Fix plugin dev rebuild signaling and reload toast timing

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

.claude/commands/release/check-out-pr.md

@@ -1,62 +0,0 @@
----
-description: Review a PR in a new worktree
-allowed-tools: Bash(git worktree:*), Bash(gh pr:*), Bash(git branch:*)
----
-
-Check out a GitHub pull request for review.
-
-## Usage
-
-```
-/check-out-pr <PR_NUMBER>
-```
-
-## What to do
-
-1. If no PR number is provided, list all open pull requests and ask the user to select one
-2. Get PR information using `gh pr view <PR_NUMBER> --json number,headRefName`
-3. **Ask the user** whether they want to:
-   - **A) Check out in current directory** — simple `gh pr checkout <PR_NUMBER>`
-   - **B) Create a new worktree** — isolated copy at `../yaak-worktrees/pr-<PR_NUMBER>`
-4. Follow the appropriate path below
-
-## Option A: Check out in current directory
-
-1. Run `gh pr checkout <PR_NUMBER>`
-2. Inform the user which branch they're now on
-
-## Option B: Create a new worktree
-
-1. Create a new worktree at `../yaak-worktrees/pr-<PR_NUMBER>` using `git worktree add` with a timeout of at least 300000ms (5 minutes) since the post-checkout hook runs a bootstrap script
-2. Checkout the PR branch in the new worktree using `gh pr checkout <PR_NUMBER>`
-3. The post-checkout hook will automatically:
-   - Create `.env.local` with unique ports
-   - Copy editor config folders
-   - Run `npm install && npm run bootstrap`
-4. Inform the user:
-   - Where the worktree was created
-   - What ports were assigned
-   - How to access it (cd command)
-   - How to run the dev server
-   - How to remove the worktree when done
-
-### Example worktree output
-
-```
-Created worktree for PR #123 at ../yaak-worktrees/pr-123
-Branch: feature-auth
-Ports: Vite (1421), MCP (64344)
-
-To start working:
-  cd ../yaak-worktrees/pr-123
-  npm run app-dev
-
-To remove when done:
-  git worktree remove ../yaak-worktrees/pr-123
-```
-
-## Error Handling
-
-- If the PR doesn't exist, show a helpful error
-- If the worktree already exists, inform the user and ask if they want to remove and recreate it
-- If `gh` CLI is not available, inform the user to install it

.claude/skills/worktree.md

@@ -1,35 +0,0 @@
-# Worktree Management Skill
-
-## Creating Worktrees
-
-When creating git worktrees for this project, ALWAYS use the path format:
-```
-../yaak-worktrees/<NAME>
-```
-
-For example:
-- `git worktree add ../yaak-worktrees/feature-auth`
-- `git worktree add ../yaak-worktrees/bugfix-login`
-- `git worktree add ../yaak-worktrees/refactor-api`
-
-## What Happens Automatically
-
-The post-checkout hook will automatically:
-1. Create `.env.local` with unique ports (YAAK_DEV_PORT and YAAK_PLUGIN_MCP_SERVER_PORT)
-2. Copy gitignored editor config folders (.zed, .idea, etc.)
-3. Run `npm install && npm run bootstrap`
-
-## Deleting Worktrees
-
-```bash
-git worktree remove ../yaak-worktrees/<NAME>
-```
-
-## Port Assignments
-
-- Main worktree: 1420 (Vite), 64343 (MCP)
-- First worktree: 1421, 64344
-- Second worktree: 1422, 64345
-- etc.
-
-Each worktree can run `npm run app-dev` simultaneously without conflicts.

.codex/skills/release-check-out-pr/SKILL.md

@@ -1,46 +0,0 @@
----
-name: release-check-out-pr
-description: Check out a GitHub pull request for review in this repo, either in the current directory or in a new isolated worktree at ../yaak-worktrees/pr-<PR_NUMBER>. Use when asked to run or replace the old Claude check-out-pr command.
----
-
-# Check Out PR
-
-Check out a PR by number and let the user choose between current-directory checkout and isolated worktree checkout.
-
-## Workflow
-
-1. Confirm `gh` CLI is available.
-2. If no PR number is provided, list open PRs (`gh pr list`) and ask the user to choose one.
-3. Read PR metadata:
-   - `gh pr view <PR_NUMBER> --json number,headRefName`
-4. Ask the user to choose:
-   - Option A: check out in the current directory
-   - Option B: create a new worktree at `../yaak-worktrees/pr-<PR_NUMBER>`
-
-## Option A: Current Directory
-
-1. Run:
-   - `gh pr checkout <PR_NUMBER>`
-2. Report the checked-out branch.
-
-## Option B: New Worktree
-
-1. Use path:
-   - `../yaak-worktrees/pr-<PR_NUMBER>`
-2. Create the worktree with a timeout of at least 5 minutes because checkout hooks run bootstrap.
-3. In the new worktree, run:
-   - `gh pr checkout <PR_NUMBER>`
-4. Report:
-   - Worktree path
-   - Assigned ports from `.env.local` if present
-   - How to start work:
-     - `cd ../yaak-worktrees/pr-<PR_NUMBER>`
-     - `npm run app-dev`
-   - How to remove when done:
-     - `git worktree remove ../yaak-worktrees/pr-<PR_NUMBER>`
-
-## Error Handling
-
-- If PR does not exist, show a clear error.
-- If worktree already exists, ask whether to reuse it or remove/recreate it.
-- If `gh` is missing, instruct the user to install/authenticate it.

.codex/skills/worktree-management/SKILL.md

@@ -1,37 +0,0 @@
----
-name: worktree-management
-description: Manage Yaak git worktrees using the standard ../yaak-worktrees/<NAME> layout, including creation, removal, and expected automatic setup behavior and port assignments.
----
-
-# Worktree Management
-
-Use the Yaak-standard worktree path layout and lifecycle commands.
-
-## Path Convention
-
-Always create worktrees under:
-
-`../yaak-worktrees/<NAME>`
-
-Examples:
-- `git worktree add ../yaak-worktrees/feature-auth`
-- `git worktree add ../yaak-worktrees/bugfix-login`
-- `git worktree add ../yaak-worktrees/refactor-api`
-
-## Automatic Setup After Checkout
-
-Project git hooks automatically:
-1. Create `.env.local` with unique `YAAK_DEV_PORT` and `YAAK_PLUGIN_MCP_SERVER_PORT`
-2. Copy gitignored editor config folders
-3. Run `npm install && npm run bootstrap`
-
-## Remove Worktree
-
-`git worktree remove ../yaak-worktrees/<NAME>`
-
-## Port Pattern
-
-- Main worktree: Vite `1420`, MCP `64343`
-- First extra worktree: `1421`, `64344`
-- Second extra worktree: `1422`, `64345`
-- Continue incrementally for additional worktrees

.github/pull_request_template.md

@@ -0,0 +1,18 @@
+## Summary
+
+<!-- Describe the bug and the fix in 1-3 sentences. -->
+
+## Submission
+
+- [ ] This PR is a bug fix or small-scope improvement.
+- [ ] If this PR is not a bug fix or small-scope improvement, I linked an approved feedback item below.
+- [ ] I have read and followed [`CONTRIBUTING.md`](CONTRIBUTING.md).
+- [ ] I tested this change locally.
+- [ ] I added or updated tests when reasonable.
+
+Approved feedback item (required if not a bug fix or small-scope improvement):
+<!-- https://yaak.app/feedback/... -->
+
+## Related
+
+<!-- Link related issues, discussions, or feedback items. -->

.github/workflows/release-api-npm.yml

@@ -0,0 +1,59 @@
+name: Release API to NPM
+
+on:
+  push:
+    tags: [yaak-api-*]
+  workflow_dispatch:
+    inputs:
+      version:
+        description: API version to publish (for example 0.9.0 or v0.9.0)
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  publish-npm:
+    name: Publish @yaakapp/api
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: lts/*
+          registry-url: https://registry.npmjs.org
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Set @yaakapp/api version
+        shell: bash
+        env:
+          WORKFLOW_VERSION: ${{ inputs.version }}
+        run: |
+          set -euo pipefail
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            VERSION="$WORKFLOW_VERSION"
+          else
+            VERSION="${GITHUB_REF_NAME#yaak-api-}"
+          fi
+          VERSION="${VERSION#v}"
+          echo "Preparing @yaakapp/api version: $VERSION"
+          cd packages/plugin-runtime-types
+          npm version "$VERSION" --no-git-tag-version --allow-same-version
+
+      - name: Build @yaakapp/api
+        working-directory: packages/plugin-runtime-types
+        run: npm run build
+
+      - name: Publish @yaakapp/api
+        working-directory: packages/plugin-runtime-types
+        run: npm publish --provenance --access public

.github/workflows/release-app.yml

@@ -1,4 +1,4 @@
-name: Generate Artifacts
+name: Release App Artifacts
 on:
   push:
     tags: [v*]

.github/workflows/release-cli-npm.yml

@@ -0,0 +1,218 @@
+name: Release CLI to NPM
+
+on:
+  push:
+    tags: [yaak-cli-*]
+  workflow_dispatch:
+    inputs:
+      version:
+        description: CLI version to publish (for example 0.4.0 or v0.4.0)
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  prepare-vendored-assets:
+    name: Prepare vendored plugin assets
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: lts/*
+
+      - name: Install Rust stable
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build plugin assets
+        env:
+          SKIP_WASM_BUILD: "1"
+        run: |
+          npm run build
+          npm run vendor:vendor-plugins
+
+      - name: Upload vendored assets
+        uses: actions/upload-artifact@v4
+        with:
+          name: vendored-assets
+          path: |
+            crates-tauri/yaak-app/vendored/plugin-runtime/index.cjs
+            crates-tauri/yaak-app/vendored/plugins
+          if-no-files-found: error
+
+  build-binaries:
+    name: Build ${{ matrix.pkg }}
+    needs: prepare-vendored-assets
+    runs-on: ${{ matrix.runner }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - pkg: cli-darwin-arm64
+            runner: macos-latest
+            target: aarch64-apple-darwin
+            binary: yaak
+          - pkg: cli-darwin-x64
+            runner: macos-latest
+            target: x86_64-apple-darwin
+            binary: yaak
+          - pkg: cli-linux-arm64
+            runner: ubuntu-22.04-arm
+            target: aarch64-unknown-linux-gnu
+            binary: yaak
+          - pkg: cli-linux-x64
+            runner: ubuntu-22.04
+            target: x86_64-unknown-linux-gnu
+            binary: yaak
+          - pkg: cli-win32-arm64
+            runner: windows-latest
+            target: aarch64-pc-windows-msvc
+            binary: yaak.exe
+          - pkg: cli-win32-x64
+            runner: windows-latest
+            target: x86_64-pc-windows-msvc
+            binary: yaak.exe
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install Rust stable
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ matrix.target }}
+
+      - name: Restore Rust cache
+        uses: Swatinem/rust-cache@v2
+        with:
+          shared-key: release-cli-npm
+          cache-on-failure: true
+
+      - name: Install Linux build dependencies
+        if: startsWith(matrix.runner, 'ubuntu')
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y pkg-config libdbus-1-dev
+
+      - name: Download vendored assets
+        uses: actions/download-artifact@v4
+        with:
+          name: vendored-assets
+          path: crates-tauri/yaak-app/vendored
+
+      - name: Set CLI build version
+        shell: bash
+        env:
+          WORKFLOW_VERSION: ${{ inputs.version }}
+        run: |
+          set -euo pipefail
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            VERSION="$WORKFLOW_VERSION"
+          else
+            VERSION="${GITHUB_REF_NAME#yaak-cli-}"
+          fi
+          VERSION="${VERSION#v}"
+          echo "Building yaak version: $VERSION"
+          echo "YAAK_CLI_VERSION=$VERSION" >> "$GITHUB_ENV"
+
+      - name: Build yaak
+        run: cargo build --locked --release -p yaak-cli --bin yaak --target ${{ matrix.target }}
+
+      - name: Stage binary artifact
+        shell: bash
+        run: |
+          set -euo pipefail
+          mkdir -p "npm/dist/${{ matrix.pkg }}"
+          cp "target/${{ matrix.target }}/release/${{ matrix.binary }}" "npm/dist/${{ matrix.pkg }}/${{ matrix.binary }}"
+
+      - name: Upload binary artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ matrix.pkg }}
+          path: npm/dist/${{ matrix.pkg }}/${{ matrix.binary }}
+          if-no-files-found: error
+
+  publish-npm:
+    name: Publish @yaakapp/cli packages
+    needs: build-binaries
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: lts/*
+          registry-url: https://registry.npmjs.org
+
+      - name: Download binary artifacts
+        uses: actions/download-artifact@v4
+        with:
+          pattern: cli-*
+          path: npm/dist
+          merge-multiple: false
+
+      - name: Prepare npm packages
+        shell: bash
+        env:
+          WORKFLOW_VERSION: ${{ inputs.version }}
+        run: |
+          set -euo pipefail
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            VERSION="$WORKFLOW_VERSION"
+          else
+            VERSION="${GITHUB_REF_NAME#yaak-cli-}"
+          fi
+          VERSION="${VERSION#v}"
+          if [[ "$VERSION" == *-* ]]; then
+            PRERELEASE="${VERSION#*-}"
+            NPM_TAG="${PRERELEASE%%.*}"
+          else
+            NPM_TAG="latest"
+          fi
+          echo "Preparing CLI npm packages for version: $VERSION"
+          echo "Publishing with npm dist-tag: $NPM_TAG"
+          echo "NPM_TAG=$NPM_TAG" >> "$GITHUB_ENV"
+          YAAK_CLI_VERSION="$VERSION" node npm/prepare-publish.js
+
+      - name: Publish @yaakapp/cli-darwin-arm64
+        run: npm publish --provenance --access public --tag "$NPM_TAG"
+        working-directory: npm/cli-darwin-arm64
+
+      - name: Publish @yaakapp/cli-darwin-x64
+        run: npm publish --provenance --access public --tag "$NPM_TAG"
+        working-directory: npm/cli-darwin-x64
+
+      - name: Publish @yaakapp/cli-linux-arm64
+        run: npm publish --provenance --access public --tag "$NPM_TAG"
+        working-directory: npm/cli-linux-arm64
+
+      - name: Publish @yaakapp/cli-linux-x64
+        run: npm publish --provenance --access public --tag "$NPM_TAG"
+        working-directory: npm/cli-linux-x64
+
+      - name: Publish @yaakapp/cli-win32-arm64
+        run: npm publish --provenance --access public --tag "$NPM_TAG"
+        working-directory: npm/cli-win32-arm64
+
+      - name: Publish @yaakapp/cli-win32-x64
+        run: npm publish --provenance --access public --tag "$NPM_TAG"
+        working-directory: npm/cli-win32-x64
+
+      - name: Publish @yaakapp/cli
+        run: npm publish --provenance --access public --tag "$NPM_TAG"
+        working-directory: npm/cli

.gitignore

@@ -54,3 +54,6 @@ flatpak/node-sources.json
 
 # Local Codex desktop env state
 .codex/environments/environment.toml
+
+# Claude Code local settings
+.claude/settings.local.json

AGENTS.md

@@ -0,0 +1,2 @@
+- Tag safety: app releases use `v*` tags and CLI releases use `yaak-cli-*` tags; always confirm which one is requested before retagging.
+- Do not commit, push, or tag without explicit approval

CONTRIBUTING.md

@@ -0,0 +1,16 @@
+# Contributing to Yaak
+
+Yaak accepts community pull requests for:
+
+- Bug fixes
+- Small-scope improvements directly tied to existing behavior
+
+Pull requests that introduce broad new features, major redesigns, or large refactors are out of scope unless explicitly approved first.
+
+## Approval for Non-Bugfix Changes
+
+If your PR is not a bug fix or small-scope improvement, include a link to the approved [feedback item](https://yaak.app/feedback) where contribution approval was explicitly stated.
+
+## Development Setup
+
+For local setup and development workflows, see [`DEVELOPMENT.md`](DEVELOPMENT.md).

Cargo.toml

@@ -35,6 +35,7 @@ log = "0.4.29"
 reqwest = "0.12.20"
 rustls = { version = "0.23.34", default-features = false }
 rustls-platform-verifier = "0.6.2"
+schemars = { version = "0.8.22", features = ["chrono"] }
 serde = "1.0.228"
 serde_json = "1.0.145"
 sha2 = "0.10.9"

README.md

@@ -22,7 +22,7 @@
   <!-- sponsors-premium --><a href="https://github.com/MVST-Solutions"><img src="https:&#x2F;&#x2F;github.com&#x2F;MVST-Solutions.png" width="80px" alt="User avatar: MVST-Solutions" /></a>&nbsp;&nbsp;<a href="https://github.com/dharsanb"><img src="https:&#x2F;&#x2F;github.com&#x2F;dharsanb.png" width="80px" alt="User avatar: dharsanb" /></a>&nbsp;&nbsp;<a href="https://github.com/railwayapp"><img src="https:&#x2F;&#x2F;github.com&#x2F;railwayapp.png" width="80px" alt="User avatar: railwayapp" /></a>&nbsp;&nbsp;<a href="https://github.com/caseyamcl"><img src="https:&#x2F;&#x2F;github.com&#x2F;caseyamcl.png" width="80px" alt="User avatar: caseyamcl" /></a>&nbsp;&nbsp;<a href="https://github.com/bytebase"><img src="https:&#x2F;&#x2F;github.com&#x2F;bytebase.png" width="80px" alt="User avatar: bytebase" /></a>&nbsp;&nbsp;<a href="https://github.com/"><img src="https:&#x2F;&#x2F;raw.githubusercontent.com&#x2F;JamesIves&#x2F;github-sponsors-readme-action&#x2F;dev&#x2F;.github&#x2F;assets&#x2F;placeholder.png" width="80px" alt="User avatar: " /></a>&nbsp;&nbsp;<!-- sponsors-premium -->
 </p>
 <p align="center">
-  <!-- sponsors-base --><a href="https://github.com/seanwash"><img src="https:&#x2F;&#x2F;github.com&#x2F;seanwash.png" width="50px" alt="User avatar: seanwash" /></a>&nbsp;&nbsp;<a href="https://github.com/jerath"><img src="https:&#x2F;&#x2F;github.com&#x2F;jerath.png" width="50px" alt="User avatar: jerath" /></a>&nbsp;&nbsp;<a href="https://github.com/itsa-sh"><img src="https:&#x2F;&#x2F;github.com&#x2F;itsa-sh.png" width="50px" alt="User avatar: itsa-sh" /></a>&nbsp;&nbsp;<a href="https://github.com/dmmulroy"><img src="https:&#x2F;&#x2F;github.com&#x2F;dmmulroy.png" width="50px" alt="User avatar: dmmulroy" /></a>&nbsp;&nbsp;<a href="https://github.com/timcole"><img src="https:&#x2F;&#x2F;github.com&#x2F;timcole.png" width="50px" alt="User avatar: timcole" /></a>&nbsp;&nbsp;<a href="https://github.com/VLZH"><img src="https:&#x2F;&#x2F;github.com&#x2F;VLZH.png" width="50px" alt="User avatar: VLZH" /></a>&nbsp;&nbsp;<a href="https://github.com/terasaka2k"><img src="https:&#x2F;&#x2F;github.com&#x2F;terasaka2k.png" width="50px" alt="User avatar: terasaka2k" /></a>&nbsp;&nbsp;<a href="https://github.com/andriyor"><img src="https:&#x2F;&#x2F;github.com&#x2F;andriyor.png" width="50px" alt="User avatar: andriyor" /></a>&nbsp;&nbsp;<a href="https://github.com/majudhu"><img src="https:&#x2F;&#x2F;github.com&#x2F;majudhu.png" width="50px" alt="User avatar: majudhu" /></a>&nbsp;&nbsp;<a href="https://github.com/axelrindle"><img src="https:&#x2F;&#x2F;github.com&#x2F;axelrindle.png" width="50px" alt="User avatar: axelrindle" /></a>&nbsp;&nbsp;<a href="https://github.com/jirizverina"><img src="https:&#x2F;&#x2F;github.com&#x2F;jirizverina.png" width="50px" alt="User avatar: jirizverina" /></a>&nbsp;&nbsp;<a href="https://github.com/chip-well"><img src="https:&#x2F;&#x2F;github.com&#x2F;chip-well.png" width="50px" alt="User avatar: chip-well" /></a>&nbsp;&nbsp;<a href="https://github.com/GRAYAH"><img src="https:&#x2F;&#x2F;github.com&#x2F;GRAYAH.png" width="50px" alt="User avatar: GRAYAH" /></a>&nbsp;&nbsp;<a href="https://github.com/flashblaze"><img src="https:&#x2F;&#x2F;github.com&#x2F;flashblaze.png" width="50px" alt="User avatar: flashblaze" /></a>&nbsp;&nbsp;<!-- sponsors-base -->
+  <!-- sponsors-base --><a href="https://github.com/seanwash"><img src="https:&#x2F;&#x2F;github.com&#x2F;seanwash.png" width="50px" alt="User avatar: seanwash" /></a>&nbsp;&nbsp;<a href="https://github.com/jerath"><img src="https:&#x2F;&#x2F;github.com&#x2F;jerath.png" width="50px" alt="User avatar: jerath" /></a>&nbsp;&nbsp;<a href="https://github.com/itsa-sh"><img src="https:&#x2F;&#x2F;github.com&#x2F;itsa-sh.png" width="50px" alt="User avatar: itsa-sh" /></a>&nbsp;&nbsp;<a href="https://github.com/dmmulroy"><img src="https:&#x2F;&#x2F;github.com&#x2F;dmmulroy.png" width="50px" alt="User avatar: dmmulroy" /></a>&nbsp;&nbsp;<a href="https://github.com/timcole"><img src="https:&#x2F;&#x2F;github.com&#x2F;timcole.png" width="50px" alt="User avatar: timcole" /></a>&nbsp;&nbsp;<a href="https://github.com/VLZH"><img src="https:&#x2F;&#x2F;github.com&#x2F;VLZH.png" width="50px" alt="User avatar: VLZH" /></a>&nbsp;&nbsp;<a href="https://github.com/terasaka2k"><img src="https:&#x2F;&#x2F;github.com&#x2F;terasaka2k.png" width="50px" alt="User avatar: terasaka2k" /></a>&nbsp;&nbsp;<a href="https://github.com/andriyor"><img src="https:&#x2F;&#x2F;github.com&#x2F;andriyor.png" width="50px" alt="User avatar: andriyor" /></a>&nbsp;&nbsp;<a href="https://github.com/majudhu"><img src="https:&#x2F;&#x2F;github.com&#x2F;majudhu.png" width="50px" alt="User avatar: majudhu" /></a>&nbsp;&nbsp;<a href="https://github.com/axelrindle"><img src="https:&#x2F;&#x2F;github.com&#x2F;axelrindle.png" width="50px" alt="User avatar: axelrindle" /></a>&nbsp;&nbsp;<a href="https://github.com/jirizverina"><img src="https:&#x2F;&#x2F;github.com&#x2F;jirizverina.png" width="50px" alt="User avatar: jirizverina" /></a>&nbsp;&nbsp;<a href="https://github.com/chip-well"><img src="https:&#x2F;&#x2F;github.com&#x2F;chip-well.png" width="50px" alt="User avatar: chip-well" /></a>&nbsp;&nbsp;<a href="https://github.com/GRAYAH"><img src="https:&#x2F;&#x2F;github.com&#x2F;GRAYAH.png" width="50px" alt="User avatar: GRAYAH" /></a>&nbsp;&nbsp;<a href="https://github.com/flashblaze"><img src="https:&#x2F;&#x2F;github.com&#x2F;flashblaze.png" width="50px" alt="User avatar: flashblaze" /></a>&nbsp;&nbsp;<a href="https://github.com/Frostist"><img src="https:&#x2F;&#x2F;github.com&#x2F;Frostist.png" width="50px" alt="User avatar: Frostist" /></a>&nbsp;&nbsp;<!-- sponsors-base -->
 </p>
 
 ![Yaak API Client](https://yaak.app/static/screenshot.png)
@@ -58,8 +58,10 @@ Built with [Tauri](https://tauri.app), Rust, and React, it’s fast, lightweight
 
 ## Contribution Policy
 
-Yaak is open source but only accepting contributions for bug fixes. To get started, 
-visit [`DEVELOPMENT.md`](DEVELOPMENT.md) for tips on setting up your environment.
+> [!IMPORTANT]
+> Community PRs are currently limited to bug fixes and small-scope improvements.
+> If your PR is out of scope, link an approved feedback item from [yaak.app/feedback](https://yaak.app/feedback).
+> See [`CONTRIBUTING.md`](CONTRIBUTING.md) for policy details and [`DEVELOPMENT.md`](DEVELOPMENT.md) for local setup.
 
