from 'react';
 import { useLocalStorage } from 'react-use';
@@ -16,6 +15,7 @@ import { Editor } from '../core/Editor/LazyEditor';
 import { FormattedError } from '../core/FormattedError';
 import { Icon } from '../core/Icon';
 import { Separator } from '../core/Separator';
+import { tryFormatGraphql } from '../../lib/formatters';
 import { showGraphQLDocExplorerAtom } from './graphqlAtoms';
 
 type Props = Pick<EditorProps, 'heightMode' | 'className' | 'forceUpdateKey'> & {
@@ -156,6 +156,7 @@ function GraphQLEditorInner({ request, onChange, baseRequest, ...extraEditorProp
                 { type: 'separator', label: 'Setting' },
                 {
                   label: 'Automatic Introspection',
+                  keepOpenOnSelect: true,
                   onSelect: () => {
                     setAutoIntrospectDisabled({
                       ...autoIntrospectDisabled,
@@ -210,7 +211,7 @@ function GraphQLEditorInner({ request, onChange, baseRequest, ...extraEditorProp
         language="graphql"
         heightMode="auto"
         graphQLSchema={schema}
-        format={formatSdl}
+        format={tryFormatGraphql}
         defaultValue={currentBody.query}
         onChange={handleChangeQuery}
         placeholder="..."

src-web/lib/constants.ts

@@ -1,4 +1,4 @@
-export const HEADER_SIZE_MD = '27px';
+export const HEADER_SIZE_MD = '30px';
 export const HEADER_SIZE_LG = '40px';
 
 export const WINDOW_CONTROLS_WIDTH = '10.5rem';

src-web/lib/formatters.ts

@@ -20,6 +20,18 @@ export async function tryFormatJson(text: string): Promise<string> {
   return text;
 }
 
+export async function tryFormatGraphql(text: string): Promise<string> {
+  if (text === '') return text;
+
+  try {
+    return await invokeCmd<string>('cmd_format_graphql', { text });
+  } catch (err) {
+    console.warn('Failed to format GraphQL', err);
+  }
+
+  return text;
+}
+
 export async function tryFormatXml(text: string): Promise<string> {
   if (text === '') return text;
 

src-web/lib/initGlobalListeners.tsx

@@ -123,6 +123,39 @@ export function initGlobalListeners() {
     console.log('Got plugin updates event', payload);
     showPluginUpdatesToast(payload);
   });
+
+  // Check for plugin initialization errors
+  invokeCmd<[string, string][]>('cmd_plugin_init_errors').then((errors) => {
+    for (const [dir, message] of errors) {
+      const dirBasename = dir.split('/').pop() ?? dir;
+      showToast({
+        id: `plugin-init-error-${dirBasename}`,
+        color: 'warning',
+        timeout: null,
+        message: (
+          <VStack>
+            <h2 className="font-semibold">Plugin failed to load</h2>
+            <p className="text-text-subtle text-sm">
+              {dirBasename}: {message}
+            </p>
+          </VStack>
+        ),
+        action: ({ hide }) => (
+          <Button
+            size="xs"
+            color="warning"
+            variant="border"
+            onClick={() => {
+              hide();
+              openSettings.mutate('plugins:installed');
+            }}
+          >
+            View Plugins
+          </Button>
+        ),
+      });
+    }
+  });
 }
 
 function showUpdateInstalledToast(version: string) {

src-web/lib/jsonComments.ts

@@ -0,0 +1,30 @@
+/**
+ * Simple heuristic to detect if a string likely contains JSON/JSONC comments.
+ * Checks for // and /* patterns that are NOT inside double-quoted strings.
+ * Used for UI hints only — doesn't need to be perfect.
+ */
+export function textLikelyContainsJsonComments(text: string): boolean {
+  let inString = false;
+  for (let i = 0; i < text.length; i++) {
+    const ch = text[i];
+    if (inString) {
+      if (ch === '"') {
+        inString = false;
+      } else if (ch === '\\') {
+        i++; // skip escaped char
+      }
+      continue;
+    }
+    if (ch === '"') {
+      inString = true;
+      continue;
+    }
+    if (ch === '/' && i + 1 < text.length) {
+      const next = text[i + 1];
+      if (next === '/' || next === '*') {
+        return true;
+      }
+    }
+  }
+  return false;
+}

src-web/lib/tauri.ts

@@ -17,6 +17,7 @@ type TauriCmd =
   | 'cmd_delete_send_history'
   | 'cmd_dismiss_notification'
   | 'cmd_export_data'
+  | 'cmd_format_graphql'
   | 'cmd_format_json'
   | 'cmd_get_http_authentication_config'
   | 'cmd_get_http_authentication_summaries'
@@ -41,6 +42,7 @@ type TauriCmd =
   | 'cmd_new_child_window'
   | 'cmd_new_main_window'
   | 'cmd_plugin_info'
+  | 'cmd_plugin_init_errors'
   | 'cmd_reload_plugins'
   | 'cmd_render_template'
   | 'cmd_save_response'

src-web/lib/theme/window.ts

@@ -138,7 +138,7 @@ function bannerColorVariables(color: YaakColor | null): Partial<CSSVariables> {
   };
 }
 
-function inputCSS(color: YaakColor | null): Partial<CSSVariables> {
+function _inputCSS(color: YaakColor | null): Partial<CSSVariables> {
   if (color == null) return {};
 
   const theme: Partial<ThemeComponentColors> = {

src-web/modules.d.ts

@@ -1,2 +1 @@
-declare module 'format-graphql';
 declare module 'vkbeautify';

src-web/package.json

@@ -27,6 +27,7 @@
     "@replit/codemirror-emacs": "^6.1.0",
     "@replit/codemirror-vim": "^6.3.0",
     "@replit/codemirror-vscode-keymap": "^6.0.2",
+    "@shopify/lang-jsonc": "^1.0.1",
     "@tanstack/react-query": "^5.90.5",
     "@tanstack/react-router": "^1.133.13",
     "@tanstack/react-virtual": "^3.13.12",
@@ -46,7 +47,6 @@
     "deep-equal": "^2.2.3",
     "eventemitter3": "^5.0.1",
     "focus-trap-react": "^11.0.4",
-    "format-graphql": "^1.5.0",
     "fuzzbunny": "^1.0.1",
     "hexy": "^0.3.5",
     "history": "^5.3.0",