 ## Useful Resources
 

crates-cli/yaak-cli/Cargo.toml

@@ -5,18 +5,34 @@ edition = "2024"
 publish = false
 
 [[bin]]
-name = "yaakcli"
+name = "yaak"
 path = "src/main.rs"
 
 [dependencies]
+base64 = "0.22"
 clap = { version = "4", features = ["derive"] }
+console = "0.15"
 dirs = "6"
 env_logger = "0.11"
+futures = "0.3"
+hex = { workspace = true }
+include_dir = "0.7"
+keyring = { workspace = true, features = ["apple-native", "windows-native", "sync-secret-service"] }
 log = { workspace = true }
+rand = "0.8"
+reqwest = { workspace = true }
+rolldown = "0.1.0"
+oxc_resolver = "=11.10.0"
+schemars = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }
-tokio = { workspace = true, features = ["rt-multi-thread", "macros"] }
+sha2 = { workspace = true }
+tokio = { workspace = true, features = ["rt-multi-thread", "macros", "io-util", "net", "signal", "time"] }
+walkdir = "2"
+webbrowser = "1"
+zip = "4"
 yaak = { workspace = true }
+yaak-api = { workspace = true }
 yaak-crypto = { workspace = true }
 yaak-http = { workspace = true }
 yaak-models = { workspace = true }

crates-cli/yaak-cli/PLAN.md

@@ -1,340 +0,0 @@
-# CLI Command Architecture Plan
-
-## Goal
-
-Redesign the yaak-cli command structure to use a resource-oriented `<resource> <action>`
-pattern that scales well, is discoverable, and supports both human and LLM workflows.
-
-## Status Snapshot
-
-Current branch state:
-
-- Modular CLI structure with command modules and shared `CliContext`
-- Resource/action hierarchy in place for:
-  - `workspace list|show|create|update|delete`
-  - `request list|show|create|update|send|delete`
-  - `folder list|show|create|update|delete`
-  - `environment list|show|create|update|delete`
-- Top-level `send` exists as a request-send shortcut (not yet flexible request/folder/workspace resolution)
-- Legacy `get` command removed
-- JSON create/update flow implemented (`--json` and positional JSON shorthand)
-- No `request schema` command yet
-
-Progress checklist:
-
-- [x] Phase 1 complete
-- [x] Phase 2 complete
-- [x] Phase 3 complete
-- [ ] Phase 4 complete
-- [ ] Phase 5 complete
-- [ ] Phase 6 complete
-
-## Command Architecture
-
-### Design Principles
-
-- **Resource-oriented**: top-level commands are nouns, subcommands are verbs
-- **Polymorphic requests**: `request` covers HTTP, gRPC, and WebSocket — the CLI
-  resolves the type via `get_any_request` and adapts behavior accordingly
-- **Simple creation, full-fidelity via JSON**: human-friendly flags for basic creation,
-  `--json` for full control (targeted at LLM and scripting workflows)
-- **Runtime schema introspection**: `request schema` outputs JSON Schema for the request
-  models, with dynamic auth fields populated from loaded plugins at runtime
-- **Destructive actions require confirmation**: `delete` commands prompt for user
-  confirmation before proceeding. Can be bypassed with `--yes` / `-y` for scripting
-
-### Commands
-
-```
-# Top-level shortcut
-yaakcli send <id> [-e <env_id>]          # id can be a request, folder, or workspace
-
-# Resource commands
-yaakcli workspace list
-yaakcli workspace show <id>
-yaakcli workspace create --name <name>
-yaakcli workspace create --json '{"name": "My Workspace"}'
-yaakcli workspace create '{"name": "My Workspace"}'              # positional JSON shorthand
-yaakcli workspace update --json '{"id": "wk_abc", "name": "New Name"}'
-yaakcli workspace delete <id>
-
-yaakcli request list <workspace_id>
-yaakcli request show <id>
-yaakcli request create <workspace_id> --name <name> --url <url> [--method GET]
-yaakcli request create --json '{"workspaceId": "wk_abc", "url": "..."}'
-yaakcli request update --json '{"id": "rq_abc", "url": "https://new.com"}'
-yaakcli request send <id> [-e <env_id>]
-yaakcli request delete <id>
-yaakcli request schema <http|grpc|websocket>
-
-yaakcli folder list <workspace_id>
-yaakcli folder show <id>
-yaakcli folder create <workspace_id> --name <name>
-yaakcli folder create --json '{"workspaceId": "wk_abc", "name": "Auth"}'
-yaakcli folder update --json '{"id": "fl_abc", "name": "New Name"}'
-yaakcli folder delete <id>
-
-yaakcli environment list <workspace_id>
-yaakcli environment show <id>
-yaakcli environment create <workspace_id> --name <name>
-yaakcli environment create --json '{"workspaceId": "wk_abc", "name": "Production"}'
-yaakcli environment update --json '{"id": "ev_abc", ...}'
-yaakcli environment delete <id>
-
-```
-
-### `send` — Top-Level Shortcut
-
-`yaakcli send <id>` is a convenience alias that accepts any sendable ID. It tries
-each type in order via DB lookups (short-circuiting on first match):
-
-1. Request (HTTP, gRPC, or WebSocket via `get_any_request`)
-2. Folder (sends all requests in the folder)
-3. Workspace (sends all requests in the workspace)
-
-ID prefixes exist (e.g. `rq_`, `fl_`, `wk_`) but are not relied upon — resolution
-is purely by DB lookup.
-
-`request send <id>` is the same but restricted to request IDs only.
-
-### Request Send — Polymorphic Behavior
-
-`send` means "execute this request" regardless of protocol:
-
-- **HTTP**: send request, print response, exit
-- **gRPC**: invoke the method; for streaming, stream output to stdout until done/Ctrl+C
-- **WebSocket**: connect, stream messages to stdout until closed/Ctrl+C
-
-### `request schema` — Runtime JSON Schema
-
-Outputs a JSON Schema describing the full request shape, including dynamic fields:
-
-1. Generate base schema from `schemars::JsonSchema` derive on the Rust model structs
-2. Load plugins, collect auth strategy definitions and their form inputs
-3. Merge plugin-defined auth fields into the `authentication` property as a `oneOf`
-4. Output the combined schema as JSON
-
-This lets an LLM call `schema`, read the shape, and construct valid JSON for
-`create --json` or `update --json`.
-
-## Implementation Steps
-
-### Phase 1: Restructure commands (no new functionality)
-
-Refactor `main.rs` into the new resource/action pattern using clap subcommand nesting.
-Existing behavior stays the same, just reorganized. Remove the `get` command.
-
-1. Create module structure: `commands/workspace.rs`, `commands/request.rs`, etc.
-2. Define nested clap enums:
-   ```rust
-   enum Commands {
-       Send(SendArgs),
-       Workspace(WorkspaceArgs),
-       Request(RequestArgs),
-       Folder(FolderArgs),
-       Environment(EnvironmentArgs),
-   }
-   ```
-3. Move existing `Workspaces` logic into `workspace list`
-4. Move existing `Requests` logic into `request list`
-5. Move existing `Send` logic into `request send`
-6. Move existing `Create` logic into `request create`
-7. Delete the `Get` command entirely
-8. Extract shared setup (DB init, plugin init, encryption) into a reusable context struct
-
-### Phase 2: Add missing CRUD commands
-
-Status: complete
-
-1. `workspace show <id>`
-2. `workspace create --name <name>` (and `--json`)
-3. `workspace update --json`
-4. `workspace delete <id>`
-5. `request show <id>` (JSON output of the full request model)
-6. `request delete <id>`
-7. `folder list <workspace_id>`
-8. `folder show <id>`
-9. `folder create <workspace_id> --name <name>` (and `--json`)
-10. `folder update --json`
-11. `folder delete <id>`
-12. `environment list <workspace_id>`
-13. `environment show <id>`
-14. `environment create <workspace_id> --name <name>` (and `--json`)
-15. `environment update --json`
-16. `environment delete <id>`
-
-### Phase 3: JSON input for create/update
-
-Both commands accept JSON via `--json <string>` or as a positional argument (detected
-by leading `{`). They follow the same upsert pattern as the plugin API.
-
-- **`create --json`**: JSON must include `workspaceId`. Must NOT include `id` (or
-  use empty string `""`). Deserializes into the model with defaults for missing fields,
-  then upserts (insert).
-- **`update --json`**: JSON must include `id`. Performs a fetch-merge-upsert:
-  1. Fetch the existing model from DB
-  2. Serialize it to `serde_json::Value`
-  3. Deep-merge the user's partial JSON on top (JSON Merge Patch / RFC 7386 semantics)
-  4. Deserialize back into the typed model
-  5. Upsert (update)
-
-  This matches how the MCP server plugin already does it (fetch existing, spread, override),
-  but the CLI handles the merge server-side so callers don't have to.
-
-  Setting a field to `null` removes it (for `Option<T>` fields), per RFC 7386.
-
-Implementation:
-1. Add `--json` flag and positional JSON detection to `create` commands
-2. Add `update` commands with required `--json` flag
-3. Implement JSON merge utility (or use `json-patch` crate)
-
-### Phase 4: Runtime schema generation
-
-1. Add `schemars` dependency to `yaak-models`
-2. Derive `JsonSchema` on `HttpRequest`, `GrpcRequest`, `WebsocketRequest`, and their
-   nested types (`HttpRequestHeader`, `HttpUrlParameter`, etc.)
-3. Implement `request schema` command:
-   - Generate base schema from schemars
-   - Query plugins for auth strategy form inputs
-   - Convert plugin form inputs into JSON Schema properties
-   - Merge into the `authentication` field
-   - Print to stdout
-
-### Phase 5: Polymorphic send
-
-1. Update `request send` to use `get_any_request` to resolve the request type
-2. Match on `AnyRequest` variant and dispatch to the appropriate sender:
-   - `AnyRequest::HttpRequest` — existing HTTP send logic
-   - `AnyRequest::GrpcRequest` — gRPC invoke (future implementation)
-   - `AnyRequest::WebsocketRequest` — WebSocket connect (future implementation)
-3. gRPC and WebSocket send can initially return "not yet implemented" errors
-
-### Phase 6: Top-level `send` and folder/workspace send
-
-1. Add top-level `yaakcli send <id>` command
-2. Resolve ID by trying DB lookups in order: any_request → folder → workspace
-3. For folder: list all requests in folder, send each
-4. For workspace: list all requests in workspace, send each
-5. Add execution options: `--sequential` (default), `--parallel`, `--fail-fast`
-
-## Execution Plan (PR Slices)
-
-### PR 1: Command tree refactor + compatibility aliases
-
-Scope:
-
-1. Introduce `commands/` modules and a `CliContext` for shared setup
-2. Add new clap hierarchy (`workspace`, `request`, `folder`, `environment`)
-3. Route existing behavior into:
-   - `workspace list`
-   - `request list <workspace_id>`
-   - `request send <id>`
-   - `request create <workspace_id> ...`
-4. Keep compatibility aliases temporarily:
-   - `workspaces` -> `workspace list`
-   - `requests <workspace_id>` -> `request list <workspace_id>`
-   - `create ...` -> `request create ...`
-5. Remove `get` and update help text
-
-Acceptance criteria:
-
-- `yaakcli --help` shows noun/verb structure
-- Existing list/send/create workflows still work
-- No behavior change in HTTP send output format
-
-### PR 2: CRUD surface area
-
-Scope:
-
-1. Implement `show/create/update/delete` for `workspace`, `request`, `folder`, `environment`
-2. Ensure delete commands require confirmation by default (`--yes` bypass)
-3. Normalize output format for list/show/create/update/delete responses
-
-Acceptance criteria:
-
-- Every command listed in the "Commands" section parses and executes
-- Delete commands are safe by default in interactive terminals
-- `--yes` supports non-interactive scripts
-
-### PR 3: JSON input + merge patch semantics
-
-Scope:
-
-1. Add shared parser for `--json` and positional JSON shorthand
-2. Add `create --json` and `update --json` for all mutable resources
-3. Implement server-side RFC 7386 merge patch behavior
-4. Add guardrails:
-   - `create --json`: reject non-empty `id`
-   - `update --json`: require `id`
-
-Acceptance criteria:
-
-- Partial `update --json` only modifies provided keys
-- `null` clears optional values
-- Invalid JSON and missing required fields return actionable errors
-
-### PR 4: `request schema` and plugin auth integration
-
-Scope:
-
-1. Add `schemars` to `yaak-models` and derive `JsonSchema` for request models
-2. Implement `request schema <http|grpc|websocket>`
-3. Merge plugin auth form inputs into `authentication` schema at runtime
-
-Acceptance criteria:
-
-- Command prints valid JSON schema
-- Schema reflects installed auth providers at runtime
-- No panic when plugins fail to initialize (degrade gracefully)
-
-### PR 5: Polymorphic request send
-
-Scope:
-
-1. Replace request resolution in `request send` with `get_any_request`
-2. Dispatch by request type
-3. Keep HTTP fully functional
-4. Return explicit NYI errors for gRPC/WebSocket until implemented
-
-Acceptance criteria:
-
-- HTTP behavior remains unchanged
-- gRPC/WebSocket IDs are recognized and return explicit status
-
-### PR 6: Top-level `send` + bulk execution
-
-Scope:
-
-1. Add top-level `send <id>` for request/folder/workspace IDs
-2. Implement folder/workspace fan-out execution
-3. Add execution controls: `--sequential`, `--parallel`, `--fail-fast`
-
-Acceptance criteria:
-
-- Correct ID dispatch order: request -> folder -> workspace
-- Deterministic summary output (success/failure counts)
-- Non-zero exit code when any request fails (unless explicitly configured otherwise)
-
-## Validation Matrix
-
-1. CLI parsing tests for every command path (including aliases while retained)
-2. Integration tests against temp SQLite DB for CRUD flows
-3. Snapshot tests for output text where scripting compatibility matters
-4. Manual smoke tests:
-   - Send HTTP request with template/rendered vars
-   - JSON create/update for each resource
-   - Delete confirmation and `--yes`
-   - Top-level `send` on request/folder/workspace
-
-## Open Questions
-
-1. Should compatibility aliases (`workspaces`, `requests`, `create`) be removed immediately or after one release cycle?
-2. For bulk `send`, should default behavior stop on first failure or continue and summarize?
-3. Should command output default to human-readable text with an optional `--format json`, or return JSON by default for `show`/`list`?
-4. For `request schema`, should plugin-derived auth fields be namespaced by plugin ID to avoid collisions?
-
-## Crate Changes
-
-- **yaak-cli**: restructure into modules, new clap hierarchy
-- **yaak-models**: add `schemars` dependency, derive `JsonSchema` on model structs
-  (current derives: `Debug, Clone, PartialEq, Serialize, Deserialize, Default, TS`)

crates-cli/yaak-cli/README.md

@@ -1,87 +1,66 @@
-# yaak-cli
+# Yaak CLI
 
-Command-line interface for Yaak.
+The `yaak` CLI for publishing plugins and creating/updating/sending requests. 
 
-## Command Overview
+## Installation
 
-Current top-level commands:
+```sh
+npm install @yaakapp/cli
+```
+
+## Agentic Workflows
+
+The `yaak` CLI is primarily meant to be used by AI agents, and has the following features:
+
+- `schema` subcommands to get the JSON Schema for any model (eg. `yaak request schema http`)
+- `--json '{...}'` input format to create and update data
+- `--verbose` mode for extracting debug info while sending requests
+- The ability to send entire workspaces and folders (Supports `--parallel` and `--fail-fast`)
+
+### Example Prompts
+
+Use the `yaak` CLI with agents like Claude or Codex to do useful things for you.
+
+Here are some example prompts:
 
 ```text
-yaakcli send <request_id>
-yaakcli workspace list
-yaakcli workspace show <workspace_id>
-yaakcli workspace create --name <name>
-yaakcli workspace create --json '{"name":"My Workspace"}'
-yaakcli workspace create '{"name":"My Workspace"}'
-yaakcli workspace update --json '{"id":"wk_abc","description":"Updated"}'
-yaakcli workspace delete <workspace_id> [--yes]
-yaakcli request list <workspace_id>
-yaakcli request show <request_id>
-yaakcli request send <request_id>
-yaakcli request create <workspace_id> --name <name> --url <url> [--method GET]
-yaakcli request create --json '{"workspaceId":"wk_abc","name":"Users","url":"https://api.example.com/users"}'
-yaakcli request create '{"workspaceId":"wk_abc","name":"Users","url":"https://api.example.com/users"}'
-yaakcli request update --json '{"id":"rq_abc","name":"Users v2"}'
-yaakcli request delete <request_id> [--yes]
-yaakcli folder list <workspace_id>
-yaakcli folder show <folder_id>
-yaakcli folder create <workspace_id> --name <name>
-yaakcli folder create --json '{"workspaceId":"wk_abc","name":"Auth"}'
-yaakcli folder create '{"workspaceId":"wk_abc","name":"Auth"}'
-yaakcli folder update --json '{"id":"fl_abc","name":"Auth v2"}'
-yaakcli folder delete <folder_id> [--yes]
-yaakcli environment list <workspace_id>
-yaakcli environment show <environment_id>
-yaakcli environment create <workspace_id> --name <name>
-yaakcli environment create --json '{"workspaceId":"wk_abc","name":"Production"}'
-yaakcli environment create '{"workspaceId":"wk_abc","name":"Production"}'
-yaakcli environment update --json '{"id":"ev_abc","color":"#00ff00"}'
-yaakcli environment delete <environment_id> [--yes]
+Scan my API routes and create a workspace (using yaak cli) with 
+all the requests needed for me to do manual testing?  
 ```
 
-Global options:
-
-- `--data-dir <path>`: use a custom data directory
-- `-e, --environment <id>`: environment to use during request rendering/sending
-- `-v, --verbose`: verbose logging and send output
-
-Notes:
-
-- `send` is currently a shortcut for sending an HTTP request ID.
-- `delete` commands prompt for confirmation unless `--yes` is provided.
-- In non-interactive mode, `delete` commands require `--yes`.
-- `create` and `update` commands support `--json` and positional JSON shorthand.
-- `update` uses JSON Merge Patch semantics (RFC 7386) for partial updates.
-
-## Examples
-
-```bash
-yaakcli workspace list
-yaakcli workspace create --name "My Workspace"
-yaakcli workspace show wk_abc
-yaakcli workspace update --json '{"id":"wk_abc","description":"Team workspace"}'
-yaakcli request list wk_abc
-yaakcli request show rq_abc
-yaakcli request create wk_abc --name "Users" --url "https://api.example.com/users"
-yaakcli request update --json '{"id":"rq_abc","name":"Users v2"}'
-yaakcli request send rq_abc -e ev_abc
-yaakcli request delete rq_abc --yes
-yaakcli folder create wk_abc --name "Auth"
-yaakcli folder update --json '{"id":"fl_abc","name":"Auth v2"}'
-yaakcli environment create wk_abc --name "Production"
-yaakcli environment update --json '{"id":"ev_abc","color":"#00ff00"}'
+```text
+Send all the GraphQL requests in my workspace
 ```
 
-## Roadmap
+## Description
 
-Planned command expansion (request schema and polymorphic send) is tracked in `PLAN.md`.
+Here's the current print of `yaak --help`
 
-When command behavior changes, update this README and verify with:
+```text
+Yaak CLI - API client from the command line
 
-```bash
-cargo run -q -p yaak-cli -- --help
-cargo run -q -p yaak-cli -- request --help
-cargo run -q -p yaak-cli -- workspace --help
-cargo run -q -p yaak-cli -- folder --help
-cargo run -q -p yaak-cli -- environment --help
+Usage: yaak [OPTIONS] <COMMAND>
+
+Commands:
+  auth         Authentication commands
+  plugin       Plugin development and publishing commands
+  send         Send a request, folder, or workspace by ID
+  workspace    Workspace commands
+  request      Request commands
+  folder       Folder commands
+  environment  Environment commands
+
+Options:
+      --data-dir <DATA_DIR>        Use a custom data directory
+  -e, --environment <ENVIRONMENT>  Environment ID to use for variable substitution
+  -v, --verbose                    Enable verbose send output (events and streamed response body)
+      --log [<LEVEL>]              Enable CLI logging; optionally set level (error|warn|info|debug|trace) [possible values: error, warn, info, debug, trace]
+  -h, --help                       Print help
+  -V, --version                    Print version
+
+Agent Hints:
+  - Template variable syntax is ${[ my_var ]}, not {{ ... }}
+  - Template function syntax is ${[ namespace.my_func(a='aaa',b='bbb') ]}
+  - View JSONSchema for models before creating or updating (eg. `yaak request schema http`)
+  - Deletion requires confirmation (--yes for non-interactive environments)
 ```

crates-cli/yaak-cli/src/cli.rs

@@ -1,9 +1,17 @@
-use clap::{Args, Parser, Subcommand};
+use clap::{Args, Parser, Subcommand, ValueEnum};
 use std::path::PathBuf;
 
 #[derive(Parser)]
-#[command(name = "yaakcli")]
+#[command(name = "yaak")]
 #[command(about = "Yaak CLI - API client from the command line")]
+#[command(version = crate::version::cli_version())]
+#[command(disable_help_subcommand = true)]
+#[command(after_help = r#"Agent Hints:
+  - Template variable syntax is ${[ my_var ]}, not {{ ... }}
+  - Template function syntax is ${[ namespace.my_func(a='aaa',b='bbb') ]}
+  - View JSONSchema for models before creating or updating (eg. `yaak request schema http`)
+  - Deletion requires confirmation (--yes for non-interactive environments)
+  "#)]
 pub struct Cli {
     /// Use a custom data directory
     #[arg(long, global = true)]
@@ -13,17 +21,41 @@ pub struct Cli {
     #[arg(long, short, global = true)]
     pub environment: Option<String>,
 
-    /// Enable verbose logging
+    /// Enable verbose send output (events and streamed response body)
     #[arg(long, short, global = true)]
     pub verbose: bool,
 
+    /// Enable CLI logging; optionally set level (error|warn|info|debug|trace)
+    #[arg(long, global = true, value_name = "LEVEL", num_args = 0..=1, ignore_case = true)]
+    pub log: Option<Option<LogLevel>>,
+
     #[command(subcommand)]
     pub command: Commands,
 }
 
 #[derive(Subcommand)]
 pub enum Commands {
-    /// Send an HTTP request by ID
+    /// Authentication commands
+    Auth(AuthArgs),
+
+    /// Plugin development and publishing commands
+    Plugin(PluginArgs),
+
+    #[command(hide = true)]
+    Build(PluginPathArg),
+
+    #[command(hide = true)]
+    Dev(PluginPathArg),
+
+    /// Backward-compatible alias for `plugin generate`
+    #[command(hide = true)]
+    Generate(GenerateArgs),
+
+    /// Backward-compatible alias for `plugin publish`
+    #[command(hide = true)]
+    Publish(PluginPathArg),
+
+    /// Send a request, folder, or workspace by ID
     Send(SendArgs),
 
     /// Workspace commands
@@ -41,11 +73,20 @@ pub enum Commands {
 
 #[derive(Args)]
 pub struct SendArgs {
-    /// Request ID
-    pub request_id: String,
+    /// Request, folder, or workspace ID
+    pub id: String,
+
+    /// Execute requests in parallel
+    #[arg(long)]
+    pub parallel: bool,
+
+    /// Stop on first request failure when sending folders/workspaces
+    #[arg(long, conflicts_with = "parallel")]
+    pub fail_fast: bool,
 }
 
 #[derive(Args)]
+#[command(disable_help_subcommand = true)]
 pub struct WorkspaceArgs {
     #[command(subcommand)]
     pub command: WorkspaceCommands,
@@ -56,6 +97,13 @@ pub enum WorkspaceCommands {
     /// List all workspaces
     List,
 
+    /// Output JSON schema for workspace create/update payloads
+    Schema {
+        /// Pretty-print schema JSON output
+        #[arg(long)]
+        pretty: bool,
+    },
+
     /// Show a workspace as JSON
     Show {
         /// Workspace ID
@@ -100,6 +148,7 @@ pub enum WorkspaceCommands {
 }
 
 #[derive(Args)]
+#[command(disable_help_subcommand = true)]
 pub struct RequestArgs {
     #[command(subcommand)]
     pub command: RequestCommands,
@@ -119,12 +168,22 @@ pub enum RequestCommands {
         request_id: String,
     },
 
-    /// Send an HTTP request by ID
+    /// Send a request by ID
     Send {
         /// Request ID
         request_id: String,
     },
 
+    /// Output JSON schema for request create/update payloads
+    Schema {
+        #[arg(value_enum)]
+        request_type: RequestSchemaType,
+
+        /// Pretty-print schema JSON output
+        #[arg(long)]
+        pretty: bool,
+    },
+
     /// Create a new HTTP request
     Create {
         /// Workspace ID (or positional JSON payload shorthand)
@@ -169,7 +228,36 @@ pub enum RequestCommands {
     },
 }
 
+#[derive(Clone, Copy, Debug, ValueEnum)]
+pub enum RequestSchemaType {
+    Http,
+    Grpc,
+    Websocket,
+}
+
+#[derive(Clone, Copy, Debug, ValueEnum)]
+pub enum LogLevel {
+    Error,
+    Warn,
+    Info,
+    Debug,
+    Trace,
+}
+
+impl LogLevel {
+    pub fn as_filter(self) -> log::LevelFilter {
+        match self {
+            LogLevel::Error => log::LevelFilter::Error,
+            LogLevel::Warn => log::LevelFilter::Warn,
+            LogLevel::Info => log::LevelFilter::Info,
+            LogLevel::Debug => log::LevelFilter::Debug,
+            LogLevel::Trace => log::LevelFilter::Trace,
+        }
+    }
+}
+
 #[derive(Args)]
+#[command(disable_help_subcommand = true)]
 pub struct FolderArgs {
     #[command(subcommand)]
     pub command: FolderCommands,
@@ -226,6 +314,7 @@ pub enum FolderCommands {
 }
 
 #[derive(Args)]
+#[command(disable_help_subcommand = true)]
 pub struct EnvironmentArgs {
     #[command(subcommand)]
     pub command: EnvironmentCommands,
@@ -239,6 +328,13 @@ pub enum EnvironmentCommands {
         workspace_id: String,
     },
 
+    /// Output JSON schema for environment create/update payloads
+    Schema {
+        /// Pretty-print schema JSON output
+        #[arg(long)]
+        pretty: bool,
+    },
+
     /// Show an environment as JSON
     Show {
         /// Environment ID
@@ -246,15 +342,22 @@ pub enum EnvironmentCommands {
     },
 
     /// Create an environment
+    #[command(after_help = r#"Modes (choose one):
+  1) yaak environment create <workspace_id> --name <name>
+  2) yaak environment create --json '{"workspaceId":"wk_abc","name":"Production"}'
+  3) yaak environment create '{"workspaceId":"wk_abc","name":"Production"}'
+  4) yaak environment create <workspace_id> --json '{"name":"Production"}'
+"#)]
     Create {
-        /// Workspace ID (or positional JSON payload shorthand)
+        /// Workspace ID for flag-based mode, or positional JSON payload shorthand
+        #[arg(value_name = "WORKSPACE_ID_OR_JSON")]
         workspace_id: Option<String>,
 
         /// Environment name
         #[arg(short, long)]
         name: Option<String>,
 
-        /// JSON payload
+        /// JSON payload (use instead of WORKSPACE_ID/--name)
         #[arg(long)]
         json: Option<String>,
     },
@@ -280,3 +383,61 @@ pub enum EnvironmentCommands {
         yes: bool,
     },
 }
+
+#[derive(Args)]
+#[command(disable_help_subcommand = true)]
+pub struct AuthArgs {
+    #[command(subcommand)]
+    pub command: AuthCommands,
+}
+
+#[derive(Subcommand)]
+pub enum AuthCommands {
+    /// Login to Yaak via web browser
+    Login,
+
+    /// Sign out of the Yaak CLI
+    Logout,
+
+    /// Print the current logged-in user's info
+    Whoami,
+}
+
+#[derive(Args)]
+#[command(disable_help_subcommand = true)]
+pub struct PluginArgs {
+    #[command(subcommand)]
+    pub command: PluginCommands,
+}
+
+#[derive(Subcommand)]
+pub enum PluginCommands {
+    /// Transpile code into a runnable plugin bundle
+    Build(PluginPathArg),
+
+    /// Build plugin bundle continuously when the filesystem changes
+    Dev(PluginPathArg),
+
+    /// Generate a "Hello World" Yaak plugin
+    Generate(GenerateArgs),
+
+    /// Publish a Yaak plugin version to the plugin registry
+    Publish(PluginPathArg),
+}
+
+#[derive(Args, Clone)]
+pub struct PluginPathArg {
+    /// Path to plugin directory (defaults to current working directory)
+    pub path: Option<PathBuf>,
+}
+
+#[derive(Args, Clone)]
+pub struct GenerateArgs {
+    /// Plugin name (defaults to a generated name in interactive mode)
+    #[arg(long)]
+    pub name: Option<String>,
+
+    /// Output directory for the generated plugin (defaults to ./<name> in interactive mode)
+    #[arg(long)]
+    pub dir: Option<PathBuf>,
+}

crates-cli/yaak-cli/src/commands/auth.rs

@@ -0,0 +1,528 @@
+use crate::cli::{AuthArgs, AuthCommands};
+use crate::ui;
+use crate::utils::http;
+use base64::Engine as _;
+use keyring::Entry;
+use rand::RngCore;
+use rand::rngs::OsRng;
+use reqwest::Url;
+use serde_json::Value;
+use sha2::{Digest, Sha256};
+use std::io::{self, IsTerminal, Write};
+use std::time::Duration;
+use tokio::io::{AsyncReadExt, AsyncWriteExt};
+use tokio::net::{TcpListener, TcpStream};
+
+const OAUTH_CLIENT_ID: &str = "a1fe44800c2d7e803cad1b4bf07a291c";
+const KEYRING_USER: &str = "yaak";
+const AUTH_TIMEOUT: Duration = Duration::from_secs(300);
+const MAX_REQUEST_BYTES: usize = 16 * 1024;
+
+type CommandResult<T = ()> = std::result::Result<T, String>;
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+enum Environment {
+    Production,
+    Staging,
+    Development,
+}
+
+impl Environment {
+    fn app_base_url(self) -> &'static str {
+        match self {
+            Environment::Production => "https://yaak.app",
+            Environment::Staging => "https://todo.yaak.app",
+            Environment::Development => "http://localhost:9444",
+        }
+    }
+
+    fn api_base_url(self) -> &'static str {
+        match self {
+            Environment::Production => "https://api.yaak.app",
+            Environment::Staging => "https://todo.yaak.app",
+            Environment::Development => "http://localhost:9444",
+        }
+    }
+
+    fn keyring_service(self) -> &'static str {
+        match self {
+            Environment::Production => "app.yaak.cli.Token",
+            Environment::Staging => "app.yaak.cli.staging.Token",
+            Environment::Development => "app.yaak.cli.dev.Token",
+        }
+    }
+}
+
+struct OAuthFlow {
+    app_base_url: String,
+    auth_url: Url,
+    token_url: String,
+    redirect_url: String,
+    state: String,
+    code_verifier: String,
+}
+
+pub async fn run(args: AuthArgs) -> i32 {
+    let result = match args.command {
+        AuthCommands::Login => login().await,
+        AuthCommands::Logout => logout(),
+        AuthCommands::Whoami => whoami().await,
+    };
+
+    match result {
+        Ok(()) => 0,
+        Err(error) => {
+            ui::error(&error);
+            1
+        }
+    }
+}
+
+async fn login() -> CommandResult {
+    let environment = current_environment();
+
+    let listener = TcpListener::bind("127.0.0.1:0")
+        .await
+        .map_err(|e| format!("Failed to start OAuth callback server: {e}"))?;
+    let port = listener
+        .local_addr()
+        .map_err(|e| format!("Failed to determine callback server port: {e}"))?
+        .port();
+
+    let oauth = build_oauth_flow(environment, port)?;
+
+    ui::info(&format!("Initiating login to {}", oauth.auth_url));
+    if !confirm_open_browser()? {
+        ui::info("Login canceled");
+        return Ok(());
+    }
+
+    if let Err(err) = webbrowser::open(oauth.auth_url.as_ref()) {
+        ui::warning(&format!("Failed to open browser: {err}"));
+        ui::info(&format!("Open this URL manually:\n{}", oauth.auth_url));
+    }
+    ui::info("Waiting for authentication...");
+
+    let code = tokio::select! {
+        result = receive_oauth_code(listener, &oauth.state, &oauth.app_base_url) => result?,
+        _ = tokio::signal::ctrl_c() => {
+            return Err("Interrupted by user".to_string());
+        }
+        _ = tokio::time::sleep(AUTH_TIMEOUT) => {
+            return Err("Timeout waiting for authentication".to_string());
+        }
+    };
+
+    let token = exchange_access_token(&oauth, &code).await?;
+    store_auth_token(environment, &token)?;
+    ui::success("Authentication successful!");
+    Ok(())
+}
+
+fn logout() -> CommandResult {
+    delete_auth_token(current_environment())?;
+    ui::success("Signed out of Yaak");
+    Ok(())
+}
+
+async fn whoami() -> CommandResult {
+    let environment = current_environment();
+    let token = match get_auth_token(environment)? {
+        Some(token) => token,
+        None => {
+            ui::warning("Not logged in");
+            ui::info("Please run `yaak auth login`");
+            return Ok(());
+        }
+    };
+
+    let url = format!("{}/api/v1/whoami", environment.api_base_url());
+    let response = http::build_client(Some(&token))?
+        .get(url)
+        .send()
+        .await
+        .map_err(|e| format!("Failed to call whoami endpoint: {e}"))?;
+
+    let status = response.status();
+    let body =
+        response.text().await.map_err(|e| format!("Failed to read whoami response body: {e}"))?;
+
+    if !status.is_success() {
+        if status.as_u16() == 401 {
+            let _ = delete_auth_token(environment);
+            return Err(
+                "Unauthorized to access CLI. Run `yaak auth login` to refresh credentials."
+                    .to_string(),
+            );
+        }
+        return Err(http::parse_api_error(status.as_u16(), &body));
+    }
+
+    println!("{body}");
+    Ok(())
+}
+
+fn current_environment() -> Environment {
+    let value = std::env::var("ENVIRONMENT").ok();
+    parse_environment(value.as_deref())
+}
+
+fn parse_environment(value: Option<&str>) -> Environment {
+    match value {
+        Some("staging") => Environment::Staging,
+        Some("development") => Environment::Development,
+        _ => Environment::Production,
+    }
+}
+
+fn build_oauth_flow(environment: Environment, callback_port: u16) -> CommandResult<OAuthFlow> {
+    let code_verifier = random_hex(32);
+    let state = random_hex(24);
+    let redirect_url = format!("http://127.0.0.1:{callback_port}/oauth/callback");
+
+    let code_challenge = base64::engine::general_purpose::URL_SAFE_NO_PAD
+        .encode(Sha256::digest(code_verifier.as_bytes()));
+
+    let mut auth_url = Url::parse(&format!("{}/login/oauth/authorize", environment.app_base_url()))
+        .map_err(|e| format!("Failed to build OAuth authorize URL: {e}"))?;
+    auth_url
+        .query_pairs_mut()
+        .append_pair("response_type", "code")
+        .append_pair("client_id", OAUTH_CLIENT_ID)
+        .append_pair("redirect_uri", &redirect_url)
+        .append_pair("state", &state)
+        .append_pair("code_challenge_method", "S256")
+        .append_pair("code_challenge", &code_challenge);
+
+    Ok(OAuthFlow {
+        app_base_url: environment.app_base_url().to_string(),
+        auth_url,
+        token_url: format!("{}/login/oauth/access_token", environment.app_base_url()),
+        redirect_url,
+        state,
+        code_verifier,
+    })
+}
+
+async fn receive_oauth_code(
+    listener: TcpListener,
+    expected_state: &str,
+    app_base_url: &str,
+) -> CommandResult<String> {
+    loop {
+        let (mut stream, _) = listener
+            .accept()
+            .await
+            .map_err(|e| format!("OAuth callback server accept error: {e}"))?;
+
+        match parse_callback_request(&mut stream).await {
+            Ok((state, code)) => {
+                if state != expected_state {
+                    let _ = write_bad_request(&mut stream, "Invalid OAuth state").await;
+                    continue;
+                }
+
+                let success_redirect = format!("{app_base_url}/login/oauth/success");
+                write_redirect(&mut stream, &success_redirect)
+                    .await
+                    .map_err(|e| format!("Failed responding to OAuth callback: {e}"))?;
+                return Ok(code);
+            }
+            Err(error) => {
+                let _ = write_bad_request(&mut stream, &error).await;
+                if error.starts_with("OAuth provider returned error:") {
+                    return Err(error);
+                }
+            }
+        }
+    }
+}
+
+async fn parse_callback_request(stream: &mut TcpStream) -> CommandResult<(String, String)> {
+    let target = read_http_target(stream).await?;
+    if !target.starts_with("/oauth/callback") {
+        return Err("Expected /oauth/callback path".to_string());
+    }
+
+    let url = Url::parse(&format!("http://127.0.0.1{target}"))
+        .map_err(|e| format!("Failed to parse callback URL: {e}"))?;
+    let mut state: Option<String> = None;
+    let mut code: Option<String> = None;
+    let mut oauth_error: Option<String> = None;
+    let mut oauth_error_description: Option<String> = None;
+
+    for (k, v) in url.query_pairs() {
+        if k == "state" {
+            state = Some(v.into_owned());
+        } else if k == "code" {
+            code = Some(v.into_owned());
+        } else if k == "error" {
+            oauth_error = Some(v.into_owned());
+        } else if k == "error_description" {
+            oauth_error_description = Some(v.into_owned());
+        }
+    }
+
+    if let Some(error) = oauth_error {
+        let mut message = format!("OAuth provider returned error: {error}");
+        if let Some(description) = oauth_error_description.filter(|d| !d.is_empty()) {
+            message.push_str(&format!(" ({description})"));
+        }
+        return Err(message);
+    }
+
+    let state = state.ok_or_else(|| "Missing 'state' query parameter".to_string())?;
+    let code = code.ok_or_else(|| "Missing 'code' query parameter".to_string())?;
+
+    if code.is_empty() {
+        return Err("Missing 'code' query parameter".to_string());
+    }
+
+    Ok((state, code))
+}
+
+async fn read_http_target(stream: &mut TcpStream) -> CommandResult<String> {
+    let mut buf = vec![0_u8; MAX_REQUEST_BYTES];
+    let mut total_read = 0_usize;
+
+    loop {
+        let n = stream
+            .read(&mut buf[total_read..])
+            .await
+            .map_err(|e| format!("Failed reading callback request: {e}"))?;
+        if n == 0 {
+            break;
+        }
+        total_read += n;
+
+        if buf[..total_read].windows(4).any(|w| w == b"\r\n\r\n") {
+            break;
+        }
+
+        if total_read == MAX_REQUEST_BYTES {
+            return Err("OAuth callback request too large".to_string());
+        }
+    }
+
+    let req = String::from_utf8_lossy(&buf[..total_read]);
+    let request_line =
+        req.lines().next().ok_or_else(|| "Invalid callback request line".to_string())?;
+    let mut parts = request_line.split_whitespace();
+    let method = parts.next().unwrap_or_default();
+    let target = parts.next().unwrap_or_default();
+
+    if method != "GET" {
+        return Err(format!("Expected GET callback request, got '{method}'"));
+    }
+    if target.is_empty() {
+        return Err("Missing callback request target".to_string());
+    }
+
+    Ok(target.to_string())
+}
+
+async fn write_bad_request(stream: &mut TcpStream, message: &str) -> std::io::Result<()> {
+    let body = format!("Failed to authenticate: {message}");
+    let response = format!(
+        "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain; charset=utf-8\r\nContent-Length: {}\r\nConnection: close\r\n\r\n{}",
+        body.len(),
+        body
+    );
+    stream.write_all(response.as_bytes()).await?;
+    stream.shutdown().await
+}
+
+async fn write_redirect(stream: &mut TcpStream, location: &str) -> std::io::Result<()> {
+    let response = format!(
+        "HTTP/1.1 302 Found\r\nLocation: {location}\r\nContent-Length: 0\r\nConnection: close\r\n\r\n"
+    );
+    stream.write_all(response.as_bytes()).await?;
+    stream.shutdown().await
+}
+
+async fn exchange_access_token(oauth: &OAuthFlow, code: &str) -> CommandResult<String> {
+    let response = http::build_client(None)?
+        .post(&oauth.token_url)
+        .form(&[
+            ("grant_type", "authorization_code"),
+            ("client_id", OAUTH_CLIENT_ID),
+            ("code", code),
+            ("redirect_uri", oauth.redirect_url.as_str()),
+            ("code_verifier", oauth.code_verifier.as_str()),
+        ])
+        .send()
+        .await
+        .map_err(|e| format!("Failed to exchange OAuth code for access token: {e}"))?;
+
+    let status = response.status();
+    let body =
+        response.text().await.map_err(|e| format!("Failed to read token response body: {e}"))?;
+
+    if !status.is_success() {
+        return Err(format!(
+            "Failed to fetch access token: status={} body={}",
+            status.as_u16(),
+            body
+        ));
+    }
+
+    let parsed: Value =
+        serde_json::from_str(&body).map_err(|e| format!("Invalid token response JSON: {e}"))?;
+    let token = parsed
+        .get("access_token")
+        .and_then(Value::as_str)
+        .filter(|s| !s.is_empty())
+        .ok_or_else(|| format!("Token response missing access_token: {body}"))?;
+
+    Ok(token.to_string())
+}
+
+fn keyring_entry(environment: Environment) -> CommandResult<Entry> {
+    Entry::new(environment.keyring_service(), KEYRING_USER)
+        .map_err(|e| format!("Failed to initialize auth keyring entry: {e}"))
+}
+
+fn get_auth_token(environment: Environment) -> CommandResult<Option<String>> {
+    let entry = keyring_entry(environment)?;
+    match entry.get_password() {
+        Ok(token) => Ok(Some(token)),
+        Err(keyring::Error::NoEntry) => Ok(None),
+        Err(err) => Err(format!("Failed to read auth token: {err}")),
+    }
+}
+
+fn store_auth_token(environment: Environment, token: &str) -> CommandResult {
+    let entry = keyring_entry(environment)?;
+    entry.set_password(token).map_err(|e| format!("Failed to store auth token: {e}"))
+}
+
+fn delete_auth_token(environment: Environment) -> CommandResult {
+    let entry = keyring_entry(environment)?;
+    match entry.delete_credential() {
+        Ok(()) | Err(keyring::Error::NoEntry) => Ok(()),
+        Err(err) => Err(format!("Failed to delete auth token: {err}")),
+    }
+}
+
+fn random_hex(bytes: usize) -> String {
+    let mut data = vec![0_u8; bytes];
+    OsRng.fill_bytes(&mut data);
+    hex::encode(data)
+}
+
+fn confirm_open_browser() -> CommandResult<bool> {
+    if !io::stdin().is_terminal() {
+        return Ok(true);
+    }
+
+    loop {
+        print!("Open default browser? [Y/n]: ");
+        io::stdout().flush().map_err(|e| format!("Failed to flush stdout: {e}"))?;
+
+        let mut input = String::new();
+        io::stdin().read_line(&mut input).map_err(|e| format!("Failed to read input: {e}"))?;
+
+        match input.trim().to_ascii_lowercase().as_str() {
+            "" | "y" | "yes" => return Ok(true),
+            "n" | "no" => return Ok(false),
+            _ => ui::warning("Please answer y or n"),
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn environment_mapping() {
+        assert_eq!(parse_environment(Some("staging")), Environment::Staging);
+        assert_eq!(parse_environment(Some("development")), Environment::Development);
+        assert_eq!(parse_environment(Some("production")), Environment::Production);
+        assert_eq!(parse_environment(None), Environment::Production);
+    }
+
+    #[tokio::test]
+    async fn parses_callback_request() {
+        let listener = TcpListener::bind("127.0.0.1:0").await.expect("bind");
+        let addr = listener.local_addr().expect("local addr");
+
+        let server = tokio::spawn(async move {
+            let (mut stream, _) = listener.accept().await.expect("accept");
+            parse_callback_request(&mut stream).await
+        });
+
+        let mut client = TcpStream::connect(addr).await.expect("connect");
+        client
+            .write_all(
+                b"GET /oauth/callback?code=abc123&state=xyz HTTP/1.1\r\nHost: localhost\r\n\r\n",
+            )
+            .await
+            .expect("write");
+
+        let parsed = server.await.expect("join").expect("parse");
+        assert_eq!(parsed.0, "xyz");
+        assert_eq!(parsed.1, "abc123");
+    }
+
+    #[tokio::test]
+    async fn parse_callback_request_oauth_error() {
+        let listener = TcpListener::bind("127.0.0.1:0").await.expect("bind");
+        let addr = listener.local_addr().expect("local addr");
+
+        let server = tokio::spawn(async move {
+            let (mut stream, _) = listener.accept().await.expect("accept");
+            parse_callback_request(&mut stream).await
+        });
+
+        let mut client = TcpStream::connect(addr).await.expect("connect");
+        client
+            .write_all(
+                b"GET /oauth/callback?error=access_denied&error_description=User%20denied&state=xyz HTTP/1.1\r\nHost: localhost\r\n\r\n",
+            )
+            .await
+            .expect("write");
+
+        let err = server.await.expect("join").expect_err("should fail");
+        assert!(err.contains("OAuth provider returned error: access_denied"));
+        assert!(err.contains("User denied"));
+    }
+
+    #[tokio::test]
+    async fn receive_oauth_code_fails_fast_on_provider_error() {
+        let listener = TcpListener::bind("127.0.0.1:0").await.expect("bind");
+        let addr = listener.local_addr().expect("local addr");
+
+        let server = tokio::spawn(async move {
+            receive_oauth_code(listener, "expected-state", "http://localhost:9444").await
+        });
+
+        let mut client = TcpStream::connect(addr).await.expect("connect");
+        client
+            .write_all(
+                b"GET /oauth/callback?error=access_denied&state=expected-state HTTP/1.1\r\nHost: localhost\r\n\r\n",
+            )
+            .await
+            .expect("write");
+
+        let result = tokio::time::timeout(std::time::Duration::from_secs(2), server)
+            .await
+            .expect("should not timeout")
+            .expect("join");
+        let err = result.expect_err("should return oauth error");
+        assert!(err.contains("OAuth provider returned error: access_denied"));
+    }
+
+    #[test]
+    fn builds_oauth_flow_with_pkce() {
+        let flow = build_oauth_flow(Environment::Development, 8080).expect("flow");
+        assert!(flow.auth_url.as_str().contains("code_challenge_method=S256"));
+        assert!(
+            flow.auth_url
+                .as_str()
+                .contains("redirect_uri=http%3A%2F%2F127.0.0.1%3A8080%2Foauth%2Fcallback")
+        );
+        assert_eq!(flow.redirect_url, "http://127.0.0.1:8080/oauth/callback");
+        assert_eq!(flow.token_url, "http://localhost:9444/login/oauth/access_token");
+    }
+}

crates-cli/yaak-cli/src/commands/environment.rs

@@ -2,9 +2,11 @@ use crate::cli::{EnvironmentArgs, EnvironmentCommands};
 use crate::context::CliContext;
 use crate::utils::confirm::confirm_delete;
 use crate::utils::json::{
-    apply_merge_patch, is_json_shorthand, parse_optional_json, parse_required_json, require_id,
-    validate_create_id,
+    apply_merge_patch, is_json_shorthand, merge_workspace_id_arg, parse_optional_json,
+    parse_required_json, require_id, validate_create_id,
 };
+use crate::utils::schema::append_agent_hints;
+use schemars::schema_for;
 use yaak_models::models::Environment;
 use yaak_models::util::UpdateSource;
 
@@ -13,6 +15,7 @@ type CommandResult<T = ()> = std::result::Result<T, String>;
 pub fn run(ctx: &CliContext, args: EnvironmentArgs) -> i32 {
     let result = match args.command {
         EnvironmentCommands::List { workspace_id } => list(ctx, &workspace_id),
+        EnvironmentCommands::Schema { pretty } => schema(pretty),
         EnvironmentCommands::Show { environment_id } => show(ctx, &environment_id),
         EnvironmentCommands::Create { workspace_id, name, json } => {
             create(ctx, workspace_id, name, json)
@@ -30,6 +33,18 @@ pub fn run(ctx: &CliContext, args: EnvironmentArgs) -> i32 {
     }
 }
 
+fn schema(pretty: bool) -> CommandResult {
+    let mut schema = serde_json::to_value(schema_for!(Environment))
+        .map_err(|e| format!("Failed to serialize environment schema: {e}"))?;
+    append_agent_hints(&mut schema);
+
+    let output =
+        if pretty { serde_json::to_string_pretty(&schema) } else { serde_json::to_string(&schema) }
+            .map_err(|e| format!("Failed to format environment schema JSON: {e}"))?;
+    println!("{output}");
+    Ok(())
+}
+
 fn list(ctx: &CliContext, workspace_id: &str) -> CommandResult {
     let environments = ctx
         .db()
@@ -51,8 +66,8 @@ fn show(ctx: &CliContext, environment_id: &str) -> CommandResult {
         .db()
         .get_environment(environment_id)
         .map_err(|e| format!("Failed to get environment: {e}"))?;
-    let output =
-        serde_json::to_string_pretty(&environment).map_err(|e| format!("Failed to serialize environment: {e}"))?;
+    let output = serde_json::to_string_pretty(&environment)
+        .map_err(|e| format!("Failed to serialize environment: {e}"))?;
     println!("{output}");
     Ok(())
 }
@@ -63,17 +78,11 @@ fn create(
     name: Option<String>,
     json: Option<String>,
 ) -> CommandResult {
-    if json.is_some() && workspace_id.as_deref().is_some_and(|v| !is_json_shorthand(v)) {
-        return Err(
-            "environment create cannot combine workspace_id with --json payload".to_string()
-        );
-    }
+    let json_shorthand =
+        workspace_id.as_deref().filter(|v| is_json_shorthand(v)).map(str::to_owned);
+    let workspace_id_arg = workspace_id.filter(|v| !is_json_shorthand(v));
 
-    let payload = parse_optional_json(
-        json,
-        workspace_id.clone().filter(|v| is_json_shorthand(v)),
-        "environment create",
-    )?;
+    let payload = parse_optional_json(json, json_shorthand, "environment create")?;
 
     if let Some(payload) = payload {
         if name.is_some() {
@@ -81,13 +90,13 @@ fn create(
         }
 
         validate_create_id(&payload, "environment")?;
-        let mut environment: Environment =
-            serde_json::from_value(payload)
-                .map_err(|e| format!("Failed to parse environment create JSON: {e}"))?;
-
-        if environment.workspace_id.is_empty() {
-            return Err("environment create JSON requires non-empty \"workspaceId\"".to_string());
-        }
+        let mut environment: Environment = serde_json::from_value(payload)
+            .map_err(|e| format!("Failed to parse environment create JSON: {e}"))?;
+        merge_workspace_id_arg(
+            workspace_id_arg.as_deref(),
+            &mut environment.workspace_id,
+            "environment create",
+        )?;
 
         if environment.parent_model.is_empty() {
             environment.parent_model = "environment".to_string();
@@ -102,11 +111,12 @@ fn create(
         return Ok(());
     }
 
-    let workspace_id = workspace_id.ok_or_else(|| {
+    let workspace_id = workspace_id_arg.ok_or_else(|| {
         "environment create requires workspace_id unless JSON payload is provided".to_string()
     })?;
-    let name = name
-        .ok_or_else(|| "environment create requires --name unless JSON payload is provided".to_string())?;
+    let name = name.ok_or_else(|| {
+        "environment create requires --name unless JSON payload is provided".to_string()
+    })?;
 
     let environment = Environment {
         workspace_id,

crates-cli/yaak-cli/src/commands/folder.rs

@@ -2,8 +2,8 @@ use crate::cli::{FolderArgs, FolderCommands};
 use crate::context::CliContext;
 use crate::utils::confirm::confirm_delete;
 use crate::utils::json::{
-    apply_merge_patch, is_json_shorthand, parse_optional_json, parse_required_json, require_id,
-    validate_create_id,
+    apply_merge_patch, is_json_shorthand, merge_workspace_id_arg, parse_optional_json,
+    parse_required_json, require_id, validate_create_id,
 };
 use yaak_models::models::Folder;
 use yaak_models::util::UpdateSource;
@@ -31,7 +31,8 @@ pub fn run(ctx: &CliContext, args: FolderArgs) -> i32 {
 }
 
 fn list(ctx: &CliContext, workspace_id: &str) -> CommandResult {
-    let folders = ctx.db().list_folders(workspace_id).map_err(|e| format!("Failed to list folders: {e}"))?;
+    let folders =
+        ctx.db().list_folders(workspace_id).map_err(|e| format!("Failed to list folders: {e}"))?;
     if folders.is_empty() {
         println!("No folders found in workspace {}", workspace_id);
     } else {
@@ -43,9 +44,10 @@ fn list(ctx: &CliContext, workspace_id: &str) -> CommandResult {
 }
 
 fn show(ctx: &CliContext, folder_id: &str) -> CommandResult {
-    let folder = ctx.db().get_folder(folder_id).map_err(|e| format!("Failed to get folder: {e}"))?;
-    let output =
-        serde_json::to_string_pretty(&folder).map_err(|e| format!("Failed to serialize folder: {e}"))?;
+    let folder =
+        ctx.db().get_folder(folder_id).map_err(|e| format!("Failed to get folder: {e}"))?;
+    let output = serde_json::to_string_pretty(&folder)
+        .map_err(|e| format!("Failed to serialize folder: {e}"))?;
     println!("{output}");
     Ok(())
 }
@@ -56,15 +58,11 @@ fn create(
     name: Option<String>,
     json: Option<String>,
 ) -> CommandResult {
-    if json.is_some() && workspace_id.as_deref().is_some_and(|v| !is_json_shorthand(v)) {
-        return Err("folder create cannot combine workspace_id with --json payload".to_string());
-    }
+    let json_shorthand =
+        workspace_id.as_deref().filter(|v| is_json_shorthand(v)).map(str::to_owned);
+    let workspace_id_arg = workspace_id.filter(|v| !is_json_shorthand(v));
 
-    let payload = parse_optional_json(
-        json,
-        workspace_id.clone().filter(|v| is_json_shorthand(v)),
-        "folder create",
-    )?;
+    let payload = parse_optional_json(json, json_shorthand, "folder create")?;
 
     if let Some(payload) = payload {
         if name.is_some() {
@@ -72,12 +70,13 @@ fn create(
         }
 
         validate_create_id(&payload, "folder")?;
-        let folder: Folder =
-            serde_json::from_value(payload).map_err(|e| format!("Failed to parse folder create JSON: {e}"))?;
-
-        if folder.workspace_id.is_empty() {
-            return Err("folder create JSON requires non-empty \"workspaceId\"".to_string());
-        }
+        let mut folder: Folder = serde_json::from_value(payload)
+            .map_err(|e| format!("Failed to parse folder create JSON: {e}"))?;
+        merge_workspace_id_arg(
+            workspace_id_arg.as_deref(),
+            &mut folder.workspace_id,
+            "folder create",
+        )?;
 
         let created = ctx
             .db()
@@ -88,10 +87,12 @@ fn create(
         return Ok(());
     }
 
-    let workspace_id = workspace_id
-        .ok_or_else(|| "folder create requires workspace_id unless JSON payload is provided".to_string())?;
-    let name =
-        name.ok_or_else(|| "folder create requires --name unless JSON payload is provided".to_string())?;
+    let workspace_id = workspace_id_arg.ok_or_else(|| {
+        "folder create requires workspace_id unless JSON payload is provided".to_string()
+    })?;
+    let name = name.ok_or_else(|| {
+        "folder create requires --name unless JSON payload is provided".to_string()
+    })?;
 
     let folder = Folder { workspace_id, name, ..Default::default() };
 
@@ -108,10 +109,8 @@ fn update(ctx: &CliContext, json: Option<String>, json_input: Option<String>) ->
     let patch = parse_required_json(json, json_input, "folder update")?;
     let id = require_id(&patch, "folder update")?;
 
-    let existing = ctx
-        .db()
-        .get_folder(&id)
-        .map_err(|e| format!("Failed to get folder for update: {e}"))?;
+    let existing =
+        ctx.db().get_folder(&id).map_err(|e| format!("Failed to get folder for update: {e}"))?;
     let updated = apply_merge_patch(&existing, &patch, &id, "folder update")?;
 
     let saved = ctx

crates-cli/yaak-cli/src/commands/mod.rs

@@ -1,5 +1,7 @@
+pub mod auth;
 pub mod environment;
 pub mod folder;
+pub mod plugin;
 pub mod request;
 pub mod send;
 pub mod workspace;

crates-cli/yaak-cli/src/commands/plugin.rs

@@ -0,0 +1,566 @@
+use crate::cli::{GenerateArgs, PluginArgs, PluginCommands, PluginPathArg};
+use crate::ui;
+use crate::utils::http;
+use keyring::Entry;
+use rand::Rng;
+use rolldown::{
+    BundleEvent, Bundler, BundlerOptions, ExperimentalOptions, InputItem, LogLevel, OutputFormat,
+    Platform, WatchOption, Watcher, WatcherEvent,
+};
+use serde::Deserialize;
+use std::collections::HashSet;
+use std::fs;
+use std::io::{self, IsTerminal, Read, Write};
+use std::path::{Path, PathBuf};
+use std::sync::Arc;
+use tokio::sync::Mutex;
+use walkdir::WalkDir;
+use zip::CompressionMethod;
+use zip::write::SimpleFileOptions;
+
+type CommandResult<T = ()> = std::result::Result<T, String>;
+
+const KEYRING_USER: &str = "yaak";
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+enum Environment {
+    Production,
+    Staging,
+    Development,
+}
+
+impl Environment {
+    fn api_base_url(self) -> &'static str {
+        match self {
+            Environment::Production => "https://api.yaak.app",
+            Environment::Staging => "https://todo.yaak.app",
+            Environment::Development => "http://localhost:9444",
+        }
+    }
+
+    fn keyring_service(self) -> &'static str {
+        match self {
+            Environment::Production => "app.yaak.cli.Token",
+            Environment::Staging => "app.yaak.cli.staging.Token",
+            Environment::Development => "app.yaak.cli.dev.Token",
+        }
+    }
+}
+
+pub async fn run_build(args: PluginPathArg) -> i32 {
+    match build(args).await {
+        Ok(()) => 0,
+        Err(error) => {
+            ui::error(&error);
+            1
+        }
+    }
+}
+
+pub async fn run(args: PluginArgs) -> i32 {
+    match args.command {
+        PluginCommands::Build(args) => run_build(args).await,
+        PluginCommands::Dev(args) => run_dev(args).await,
+        PluginCommands::Generate(args) => run_generate(args).await,
+        PluginCommands::Publish(args) => run_publish(args).await,
+    }
+}
+
+pub async fn run_dev(args: PluginPathArg) -> i32 {
+    match dev(args).await {
+        Ok(()) => 0,
+        Err(error) => {
+            ui::error(&error);
+            1
+        }
+    }
+}
+
+pub async fn run_generate(args: GenerateArgs) -> i32 {
+    match generate(args) {
+        Ok(()) => 0,
+        Err(error) => {
+            ui::error(&error);
+            1
+        }
+    }
+}
+
+pub async fn run_publish(args: PluginPathArg) -> i32 {
+    match publish(args).await {
+        Ok(()) => 0,
+        Err(error) => {
+            ui::error(&error);
+            1
+        }
+    }
+}
+
+async fn build(args: PluginPathArg) -> CommandResult {
+    let plugin_dir = resolve_plugin_dir(args.path)?;
+    ensure_plugin_build_inputs(&plugin_dir)?;
+
+    ui::info(&format!("Building plugin {}...", plugin_dir.display()));
+    let warnings = build_plugin_bundle(&plugin_dir).await?;
+    for warning in warnings {
+        ui::warning(&warning);
+    }
+    ui::success(&format!("Built plugin bundle at {}", plugin_dir.join("build/index.js").display()));
+    Ok(())
+}
+
+async fn dev(args: PluginPathArg) -> CommandResult {
+    let plugin_dir = resolve_plugin_dir(args.path)?;
+    ensure_plugin_build_inputs(&plugin_dir)?;
+
+    ui::info(&format!("Watching plugin {}...", plugin_dir.display()));
+
+    let bundler = Bundler::new(bundler_options(&plugin_dir, true))
+        .map_err(|err| format!("Failed to initialize Rolldown watcher: {err}"))?;
+    let watcher = Watcher::new(vec![Arc::new(Mutex::new(bundler))], None)
+        .map_err(|err| format!("Failed to start Rolldown watcher: {err}"))?;
+    let emitter = watcher.emitter();
+    let watch_root = plugin_dir.clone();
+    let _event_logger = tokio::spawn(async move {
+        loop {
+            let event = {
+                let rx = emitter.rx.lock().await;
+                rx.recv()
+            };
+
+            let Ok(event) = event else {
+                break;
+            };
+
+            match event {
+                WatcherEvent::Change(change) => {
+                    let changed_path = Path::new(change.path.as_str());
+                    let display_path = changed_path
+                        .strip_prefix(&watch_root)
+                        .map(|p| p.display().to_string())
+                        .unwrap_or_else(|_| {
+                            changed_path
+                                .file_name()
+                                .map(|name| name.to_string_lossy().into_owned())
+                                .unwrap_or_else(|| "unknown".to_string())
+                        });
+                    ui::info(&format!("Rebuilding plugin {display_path}"));
+                }
+                WatcherEvent::Event(BundleEvent::BundleEnd(_)) => {}
+                WatcherEvent::Event(BundleEvent::Error(event)) => {
+                    if event.error.diagnostics.is_empty() {
+                        ui::error("Plugin build failed");
+                    } else {
+                        for diagnostic in event.error.diagnostics {
+                            ui::error(&diagnostic.to_string());
+                        }
+                    }
+                }
+                WatcherEvent::Close => break,
+                _ => {}
+            }
+        }
+    });
+
+    watcher.start().await;
+    Ok(())
+}
+
+fn generate(args: GenerateArgs) -> CommandResult {
+    let default_name = random_name();
+    let name = match args.name {
+        Some(name) => name,
+        None => prompt_with_default("Plugin name", &default_name)?,
+    };
+
+    let default_dir = format!("./{name}");
+    let output_dir = match args.dir {
+        Some(dir) => dir,
+        None => PathBuf::from(prompt_with_default("Plugin dir", &default_dir)?),
+    };
+
+    if output_dir.exists() {
+        return Err(format!("Plugin directory already exists: {}", output_dir.display()));
+    }
+
+    ui::info(&format!("Generating plugin in {}", output_dir.display()));
+    fs::create_dir_all(output_dir.join("src"))
+        .map_err(|e| format!("Failed creating plugin directory {}: {e}", output_dir.display()))?;
+
+    write_file(&output_dir.join(".gitignore"), TEMPLATE_GITIGNORE)?;
+    write_file(
+        &output_dir.join("package.json"),
+        &TEMPLATE_PACKAGE_JSON.replace("yaak-plugin-name", &name),
+    )?;
+    write_file(&output_dir.join("tsconfig.json"), TEMPLATE_TSCONFIG)?;
+    write_file(&output_dir.join("README.md"), &TEMPLATE_README.replace("yaak-plugin-name", &name))?;
+    write_file(
+        &output_dir.join("src/index.ts"),
+        &TEMPLATE_INDEX_TS.replace("yaak-plugin-name", &name),
+    )?;
+    write_file(&output_dir.join("src/index.test.ts"), TEMPLATE_INDEX_TEST_TS)?;
+
+    ui::success("Plugin scaffold generated");
+    ui::info("Next steps:");
+    println!("  1. cd {}", output_dir.display());
+    println!("  2. npm install");
+    println!("  3. yaak plugin build");
+    Ok(())
+}
+
+async fn publish(args: PluginPathArg) -> CommandResult {
+    let plugin_dir = resolve_plugin_dir(args.path)?;
+    ensure_plugin_build_inputs(&plugin_dir)?;
+
+    let environment = current_environment();
+    let token = get_auth_token(environment)?
+        .ok_or_else(|| "Not logged in. Run `yaak auth login`.".to_string())?;
+
+    ui::info(&format!("Building plugin {}...", plugin_dir.display()));
+    let warnings = build_plugin_bundle(&plugin_dir).await?;
+    for warning in warnings {
+        ui::warning(&warning);
+    }
+
+    ui::info("Archiving plugin");
+    let archive = create_publish_archive(&plugin_dir)?;
+
+    ui::info("Uploading plugin");
+    let url = format!("{}/api/v1/plugins/publish", environment.api_base_url());
+    let response = http::build_client(Some(&token))?
+        .post(url)
+        .header(reqwest::header::CONTENT_TYPE, "application/zip")
+        .body(archive)
+        .send()
+        .await
+        .map_err(|e| format!("Failed to upload plugin: {e}"))?;
+
+    let status = response.status();
+    let body =
+        response.text().await.map_err(|e| format!("Failed reading publish response body: {e}"))?;
+
+    if !status.is_success() {
+        return Err(http::parse_api_error(status.as_u16(), &body));
+    }
+
+    let published: PublishResponse = serde_json::from_str(&body)
+        .map_err(|e| format!("Failed parsing publish response JSON: {e}\nResponse: {body}"))?;
+    ui::success(&format!("Plugin published {}", published.version));
+    println!(" -> {}", published.url);
+    Ok(())
+}
+
+#[derive(Deserialize)]
+struct PublishResponse {
+    version: String,
+    url: String,
+}
+
+async fn build_plugin_bundle(plugin_dir: &Path) -> CommandResult<Vec<String>> {
+    prepare_build_output_dir(plugin_dir)?;
+    let mut bundler = Bundler::new(bundler_options(plugin_dir, false))
+        .map_err(|err| format!("Failed to initialize Rolldown: {err}"))?;
+    let output = bundler.write().await.map_err(|err| format!("Plugin build failed:\n{err}"))?;
+
+    Ok(output.warnings.into_iter().map(|w| w.to_string()).collect())
+}
+
+fn prepare_build_output_dir(plugin_dir: &Path) -> CommandResult {
+    let build_dir = plugin_dir.join("build");
+    if build_dir.exists() {
+        fs::remove_dir_all(&build_dir)
+            .map_err(|e| format!("Failed to clean build directory {}: {e}", build_dir.display()))?;
+    }
+    fs::create_dir_all(&build_dir)
+        .map_err(|e| format!("Failed to create build directory {}: {e}", build_dir.display()))
+}
+
+fn bundler_options(plugin_dir: &Path, watch: bool) -> BundlerOptions {
+    BundlerOptions {
+        input: Some(vec![InputItem { import: "./src/index.ts".to_string(), ..Default::default() }]),
+        cwd: Some(plugin_dir.to_path_buf()),
+        file: Some("build/index.js".to_string()),
+        format: Some(OutputFormat::Cjs),
+        platform: Some(Platform::Node),
+        log_level: Some(LogLevel::Info),
+        experimental: watch
+            .then_some(ExperimentalOptions { incremental_build: Some(true), ..Default::default() }),
+        watch: watch.then_some(WatchOption::default()),
+        ..Default::default()
+    }
+}
+
+fn resolve_plugin_dir(path: Option<PathBuf>) -> CommandResult<PathBuf> {
+    let cwd =
+        std::env::current_dir().map_err(|e| format!("Failed to read current directory: {e}"))?;
+    let candidate = match path {
+        Some(path) if path.is_absolute() => path,
+        Some(path) => cwd.join(path),
+        None => cwd,
+    };
+
+    if !candidate.exists() {
+        return Err(format!("Plugin directory does not exist: {}", candidate.display()));
+    }
+    if !candidate.is_dir() {
+        return Err(format!("Plugin path is not a directory: {}", candidate.display()));
+    }
+
+    candidate
+        .canonicalize()
+        .map_err(|e| format!("Failed to resolve plugin directory {}: {e}", candidate.display()))
+}
+
+fn ensure_plugin_build_inputs(plugin_dir: &Path) -> CommandResult {
+    let package_json = plugin_dir.join("package.json");
+    if !package_json.is_file() {
+        return Err(format!(
+            "{} does not exist. Ensure that you are in a plugin directory.",
+            package_json.display()
+        ));
+    }
+
+    let entry = plugin_dir.join("src/index.ts");
+    if !entry.is_file() {
+        return Err(format!("Required entrypoint missing: {}", entry.display()));
+    }
+
+    Ok(())
+}
+
+fn create_publish_archive(plugin_dir: &Path) -> CommandResult<Vec<u8>> {
+    let required_files = [
+        "README.md",
+        "package.json",
+        "build/index.js",
+        "src/index.ts",
+    ];
+    let optional_files = ["package-lock.json"];
+
+    let mut selected = HashSet::new();
+    for required in required_files {
+        let required_path = plugin_dir.join(required);
+        if !required_path.is_file() {
+            return Err(format!("Missing required file: {required}"));
+        }
+        selected.insert(required.to_string());
+    }
+    for optional in optional_files {
+        selected.insert(optional.to_string());
+    }
+
+    let cursor = std::io::Cursor::new(Vec::new());
+    let mut zip = zip::ZipWriter::new(cursor);
+    let options = SimpleFileOptions::default().compression_method(CompressionMethod::Deflated);
+
+    for entry in WalkDir::new(plugin_dir) {
+        let entry = entry.map_err(|e| format!("Failed walking plugin directory: {e}"))?;
+        if !entry.file_type().is_file() {
+            continue;
+        }
+
+        let path = entry.path();
+        let rel = path
+            .strip_prefix(plugin_dir)
+            .map_err(|e| format!("Failed deriving relative path for {}: {e}", path.display()))?;
+        let rel = rel.to_string_lossy().replace('\\', "/");
+
+        let keep = rel.starts_with("src/") || rel.starts_with("build/") || selected.contains(&rel);
+        if !keep {
+            continue;
+        }
+
+        zip.start_file(rel, options).map_err(|e| format!("Failed adding file to archive: {e}"))?;
+        let mut file = fs::File::open(path)
+            .map_err(|e| format!("Failed opening file {}: {e}", path.display()))?;
+        let mut contents = Vec::new();
+        file.read_to_end(&mut contents)
+            .map_err(|e| format!("Failed reading file {}: {e}", path.display()))?;
+        zip.write_all(&contents).map_err(|e| format!("Failed writing archive contents: {e}"))?;
+    }
+
+    let cursor = zip.finish().map_err(|e| format!("Failed finalizing plugin archive: {e}"))?;
+    Ok(cursor.into_inner())
+}
+
+fn write_file(path: &Path, contents: &str) -> CommandResult {
+    if let Some(parent) = path.parent() {
+        fs::create_dir_all(parent)
+            .map_err(|e| format!("Failed creating directory {}: {e}", parent.display()))?;
+    }
+    fs::write(path, contents).map_err(|e| format!("Failed writing file {}: {e}", path.display()))
+}
+
+fn prompt_with_default(label: &str, default: &str) -> CommandResult<String> {
+    if !io::stdin().is_terminal() {
+        return Ok(default.to_string());
+    }
+
+    print!("{label} [{default}]: ");
+    io::stdout().flush().map_err(|e| format!("Failed to flush stdout: {e}"))?;
+
+    let mut input = String::new();
+    io::stdin().read_line(&mut input).map_err(|e| format!("Failed to read input: {e}"))?;
+    let trimmed = input.trim();
+
+    if trimmed.is_empty() { Ok(default.to_string()) } else { Ok(trimmed.to_string()) }
+}
+
+fn current_environment() -> Environment {
+    match std::env::var("ENVIRONMENT").as_deref() {
+        Ok("staging") => Environment::Staging,
+        Ok("development") => Environment::Development,
+        _ => Environment::Production,
+    }
+}
+
+fn keyring_entry(environment: Environment) -> CommandResult<Entry> {
+    Entry::new(environment.keyring_service(), KEYRING_USER)
+        .map_err(|e| format!("Failed to initialize auth keyring entry: {e}"))
+}
+
+fn get_auth_token(environment: Environment) -> CommandResult<Option<String>> {
+    let entry = keyring_entry(environment)?;
+    match entry.get_password() {
+        Ok(token) => Ok(Some(token)),
+        Err(keyring::Error::NoEntry) => Ok(None),
+        Err(err) => Err(format!("Failed to read auth token: {err}")),
+    }
+}
+
+fn random_name() -> String {
+    const ADJECTIVES: &[&str] = &[
+        "young", "youthful", "yellow", "yielding", "yappy", "yawning", "yummy", "yucky", "yearly",
+        "yester", "yeasty", "yelling",
+    ];
+    const NOUNS: &[&str] = &[
+        "yak", "yarn", "year", "yell", "yoke", "yoga", "yam", "yacht", "yodel",
+    ];
+
+    let mut rng = rand::thread_rng();
+    let adjective = ADJECTIVES[rng.gen_range(0..ADJECTIVES.len())];
+    let noun = NOUNS[rng.gen_range(0..NOUNS.len())];
+    format!("{adjective}-{noun}")
+}
+
+const TEMPLATE_GITIGNORE: &str = "node_modules\n";
+
+const TEMPLATE_PACKAGE_JSON: &str = r#"{
+  "name": "yaak-plugin-name",
+  "private": true,
+  "version": "0.0.1",
+  "scripts": {
+    "build": "yaak plugin build",
+    "dev": "yaak plugin dev"
+  },
+  "devDependencies": {
+    "@types/node": "^24.10.1",
+    "typescript": "^5.9.3",
+    "vitest": "^4.0.14"
+  },
+  "dependencies": {
+    "@yaakapp/api": "^0.7.0"
+  }
+}
+"#;
+
+const TEMPLATE_TSCONFIG: &str = r#"{
+  "compilerOptions": {
+    "target": "es2021",
+    "lib": ["DOM", "DOM.Iterable", "ESNext"],
+    "useDefineForClassFields": true,
+    "allowJs": false,
+    "skipLibCheck": true,
+    "esModuleInterop": false,
+    "allowSyntheticDefaultImports": true,
+    "strict": true,
+    "noUncheckedIndexedAccess": true,
+    "forceConsistentCasingInFileNames": true,
+    "module": "ESNext",
+    "moduleResolution": "Node",
+    "resolveJsonModule": true,
+    "isolatedModules": true,
+    "noEmit": true,
+    "jsx": "react-jsx"
+  },
+  "include": ["src"]
+}
+"#;
+
+const TEMPLATE_README: &str = r#"# yaak-plugin-name
+
+Describe what your plugin does.
+"#;
+
+const TEMPLATE_INDEX_TS: &str = r#"import type { PluginDefinition } from "@yaakapp/api";
+
+export const plugin: PluginDefinition = {
+  httpRequestActions: [
+    {
+      label: "Hello, From Plugin",
+      icon: "info",
+      async onSelect(ctx, args) {
+        await ctx.toast.show({
+          color: "success",
+          message: `You clicked the request ${args.httpRequest.id}`,
+        });
+      },
+    },
+  ],
+};
+"#;
+
+const TEMPLATE_INDEX_TEST_TS: &str = r#"import { describe, expect, test } from "vitest";
+import { plugin } from "./index";
+
+describe("Example Plugin", () => {
+  test("Exports plugin object", () => {
+    expect(plugin).toBeTypeOf("object");
+  });
+});
+"#;
+
+#[cfg(test)]
+mod tests {
+    use super::create_publish_archive;
+    use std::collections::HashSet;
+    use std::fs;
+    use std::io::Cursor;
+    use tempfile::TempDir;
+    use zip::ZipArchive;
+
+    #[test]
+    fn publish_archive_includes_required_and_optional_files() {
+        let dir = TempDir::new().expect("temp dir");
+        let root = dir.path();
+
+        fs::create_dir_all(root.join("src")).expect("create src");
+        fs::create_dir_all(root.join("build")).expect("create build");
+        fs::create_dir_all(root.join("ignored")).expect("create ignored");
+
+        fs::write(root.join("README.md"), "# Demo\n").expect("write README");
+        fs::write(root.join("package.json"), "{}").expect("write package.json");
+        fs::write(root.join("package-lock.json"), "{}").expect("write package-lock.json");
+        fs::write(root.join("src/index.ts"), "export const plugin = {};\n")
+            .expect("write src/index.ts");
+        fs::write(root.join("build/index.js"), "exports.plugin = {};\n")
+            .expect("write build/index.js");
+        fs::write(root.join("ignored/secret.txt"), "do-not-ship").expect("write ignored file");
+
+        let archive = create_publish_archive(root).expect("create archive");
+        let mut zip = ZipArchive::new(Cursor::new(archive)).expect("open zip");
+
+        let mut names = HashSet::new();
+        for i in 0..zip.len() {
+            let file = zip.by_index(i).expect("zip entry");
+            names.insert(file.name().to_string());
+        }
+
+        assert!(names.contains("README.md"));
+        assert!(names.contains("package.json"));
+        assert!(names.contains("package-lock.json"));
+        assert!(names.contains("src/index.ts"));
+        assert!(names.contains("build/index.js"));
+        assert!(!names.contains("ignored/secret.txt"));
+    }
+}

crates-cli/yaak-cli/src/commands/request.rs

@@ -1,15 +1,22 @@
-use crate::cli::{RequestArgs, RequestCommands};
+use crate::cli::{RequestArgs, RequestCommands, RequestSchemaType};
 use crate::context::CliContext;
 use crate::utils::confirm::confirm_delete;
 use crate::utils::json::{
-    apply_merge_patch, is_json_shorthand, parse_optional_json, parse_required_json, require_id,
-    validate_create_id,
+    apply_merge_patch, is_json_shorthand, merge_workspace_id_arg, parse_optional_json,
+    parse_required_json, require_id, validate_create_id,
 };
+use crate::utils::schema::append_agent_hints;
+use schemars::schema_for;
+use serde_json::{Map, Value, json};
+use std::collections::HashMap;
+use std::io::Write;
 use tokio::sync::mpsc;
 use yaak::send::{SendHttpRequestByIdWithPluginsParams, send_http_request_by_id_with_plugins};
-use yaak_models::models::HttpRequest;
+use yaak_http::sender::HttpResponseEvent as SenderHttpResponseEvent;
+use yaak_models::models::{GrpcRequest, HttpRequest, WebsocketRequest};
+use yaak_models::queries::any_request::AnyRequest;
 use yaak_models::util::UpdateSource;
-use yaak_plugins::events::PluginContext;
+use yaak_plugins::events::{FormInput, FormInputBase, JsonPrimitive, PluginContext};
 
 type CommandResult<T = ()> = std::result::Result<T, String>;
 
@@ -31,6 +38,15 @@ pub async fn run(
                 }
             };
         }
+        RequestCommands::Schema { request_type, pretty } => {
+            return match schema(ctx, request_type, pretty).await {
+                Ok(()) => 0,
+                Err(error) => {
+                    eprintln!("Error: {error}");
+                    1
+                }
+            };
+        }
         RequestCommands::Create { workspace_id, name, method, url, json } => {
             create(ctx, workspace_id, name, method, url, json)
         }
@@ -62,6 +78,256 @@ fn list(ctx: &CliContext, workspace_id: &str) -> CommandResult {
     Ok(())
 }
 
+async fn schema(ctx: &CliContext, request_type: RequestSchemaType, pretty: bool) -> CommandResult {
+    let mut schema = match request_type {
+        RequestSchemaType::Http => serde_json::to_value(schema_for!(HttpRequest))
+            .map_err(|e| format!("Failed to serialize HTTP request schema: {e}"))?,
+        RequestSchemaType::Grpc => serde_json::to_value(schema_for!(GrpcRequest))
+            .map_err(|e| format!("Failed to serialize gRPC request schema: {e}"))?,
+        RequestSchemaType::Websocket => serde_json::to_value(schema_for!(WebsocketRequest))
+            .map_err(|e| format!("Failed to serialize WebSocket request schema: {e}"))?,
+    };
+
+    enrich_schema_guidance(&mut schema, request_type);
+    append_agent_hints(&mut schema);
+
+    if let Err(error) = merge_auth_schema_from_plugins(ctx, &mut schema).await {
+        eprintln!("Warning: Failed to enrich authentication schema from plugins: {error}");
+    }
+
+    let output =
+        if pretty { serde_json::to_string_pretty(&schema) } else { serde_json::to_string(&schema) }
+            .map_err(|e| format!("Failed to format schema JSON: {e}"))?;
+    println!("{output}");
+    Ok(())
+}
+
+fn enrich_schema_guidance(schema: &mut Value, request_type: RequestSchemaType) {
+    if !matches!(request_type, RequestSchemaType::Http) {
+        return;
+    }
+
+    let Some(properties) = schema.get_mut("properties").and_then(Value::as_object_mut) else {
+        return;
+    };
+
+    if let Some(url_schema) = properties.get_mut("url").and_then(Value::as_object_mut) {
+        append_description(
+            url_schema,
+            "For path segments like `/foo/:id/comments/:commentId`, put concrete values in `urlParameters` using names without `:` (for example `id`, `commentId`).",
+        );
+    }
+}
+
+fn append_description(schema: &mut Map<String, Value>, extra: &str) {
+    match schema.get_mut("description") {
+        Some(Value::String(existing)) if !existing.trim().is_empty() => {
+            if !existing.ends_with(' ') {
+                existing.push(' ');
+            }
+            existing.push_str(extra);
+        }
+        _ => {
+            schema.insert("description".to_string(), Value::String(extra.to_string()));
+        }
+    }
+}
+
+async fn merge_auth_schema_from_plugins(
+    ctx: &CliContext,
+    schema: &mut Value,
+) -> Result<(), String> {
+    let plugin_context = PluginContext::new_empty();
+    let plugin_manager = ctx.plugin_manager();
+    let summaries = plugin_manager
+        .get_http_authentication_summaries(&plugin_context)
+        .await
+        .map_err(|e| e.to_string())?;
+
+    let mut auth_variants = Vec::new();
+    for (_, summary) in summaries {
+        let config = match plugin_manager
+            .get_http_authentication_config(
+                &plugin_context,
+                &summary.name,
+                HashMap::<String, JsonPrimitive>::new(),
+                "yaakcli_request_schema",
+            )
+            .await
+        {
+            Ok(config) => config,
+            Err(error) => {
+                eprintln!(
+                    "Warning: Failed to load auth config for strategy '{}': {}",
+                    summary.name, error
+                );
+                continue;
+            }
+        };
+
+        auth_variants.push(auth_variant_schema(&summary.name, &summary.label, &config.args));
+    }
+
+    let Some(properties) = schema.get_mut("properties").and_then(Value::as_object_mut) else {
+        return Ok(());
+    };
+
+    let Some(auth_schema) = properties.get_mut("authentication") else {
+        return Ok(());
+    };
+
+    if !auth_variants.is_empty() {
+        let mut one_of = vec![auth_schema.clone()];
+        one_of.extend(auth_variants);
+        *auth_schema = json!({ "oneOf": one_of });
+    }
+
+    Ok(())
+}
+
+fn auth_variant_schema(auth_name: &str, auth_label: &str, args: &[FormInput]) -> Value {
+    let mut properties = Map::new();
+    let mut required = Vec::new();
+    for input in args {
+        add_input_schema(input, &mut properties, &mut required);
+    }
+
+    let mut schema = json!({
+        "title": auth_label,
+        "description": format!("Authentication values for strategy '{}'", auth_name),
+        "type": "object",
+        "properties": properties,
+        "additionalProperties": true
+    });
+
+    if !required.is_empty() {
+        schema["required"] = json!(required);
+    }
+
+    schema
+}
+
+fn add_input_schema(
+    input: &FormInput,
+    properties: &mut Map<String, Value>,
+    required: &mut Vec<String>,
+) {
+    match input {
+        FormInput::Text(v) => add_base_schema(
+            &v.base,
+            json!({
+                "type": "string",
+                "writeOnly": v.password.unwrap_or(false),
+            }),
+            properties,
+            required,
+        ),
+        FormInput::Editor(v) => add_base_schema(
+            &v.base,
+            json!({
+                "type": "string",
+                "x-editorLanguage": v.language.clone(),
+            }),
+            properties,
+            required,
+        ),
+        FormInput::Select(v) => {
+            let options: Vec<Value> =
+                v.options.iter().map(|o| Value::String(o.value.clone())).collect();
+            add_base_schema(
+                &v.base,
+                json!({
+                    "type": "string",
+                    "enum": options,
+                }),
+                properties,
+                required,
+            );
+        }
+        FormInput::Checkbox(v) => {
+            add_base_schema(&v.base, json!({ "type": "boolean" }), properties, required);
+        }
+        FormInput::File(v) => {
+            if v.multiple.unwrap_or(false) {
+                add_base_schema(
+                    &v.base,
+                    json!({
+                        "type": "array",
+                        "items": { "type": "string" },
+                    }),
+                    properties,
+                    required,
+                );
+            } else {
+                add_base_schema(&v.base, json!({ "type": "string" }), properties, required);
+            }
+        }
+        FormInput::HttpRequest(v) => {
+            add_base_schema(&v.base, json!({ "type": "string" }), properties, required);
+        }
+        FormInput::KeyValue(v) => {
+            add_base_schema(
+                &v.base,
+                json!({
+                    "type": "object",
+                    "additionalProperties": true,
+                }),
+                properties,
+                required,
+            );
+        }
+        FormInput::Accordion(v) => {
+            if let Some(children) = &v.inputs {
+                for child in children {
+                    add_input_schema(child, properties, required);
+                }
+            }
+        }
+        FormInput::HStack(v) => {
+            if let Some(children) = &v.inputs {
+                for child in children {
+                    add_input_schema(child, properties, required);
+                }
+            }
+        }
+        FormInput::Banner(v) => {
+            if let Some(children) = &v.inputs {
+                for child in children {
+                    add_input_schema(child, properties, required);
+                }
+            }
+        }
+        FormInput::Markdown(_) => {}
+    }
+}
+
+fn add_base_schema(
+    base: &FormInputBase,
+    mut schema: Value,
+    properties: &mut Map<String, Value>,
+    required: &mut Vec<String>,
+) {
+    if base.hidden.unwrap_or(false) || base.name.trim().is_empty() {
+        return;
+    }
+
+    if let Some(description) = &base.description {
+        schema["description"] = Value::String(description.clone());
+    }
+    if let Some(label) = &base.label {
+        schema["title"] = Value::String(label.clone());
+    }
+    if let Some(default_value) = &base.default_value {
+        schema["default"] = Value::String(default_value.clone());
+    }
+
+    let name = base.name.clone();
+    properties.insert(name.clone(), schema);
+    if !base.optional.unwrap_or(false) {
+        required.push(name);
+    }
+}
+
 fn create(
     ctx: &CliContext,
     workspace_id: Option<String>,
@@ -70,15 +336,11 @@ fn create(
     url: Option<String>,
     json: Option<String>,
 ) -> CommandResult {
-    if json.is_some() && workspace_id.as_deref().is_some_and(|v| !is_json_shorthand(v)) {
-        return Err("request create cannot combine workspace_id with --json payload".to_string());
-    }
+    let json_shorthand =
+        workspace_id.as_deref().filter(|v| is_json_shorthand(v)).map(str::to_owned);
+    let workspace_id_arg = workspace_id.filter(|v| !is_json_shorthand(v));
 
-    let payload = parse_optional_json(
-        json,
-        workspace_id.clone().filter(|v| is_json_shorthand(v)),
-        "request create",
-    )?;
+    let payload = parse_optional_json(json, json_shorthand, "request create")?;
 
     if let Some(payload) = payload {
         if name.is_some() || method.is_some() || url.is_some() {
@@ -86,12 +348,13 @@ fn create(
         }
 
         validate_create_id(&payload, "request")?;
-        let request: HttpRequest = serde_json::from_value(payload)
+        let mut request: HttpRequest = serde_json::from_value(payload)
             .map_err(|e| format!("Failed to parse request create JSON: {e}"))?;
-
-        if request.workspace_id.is_empty() {
-            return Err("request create JSON requires non-empty \"workspaceId\"".to_string());
-        }
+        merge_workspace_id_arg(
+            workspace_id_arg.as_deref(),
+            &mut request.workspace_id,
+            "request create",
+        )?;
 
         let created = ctx
             .db()
@@ -102,7 +365,7 @@ fn create(
         return Ok(());
     }
 
-    let workspace_id = workspace_id.ok_or_else(|| {
+    let workspace_id = workspace_id_arg.ok_or_else(|| {
         "request create requires workspace_id unless JSON payload is provided".to_string()
     })?;
     let name = name.unwrap_or_default();
@@ -146,12 +409,10 @@ fn update(ctx: &CliContext, json: Option<String>, json_input: Option<String>) ->
 }
 
 fn show(ctx: &CliContext, request_id: &str) -> CommandResult {
-    let request = ctx
-        .db()
-        .get_http_request(request_id)
-        .map_err(|e| format!("Failed to get request: {e}"))?;
-    let output =
-        serde_json::to_string_pretty(&request).map_err(|e| format!("Failed to serialize request: {e}"))?;
+    let request =
+        ctx.db().get_http_request(request_id).map_err(|e| format!("Failed to get request: {e}"))?;
+    let output = serde_json::to_string_pretty(&request)
+        .map_err(|e| format!("Failed to serialize request: {e}"))?;
     println!("{output}");
     Ok(())
 }
@@ -178,18 +439,54 @@ pub async fn send_request_by_id(
     verbose: bool,
 ) -> Result<(), String> {
     let request =
-        ctx.db().get_http_request(request_id).map_err(|e| format!("Failed to get request: {e}"))?;
+        ctx.db().get_any_request(request_id).map_err(|e| format!("Failed to get request: {e}"))?;
+    match request {
+        AnyRequest::HttpRequest(http_request) => {
+            send_http_request_by_id(
+                ctx,
+                &http_request.id,
+                &http_request.workspace_id,
+                environment,
+                verbose,
+            )
+            .await
+        }
+        AnyRequest::GrpcRequest(_) => {
+            Err("gRPC request send is not implemented yet in yaak-cli".to_string())
+        }
+        AnyRequest::WebsocketRequest(_) => {
+            Err("WebSocket request send is not implemented yet in yaak-cli".to_string())
+        }
+    }
+}
 
-    let plugin_context = PluginContext::new(None, Some(request.workspace_id.clone()));
+async fn send_http_request_by_id(
+    ctx: &CliContext,
+    request_id: &str,
+    workspace_id: &str,
+    environment: Option<&str>,
+    verbose: bool,
+) -> Result<(), String> {
+    let plugin_context = PluginContext::new(None, Some(workspace_id.to_string()));
 
-    let (event_tx, mut event_rx) = mpsc::channel(100);
+    let (event_tx, mut event_rx) = mpsc::channel::<SenderHttpResponseEvent>(100);
+    let (body_chunk_tx, mut body_chunk_rx) = mpsc::unbounded_channel::<Vec<u8>>();
     let event_handle = tokio::spawn(async move {
         while let Some(event) = event_rx.recv().await {
-            if verbose {
+            if verbose && !matches!(event, SenderHttpResponseEvent::ChunkReceived { .. }) {
                 println!("{}", event);
             }
         }
     });
+    let body_handle = tokio::task::spawn_blocking(move || {
+        let mut stdout = std::io::stdout();
+        while let Some(chunk) = body_chunk_rx.blocking_recv() {
+            if stdout.write_all(&chunk).is_err() {
+                break;
+            }
+            let _ = stdout.flush();
+        }
+    });
     let response_dir = ctx.data_dir().join("responses");
 
     let result = send_http_request_by_id_with_plugins(SendHttpRequestByIdWithPluginsParams {
@@ -201,6 +498,7 @@ pub async fn send_request_by_id(
         cookie_jar_id: None,
         response_dir: &response_dir,
         emit_events_to: Some(event_tx),
+        emit_response_body_chunks_to: Some(body_chunk_tx),
         plugin_manager: ctx.plugin_manager(),
         encryption_manager: ctx.encryption_manager.clone(),
         plugin_context: &plugin_context,
@@ -210,24 +508,7 @@ pub async fn send_request_by_id(
     .await;
 
     let _ = event_handle.await;
-    let result = result.map_err(|e| e.to_string())?;
-
-    if verbose {
-        println!();
-    }
-    println!(
-        "HTTP {} {}",
-        result.response.status,
-        result.response.status_reason.as_deref().unwrap_or("")
-    );
-    if verbose {
-        for header in &result.response.headers {
-            println!("{}: {}", header.name, header.value);
-        }
-        println!();
-    }
-    let body = String::from_utf8(result.response_body)
-        .map_err(|e| format!("Failed to read response body: {e}"))?;
-    println!("{}", body);
+    let _ = body_handle.await;
+    result.map_err(|e| e.to_string())?;
     Ok(())
 }

crates-cli/yaak-cli/src/commands/send.rs

@@ -1,6 +1,12 @@
 use crate::cli::SendArgs;
 use crate::commands::request;
 use crate::context::CliContext;
+use futures::future::join_all;
+
+enum ExecutionMode {
+    Sequential,
+    Parallel,
+}
 
 pub async fn run(
     ctx: &CliContext,
@@ -8,7 +14,7 @@ pub async fn run(
     environment: Option<&str>,
     verbose: bool,
 ) -> i32 {
-    match request::send_request_by_id(ctx, &args.request_id, environment, verbose).await {
+    match send_target(ctx, args, environment, verbose).await {
         Ok(()) => 0,
         Err(error) => {
             eprintln!("Error: {error}");
@@ -16,3 +22,163 @@ pub async fn run(
         }
     }
 }
+
+async fn send_target(
+    ctx: &CliContext,
+    args: SendArgs,
+    environment: Option<&str>,
+    verbose: bool,
+) -> Result<(), String> {
+    let mode = if args.parallel { ExecutionMode::Parallel } else { ExecutionMode::Sequential };
+
+    if ctx.db().get_any_request(&args.id).is_ok() {
+        return request::send_request_by_id(ctx, &args.id, environment, verbose).await;
+    }
+
+    if ctx.db().get_folder(&args.id).is_ok() {
+        let request_ids = collect_folder_request_ids(ctx, &args.id)?;
+        if request_ids.is_empty() {
+            println!("No requests found in folder {}", args.id);
+            return Ok(());
+        }
+        return send_many(ctx, request_ids, mode, args.fail_fast, environment, verbose).await;
+    }
+
+    if ctx.db().get_workspace(&args.id).is_ok() {
+        let request_ids = collect_workspace_request_ids(ctx, &args.id)?;
+        if request_ids.is_empty() {
+            println!("No requests found in workspace {}", args.id);
+            return Ok(());
+        }
+        return send_many(ctx, request_ids, mode, args.fail_fast, environment, verbose).await;
+    }
+
+    Err(format!("Could not resolve ID '{}' as request, folder, or workspace", args.id))
+}
+
+fn collect_folder_request_ids(ctx: &CliContext, folder_id: &str) -> Result<Vec<String>, String> {
+    let mut ids = Vec::new();
+
+    let mut http_ids = ctx
+        .db()
+        .list_http_requests_for_folder_recursive(folder_id)
+        .map_err(|e| format!("Failed to list HTTP requests in folder: {e}"))?
+        .into_iter()
+        .map(|r| r.id)
+        .collect::<Vec<_>>();
+    ids.append(&mut http_ids);
+
+    let mut grpc_ids = ctx
+        .db()
+        .list_grpc_requests_for_folder_recursive(folder_id)
+        .map_err(|e| format!("Failed to list gRPC requests in folder: {e}"))?
+        .into_iter()
+        .map(|r| r.id)
+        .collect::<Vec<_>>();
+    ids.append(&mut grpc_ids);
+
+    let mut websocket_ids = ctx
+        .db()
+        .list_websocket_requests_for_folder_recursive(folder_id)
+        .map_err(|e| format!("Failed to list WebSocket requests in folder: {e}"))?
+        .into_iter()
+        .map(|r| r.id)
+        .collect::<Vec<_>>();
+    ids.append(&mut websocket_ids);
+
+    Ok(ids)
+}
+
+fn collect_workspace_request_ids(
+    ctx: &CliContext,
+    workspace_id: &str,
+) -> Result<Vec<String>, String> {
+    let mut ids = Vec::new();
+
+    let mut http_ids = ctx
+        .db()
+        .list_http_requests(workspace_id)
+        .map_err(|e| format!("Failed to list HTTP requests in workspace: {e}"))?
+        .into_iter()
+        .map(|r| r.id)
+        .collect::<Vec<_>>();
+    ids.append(&mut http_ids);
+
+    let mut grpc_ids = ctx
+        .db()
+        .list_grpc_requests(workspace_id)
+        .map_err(|e| format!("Failed to list gRPC requests in workspace: {e}"))?
+        .into_iter()
+        .map(|r| r.id)
+        .collect::<Vec<_>>();
+    ids.append(&mut grpc_ids);
+
+    let mut websocket_ids = ctx
+        .db()
+        .list_websocket_requests(workspace_id)
+        .map_err(|e| format!("Failed to list WebSocket requests in workspace: {e}"))?
+        .into_iter()
+        .map(|r| r.id)
+        .collect::<Vec<_>>();
+    ids.append(&mut websocket_ids);
+
+    Ok(ids)
+}
+
+async fn send_many(
+    ctx: &CliContext,
+    request_ids: Vec<String>,
+    mode: ExecutionMode,
+    fail_fast: bool,
+    environment: Option<&str>,
+    verbose: bool,
+) -> Result<(), String> {
+    let mut success_count = 0usize;
+    let mut failures: Vec<(String, String)> = Vec::new();
+
+    match mode {
+        ExecutionMode::Sequential => {
+            for request_id in request_ids {
+                match request::send_request_by_id(ctx, &request_id, environment, verbose).await {
+                    Ok(()) => success_count += 1,
+                    Err(error) => {
+                        failures.push((request_id, error));
+                        if fail_fast {
+                            break;
+                        }
+                    }
+                }
+            }
+        }
+        ExecutionMode::Parallel => {
+            let tasks = request_ids
+                .iter()
+                .map(|request_id| async move {
+                    (
+                        request_id.clone(),
+                        request::send_request_by_id(ctx, request_id, environment, verbose).await,
+                    )
+                })
+                .collect::<Vec<_>>();
+
+            for (request_id, result) in join_all(tasks).await {
+                match result {
+                    Ok(()) => success_count += 1,
+                    Err(error) => failures.push((request_id, error)),
+                }
+            }
+        }
+    }
+
+    let failure_count = failures.len();
+    println!("Send summary: {success_count} succeeded, {failure_count} failed");
+
+    if failure_count == 0 {
+        return Ok(());
+    }
+
+    for (request_id, error) in failures {
+        eprintln!("  {}: {}", request_id, error);
+    }
+    Err("One or more requests failed".to_string())
+}

crates-cli/yaak-cli/src/commands/workspace.rs

@@ -4,6 +4,8 @@ use crate::utils::confirm::confirm_delete;
 use crate::utils::json::{
     apply_merge_patch, parse_optional_json, parse_required_json, require_id, validate_create_id,
 };
+use crate::utils::schema::append_agent_hints;
+use schemars::schema_for;
 use yaak_models::models::Workspace;
 use yaak_models::util::UpdateSource;
 
@@ -12,6 +14,7 @@ type CommandResult<T = ()> = std::result::Result<T, String>;
 pub fn run(ctx: &CliContext, args: WorkspaceArgs) -> i32 {
     let result = match args.command {
         WorkspaceCommands::List => list(ctx),
+        WorkspaceCommands::Schema { pretty } => schema(pretty),
         WorkspaceCommands::Show { workspace_id } => show(ctx, &workspace_id),
         WorkspaceCommands::Create { name, json, json_input } => create(ctx, name, json, json_input),
         WorkspaceCommands::Update { json, json_input } => update(ctx, json, json_input),
@@ -27,8 +30,21 @@ pub fn run(ctx: &CliContext, args: WorkspaceArgs) -> i32 {
     }
 }
 
+fn schema(pretty: bool) -> CommandResult {
+    let mut schema = serde_json::to_value(schema_for!(Workspace))
+        .map_err(|e| format!("Failed to serialize workspace schema: {e}"))?;
+    append_agent_hints(&mut schema);
+
+    let output =
+        if pretty { serde_json::to_string_pretty(&schema) } else { serde_json::to_string(&schema) }
+            .map_err(|e| format!("Failed to format workspace schema JSON: {e}"))?;
+    println!("{output}");
+    Ok(())
+}
+
 fn list(ctx: &CliContext) -> CommandResult {
-    let workspaces = ctx.db().list_workspaces().map_err(|e| format!("Failed to list workspaces: {e}"))?;
+    let workspaces =
+        ctx.db().list_workspaces().map_err(|e| format!("Failed to list workspaces: {e}"))?;
     if workspaces.is_empty() {
         println!("No workspaces found");
     } else {
@@ -75,8 +91,9 @@ fn create(
         return Ok(());
     }
 
-    let name =
-        name.ok_or_else(|| "workspace create requires --name unless JSON payload is provided".to_string())?;
+    let name = name.ok_or_else(|| {
+        "workspace create requires --name unless JSON payload is provided".to_string()
+    })?;
 
     let workspace = Workspace { name, ..Default::default() };
     let created = ctx

crates-cli/yaak-cli/src/context.rs

@@ -1,5 +1,9 @@
+use crate::plugin_events::CliPluginEventBridge;
+use include_dir::{Dir, include_dir};
+use std::fs;
 use std::path::{Path, PathBuf};
 use std::sync::Arc;
+use tokio::sync::Mutex;
 use yaak_crypto::manager::EncryptionManager;
 use yaak_models::blob_manager::BlobManager;
 use yaak_models::db_context::DbContext;
@@ -7,12 +11,20 @@ use yaak_models::query_manager::QueryManager;
 use yaak_plugins::events::PluginContext;
 use yaak_plugins::manager::PluginManager;
 
+const EMBEDDED_PLUGIN_RUNTIME: &str = include_str!(concat!(
+    env!("CARGO_MANIFEST_DIR"),
+    "/../../crates-tauri/yaak-app/vendored/plugin-runtime/index.cjs"
+));
+static EMBEDDED_VENDORED_PLUGINS: Dir<'_> =
+    include_dir!("$CARGO_MANIFEST_DIR/../../crates-tauri/yaak-app/vendored/plugins");
+
 pub struct CliContext {
     data_dir: PathBuf,
     query_manager: QueryManager,
     blob_manager: BlobManager,
     pub encryption_manager: Arc<EncryptionManager>,
     plugin_manager: Option<Arc<PluginManager>>,
+    plugin_event_bridge: Mutex<Option<CliPluginEventBridge>>,
 }
 
 impl CliContext {
@@ -30,42 +42,50 @@ impl CliContext {
             let installed_plugin_dir = data_dir.join("installed-plugins");
             let node_bin_path = PathBuf::from("node");
 
+            prepare_embedded_vendored_plugins(&vendored_plugin_dir)
+                .expect("Failed to prepare bundled plugins");
+
             let plugin_runtime_main =
                 std::env::var("YAAK_PLUGIN_RUNTIME").map(PathBuf::from).unwrap_or_else(|_| {
-                    PathBuf::from(env!("CARGO_MANIFEST_DIR"))
-                        .join("../../crates-tauri/yaak-app/vendored/plugin-runtime/index.cjs")
+                    prepare_embedded_plugin_runtime(&data_dir)
+                        .expect("Failed to prepare embedded plugin runtime")
                 });
 
-            let plugin_manager = Arc::new(
-                PluginManager::new(
-                    vendored_plugin_dir,
-                    installed_plugin_dir,
-                    node_bin_path,
-                    plugin_runtime_main,
-                    false,
-                )
-                .await,
-            );
-
-            let plugins = query_manager.connect().list_plugins().unwrap_or_default();
-            if !plugins.is_empty() {
-                let errors = plugin_manager
-                    .initialize_all_plugins(plugins, &PluginContext::new_empty())
-                    .await;
-                for (plugin_dir, error_msg) in errors {
-                    eprintln!(
-                        "Warning: Failed to initialize plugin '{}': {}",
-                        plugin_dir, error_msg
-                    );
+            match PluginManager::new(
+                vendored_plugin_dir,
+                installed_plugin_dir,
+                node_bin_path,
+                plugin_runtime_main,
+                &query_manager,
+                &PluginContext::new_empty(),
+                false,
+            )
+            .await
+            {
+                Ok(plugin_manager) => Some(Arc::new(plugin_manager)),
+                Err(err) => {
+                    eprintln!("Warning: Failed to initialize plugins: {err}");
+                    None
                 }
             }
-
-            Some(plugin_manager)
         } else {
             None
         };
 
-        Self { data_dir, query_manager, blob_manager, encryption_manager, plugin_manager }
+        let plugin_event_bridge = if let Some(plugin_manager) = &plugin_manager {
+            Some(CliPluginEventBridge::start(plugin_manager.clone(), query_manager.clone()).await)
+        } else {
+            None
+        };
+
+        Self {
+            data_dir,
+            query_manager,
+            blob_manager,
+            encryption_manager,
+            plugin_manager,
+            plugin_event_bridge: Mutex::new(plugin_event_bridge),
+        }
     }
 
     pub fn data_dir(&self) -> &Path {
@@ -90,7 +110,24 @@ impl CliContext {
 
     pub async fn shutdown(&self) {
         if let Some(plugin_manager) = &self.plugin_manager {
+            if let Some(plugin_event_bridge) = self.plugin_event_bridge.lock().await.take() {
+                plugin_event_bridge.shutdown(plugin_manager).await;
+            }
             plugin_manager.terminate().await;
         }
     }
 }
+
+fn prepare_embedded_plugin_runtime(data_dir: &Path) -> std::io::Result<PathBuf> {
+    let runtime_dir = data_dir.join("vendored").join("plugin-runtime");
+    fs::create_dir_all(&runtime_dir)?;
+    let runtime_main = runtime_dir.join("index.cjs");
+    fs::write(&runtime_main, EMBEDDED_PLUGIN_RUNTIME)?;
+    Ok(runtime_main)
+}
+
+fn prepare_embedded_vendored_plugins(vendored_plugin_dir: &Path) -> std::io::Result<()> {
+    fs::create_dir_all(vendored_plugin_dir)?;
+    EMBEDDED_VENDORED_PLUGINS.extract(vendored_plugin_dir)?;
+    Ok(())
+}

crates-cli/yaak-cli/src/main.rs

@@ -1,7 +1,11 @@
 mod cli;
 mod commands;
 mod context;
+mod plugin_events;
+mod ui;
 mod utils;
+mod version;
+mod version_check;
 
 use clap::Parser;
 use cli::{Cli, Commands, RequestCommands};
@@ -9,10 +13,18 @@ use context::CliContext;
 
 #[tokio::main]
 async fn main() {
-    let Cli { data_dir, environment, verbose, command } = Cli::parse();
+    let Cli { data_dir, environment, verbose, log, command } = Cli::parse();
 
-    if verbose {
-        env_logger::Builder::from_env(env_logger::Env::default().default_filter_or("info")).init();
+    if let Some(log_level) = log {
+        match log_level {
+            Some(level) => {
+                env_logger::Builder::new().filter_level(level.as_filter()).init();
+            }
+            None => {
+                env_logger::Builder::from_env(env_logger::Env::default().default_filter_or("info"))
+                    .init();
+            }
+        }
     }
 
     let app_id = if cfg!(debug_assertions) { "app.yaak.desktop.dev" } else { "app.yaak.desktop" };
@@ -21,27 +33,72 @@ async fn main() {
         dirs::data_dir().expect("Could not determine data directory").join(app_id)
     });
 
+    version_check::maybe_check_for_updates().await;
+
+    let needs_context = matches!(
+        &command,
+        Commands::Send(_)
+            | Commands::Workspace(_)
+            | Commands::Request(_)
+            | Commands::Folder(_)
+            | Commands::Environment(_)
+    );
+
     let needs_plugins = matches!(
         &command,
         Commands::Send(_)
-            | Commands::Request(cli::RequestArgs { command: RequestCommands::Send { .. } })
+            | Commands::Request(cli::RequestArgs {
+                command: RequestCommands::Send { .. } | RequestCommands::Schema { .. },
+            })
     );
 
-    let context = CliContext::initialize(data_dir, app_id, needs_plugins).await;
-
-    let exit_code = match command {
-        Commands::Send(args) => {
-            commands::send::run(&context, args, environment.as_deref(), verbose).await
-        }
-        Commands::Workspace(args) => commands::workspace::run(&context, args),
-        Commands::Request(args) => {
-            commands::request::run(&context, args, environment.as_deref(), verbose).await
-        }
-        Commands::Folder(args) => commands::folder::run(&context, args),
-        Commands::Environment(args) => commands::environment::run(&context, args),
+    let context = if needs_context {
+        Some(CliContext::initialize(data_dir, app_id, needs_plugins).await)
+    } else {
+        None
     };
 
-    context.shutdown().await;
+    let exit_code = match command {
+        Commands::Auth(args) => commands::auth::run(args).await,
+        Commands::Plugin(args) => commands::plugin::run(args).await,
+        Commands::Build(args) => commands::plugin::run_build(args).await,
+        Commands::Dev(args) => commands::plugin::run_dev(args).await,
+        Commands::Generate(args) => commands::plugin::run_generate(args).await,
+        Commands::Publish(args) => commands::plugin::run_publish(args).await,
+        Commands::Send(args) => {
+            commands::send::run(
+                context.as_ref().expect("context initialized for send"),
+                args,
+                environment.as_deref(),
+                verbose,
+            )
+            .await
+        }
+        Commands::Workspace(args) => commands::workspace::run(
+            context.as_ref().expect("context initialized for workspace"),
+            args,
+        ),
+        Commands::Request(args) => {
+            commands::request::run(
+                context.as_ref().expect("context initialized for request"),
+                args,
+                environment.as_deref(),
+                verbose,
+            )
+            .await
+        }
+        Commands::Folder(args) => {
+            commands::folder::run(context.as_ref().expect("context initialized for folder"), args)
+        }
+        Commands::Environment(args) => commands::environment::run(
+            context.as_ref().expect("context initialized for environment"),
+            args,
+        ),
+    };
+
+    if let Some(context) = &context {
+        context.shutdown().await;
+    }
 
     if exit_code != 0 {
         std::process::exit(exit_code);

crates-cli/yaak-cli/src/plugin_events.rs

@@ -0,0 +1,212 @@
+use std::sync::Arc;
+use tokio::task::JoinHandle;
+use yaak::plugin_events::{
+    GroupedPluginEvent, HostRequest, SharedPluginEventContext, handle_shared_plugin_event,
+};
+use yaak_models::query_manager::QueryManager;
+use yaak_plugins::events::{
+    EmptyPayload, ErrorResponse, InternalEvent, InternalEventPayload, ListOpenWorkspacesResponse,
+    WorkspaceInfo,
+};
+use yaak_plugins::manager::PluginManager;
+
+pub struct CliPluginEventBridge {
+    rx_id: String,
+    task: JoinHandle<()>,
+}
+
+impl CliPluginEventBridge {
+    pub async fn start(plugin_manager: Arc<PluginManager>, query_manager: QueryManager) -> Self {
+        let (rx_id, mut rx) = plugin_manager.subscribe("cli").await;
+        let rx_id_for_task = rx_id.clone();
+        let pm = plugin_manager.clone();
+
+        let task = tokio::spawn(async move {
+            while let Some(event) = rx.recv().await {
+                // Events with reply IDs are replies to app-originated requests.
+                if event.reply_id.is_some() {
+                    continue;
+                }
+
+                let Some(plugin_handle) = pm.get_plugin_by_ref_id(&event.plugin_ref_id).await
+                else {
+                    eprintln!(
+                        "Warning: Ignoring plugin event with unknown plugin ref '{}'",
+                        event.plugin_ref_id
+                    );
+                    continue;
+                };
+
+                let plugin_name = plugin_handle.info().name;
+                let Some(reply_payload) = build_plugin_reply(&query_manager, &event, &plugin_name)
+                else {
+                    continue;
+                };
+
+                if let Err(err) = pm.reply(&event, &reply_payload).await {
+                    eprintln!("Warning: Failed replying to plugin event: {err}");
+                }
+            }
+
+            pm.unsubscribe(&rx_id_for_task).await;
+        });
+
+        Self { rx_id, task }
+    }
+
+    pub async fn shutdown(self, plugin_manager: &PluginManager) {
+        plugin_manager.unsubscribe(&self.rx_id).await;
+        self.task.abort();
+        let _ = self.task.await;
+    }
+}
+
+fn build_plugin_reply(
+    query_manager: &QueryManager,
+    event: &InternalEvent,
+    plugin_name: &str,
+) -> Option<InternalEventPayload> {
+    match handle_shared_plugin_event(
+        query_manager,
+        &event.payload,
+        SharedPluginEventContext {
+            plugin_name,
+            workspace_id: event.context.workspace_id.as_deref(),
+        },
+    ) {
+        GroupedPluginEvent::Handled(payload) => payload,
+        GroupedPluginEvent::ToHandle(host_request) => match host_request {
+            HostRequest::ErrorResponse(resp) => {
+                eprintln!("[plugin:{}] error: {}", plugin_name, resp.error);
+                None
+            }
+            HostRequest::ReloadResponse(_) => None,
+            HostRequest::ShowToast(req) => {
+                eprintln!("[plugin:{}] {}", plugin_name, req.message);
+                Some(InternalEventPayload::ShowToastResponse(EmptyPayload {}))
+            }
+            HostRequest::ListOpenWorkspaces(_) => {
+                let workspaces = match query_manager.connect().list_workspaces() {
+                    Ok(workspaces) => workspaces
+                        .into_iter()
+                        .map(|w| WorkspaceInfo { id: w.id.clone(), name: w.name, label: w.id })
+                        .collect(),
+                    Err(err) => {
+                        return Some(InternalEventPayload::ErrorResponse(ErrorResponse {
+                            error: format!("Failed to list workspaces in CLI: {err}"),
+                        }));
+                    }
+                };
+                Some(InternalEventPayload::ListOpenWorkspacesResponse(ListOpenWorkspacesResponse {
+                    workspaces,
+                }))
+            }
+            req => Some(InternalEventPayload::ErrorResponse(ErrorResponse {
+                error: format!("Unsupported plugin request in CLI: {}", req.type_name()),
+            })),
+        },
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use tempfile::TempDir;
+    use yaak_plugins::events::{GetKeyValueRequest, PluginContext, WindowInfoRequest};
+
+    fn query_manager_for_test() -> (QueryManager, TempDir) {
+        let temp_dir = TempDir::new().expect("Failed to create temp dir");
+        let db_path = temp_dir.path().join("db.sqlite");
+        let blob_path = temp_dir.path().join("blobs.sqlite");
+        let (query_manager, _blob_manager, _rx) =
+            yaak_models::init_standalone(&db_path, &blob_path).expect("Failed to initialize DB");
+        (query_manager, temp_dir)
+    }
+
+    fn event(payload: InternalEventPayload) -> InternalEvent {
+        InternalEvent {
+            id: "evt_1".to_string(),
+            plugin_ref_id: "plugin_ref_1".to_string(),
+            plugin_name: "@yaak/test-plugin".to_string(),
+            reply_id: None,
+            context: PluginContext::new_empty(),
+            payload,
+        }
+    }
+
+    #[test]
+    fn key_value_requests_round_trip() {
+        let (query_manager, _temp_dir) = query_manager_for_test();
+        let plugin_name = "@yaak/test-plugin";
+
+        let get_missing = build_plugin_reply(
+            &query_manager,
+            &event(InternalEventPayload::GetKeyValueRequest(GetKeyValueRequest {
+                key: "missing".to_string(),
+            })),
+            plugin_name,
+        );
+        match get_missing {
+            Some(InternalEventPayload::GetKeyValueResponse(r)) => assert_eq!(r.value, None),
+            other => panic!("unexpected payload for missing get: {other:?}"),
+        }
+
+        let set = build_plugin_reply(
+            &query_manager,
+            &event(InternalEventPayload::SetKeyValueRequest(
+                yaak_plugins::events::SetKeyValueRequest {
+                    key: "token".to_string(),
+                    value: "{\"access_token\":\"abc\"}".to_string(),
+                },
+            )),
+            plugin_name,
+        );
+        assert!(matches!(set, Some(InternalEventPayload::SetKeyValueResponse(_))));
+
+        let get_present = build_plugin_reply(
+            &query_manager,
+            &event(InternalEventPayload::GetKeyValueRequest(GetKeyValueRequest {
+                key: "token".to_string(),
+            })),
+            plugin_name,
+        );
+        match get_present {
+            Some(InternalEventPayload::GetKeyValueResponse(r)) => {
+                assert_eq!(r.value, Some("{\"access_token\":\"abc\"}".to_string()))
+            }
+            other => panic!("unexpected payload for present get: {other:?}"),
+        }
+
+        let delete = build_plugin_reply(
+            &query_manager,
+            &event(InternalEventPayload::DeleteKeyValueRequest(
+                yaak_plugins::events::DeleteKeyValueRequest { key: "token".to_string() },
+            )),
+            plugin_name,
+        );
+        match delete {
+            Some(InternalEventPayload::DeleteKeyValueResponse(r)) => assert!(r.deleted),
+            other => panic!("unexpected payload for delete: {other:?}"),
+        }
+    }
+
+    #[test]
+    fn unsupported_request_gets_error_reply() {
+        let (query_manager, _temp_dir) = query_manager_for_test();
+        let payload = build_plugin_reply(
+            &query_manager,
+            &event(InternalEventPayload::WindowInfoRequest(WindowInfoRequest {
+                label: "main".to_string(),
+            })),
+            "@yaak/test-plugin",
+        );
+
+        match payload {
+            Some(InternalEventPayload::ErrorResponse(err)) => {
+                assert!(err.error.contains("Unsupported plugin request in CLI"));
+                assert!(err.error.contains("window_info_request"));
+            }
+            other => panic!("unexpected payload for unsupported request: {other:?}"),
+        }
+    }
+}

crates-cli/yaak-cli/src/ui.rs

@@ -0,0 +1,42 @@
+use console::style;
+use std::io::{self, IsTerminal};
+
+pub fn info(message: &str) {
+    if io::stdout().is_terminal() {
+        println!("{:<8} {}", style("INFO").cyan().bold(), style(message).cyan());
+    } else {
+        println!("INFO     {message}");
+    }
+}
+
+pub fn warning(message: &str) {
+    if io::stdout().is_terminal() {
+        println!("{:<8} {}", style("WARNING").yellow().bold(), style(message).yellow());
+    } else {
+        println!("WARNING  {message}");
+    }
+}
+
+pub fn warning_stderr(message: &str) {
+    if io::stderr().is_terminal() {
+        eprintln!("{:<8} {}", style("WARNING").yellow().bold(), style(message).yellow());
+    } else {
+        eprintln!("WARNING  {message}");
+    }
+}
+
+pub fn success(message: &str) {
+    if io::stdout().is_terminal() {
+        println!("{:<8} {}", style("SUCCESS").green().bold(), style(message).green());
+    } else {
+        println!("SUCCESS  {message}");
+    }
+}
+
+pub fn error(message: &str) {
+    if io::stderr().is_terminal() {
+        eprintln!("{:<8} {}", style("ERROR").red().bold(), style(message).red());
+    } else {
+        eprintln!("Error: {message}");
+    }
+}

crates-cli/yaak-cli/src/utils/http.rs

@@ -0,0 +1,47 @@
+use reqwest::Client;
+use reqwest::header::{HeaderMap, HeaderName, HeaderValue, USER_AGENT};
+use serde_json::Value;
+
+pub fn build_client(session_token: Option<&str>) -> Result<Client, String> {
+    let mut headers = HeaderMap::new();
+    let user_agent = HeaderValue::from_str(&user_agent())
+        .map_err(|e| format!("Failed to build user-agent header: {e}"))?;
+    headers.insert(USER_AGENT, user_agent);
+
+    if let Some(token) = session_token {
+        let token_value = HeaderValue::from_str(token)
+            .map_err(|e| format!("Failed to build session header: {e}"))?;
+        headers.insert(HeaderName::from_static("x-yaak-session"), token_value);
+    }
+
+    Client::builder()
+        .default_headers(headers)
+        .build()
+        .map_err(|e| format!("Failed to initialize HTTP client: {e}"))
+}
+
+pub fn parse_api_error(status: u16, body: &str) -> String {
+    if let Ok(value) = serde_json::from_str::<Value>(body) {
+        if let Some(message) = value.get("message").and_then(Value::as_str) {
+            return message.to_string();
+        }
+        if let Some(error) = value.get("error").and_then(Value::as_str) {
+            return error.to_string();
+        }
+    }
+
+    format!("API error {status}: {body}")
+}
+
+fn user_agent() -> String {
+    format!("YaakCli/{} ({})", crate::version::cli_version(), ua_platform())
+}
+
+fn ua_platform() -> &'static str {
+    match std::env::consts::OS {
+        "windows" => "Win",
+        "darwin" => "Mac",
+        "linux" => "Linux",
+        _ => "Unknown",
+    }
+}

crates-cli/yaak-cli/src/utils/json.rs

@@ -25,9 +25,9 @@ pub fn parse_optional_json(
     context: &str,
 ) -> JsonResult<Option<Value>> {
     match (json_flag, json_shorthand) {
-        (Some(_), Some(_)) => Err(format!(
-            "Cannot provide both --json and positional JSON for {context}"
-        )),
+        (Some(_), Some(_)) => {
+            Err(format!("Cannot provide both --json and positional JSON for {context}"))
+        }
         (Some(raw), None) => parse_json_object(&raw, context).map(Some),
         (None, Some(raw)) => parse_json_object(&raw, context).map(Some),
         (None, None) => Ok(None),
@@ -39,9 +39,8 @@ pub fn parse_required_json(
     json_shorthand: Option<String>,
     context: &str,
 ) -> JsonResult<Value> {
-    parse_optional_json(json_flag, json_shorthand, context)?.ok_or_else(|| {
-        format!("Missing JSON payload for {context}. Use --json or positional JSON")
-    })
+    parse_optional_json(json_flag, json_shorthand, context)?
+        .ok_or_else(|| format!("Missing JSON payload for {context}. Use --json or positional JSON"))
 }
 
 pub fn require_id(payload: &Value, context: &str) -> JsonResult<String> {
@@ -60,12 +59,34 @@ pub fn validate_create_id(payload: &Value, context: &str) -> JsonResult<()> {
 
     match id_value {
         Value::String(id) if id.is_empty() => Ok(()),
-        _ => Err(format!(
-            "{context} create JSON must omit \"id\" or set it to an empty string"
-        )),
+        _ => Err(format!("{context} create JSON must omit \"id\" or set it to an empty string")),
     }
 }
 
+pub fn merge_workspace_id_arg(
+    workspace_id_from_arg: Option<&str>,
+    payload_workspace_id: &mut String,
+    context: &str,
+) -> JsonResult<()> {
+    if let Some(workspace_id_arg) = workspace_id_from_arg {
+        if payload_workspace_id.is_empty() {
+            *payload_workspace_id = workspace_id_arg.to_string();
+        } else if payload_workspace_id != workspace_id_arg {
+            return Err(format!(
+                "{context} got conflicting workspace_id values between positional arg and JSON payload"
+            ));
+        }
+    }
+
+    if payload_workspace_id.is_empty() {
+        return Err(format!(
+            "{context} requires non-empty \"workspaceId\" in JSON payload or positional workspace_id"
+        ));
+    }
+
+    Ok(())
+}
+
 pub fn apply_merge_patch<T>(existing: &T, patch: &Value, id: &str, context: &str) -> JsonResult<T>
 where
     T: Serialize + DeserializeOwned,

crates-cli/yaak-cli/src/utils/mod.rs

@@ -1,2 +1,4 @@
 pub mod confirm;
+pub mod http;
 pub mod json;
+pub mod schema;

crates-cli/yaak-cli/src/utils/schema.rs

@@ -0,0 +1,15 @@
+use serde_json::{Value, json};
+
+pub fn append_agent_hints(schema: &mut Value) {
+    let Some(schema_obj) = schema.as_object_mut() else {
+        return;
+    };
+
+    schema_obj.insert(
+        "x-yaak-agent-hints".to_string(),
+        json!({
+            "templateVariableSyntax": "${[ my_var ]}",
+            "templateFunctionSyntax": "${[ namespace.my_func(a='aaa',b='bbb') ]}",
+        }),
+    );
+}

crates-cli/yaak-cli/src/version.rs

@@ -0,0 +1,3 @@
+pub fn cli_version() -> &'static str {
+    option_env!("YAAK_CLI_VERSION").unwrap_or(env!("CARGO_PKG_VERSION"))
+}

crates-cli/yaak-cli/src/version_check.rs

@@ -0,0 +1,227 @@
+use crate::ui;
+use crate::version;
+use serde::{Deserialize, Serialize};
+use std::fs;
+use std::io::IsTerminal;
+use std::path::{Path, PathBuf};
+use std::time::{Duration, SystemTime, UNIX_EPOCH};
+use yaak_api::{ApiClientKind, yaak_api_client};
+
+const CACHE_FILE_NAME: &str = "cli-version-check.json";
+const CHECK_INTERVAL_SECS: u64 = 24 * 60 * 60;
+const REQUEST_TIMEOUT: Duration = Duration::from_millis(800);
+
+#[derive(Debug, Clone, Serialize, Deserialize, Default)]
+#[serde(default)]
+struct VersionCheckResponse {
+    outdated: bool,
+    latest_version: Option<String>,
+    upgrade_hint: Option<String>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(default)]
+struct CacheRecord {
+    checked_at_epoch_secs: u64,
+    response: VersionCheckResponse,
+    last_warned_at_epoch_secs: Option<u64>,
+    last_warned_version: Option<String>,
+}
+
+impl Default for CacheRecord {
+    fn default() -> Self {
+        Self {
+            checked_at_epoch_secs: 0,
+            response: VersionCheckResponse::default(),
+            last_warned_at_epoch_secs: None,
+            last_warned_version: None,
+        }
+    }
+}
+
+#[derive(Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+struct VersionCheckRequest<'a> {
+    current_version: &'a str,
+    channel: String,
+    install_source: String,
+    platform: &'a str,
+    arch: &'a str,
+}
+
+pub async fn maybe_check_for_updates() {
+    if should_skip_check() {
+        return;
+    }
+
+    let now = unix_epoch_secs();
+    let cache_path = cache_path();
+    let cached = read_cache(&cache_path);
+
+    if let Some(cache) = cached.as_ref().filter(|c| !is_expired(c.checked_at_epoch_secs, now)) {
+        let mut record = cache.clone();
+        maybe_warn_outdated(&mut record, now);
+        write_cache(&cache_path, &record);
+        return;
+    }
+
+    let fresh = fetch_version_check().await;
+    match fresh {
+        Some(response) => {
+            let mut record = CacheRecord {
+                checked_at_epoch_secs: now,
+                response: response.clone(),
+                last_warned_at_epoch_secs: cached
+                    .as_ref()
+                    .and_then(|c| c.last_warned_at_epoch_secs),
+                last_warned_version: cached.as_ref().and_then(|c| c.last_warned_version.clone()),
+            };
+            maybe_warn_outdated(&mut record, now);
+            write_cache(&cache_path, &record);
+        }
+        None => {
+            let fallback = cached.as_ref().map(|cache| cache.response.clone()).unwrap_or_default();
+            let mut record = CacheRecord {
+                checked_at_epoch_secs: now,
+                response: fallback,
+                last_warned_at_epoch_secs: cached
+                    .as_ref()
+                    .and_then(|c| c.last_warned_at_epoch_secs),
+                last_warned_version: cached.as_ref().and_then(|c| c.last_warned_version.clone()),
+            };
+            maybe_warn_outdated(&mut record, now);
+            write_cache(&cache_path, &record);
+        }
+    }
+}
+
+fn should_skip_check() -> bool {
+    if std::env::var("YAAK_CLI_NO_UPDATE_CHECK")
+        .is_ok_and(|v| v == "1" || v.eq_ignore_ascii_case("true"))
+    {
+        return true;
+    }
+
+    if std::env::var("CI").is_ok() {
+        return true;
+    }
+
+    !std::io::stdout().is_terminal()
+}
+
+async fn fetch_version_check() -> Option<VersionCheckResponse> {
+    let api_url = format!("{}/api/v1/cli/version-check", api_base_url());
+    let current_version = version::cli_version();
+    let payload = VersionCheckRequest {
+        current_version,
+        channel: release_channel(current_version),
+        install_source: install_source(),
+        platform: std::env::consts::OS,
+        arch: std::env::consts::ARCH,
+    };
+
+    let client = yaak_api_client(ApiClientKind::Cli, current_version).ok()?;
+    let request = client.post(api_url).json(&payload);
+
+    let response = tokio::time::timeout(REQUEST_TIMEOUT, request.send()).await.ok()?.ok()?;
+    if !response.status().is_success() {
+        return None;
+    }
+
+    tokio::time::timeout(REQUEST_TIMEOUT, response.json::<VersionCheckResponse>()).await.ok()?.ok()
+}
+
+fn release_channel(version: &str) -> String {
+    version
+        .split_once('-')
+        .and_then(|(_, suffix)| suffix.split('.').next())
+        .unwrap_or("stable")
+        .to_string()
+}
+
+fn install_source() -> String {
+    std::env::var("YAAK_CLI_INSTALL_SOURCE")
+        .ok()
+        .filter(|s| !s.trim().is_empty())
+        .unwrap_or_else(|| "source".to_string())
+}
+
+fn api_base_url() -> &'static str {
+    match std::env::var("ENVIRONMENT").ok().as_deref() {
+        Some("staging") => "https://todo.yaak.app",
+        Some("development") => "http://localhost:9444",
+        _ => "https://api.yaak.app",
+    }
+}
+
+fn maybe_warn_outdated(record: &mut CacheRecord, now: u64) {
+    if !record.response.outdated {
+        return;
+    }
+
+    let latest =
+        record.response.latest_version.clone().unwrap_or_else(|| "a newer release".to_string());
+    let warn_suppressed = record.last_warned_version.as_deref() == Some(latest.as_str())
+        && record.last_warned_at_epoch_secs.is_some_and(|t| !is_expired(t, now));
+    if warn_suppressed {
+        return;
+    }
+
+    let hint = record.response.upgrade_hint.clone().unwrap_or_else(default_upgrade_hint);
+    ui::warning_stderr(&format!("A newer Yaak CLI version is available ({latest}). {hint}"));
+    record.last_warned_version = Some(latest);
+    record.last_warned_at_epoch_secs = Some(now);
+}
+
+fn default_upgrade_hint() -> String {
+    if install_source() == "npm" {
+        let channel = release_channel(version::cli_version());
+        if channel == "stable" {
+            return "Run `npm install -g @yaakapp/cli@latest` to update.".to_string();
+        }
+        return format!("Run `npm install -g @yaakapp/cli@{channel}` to update.");
+    }
+
+    "Update your Yaak CLI installation to the latest release.".to_string()
+}
+
+fn cache_path() -> PathBuf {
+    std::env::temp_dir().join("yaak-cli").join(format!("{}-{CACHE_FILE_NAME}", environment_name()))
+}
+
+fn environment_name() -> &'static str {
+    match std::env::var("ENVIRONMENT").ok().as_deref() {
+        Some("staging") => "staging",
+        Some("development") => "development",
+        _ => "production",
+    }
+}
+
+fn read_cache(path: &Path) -> Option<CacheRecord> {
+    let contents = fs::read_to_string(path).ok()?;
+    serde_json::from_str::<CacheRecord>(&contents).ok()
+}
+
+fn write_cache(path: &Path, record: &CacheRecord) {
+    let Some(parent) = path.parent() else {
+        return;
+    };
+    if fs::create_dir_all(parent).is_err() {
+        return;
+    }
+    let Ok(json) = serde_json::to_string(record) else {
+        return;
+    };
+    let _ = fs::write(path, json);
+}
+
+fn is_expired(checked_at_epoch_secs: u64, now: u64) -> bool {
+    now.saturating_sub(checked_at_epoch_secs) >= CHECK_INTERVAL_SECS
+}
+
+fn unix_epoch_secs() -> u64 {
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .unwrap_or_else(|_| Duration::from_secs(0))
+        .as_secs()
+}

crates-cli/yaak-cli/tests/common/http_server.rs

@@ -1,9 +1,14 @@
 use std::io::{Read, Write};
-use std::net::TcpListener;
+use std::net::{SocketAddr, TcpListener, TcpStream};
+use std::sync::Arc;
+use std::sync::atomic::{AtomicBool, Ordering};
 use std::thread;
+use std::time::Duration;
 
 pub struct TestHttpServer {
     pub url: String,
+    addr: SocketAddr,
+    shutdown: Arc<AtomicBool>,
     handle: Option<thread::JoinHandle<()>>,
 }
 
@@ -12,29 +17,46 @@ impl TestHttpServer {
         let listener = TcpListener::bind("127.0.0.1:0").expect("Failed to bind test HTTP server");
         let addr = listener.local_addr().expect("Failed to get local addr");
         let url = format!("http://{addr}/test");
+        listener.set_nonblocking(true).expect("Failed to set test server listener nonblocking");
+
+        let shutdown = Arc::new(AtomicBool::new(false));
+        let shutdown_signal = Arc::clone(&shutdown);
         let body_bytes = body.as_bytes().to_vec();
 
         let handle = thread::spawn(move || {
-            if let Ok((mut stream, _)) = listener.accept() {
-                let mut request_buf = [0u8; 4096];
-                let _ = stream.read(&mut request_buf);
+            while !shutdown_signal.load(Ordering::Relaxed) {
+                match listener.accept() {
+                    Ok((mut stream, _)) => {
+                        let _ = stream.set_read_timeout(Some(Duration::from_secs(1)));
+                        let mut request_buf = [0u8; 4096];
+                        let _ = stream.read(&mut request_buf);
 
-                let response = format!(
-                    "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nContent-Length: {}\r\nConnection: close\r\n\r\n",
-                    body_bytes.len()
-                );
-                let _ = stream.write_all(response.as_bytes());
-                let _ = stream.write_all(&body_bytes);
-                let _ = stream.flush();
+                        let response = format!(
+                            "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nContent-Length: {}\r\nConnection: close\r\n\r\n",
+                            body_bytes.len()
+                        );
+                        let _ = stream.write_all(response.as_bytes());
+                        let _ = stream.write_all(&body_bytes);
+                        let _ = stream.flush();
+                        break;
+                    }
+                    Err(err) if err.kind() == std::io::ErrorKind::WouldBlock => {
+                        thread::sleep(Duration::from_millis(10));
+                    }
+                    Err(_) => break,
+                }
             }
         });
 
-        Self { url, handle: Some(handle) }
+        Self { url, addr, shutdown, handle: Some(handle) }
     }
 }
 
 impl Drop for TestHttpServer {
     fn drop(&mut self) {
+        self.shutdown.store(true, Ordering::Relaxed);
+        let _ = TcpStream::connect(self.addr);
+
         if let Some(handle) = self.handle.take() {
             let _ = handle.join();
         }

crates-cli/yaak-cli/tests/common/mod.rs

@@ -5,12 +5,12 @@ pub mod http_server;
 use assert_cmd::Command;
 use assert_cmd::cargo::cargo_bin_cmd;
 use std::path::Path;
-use yaak_models::models::{HttpRequest, Workspace};
+use yaak_models::models::{Folder, GrpcRequest, HttpRequest, WebsocketRequest, Workspace};
 use yaak_models::query_manager::QueryManager;
 use yaak_models::util::UpdateSource;
 
 pub fn cli_cmd(data_dir: &Path) -> Command {
-    let mut cmd = cargo_bin_cmd!("yaakcli");
+    let mut cmd = cargo_bin_cmd!("yaak");
     cmd.arg("--data-dir").arg(data_dir);
     cmd
 }
@@ -60,3 +60,47 @@ pub fn seed_request(data_dir: &Path, workspace_id: &str, request_id: &str) {
         .upsert_http_request(&request, &UpdateSource::Sync)
         .expect("Failed to seed request");
 }
+
+pub fn seed_folder(data_dir: &Path, workspace_id: &str, folder_id: &str) {
+    let folder = Folder {
+        id: folder_id.to_string(),
+        workspace_id: workspace_id.to_string(),
+        name: "Seed Folder".to_string(),
+        ..Default::default()
+    };
+
+    query_manager(data_dir)
+        .connect()
+        .upsert_folder(&folder, &UpdateSource::Sync)
+        .expect("Failed to seed folder");
+}
+
+pub fn seed_grpc_request(data_dir: &Path, workspace_id: &str, request_id: &str) {
+    let request = GrpcRequest {
+        id: request_id.to_string(),
+        workspace_id: workspace_id.to_string(),
+        name: "Seeded gRPC Request".to_string(),
+        url: "https://example.com".to_string(),
+        ..Default::default()
+    };
+
+    query_manager(data_dir)
+        .connect()
+        .upsert_grpc_request(&request, &UpdateSource::Sync)
+        .expect("Failed to seed gRPC request");
+}
+
+pub fn seed_websocket_request(data_dir: &Path, workspace_id: &str, request_id: &str) {
+    let request = WebsocketRequest {
+        id: request_id.to_string(),
+        workspace_id: workspace_id.to_string(),
+        name: "Seeded WebSocket Request".to_string(),
+        url: "wss://example.com/socket".to_string(),
+        ..Default::default()
+    };
+
+    query_manager(data_dir)
+        .connect()
+        .upsert_websocket_request(&request, &UpdateSource::Sync)
+        .expect("Failed to seed WebSocket request");
+}

crates-cli/yaak-cli/tests/environment_commands.rs

@@ -78,3 +78,69 @@ fn json_create_and_update_merge_patch_round_trip() {
         .stdout(contains("\"name\": \"Json Environment\""))
         .stdout(contains("\"color\": \"#00ff00\""));
 }
+
+#[test]
+fn create_merges_positional_workspace_id_into_json_payload() {
+    let temp_dir = TempDir::new().expect("Failed to create temp dir");
+    let data_dir = temp_dir.path();
+    seed_workspace(data_dir, "wk_test");
+
+    let create_assert = cli_cmd(data_dir)
+        .args([
+            "environment",
+            "create",
+            "wk_test",
+            "--json",
+            r#"{"name":"Merged Environment"}"#,
+        ])
+        .assert()
+        .success();
+    let environment_id = parse_created_id(&create_assert.get_output().stdout, "environment create");
+
+    cli_cmd(data_dir)
+        .args(["environment", "show", &environment_id])
+        .assert()
+        .success()
+        .stdout(contains("\"workspaceId\": \"wk_test\""))
+        .stdout(contains("\"name\": \"Merged Environment\""));
+}
+
+#[test]
+fn create_rejects_conflicting_workspace_ids_between_arg_and_json() {
+    let temp_dir = TempDir::new().expect("Failed to create temp dir");
+    let data_dir = temp_dir.path();
+    seed_workspace(data_dir, "wk_test");
+    seed_workspace(data_dir, "wk_other");
+
+    cli_cmd(data_dir)
+        .args([
+            "environment",
+            "create",
+            "wk_test",
+            "--json",
+            r#"{"workspaceId":"wk_other","name":"Mismatch"}"#,
+        ])
+        .assert()
+        .failure()
+        .stderr(contains(
+            "environment create got conflicting workspace_id values between positional arg and JSON payload",
+        ));
+}
+
+#[test]
+fn environment_schema_outputs_json_schema() {
+    let temp_dir = TempDir::new().expect("Failed to create temp dir");
+    let data_dir = temp_dir.path();
+
+    cli_cmd(data_dir)
+        .args(["environment", "schema"])
+        .assert()
+        .success()
+        .stdout(contains("\"type\":\"object\""))
+        .stdout(contains("\"x-yaak-agent-hints\""))
+        .stdout(contains("\"templateVariableSyntax\":\"${[ my_var ]}\""))
+        .stdout(contains(
+            "\"templateFunctionSyntax\":\"${[ namespace.my_func(a='aaa',b='bbb') ]}\"",
+        ))
+        .stdout(contains("\"workspaceId\""));
+}

crates-cli/yaak-cli/tests/folder_commands.rs

@@ -72,3 +72,51 @@ fn json_create_and_update_merge_patch_round_trip() {
         .stdout(contains("\"name\": \"Json Folder\""))
         .stdout(contains("\"description\": \"Folder Description\""));
 }
+
+#[test]
+fn create_merges_positional_workspace_id_into_json_payload() {
+    let temp_dir = TempDir::new().expect("Failed to create temp dir");
+    let data_dir = temp_dir.path();
+    seed_workspace(data_dir, "wk_test");
+
+    let create_assert = cli_cmd(data_dir)
+        .args([
+            "folder",
+            "create",
+            "wk_test",
+            "--json",
+            r#"{"name":"Merged Folder"}"#,
+        ])
+        .assert()
+        .success();
+    let folder_id = parse_created_id(&create_assert.get_output().stdout, "folder create");
+
+    cli_cmd(data_dir)
+        .args(["folder", "show", &folder_id])
+        .assert()
+        .success()
+        .stdout(contains("\"workspaceId\": \"wk_test\""))
+        .stdout(contains("\"name\": \"Merged Folder\""));
+}
+
+#[test]
+fn create_rejects_conflicting_workspace_ids_between_arg_and_json() {
+    let temp_dir = TempDir::new().expect("Failed to create temp dir");
+    let data_dir = temp_dir.path();
+    seed_workspace(data_dir, "wk_test");
+    seed_workspace(data_dir, "wk_other");
+
+    cli_cmd(data_dir)
+        .args([
+            "folder",
+            "create",
+            "wk_test",
+            "--json",
+            r#"{"workspaceId":"wk_other","name":"Mismatch"}"#,
+        ])
+        .assert()
+        .failure()
+        .stderr(contains(
+            "folder create got conflicting workspace_id values between positional arg and JSON payload",
+        ));
+}

crates-cli/yaak-cli/tests/request_commands.rs

@@ -1,7 +1,10 @@
 mod common;
 
 use common::http_server::TestHttpServer;
-use common::{cli_cmd, parse_created_id, query_manager, seed_request, seed_workspace};
+use common::{
+    cli_cmd, parse_created_id, query_manager, seed_grpc_request, seed_request,
+    seed_websocket_request, seed_workspace,
+};
 use predicates::str::contains;
 use tempfile::TempDir;
 use yaak_models::models::HttpResponseState;
@@ -114,8 +117,7 @@ fn create_allows_workspace_only_with_empty_defaults() {
     let data_dir = temp_dir.path();
     seed_workspace(data_dir, "wk_test");
 
-    let create_assert =
-        cli_cmd(data_dir).args(["request", "create", "wk_test"]).assert().success();
+    let create_assert = cli_cmd(data_dir).args(["request", "create", "wk_test"]).assert().success();
     let request_id = parse_created_id(&create_assert.get_output().stdout, "request create");
 
     let request = query_manager(data_dir)
@@ -128,6 +130,54 @@ fn create_allows_workspace_only_with_empty_defaults() {
     assert_eq!(request.url, "");
 }
 
+#[test]
+fn create_merges_positional_workspace_id_into_json_payload() {
+    let temp_dir = TempDir::new().expect("Failed to create temp dir");
+    let data_dir = temp_dir.path();
+    seed_workspace(data_dir, "wk_test");
+
+    let create_assert = cli_cmd(data_dir)
+        .args([
+            "request",
+            "create",
+            "wk_test",
+            "--json",
+            r#"{"name":"Merged Request","url":"https://example.com"}"#,
+        ])
+        .assert()
+        .success();
+    let request_id = parse_created_id(&create_assert.get_output().stdout, "request create");
+
+    cli_cmd(data_dir)
+        .args(["request", "show", &request_id])
+        .assert()
+        .success()
+        .stdout(contains("\"workspaceId\": \"wk_test\""))
+        .stdout(contains("\"name\": \"Merged Request\""));
+}
+
+#[test]
+fn create_rejects_conflicting_workspace_ids_between_arg_and_json() {
+    let temp_dir = TempDir::new().expect("Failed to create temp dir");
+    let data_dir = temp_dir.path();
+    seed_workspace(data_dir, "wk_test");
+    seed_workspace(data_dir, "wk_other");
+
+    cli_cmd(data_dir)
+        .args([
+            "request",
+            "create",
+            "wk_test",
+            "--json",
+            r#"{"workspaceId":"wk_other","name":"Mismatch"}"#,
+        ])
+        .assert()
+        .failure()
+        .stderr(contains(
+            "request create got conflicting workspace_id values between positional arg and JSON payload",
+        ));
+}
+
 #[test]
 fn request_send_persists_response_body_and_events() {
     let temp_dir = TempDir::new().expect("Failed to create temp dir");
@@ -154,7 +204,6 @@ fn request_send_persists_response_body_and_events() {
         .args(["request", "send", &request_id])
         .assert()
         .success()
-        .stdout(contains("HTTP 200 OK"))
         .stdout(contains("hello from integration test"));
 
     let qm = query_manager(data_dir);
@@ -177,3 +226,66 @@ fn request_send_persists_response_body_and_events() {
         db.list_http_response_events(&response.id).expect("Failed to load response events");
     assert!(!events.is_empty(), "expected at least one persisted response event");
 }
+
+#[test]
+fn request_schema_http_outputs_json_schema() {
+    let temp_dir = TempDir::new().expect("Failed to create temp dir");
+    let data_dir = temp_dir.path();
+
+    cli_cmd(data_dir)
+        .args(["request", "schema", "http"])
+        .assert()
+        .success()
+        .stdout(contains("\"type\":\"object\""))
+        .stdout(contains("\"x-yaak-agent-hints\""))
+        .stdout(contains("\"templateVariableSyntax\":\"${[ my_var ]}\""))
+        .stdout(contains(
+            "\"templateFunctionSyntax\":\"${[ namespace.my_func(a='aaa',b='bbb') ]}\"",
+        ))
+        .stdout(contains("\"authentication\":"))
+        .stdout(contains("/foo/:id/comments/:commentId"))
+        .stdout(contains("put concrete values in `urlParameters`"));
+}
+
+#[test]
+fn request_schema_http_pretty_prints_with_flag() {
+    let temp_dir = TempDir::new().expect("Failed to create temp dir");
+    let data_dir = temp_dir.path();
+
+    cli_cmd(data_dir)
+        .args(["request", "schema", "http", "--pretty"])
+        .assert()
+        .success()
+        .stdout(contains("\"type\": \"object\""))
+        .stdout(contains("\"authentication\""));
+}
+
+#[test]
+fn request_send_grpc_returns_explicit_nyi_error() {
+    let temp_dir = TempDir::new().expect("Failed to create temp dir");
+    let data_dir = temp_dir.path();
+    seed_workspace(data_dir, "wk_test");
+    seed_grpc_request(data_dir, "wk_test", "gr_seed_nyi");
+
+    cli_cmd(data_dir)
+        .args(["request", "send", "gr_seed_nyi"])
+        .assert()
+        .failure()
+        .code(1)
+        .stderr(contains("gRPC request send is not implemented yet in yaak-cli"));
+}
+
+#[test]
+fn request_send_websocket_returns_explicit_nyi_error() {
+    let temp_dir = TempDir::new().expect("Failed to create temp dir");
+    let data_dir = temp_dir.path();
+    seed_workspace(data_dir, "wk_test");
+    seed_websocket_request(data_dir, "wk_test", "wr_seed_nyi");
+
+    cli_cmd(data_dir)
+        .args(["request", "send", "wr_seed_nyi"])
+        .assert()
+        .failure()
+        .code(1)
+        .stderr(contains("WebSocket request send is not implemented yet in yaak-cli"));
+}

crates-cli/yaak-cli/tests/send_commands.rs

@@ -0,0 +1,79 @@
+mod common;
+
+use common::http_server::TestHttpServer;
+use common::{cli_cmd, query_manager, seed_folder, seed_workspace};
+use predicates::str::contains;
+use tempfile::TempDir;
+use yaak_models::models::HttpRequest;
+use yaak_models::util::UpdateSource;
+
+#[test]
+fn top_level_send_workspace_sends_http_requests_and_prints_summary() {
+    let temp_dir = TempDir::new().expect("Failed to create temp dir");
+    let data_dir = temp_dir.path();
+    seed_workspace(data_dir, "wk_test");
+
+    let server = TestHttpServer::spawn_ok("workspace bulk send");
+    let request = HttpRequest {
+        id: "rq_workspace_send".to_string(),
+        workspace_id: "wk_test".to_string(),
+        name: "Workspace Send".to_string(),
+        method: "GET".to_string(),
+        url: server.url.clone(),
+        ..Default::default()
+    };
+    query_manager(data_dir)
+        .connect()
+        .upsert_http_request(&request, &UpdateSource::Sync)
+        .expect("Failed to seed workspace request");
+
+    cli_cmd(data_dir)
+        .args(["send", "wk_test"])
+        .assert()
+        .success()
+        .stdout(contains("workspace bulk send"))
+        .stdout(contains("Send summary: 1 succeeded, 0 failed"));
+}
+
+#[test]
+fn top_level_send_folder_sends_http_requests_and_prints_summary() {
+    let temp_dir = TempDir::new().expect("Failed to create temp dir");
+    let data_dir = temp_dir.path();
+    seed_workspace(data_dir, "wk_test");
+    seed_folder(data_dir, "wk_test", "fl_test");
+
+    let server = TestHttpServer::spawn_ok("folder bulk send");
+    let request = HttpRequest {
+        id: "rq_folder_send".to_string(),
+        workspace_id: "wk_test".to_string(),
+        folder_id: Some("fl_test".to_string()),
+        name: "Folder Send".to_string(),
+        method: "GET".to_string(),
+        url: server.url.clone(),
+        ..Default::default()
+    };
+    query_manager(data_dir)
+        .connect()
+        .upsert_http_request(&request, &UpdateSource::Sync)
+        .expect("Failed to seed folder request");
+
+    cli_cmd(data_dir)
+        .args(["send", "fl_test"])
+        .assert()
+        .success()
+        .stdout(contains("folder bulk send"))
+        .stdout(contains("Send summary: 1 succeeded, 0 failed"));
+}
+
+#[test]
+fn top_level_send_unknown_id_fails_with_clear_error() {
+    let temp_dir = TempDir::new().expect("Failed to create temp dir");
+    let data_dir = temp_dir.path();
+
+    cli_cmd(data_dir)
+        .args(["send", "does_not_exist"])
+        .assert()
+        .failure()
+        .code(1)
+        .stderr(contains("Could not resolve ID 'does_not_exist' as request, folder, or workspace"));
+}

crates-cli/yaak-cli/tests/workspace_commands.rs

@@ -57,3 +57,21 @@ fn json_create_and_update_merge_patch_round_trip() {
         .stdout(contains("\"name\": \"Json Workspace\""))
         .stdout(contains("\"description\": \"Updated via JSON\""));
 }
+
+#[test]
+fn workspace_schema_outputs_json_schema() {
+    let temp_dir = TempDir::new().expect("Failed to create temp dir");
+    let data_dir = temp_dir.path();
+
+    cli_cmd(data_dir)
+        .args(["workspace", "schema"])
+        .assert()
+        .success()
+        .stdout(contains("\"type\":\"object\""))
+        .stdout(contains("\"x-yaak-agent-hints\""))
+        .stdout(contains("\"templateVariableSyntax\":\"${[ my_var ]}\""))
+        .stdout(contains(
+            "\"templateFunctionSyntax\":\"${[ namespace.my_func(a='aaa',b='bbb') ]}\"",
+        ))
+        .stdout(contains("\"name\""));
+}

crates-tauri/yaak-app/src/http_request.rs

@@ -154,6 +154,7 @@ async fn send_http_request_inner<R: Runtime>(
         cookie_jar_id,
         response_dir: &response_dir,
         emit_events_to: None,
+        emit_response_body_chunks_to: None,
         existing_response: Some(response_ctx.response().clone()),
         plugin_manager,
         encryption_manager,

crates-tauri/yaak-app/src/lib.rs

@@ -37,8 +37,8 @@ use yaak_grpc::{Code, ServiceDefinition, serialize_message};
 use yaak_mac_window::AppHandleMacWindowExt;
 use yaak_models::models::{
     AnyModel, CookieJar, Environment, GrpcConnection, GrpcConnectionState, GrpcEvent,
-    GrpcEventType, HttpRequest, HttpResponse, HttpResponseEvent, HttpResponseState, Plugin,
-    Workspace, WorkspaceMeta,
+    GrpcEventType, HttpRequest, HttpResponse, HttpResponseEvent, HttpResponseState, Workspace,
+    WorkspaceMeta,
 };
 use yaak_models::util::{BatchUpsertResult, UpdateSource, get_workspace_export_resources};
 use yaak_plugins::events::{
@@ -1345,29 +1345,6 @@ async fn cmd_send_http_request<R: Runtime>(
     Ok(r)
 }
 
-#[tauri::command]
-async fn cmd_install_plugin<R: Runtime>(
-    directory: &str,
-    url: Option<String>,
-    plugin_manager: State<'_, PluginManager>,
-    app_handle: AppHandle<R>,
-    window: WebviewWindow<R>,
-) -> YaakResult<Plugin> {
-    let plugin = app_handle.db().upsert_plugin(
-        &Plugin { directory: directory.into(), url, enabled: true, ..Default::default() },
-        &UpdateSource::from_window_label(window.label()),
-    )?;
-
-    plugin_manager
-        .add_plugin(
-            &PluginContext::new(Some(window.label().to_string()), window.workspace_id()),
-            &plugin,
-        )
-        .await?;
-
-    Ok(plugin)
-}
-
 #[tauri::command]
 async fn cmd_reload_plugins<R: Runtime>(
     app_handle: AppHandle<R>,
@@ -1652,7 +1629,6 @@ pub fn run() {
             cmd_workspace_actions,
             cmd_folder_actions,
             cmd_import_data,
-            cmd_install_plugin,
             cmd_metadata,
             cmd_new_child_window,
             cmd_new_main_window,
@@ -1721,6 +1697,7 @@ pub fn run() {
             git_ext::cmd_git_rm_remote,
             //
             // Plugin commands
+            plugins_ext::cmd_plugins_install_from_directory,
             plugins_ext::cmd_plugins_search,
             plugins_ext::cmd_plugins_install,
             plugins_ext::cmd_plugins_uninstall,

crates-tauri/yaak-app/src/models_ext.rs

@@ -15,6 +15,7 @@ use yaak_models::error::Result;
 use yaak_models::models::{AnyModel, GraphQlIntrospection, GrpcEvent, Settings, WebsocketEvent};
 use yaak_models::query_manager::QueryManager;
 use yaak_models::util::UpdateSource;
+use yaak_plugins::manager::PluginManager;
 
 const MODEL_CHANGES_RETENTION_HOURS: i64 = 1;
 const MODEL_CHANGES_POLL_INTERVAL_MS: u64 = 1000;
@@ -255,23 +256,32 @@ pub(crate) fn models_upsert_graphql_introspection<R: Runtime>(
 }
 
 #[tauri::command]
-pub(crate) fn models_workspace_models<R: Runtime>(
+pub(crate) async fn models_workspace_models<R: Runtime>(
     window: WebviewWindow<R>,
     workspace_id: Option<&str>,
+    plugin_manager: State<'_, PluginManager>,
 ) -> Result<String> {
-    let db = window.db();
     let mut l: Vec<AnyModel> = Vec::new();
 
-    // Add the settings
-    l.push(db.get_settings().into());
+    // Add the global models
+    {
+        let db = window.db();
+        l.push(db.get_settings().into());
+        l.append(&mut db.list_workspaces()?.into_iter().map(Into::into).collect());
+        l.append(&mut db.list_key_values()?.into_iter().map(Into::into).collect());
+    }
 
-    // Add global models
-    l.append(&mut db.list_workspaces()?.into_iter().map(Into::into).collect());
-    l.append(&mut db.list_key_values()?.into_iter().map(Into::into).collect());
-    l.append(&mut db.list_plugins()?.into_iter().map(Into::into).collect());
+    let plugins = {
+        let db = window.db();
+        db.list_plugins()?
+    };
+
+    let plugins = plugin_manager.resolve_plugins_for_runtime_from_db(plugins).await;
+    l.append(&mut plugins.into_iter().map(Into::into).collect());
 
     // Add the workspace children
     if let Some(wid) = workspace_id {
+        let db = window.db();
         l.append(&mut db.list_cookie_jars(wid)?.into_iter().map(Into::into).collect());
         l.append(&mut db.list_environments_ensure_base(wid)?.into_iter().map(Into::into).collect());
         l.append(&mut db.list_folders(wid)?.into_iter().map(Into::into).collect());

crates-tauri/yaak-app/src/notifications.rs

@@ -8,7 +8,7 @@ use serde::{Deserialize, Serialize};
 use std::time::Instant;
 use tauri::{AppHandle, Emitter, Manager, Runtime, WebviewWindow};
 use ts_rs::TS;
-use yaak_api::yaak_api_client;
+use yaak_api::{ApiClientKind, yaak_api_client};
 use yaak_common::platform::get_os_str;
 use yaak_models::util::UpdateSource;
 
@@ -102,7 +102,7 @@ impl YaakNotifier {
 
         let launch_info = get_or_upsert_launch_info(app_handle);
         let app_version = app_handle.package_info().version.to_string();
-        let req = yaak_api_client(&app_version)?
+        let req = yaak_api_client(ApiClientKind::App, &app_version)?
             .request(Method::GET, "https://notify.yaak.app/notifications")
             .query(&[
                 ("version", &launch_info.current_version),

crates-tauri/yaak-app/src/plugin_events.rs

@@ -15,18 +15,20 @@ use std::sync::Arc;
 use tauri::{AppHandle, Emitter, Listener, Manager, Runtime};
 use tauri_plugin_clipboard_manager::ClipboardExt;
 use tauri_plugin_opener::OpenerExt;
+use yaak::plugin_events::{
+    GroupedPluginEvent, HostRequest, SharedPluginEventContext, handle_shared_plugin_event,
+};
 use yaak_crypto::manager::EncryptionManager;
-use yaak_models::models::{AnyModel, HttpResponse, Plugin};
+use yaak_models::models::{HttpResponse, Plugin};
 use yaak_models::queries::any_request::AnyRequest;
 use yaak_models::util::UpdateSource;
 use yaak_plugins::error::Error::PluginErr;
 use yaak_plugins::events::{
-    Color, DeleteKeyValueResponse, EmptyPayload, ErrorResponse, FindHttpResponsesResponse,
-    GetCookieValueResponse, GetHttpRequestByIdResponse, GetKeyValueResponse, Icon, InternalEvent,
-    InternalEventPayload, ListCookieNamesResponse, ListHttpRequestsResponse,
-    ListWorkspacesResponse, RenderGrpcRequestResponse, RenderHttpRequestResponse,
-    SendHttpRequestResponse, SetKeyValueResponse, ShowToastRequest, TemplateRenderResponse,
-    WindowInfoResponse, WindowNavigateEvent, WorkspaceInfo,
+    Color, EmptyPayload, ErrorResponse, GetCookieValueResponse, Icon, InternalEvent,
+    InternalEventPayload, ListCookieNamesResponse, ListOpenWorkspacesResponse,
+    RenderGrpcRequestResponse, RenderHttpRequestResponse, SendHttpRequestResponse,
+    ShowToastRequest, TemplateRenderResponse, WindowInfoResponse, WindowNavigateEvent,
+    WorkspaceInfo,
 };
 use yaak_plugins::manager::PluginManager;
 use yaak_plugins::plugin_handle::PluginHandle;
@@ -41,30 +43,112 @@ pub(crate) async fn handle_plugin_event<R: Runtime>(
 ) -> Result<Option<InternalEventPayload>> {
     // log::debug!("Got event to app {event:?}");
     let plugin_context = event.context.to_owned();
-    match event.clone().payload {
-        InternalEventPayload::CopyTextRequest(req) => {
+    let plugin_name = plugin_handle.info().name;
+    let fallback_workspace_id = plugin_context.workspace_id.clone().or_else(|| {
+        plugin_context
+            .label
+            .as_ref()
+            .and_then(|label| app_handle.get_webview_window(label))
+            .and_then(|window| workspace_from_window(&window).map(|workspace| workspace.id))
+    });
+
+    match handle_shared_plugin_event(
+        app_handle.db_manager().inner(),
+        &event.payload,
+        SharedPluginEventContext {
+            plugin_name: &plugin_name,
+            workspace_id: fallback_workspace_id.as_deref(),
+        },
+    ) {
+        GroupedPluginEvent::Handled(payload) => Ok(payload),
+        GroupedPluginEvent::ToHandle(host_request) => {
+            handle_host_plugin_request(
+                app_handle,
+                event,
+                plugin_handle,
+                &plugin_context,
+                host_request,
+            )
+            .await
+        }
+    }
+}
+
+async fn handle_host_plugin_request<R: Runtime>(
+    app_handle: &AppHandle<R>,
+    event: &InternalEvent,
+    plugin_handle: &PluginHandle,
+    plugin_context: &yaak_plugins::events::PluginContext,
+    host_request: HostRequest<'_>,
+) -> Result<Option<InternalEventPayload>> {
+    match host_request {
+        HostRequest::ErrorResponse(resp) => {
+            error!("Plugin error: {}: {:?}", resp.error, resp);
+            let toast_event = plugin_handle.build_event_to_send(
+                plugin_context,
+                &InternalEventPayload::ShowToastRequest(ShowToastRequest {
+                    message: format!(
+                        "Plugin error from {}: {}",
+                        plugin_handle.info().name,
+                        resp.error
+                    ),
+                    color: Some(Color::Danger),
+                    timeout: Some(30000),
+                    ..Default::default()
+                }),
+                None,
+            );
+            Box::pin(handle_plugin_event(app_handle, &toast_event, plugin_handle)).await
+        }
+        HostRequest::ReloadResponse(req) => {
+            let plugins = app_handle.db().list_plugins()?;
+            for plugin in plugins {
+                if plugin.directory != plugin_handle.dir {
+                    continue;
+                }
+
+                let new_plugin = Plugin { updated_at: Utc::now().naive_utc(), ..plugin };
+                app_handle.db().upsert_plugin(&new_plugin, &UpdateSource::Plugin)?;
+            }
+
+            if !req.silent {
+                let info = plugin_handle.info();
+                let toast_event = plugin_handle.build_event_to_send(
+                    plugin_context,
+                    &InternalEventPayload::ShowToastRequest(ShowToastRequest {
+                        message: format!("Reloaded plugin {}@{}", info.name, info.version),
+                        icon: Some(Icon::Info),
+                        timeout: Some(5000),
+                        ..Default::default()
+                    }),
+                    None,
+                );
+                Box::pin(handle_plugin_event(app_handle, &toast_event, plugin_handle)).await
+            } else {
+                Ok(None)
+            }
+        }
+        HostRequest::CopyText(req) => {
             app_handle.clipboard().write_text(req.text.as_str())?;
             Ok(Some(InternalEventPayload::CopyTextResponse(EmptyPayload {})))
         }
-        InternalEventPayload::ShowToastRequest(req) => {
-            match plugin_context.label {
+        HostRequest::ShowToast(req) => {
+            match &plugin_context.label {
                 Some(label) => app_handle.emit_to(label, "show_toast", req)?,
                 None => app_handle.emit("show_toast", req)?,
             };
             Ok(Some(InternalEventPayload::ShowToastResponse(EmptyPayload {})))
         }
-        InternalEventPayload::PromptTextRequest(_) => {
-            let window = get_window_from_plugin_context(app_handle, &plugin_context)?;
+        HostRequest::PromptText(_) => {
+            let window = get_window_from_plugin_context(app_handle, plugin_context)?;
             Ok(call_frontend(&window, event).await)
         }
-        InternalEventPayload::PromptFormRequest(_) => {
-            let window = get_window_from_plugin_context(app_handle, &plugin_context)?;
+        HostRequest::PromptForm(_) => {
+            let window = get_window_from_plugin_context(app_handle, plugin_context)?;
             if event.reply_id.is_some() {
-                // Follow-up update from plugin runtime with resolved inputs — forward to frontend
                 window.emit_to(window.label(), "plugin_event", event.clone())?;
                 Ok(None)
             } else {
-                // Initial request — set up bidirectional communication
                 window.emit_to(window.label(), "plugin_event", event.clone()).unwrap();
 
                 let event_id = event.id.clone();
@@ -72,17 +156,14 @@ pub(crate) async fn handle_plugin_event<R: Runtime>(
                 let plugin_context = plugin_context.clone();
                 let window = window.clone();
 
-                // Spawn async task to handle bidirectional form communication
                 tauri::async_runtime::spawn(async move {
                     let (tx, mut rx) = tokio::sync::mpsc::channel::<InternalEvent>(128);
 
-                    // Listen for replies from the frontend
                     let listener_id = window.listen(event_id, move |ev: tauri::Event| {
                         let resp: InternalEvent = serde_json::from_str(ev.payload()).unwrap();
                         let _ = tx.try_send(resp);
                     });
 
-                    // Forward each reply to the plugin runtime
                     while let Some(resp) = rx.recv().await {
                         let is_done = matches!(
                             &resp.payload,
@@ -109,104 +190,8 @@ pub(crate) async fn handle_plugin_event<R: Runtime>(
                 Ok(None)
             }
         }
-        InternalEventPayload::FindHttpResponsesRequest(req) => {
-            let http_responses = app_handle
-                .db()
-                .list_http_responses_for_request(&req.request_id, req.limit.map(|l| l as u64))
-                .unwrap_or_default();
-            Ok(Some(InternalEventPayload::FindHttpResponsesResponse(FindHttpResponsesResponse {
-                http_responses,
-            })))
-        }
-        InternalEventPayload::ListHttpRequestsRequest(req) => {
-            let w = get_window_from_plugin_context(app_handle, &plugin_context)?;
-            let workspace = workspace_from_window(&w)
-                .ok_or(PluginErr("Failed to get workspace from window".into()))?;
-
-            let http_requests = if let Some(folder_id) = req.folder_id {
-                app_handle.db().list_http_requests_for_folder_recursive(&folder_id)?
-            } else {
-                app_handle.db().list_http_requests(&workspace.id)?
-            };
-
-            Ok(Some(InternalEventPayload::ListHttpRequestsResponse(ListHttpRequestsResponse {
-                http_requests,
-            })))
-        }
-        InternalEventPayload::ListFoldersRequest(_req) => {
-            let w = get_window_from_plugin_context(app_handle, &plugin_context)?;
-            let workspace = workspace_from_window(&w)
-                .ok_or(PluginErr("Failed to get workspace from window".into()))?;
-            let folders = app_handle.db().list_folders(&workspace.id)?;
-
-            Ok(Some(InternalEventPayload::ListFoldersResponse(
-                yaak_plugins::events::ListFoldersResponse { folders },
-            )))
-        }
-        InternalEventPayload::UpsertModelRequest(req) => {
-            use AnyModel::*;
-            let model = match &req.model {
-                HttpRequest(m) => {
-                    HttpRequest(app_handle.db().upsert_http_request(m, &UpdateSource::Plugin)?)
-                }
-                GrpcRequest(m) => {
-                    GrpcRequest(app_handle.db().upsert_grpc_request(m, &UpdateSource::Plugin)?)
-                }
-                WebsocketRequest(m) => WebsocketRequest(
-                    app_handle.db().upsert_websocket_request(m, &UpdateSource::Plugin)?,
-                ),
-                Folder(m) => Folder(app_handle.db().upsert_folder(m, &UpdateSource::Plugin)?),
-                Environment(m) => {
-                    Environment(app_handle.db().upsert_environment(m, &UpdateSource::Plugin)?)
-                }
-                Workspace(m) => {
-                    Workspace(app_handle.db().upsert_workspace(m, &UpdateSource::Plugin)?)
-                }
-                _ => {
-                    return Err(PluginErr("Upsert not supported for this model type".into()).into());
-                }
-            };
-
-            Ok(Some(InternalEventPayload::UpsertModelResponse(
-                yaak_plugins::events::UpsertModelResponse { model },
-            )))
-        }
-        InternalEventPayload::DeleteModelRequest(req) => {
-            let model = match req.model.as_str() {
-                "http_request" => AnyModel::HttpRequest(
-                    app_handle.db().delete_http_request_by_id(&req.id, &UpdateSource::Plugin)?,
-                ),
-                "grpc_request" => AnyModel::GrpcRequest(
-                    app_handle.db().delete_grpc_request_by_id(&req.id, &UpdateSource::Plugin)?,
-                ),
-                "websocket_request" => AnyModel::WebsocketRequest(
-                    app_handle
-                        .db()
-                        .delete_websocket_request_by_id(&req.id, &UpdateSource::Plugin)?,
-                ),
-                "folder" => AnyModel::Folder(
-                    app_handle.db().delete_folder_by_id(&req.id, &UpdateSource::Plugin)?,
-                ),
-                "environment" => AnyModel::Environment(
-                    app_handle.db().delete_environment_by_id(&req.id, &UpdateSource::Plugin)?,
-                ),
-                _ => {
-                    return Err(PluginErr("Delete not supported for this model type".into()).into());
-                }
-            };
-
-            Ok(Some(InternalEventPayload::DeleteModelResponse(
-                yaak_plugins::events::DeleteModelResponse { model },
-            )))
-        }
-        InternalEventPayload::GetHttpRequestByIdRequest(req) => {
-            let http_request = app_handle.db().get_http_request(&req.id).ok();
-            Ok(Some(InternalEventPayload::GetHttpRequestByIdResponse(GetHttpRequestByIdResponse {
-                http_request,
-            })))
-        }
-        InternalEventPayload::RenderGrpcRequestRequest(req) => {
-            let window = get_window_from_plugin_context(app_handle, &plugin_context)?;
+        HostRequest::RenderGrpcRequest(req) => {
+            let window = get_window_from_plugin_context(app_handle, plugin_context)?;
 
             let workspace =
                 workspace_from_window(&window).expect("Failed to get workspace_id from window URL");
@@ -221,8 +206,8 @@ pub(crate) async fn handle_plugin_event<R: Runtime>(
             let cb = PluginTemplateCallback::new(
                 plugin_manager,
                 encryption_manager,
-                &plugin_context,
-                req.purpose,
+                plugin_context,
+                req.purpose.clone(),
             );
             let opt = RenderOptions { error_behavior: RenderErrorBehavior::Throw };
             let grpc_request =
@@ -231,8 +216,8 @@ pub(crate) async fn handle_plugin_event<R: Runtime>(
                 grpc_request,
             })))
         }
-        InternalEventPayload::RenderHttpRequestRequest(req) => {
-            let window = get_window_from_plugin_context(app_handle, &plugin_context)?;
+        HostRequest::RenderHttpRequest(req) => {
+            let window = get_window_from_plugin_context(app_handle, plugin_context)?;
 
             let workspace =
                 workspace_from_window(&window).expect("Failed to get workspace_id from window URL");
@@ -247,18 +232,18 @@ pub(crate) async fn handle_plugin_event<R: Runtime>(
             let cb = PluginTemplateCallback::new(
                 plugin_manager,
                 encryption_manager,
-                &plugin_context,
-                req.purpose,
+                plugin_context,
+                req.purpose.clone(),
             );
             let opt = &RenderOptions { error_behavior: RenderErrorBehavior::Throw };
             let http_request =
-                render_http_request(&req.http_request, environment_chain, &cb, &opt).await?;
+                render_http_request(&req.http_request, environment_chain, &cb, opt).await?;
             Ok(Some(InternalEventPayload::RenderHttpRequestResponse(RenderHttpRequestResponse {
                 http_request,
             })))
         }
-        InternalEventPayload::TemplateRenderRequest(req) => {
-            let window = get_window_from_plugin_context(app_handle, &plugin_context)?;
+        HostRequest::TemplateRender(req) => {
+            let window = get_window_from_plugin_context(app_handle, plugin_context)?;
 
             let workspace =
                 workspace_from_window(&window).expect("Failed to get workspace_id from window URL");
@@ -283,65 +268,16 @@ pub(crate) async fn handle_plugin_event<R: Runtime>(
             let cb = PluginTemplateCallback::new(
                 plugin_manager,
                 encryption_manager,
-                &plugin_context,
-                req.purpose,
+                plugin_context,
+                req.purpose.clone(),
             );
             let opt = RenderOptions { error_behavior: RenderErrorBehavior::Throw };
-            let data = render_json_value(req.data, environment_chain, &cb, &opt).await?;
+            let data = render_json_value(req.data.clone(), environment_chain, &cb, &opt).await?;
             Ok(Some(InternalEventPayload::TemplateRenderResponse(TemplateRenderResponse { data })))
         }
-        InternalEventPayload::ErrorResponse(resp) => {
-            error!("Plugin error: {}: {:?}", resp.error, resp);
-            let toast_event = plugin_handle.build_event_to_send(
-                &plugin_context,
-                &InternalEventPayload::ShowToastRequest(ShowToastRequest {
-                    message: format!(
-                        "Plugin error from {}: {}",
-                        plugin_handle.info().name,
-                        resp.error
-                    ),
-                    color: Some(Color::Danger),
-                    timeout: Some(30000),
-                    ..Default::default()
-                }),
-                None,
-            );
-            Box::pin(handle_plugin_event(app_handle, &toast_event, plugin_handle)).await
-        }
-        InternalEventPayload::ReloadResponse(req) => {
-            let plugins = app_handle.db().list_plugins()?;
-            for plugin in plugins {
-                if plugin.directory != plugin_handle.dir {
-                    continue;
-                }
-
-                let new_plugin = Plugin {
-                    updated_at: Utc::now().naive_utc(), // TODO: Add reloaded_at field to use instead
-                    ..plugin
-                };
-                app_handle.db().upsert_plugin(&new_plugin, &UpdateSource::Plugin)?;
-            }
-
-            if !req.silent {
-                let info = plugin_handle.info();
-                let toast_event = plugin_handle.build_event_to_send(
-                    &plugin_context,
-                    &InternalEventPayload::ShowToastRequest(ShowToastRequest {
-                        message: format!("Reloaded plugin {}@{}", info.name, info.version),
-                        icon: Some(Icon::Info),
-                        timeout: Some(3000),
-                        ..Default::default()
-                    }),
-                    None,
-                );
-                Box::pin(handle_plugin_event(app_handle, &toast_event, plugin_handle)).await
-            } else {
-                Ok(None)
-            }
-        }
-        InternalEventPayload::SendHttpRequestRequest(req) => {
-            let window = get_window_from_plugin_context(app_handle, &plugin_context)?;
-            let mut http_request = req.http_request;
+        HostRequest::SendHttpRequest(req) => {
+            let window = get_window_from_plugin_context(app_handle, plugin_context)?;
+            let mut http_request = req.http_request.clone();
             let workspace =
                 workspace_from_window(&window).expect("Failed to get workspace_id from window URL");
             let cookie_jar = cookie_jar_from_window(&window);
@@ -361,7 +297,7 @@ pub(crate) async fn handle_plugin_event<R: Runtime>(
                         workspace_id: http_request.workspace_id.clone(),
                         ..Default::default()
                     },
-                    &UpdateSource::Plugin,
+                    &UpdateSource::from_window_label(window.label()),
                     &blobs,
                 )?
             };
@@ -372,8 +308,8 @@ pub(crate) async fn handle_plugin_event<R: Runtime>(
                 &http_response,
                 environment,
                 cookie_jar,
-                &mut tokio::sync::watch::channel(false).1, // No-op cancel channel
-                &plugin_context,
+                &mut tokio::sync::watch::channel(false).1,
+                plugin_context,
             )
             .await?;
 
@@ -381,7 +317,7 @@ pub(crate) async fn handle_plugin_event<R: Runtime>(
                 http_response,
             })))
         }
-        InternalEventPayload::OpenWindowRequest(req) => {
+        HostRequest::OpenWindow(req) => {
             let (navigation_tx, mut navigation_rx) = tokio::sync::mpsc::channel(128);
             let (close_tx, mut close_rx) = tokio::sync::mpsc::channel(128);
             let win_config = CreateWindowConfig {
@@ -396,7 +332,7 @@ pub(crate) async fn handle_plugin_event<R: Runtime>(
             };
             if let Err(e) = create_window(app_handle, win_config) {
                 let error_event = plugin_handle.build_event_to_send(
-                    &plugin_context,
+                    plugin_context,
                     &InternalEventPayload::ErrorResponse(ErrorResponse {
                         error: format!("Failed to create window: {:?}", e),
                     }),
@@ -414,7 +350,7 @@ pub(crate) async fn handle_plugin_event<R: Runtime>(
                     while let Some(url) = navigation_rx.recv().await {
                         let url = url.to_string();
                         let event_to_send = plugin_handle.build_event_to_send(
-                            &plugin_context, // NOTE: Sending existing context on purpose here
+                            &plugin_context,
                             &InternalEventPayload::WindowNavigateEvent(WindowNavigateEvent { url }),
                             Some(event_id.clone()),
                         );
@@ -428,7 +364,7 @@ pub(crate) async fn handle_plugin_event<R: Runtime>(
                 let plugin_handle = plugin_handle.clone();
                 let plugin_context = plugin_context.clone();
                 tauri::async_runtime::spawn(async move {
-                    while let Some(_) = close_rx.recv().await {
+                    while close_rx.recv().await.is_some() {
                         let event_to_send = plugin_handle.build_event_to_send(
                             &plugin_context,
                             &InternalEventPayload::WindowCloseEvent,
@@ -441,35 +377,33 @@ pub(crate) async fn handle_plugin_event<R: Runtime>(
 
             Ok(None)
         }
-        InternalEventPayload::CloseWindowRequest(req) => {
+        HostRequest::CloseWindow(req) => {
             if let Some(window) = app_handle.webview_windows().get(&req.label) {
                 window.close()?;
             }
             Ok(None)
         }
-        InternalEventPayload::OpenExternalUrlRequest(req) => {
+        HostRequest::OpenExternalUrl(req) => {
             app_handle.opener().open_url(&req.url, None::<&str>)?;
             Ok(Some(InternalEventPayload::OpenExternalUrlResponse(EmptyPayload {})))
         }
-        InternalEventPayload::SetKeyValueRequest(req) => {
-            let name = plugin_handle.info().name;
-            app_handle.db().set_plugin_key_value(&name, &req.key, &req.value);
-            Ok(Some(InternalEventPayload::SetKeyValueResponse(SetKeyValueResponse {})))
-        }
-        InternalEventPayload::GetKeyValueRequest(req) => {
-            let name = plugin_handle.info().name;
-            let value = app_handle.db().get_plugin_key_value(&name, &req.key).map(|v| v.value);
-            Ok(Some(InternalEventPayload::GetKeyValueResponse(GetKeyValueResponse { value })))
-        }
-        InternalEventPayload::DeleteKeyValueRequest(req) => {
-            let name = plugin_handle.info().name;
-            let deleted = app_handle.db().delete_plugin_key_value(&name, &req.key)?;
-            Ok(Some(InternalEventPayload::DeleteKeyValueResponse(DeleteKeyValueResponse {
-                deleted,
+        HostRequest::ListOpenWorkspaces(_) => {
+            let mut workspaces = Vec::new();
+            for (_, window) in app_handle.webview_windows() {
+                if let Some(workspace) = workspace_from_window(&window) {
+                    workspaces.push(WorkspaceInfo {
+                        id: workspace.id.clone(),
+                        name: workspace.name.clone(),
+                        label: window.label().to_string(),
+                    });
+                }
+            }
+            Ok(Some(InternalEventPayload::ListOpenWorkspacesResponse(ListOpenWorkspacesResponse {
+                workspaces,
             })))
         }
-        InternalEventPayload::ListCookieNamesRequest(_req) => {
-            let window = get_window_from_plugin_context(app_handle, &plugin_context)?;
+        HostRequest::ListCookieNames(_) => {
+            let window = get_window_from_plugin_context(app_handle, plugin_context)?;
             let names = match cookie_jar_from_window(&window) {
                 None => Vec::new(),
                 Some(j) => j
@@ -482,8 +416,8 @@ pub(crate) async fn handle_plugin_event<R: Runtime>(
                 names,
             })))
         }
-        InternalEventPayload::GetCookieValueRequest(req) => {
-            let window = get_window_from_plugin_context(app_handle, &plugin_context)?;
+        HostRequest::GetCookieValue(req) => {
+            let window = get_window_from_plugin_context(app_handle, plugin_context)?;
             let value = match cookie_jar_from_window(&window) {
                 None => None,
                 Some(j) => j.cookies.into_iter().find_map(|c| match Cookie::parse(c.raw_cookie) {
@@ -495,12 +429,11 @@ pub(crate) async fn handle_plugin_event<R: Runtime>(
             };
             Ok(Some(InternalEventPayload::GetCookieValueResponse(GetCookieValueResponse { value })))
         }
-        InternalEventPayload::WindowInfoRequest(req) => {
+        HostRequest::WindowInfo(req) => {
             let w = app_handle
                 .get_webview_window(&req.label)
                 .ok_or(PluginErr(format!("Failed to find window for {}", req.label)))?;
 
-            // Actually look up the data so we never return an invalid ID
             let environment_id = environment_from_window(&w).map(|m| m.id);
             let workspace_id = workspace_from_window(&w).map(|m| m.id);
             let request_id =
@@ -518,25 +451,13 @@ pub(crate) async fn handle_plugin_event<R: Runtime>(
                 environment_id,
             })))
         }
-
-        InternalEventPayload::ListWorkspacesRequest(_) => {
-            let mut workspaces = Vec::new();
-
-            for (_, window) in app_handle.webview_windows() {
-                if let Some(workspace) = workspace_from_window(&window) {
-                    workspaces.push(WorkspaceInfo {
-                        id: workspace.id.clone(),
-                        name: workspace.name.clone(),
-                        label: window.label().to_string(),
-                    });
-                }
-            }
-
-            Ok(Some(InternalEventPayload::ListWorkspacesResponse(ListWorkspacesResponse {
-                workspaces,
+        HostRequest::OtherRequest(req) => {
+            Ok(Some(InternalEventPayload::ErrorResponse(ErrorResponse {
+                error: format!(
+                    "Unsupported plugin request in app host handler: {}",
+                    req.type_name()
+                ),
             })))
         }
-
-        _ => Ok(None),
     }
 }

crates-tauri/yaak-app/src/plugins_ext.rs

@@ -21,14 +21,14 @@ use tauri::{
 };
 use tokio::sync::Mutex;
 use ts_rs::TS;
-use yaak_api::yaak_api_client;
-use yaak_models::models::Plugin;
+use yaak_api::{ApiClientKind, yaak_api_client};
+use yaak_models::models::{Plugin, PluginSource};
 use yaak_models::util::UpdateSource;
 use yaak_plugins::api::{
     PluginNameVersion, PluginSearchResponse, PluginUpdatesResponse, check_plugin_updates,
     search_plugins,
 };
-use yaak_plugins::events::{Color, Icon, PluginContext, ShowToastRequest};
+use yaak_plugins::events::PluginContext;
 use yaak_plugins::install::{delete_and_uninstall, download_and_install};
 use yaak_plugins::manager::PluginManager;
 use yaak_plugins::plugin_meta::get_plugin_meta;
@@ -73,7 +73,7 @@ impl PluginUpdater {
         info!("Checking for plugin updates");
 
         let app_version = window.app_handle().package_info().version.to_string();
-        let http_client = yaak_api_client(&app_version)?;
+        let http_client = yaak_api_client(ApiClientKind::App, &app_version)?;
         let plugins = window.app_handle().db().list_plugins()?;
         let updates = check_plugin_updates(&http_client, plugins.clone()).await?;
 
@@ -138,7 +138,7 @@ pub async fn cmd_plugins_search<R: Runtime>(
     query: &str,
 ) -> Result<PluginSearchResponse> {
     let app_version = app_handle.package_info().version.to_string();
-    let http_client = yaak_api_client(&app_version)?;
+    let http_client = yaak_api_client(ApiClientKind::App, &app_version)?;
     Ok(search_plugins(&http_client, query).await?)
 }
 
@@ -150,7 +150,7 @@ pub async fn cmd_plugins_install<R: Runtime>(
 ) -> Result<()> {
     let plugin_manager = Arc::new((*window.state::<PluginManager>()).clone());
     let app_version = window.app_handle().package_info().version.to_string();
-    let http_client = yaak_api_client(&app_version)?;
+    let http_client = yaak_api_client(ApiClientKind::App, &app_version)?;
     let query_manager = window.state::<yaak_models::query_manager::QueryManager>();
     let plugin_context = window.plugin_context();
     download_and_install(
@@ -165,6 +165,28 @@ pub async fn cmd_plugins_install<R: Runtime>(
     Ok(())
 }
 
+#[command]
+pub async fn cmd_plugins_install_from_directory<R: Runtime>(
+    window: WebviewWindow<R>,
+    directory: &str,
+) -> Result<Plugin> {
+    let plugin = window.db().upsert_plugin(
+        &Plugin {
+            directory: directory.into(),
+            url: None,
+            enabled: true,
+            source: PluginSource::Filesystem,
+            ..Default::default()
+        },
+        &UpdateSource::from_window_label(window.label()),
+    )?;
+
+    let plugin_manager = Arc::new((*window.state::<PluginManager>()).clone());
+    plugin_manager.add_plugin(&window.plugin_context(), &plugin).await?;
+
+    Ok(plugin)
+}
+
 #[command]
 pub async fn cmd_plugins_uninstall<R: Runtime>(
     plugin_id: &str,
@@ -181,7 +203,7 @@ pub async fn cmd_plugins_updates<R: Runtime>(
     app_handle: AppHandle<R>,
 ) -> Result<PluginUpdatesResponse> {
     let app_version = app_handle.package_info().version.to_string();
-    let http_client = yaak_api_client(&app_version)?;
+    let http_client = yaak_api_client(ApiClientKind::App, &app_version)?;
     let plugins = app_handle.db().list_plugins()?;
     Ok(check_plugin_updates(&http_client, plugins).await?)
 }
@@ -191,7 +213,7 @@ pub async fn cmd_plugins_update_all<R: Runtime>(
     window: WebviewWindow<R>,
 ) -> Result<Vec<PluginNameVersion>> {
     let app_version = window.app_handle().package_info().version.to_string();
-    let http_client = yaak_api_client(&app_version)?;
+    let http_client = yaak_api_client(ApiClientKind::App, &app_version)?;
     let plugins = window.db().list_plugins()?;
 
     // Get list of available updates (already filtered to only registry plugins)
@@ -268,6 +290,8 @@ pub fn init<R: Runtime>() -> TauriPlugin<R> {
                 .join("index.cjs");
 
             let dev_mode = is_dev();
+            let query_manager =
+                app_handle.state::<yaak_models::query_manager::QueryManager>().inner().clone();
 
             // Create plugin manager asynchronously
             let app_handle_clone = app_handle.clone();
@@ -277,53 +301,12 @@ pub fn init<R: Runtime>() -> TauriPlugin<R> {
                     installed_plugin_dir,
                     node_bin_path,
                     plugin_runtime_main,
+                    &query_manager,
+                    &PluginContext::new_empty(),
                     dev_mode,
                 )
-                .await;
-
-                // Initialize all plugins after manager is created
-                let bundled_dirs = manager
-                    .list_bundled_plugin_dirs()
-                    .await
-                    .expect("Failed to list bundled plugins");
-
-                // Ensure all bundled plugins make it into the database
-                let db = app_handle_clone.db();
-                for dir in &bundled_dirs {
-                    if db.get_plugin_by_directory(dir).is_none() {
-                        db.upsert_plugin(
-                            &Plugin {
-                                directory: dir.clone(),
-                                enabled: true,
-                                url: None,
-                                ..Default::default()
-                            },
-                            &UpdateSource::Background,
-                        )
-                        .expect("Failed to upsert bundled plugin");
-                    }
-                }
-
-                // Get all plugins from database and initialize
-                let plugins = db.list_plugins().expect("Failed to list plugins from database");
-                drop(db); // Explicitly drop the connection before await
-
-                let errors =
-                    manager.initialize_all_plugins(plugins, &PluginContext::new_empty()).await;
-
-                // Show toast for any failed plugins
-                for (plugin_dir, error_msg) in errors {
-                    let plugin_name = plugin_dir.split('/').last().unwrap_or(&plugin_dir);
-                    let toast = ShowToastRequest {
-                        message: format!("Failed to start plugin '{}': {}", plugin_name, error_msg),
-                        color: Some(Color::Danger),
-                        icon: Some(Icon::AlertTriangle),
-                        timeout: Some(10000),
-                    };
-                    if let Err(emit_err) = app_handle_clone.emit("show_toast", toast) {
-                        error!("Failed to emit toast for plugin error: {emit_err:?}");
-                    }
-                }
+                .await
+                .expect("Failed to initialize plugins");
 
                 app_handle_clone.manage(manager);
             });

crates-tauri/yaak-app/src/uri_scheme.rs

@@ -8,7 +8,7 @@ use std::fs;
 use std::sync::Arc;
 use tauri::{AppHandle, Emitter, Manager, Runtime, Url};
 use tauri_plugin_dialog::{DialogExt, MessageDialogButtons, MessageDialogKind};
-use yaak_api::yaak_api_client;
+use yaak_api::{ApiClientKind, yaak_api_client};
 use yaak_models::util::generate_id;
 use yaak_plugins::events::{Color, ShowToastRequest};
 use yaak_plugins::install::download_and_install;
@@ -47,7 +47,7 @@ pub(crate) async fn handle_deep_link<R: Runtime>(
             let plugin_manager = Arc::new((*window.state::<PluginManager>()).clone());
             let query_manager = app_handle.db_manager();
             let app_version = app_handle.package_info().version.to_string();
-            let http_client = yaak_api_client(&app_version)?;
+            let http_client = yaak_api_client(ApiClientKind::App, &app_version)?;
             let plugin_context = window.plugin_context();
             let pv = download_and_install(
                 plugin_manager,
@@ -88,7 +88,8 @@ pub(crate) async fn handle_deep_link<R: Runtime>(
                 }
 
                 let app_version = app_handle.package_info().version.to_string();
-                let resp = yaak_api_client(&app_version)?.get(file_url).send().await?;
+                let resp =
+                    yaak_api_client(ApiClientKind::App, &app_version)?.get(file_url).send().await?;
                 let json = resp.bytes().await?;
                 let p = app_handle
                     .path()

crates-tauri/yaak-license/src/license.rs

@@ -7,7 +7,7 @@ use std::ops::Add;
 use std::time::Duration;
 use tauri::{AppHandle, Emitter, Manager, Runtime, WebviewWindow, is_dev};
 use ts_rs::TS;
-use yaak_api::yaak_api_client;
+use yaak_api::{ApiClientKind, yaak_api_client};
 use yaak_common::platform::get_os_str;
 use yaak_models::db_context::DbContext;
 use yaak_models::query_manager::QueryManager;
@@ -119,7 +119,7 @@ pub async fn activate_license<R: Runtime>(
 ) -> Result<()> {
     info!("Activating license {}", license_key);
     let app_version = window.app_handle().package_info().version.to_string();
-    let client = yaak_api_client(&app_version)?;
+    let client = yaak_api_client(ApiClientKind::App, &app_version)?;
     let payload = ActivateLicenseRequestPayload {
         license_key: license_key.to_string(),
         app_platform: get_os_str().to_string(),
@@ -157,7 +157,7 @@ pub async fn deactivate_license<R: Runtime>(window: &WebviewWindow<R>) -> Result
     let activation_id = get_activation_id(app_handle).await;
 
     let app_version = window.app_handle().package_info().version.to_string();
-    let client = yaak_api_client(&app_version)?;
+    let client = yaak_api_client(ApiClientKind::App, &app_version)?;
     let path = format!("/licenses/activations/{}/deactivate", activation_id);
     let payload =
         DeactivateLicenseRequestPayload { app_platform: get_os_str().to_string(), app_version };
@@ -203,7 +203,7 @@ pub async fn check_license<R: Runtime>(window: &WebviewWindow<R>) -> Result<Lice
         (true, _) => {
             info!("Checking license activation");
             // A license has been activated, so let's check the license server
-            let client = yaak_api_client(&payload.app_version)?;
+            let client = yaak_api_client(ApiClientKind::App, &payload.app_version)?;
             let path = format!("/licenses/activations/{activation_id}/check-v2");
             let response = client.post(build_url(&path)).json(&payload).send().await?;
 

crates/yaak-api/src/lib.rs

@@ -8,14 +8,24 @@ use reqwest::header::{HeaderMap, HeaderValue};
 use std::time::Duration;
 use yaak_common::platform::{get_ua_arch, get_ua_platform};
 
+#[derive(Debug, Clone, Copy, Eq, PartialEq)]
+pub enum ApiClientKind {
+    App,
+    Cli,
+}
+
 /// Build a reqwest Client configured for Yaak's own API calls.
 ///
 /// Includes a custom User-Agent, JSON accept header, 20s timeout, gzip,
 /// and automatic OS-level proxy detection via sysproxy.
-pub fn yaak_api_client(version: &str) -> Result<Client> {
+pub fn yaak_api_client(kind: ApiClientKind, version: &str) -> Result<Client> {
     let platform = get_ua_platform();
     let arch = get_ua_arch();
-    let ua = format!("Yaak/{version} ({platform}; {arch})");
+    let product = match kind {
+        ApiClientKind::App => "Yaak",
+        ApiClientKind::Cli => "YaakCli",
+    };
+    let ua = format!("{product}/{version} ({platform}; {arch})");
 
     let mut default_headers = HeaderMap::new();
     default_headers.insert("Accept", HeaderValue::from_str("application/json").unwrap());

crates/yaak-grpc/src/any.rs

@@ -55,6 +55,7 @@ mod tests {
 
         let mut out = Vec::new();
         super::collect_any_types(json, &mut out);
+        out.sort();
         assert_eq!(out, vec!["foo.bar", "mount_source.MountSourceRBDVolume"]);
     }
 }

crates/yaak-http/src/manager.rs

@@ -1,7 +1,6 @@
 use crate::client::HttpConnectionOptions;
 use crate::dns::LocalhostResolver;
 use crate::error::Result;
-use log::info;
 use reqwest::Client;
 use std::collections::BTreeMap;
 use std::sync::Arc;
@@ -36,7 +35,6 @@ impl HttpConnectionManager {
         connections.retain(|_, (_, last_used)| last_used.elapsed() <= self.ttl);
 
         if let Some((cached, last_used)) = connections.get_mut(&id) {
-            info!("Re-using HTTP client {id}");
             *last_used = Instant::now();
             return Ok(CachedClient {
                 client: cached.client.clone(),

crates/yaak-models/Cargo.toml

@@ -17,6 +17,7 @@ sea-query = { version = "0.32.1", features = ["with-chrono", "attr"] }
 sea-query-rusqlite = { version = "0.7.0", features = ["with-chrono"] }
 serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true }
+schemars = { workspace = true }
 sha2 = { workspace = true }
 thiserror = { workspace = true }
 ts-rs = { workspace = true, features = ["chrono-impl", "serde-json-impl"] }

crates/yaak-models/bindings/gen_models.ts

@@ -67,7 +67,9 @@ export type ParentAuthentication = { authentication: Record<string, any>, authen
 
 export type ParentHeaders = { headers: Array<HttpRequestHeader>, };
 
-export type Plugin = { model: "plugin", id: string, createdAt: string, updatedAt: string, checkedAt: string | null, directory: string, enabled: boolean, url: string | null, };
+export type Plugin = { model: "plugin", id: string, createdAt: string, updatedAt: string, checkedAt: string | null, directory: string, enabled: boolean, url: string | null, source: PluginSource, };
+
+export type PluginSource = "bundled" | "filesystem" | "registry";
 
 export type PluginKeyValue = { model: "plugin_key_value", createdAt: string, updatedAt: string, pluginName: string, key: string, value: string, };
 

crates/yaak-models/migrations/20260301000000_plugin-source-and-unique-directory.sql

@@ -0,0 +1,33 @@
+ALTER TABLE plugins
+    ADD COLUMN source TEXT DEFAULT 'filesystem' NOT NULL;
+
+-- Existing registry installs have a URL; classify them first.
+UPDATE plugins
+SET source = 'registry'
+WHERE url IS NOT NULL;
+
+-- Best-effort bundled backfill for legacy rows.
+UPDATE plugins
+SET source = 'bundled'
+WHERE source = 'filesystem'
+  AND (
+    -- Normalize separators so this also works for Windows paths.
+    replace(directory, '\', '/') LIKE '%/vendored/plugins/%'
+        OR replace(directory, '\', '/') LIKE '%/vendored-plugins/%'
+    );
+
+-- Keep one row per exact directory before adding uniqueness.
+-- Tie-break by recency.
+WITH ranked AS (SELECT id,
+                       ROW_NUMBER() OVER (
+                           PARTITION BY directory
+                           ORDER BY updated_at DESC,
+                               created_at DESC
+                           ) AS row_num
+                FROM plugins)
+DELETE
+FROM plugins
+WHERE id IN (SELECT id FROM ranked WHERE row_num > 1);
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_plugins_directory_unique
+    ON plugins (directory);

crates/yaak-models/src/models.rs

@@ -6,6 +6,7 @@ use crate::models::HttpRequestIden::{
 use crate::util::{UpdateSource, generate_prefixed_id};
 use chrono::{NaiveDateTime, Utc};
 use rusqlite::Row;
+use schemars::JsonSchema;
 use sea_query::Order::Desc;
 use sea_query::{IntoColumnRef, IntoIden, IntoTableRef, Order, SimpleExpr, enum_def};
 use serde::{Deserialize, Deserializer, Serialize};
@@ -73,7 +74,7 @@ pub struct ClientCertificate {
     pub enabled: bool,
 }
 
-#[derive(Debug, Clone, PartialEq, Serialize, Deserialize, Default, TS)]
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize, Default, JsonSchema, TS)]
 #[serde(rename_all = "camelCase")]
 #[ts(export, export_to = "gen_models.ts")]
 pub struct DnsOverride {
@@ -292,7 +293,7 @@ impl UpsertModelInfo for Settings {
     }
 }
 
-#[derive(Debug, Clone, PartialEq, Serialize, Deserialize, Default, TS)]
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize, Default, JsonSchema, TS)]
 #[serde(default, rename_all = "camelCase")]
 #[ts(export, export_to = "gen_models.ts")]
 #[enum_def(table_name = "workspaces")]
@@ -589,7 +590,7 @@ impl UpsertModelInfo for CookieJar {
     }
 }
 
-#[derive(Debug, Clone, PartialEq, Serialize, Deserialize, Default, TS)]
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize, Default, JsonSchema, TS)]
 #[serde(default, rename_all = "camelCase")]
 #[ts(export, export_to = "gen_models.ts")]
 #[enum_def(table_name = "environments")]
@@ -610,6 +611,8 @@ pub struct Environment {
     pub base: bool,
     pub parent_model: String,
     pub parent_id: Option<String>,
+    /// Variables defined in this environment scope.
+    /// Child environments override parent variables by name.
     pub variables: Vec<EnvironmentVariable>,
     pub color: Option<String>,
     pub sort_priority: f64,
@@ -697,7 +700,7 @@ impl UpsertModelInfo for Environment {
     }
 }
 
-#[derive(Debug, Clone, PartialEq, Serialize, Deserialize, Default, TS)]
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize, Default, JsonSchema, TS)]
 #[serde(default, rename_all = "camelCase")]
 #[ts(export, export_to = "gen_models.ts")]
 pub struct EnvironmentVariable {
@@ -824,7 +827,7 @@ impl UpsertModelInfo for Folder {
     }
 }
 
-#[derive(Debug, Clone, PartialEq, Serialize, Deserialize, Default, TS)]
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize, Default, JsonSchema, TS)]
 #[serde(default, rename_all = "camelCase")]
 #[ts(export, export_to = "gen_models.ts")]
 pub struct HttpRequestHeader {
@@ -837,20 +840,22 @@ pub struct HttpRequestHeader {
     pub id: Option<String>,
 }
 
-#[derive(Debug, Clone, PartialEq, Serialize, Deserialize, Default, TS)]
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize, Default, JsonSchema, TS)]
 #[serde(default, rename_all = "camelCase")]
 #[ts(export, export_to = "gen_models.ts")]
 pub struct HttpUrlParameter {
     #[serde(default = "default_true")]
     #[ts(optional, as = "Option<bool>")]
     pub enabled: bool,
+    /// Colon-prefixed parameters are treated as path parameters if they match, like `/users/:id`
+    /// Other entries are appended as query parameters
     pub name: String,
     pub value: String,
     #[ts(optional, as = "Option<String>")]
     pub id: Option<String>,
 }
 
-#[derive(Debug, Clone, PartialEq, Serialize, Deserialize, Default, TS)]
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize, Default, JsonSchema, TS)]
 #[serde(default, rename_all = "camelCase")]
 #[ts(export, export_to = "gen_models.ts")]
 #[enum_def(table_name = "http_requests")]
@@ -876,6 +881,7 @@ pub struct HttpRequest {
     pub name: String,
     pub sort_priority: f64,
     pub url: String,
+    /// URL parameters used for both path placeholders (`:id`) and query string entries.
     pub url_parameters: Vec<HttpUrlParameter>,
 }
 
@@ -1095,7 +1101,7 @@ impl Default for WebsocketMessageType {
     }
 }
 
-#[derive(Debug, Clone, PartialEq, Serialize, Deserialize, Default, TS)]
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize, Default, JsonSchema, TS)]
 #[serde(default, rename_all = "camelCase")]
 #[ts(export, export_to = "gen_models.ts")]
 #[enum_def(table_name = "websocket_requests")]
@@ -1117,6 +1123,7 @@ pub struct WebsocketRequest {
     pub name: String,
     pub sort_priority: f64,
     pub url: String,
+    /// URL parameters used for both path placeholders (`:id`) and query string entries.
     pub url_parameters: Vec<HttpUrlParameter>,
 }
 
@@ -1704,7 +1711,7 @@ impl UpsertModelInfo for GraphQlIntrospection {
     }
 }
 
-#[derive(Debug, Clone, PartialEq, Serialize, Deserialize, Default, TS)]
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize, Default, JsonSchema, TS)]
 #[serde(default, rename_all = "camelCase")]
 #[ts(export, export_to = "gen_models.ts")]
 #[enum_def(table_name = "grpc_requests")]
@@ -1727,6 +1734,7 @@ pub struct GrpcRequest {
     pub name: String,
     pub service: Option<String>,
     pub sort_priority: f64,
+    /// Server URL (http for plaintext or https for secure)
     pub url: String,
 }
 
@@ -2066,6 +2074,46 @@ pub struct Plugin {
     pub directory: String,
     pub enabled: bool,
     pub url: Option<String>,
+    pub source: PluginSource,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, TS)]
+#[serde(rename_all = "snake_case")]
+#[ts(export, export_to = "gen_models.ts")]
+pub enum PluginSource {
+    Bundled,
+    Filesystem,
+    Registry,
+}
+
+impl FromStr for PluginSource {
+    type Err = crate::error::Error;
+
+    fn from_str(s: &str) -> Result<Self> {
+        match s {
+            "bundled" => Ok(Self::Bundled),
+            "filesystem" => Ok(Self::Filesystem),
+            "registry" => Ok(Self::Registry),
+            _ => Ok(Self::default()),
+        }
+    }
+}
+
+impl Display for PluginSource {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        let str = match self {
+            PluginSource::Bundled => "bundled".to_string(),
+            PluginSource::Filesystem => "filesystem".to_string(),
+            PluginSource::Registry => "registry".to_string(),
+        };
+        write!(f, "{}", str)
+    }
+}
+
+impl Default for PluginSource {
+    fn default() -> Self {
+        Self::Filesystem
+    }
 }
 
 impl UpsertModelInfo for Plugin {
@@ -2101,6 +2149,7 @@ impl UpsertModelInfo for Plugin {
             (Directory, self.directory.into()),
             (Url, self.url.into()),
             (Enabled, self.enabled.into()),
+            (Source, self.source.to_string().into()),
         ])
     }
 
@@ -2111,6 +2160,7 @@ impl UpsertModelInfo for Plugin {
             PluginIden::Directory,
             PluginIden::Url,
             PluginIden::Enabled,
+            PluginIden::Source,
         ]
     }
 
@@ -2127,6 +2177,7 @@ impl UpsertModelInfo for Plugin {
             url: row.get("url")?,
             directory: row.get("directory")?,
             enabled: row.get("enabled")?,
+            source: PluginSource::from_str(row.get::<_, String>("source")?.as_str()).unwrap(),
         })
     }
 }

crates/yaak-models/src/queries/grpc_requests.rs

@@ -1,7 +1,7 @@
 use super::dedupe_headers;
 use crate::db_context::DbContext;
 use crate::error::Result;
-use crate::models::{GrpcRequest, GrpcRequestIden, HttpRequestHeader};
+use crate::models::{Folder, FolderIden, GrpcRequest, GrpcRequestIden, HttpRequestHeader};
 use crate::util::UpdateSource;
 use serde_json::Value;
 use std::collections::BTreeMap;
@@ -15,6 +15,20 @@ impl<'a> DbContext<'a> {
         self.find_many(GrpcRequestIden::WorkspaceId, workspace_id, None)
     }
 
+    pub fn list_grpc_requests_for_folder_recursive(
+        &self,
+        folder_id: &str,
+    ) -> Result<Vec<GrpcRequest>> {
+        let mut children = Vec::new();
+        for folder in self.find_many::<Folder>(FolderIden::FolderId, folder_id, None)? {
+            children.extend(self.list_grpc_requests_for_folder_recursive(&folder.id)?);
+        }
+        for request in self.find_many::<GrpcRequest>(GrpcRequestIden::FolderId, folder_id, None)? {
+            children.push(request);
+        }
+        Ok(children)
+    }
+
     pub fn delete_grpc_request(
         &self,
         m: &GrpcRequest,

crates/yaak-models/src/queries/plugins.rs

@@ -26,6 +26,10 @@ impl<'a> DbContext<'a> {
     }
 
     pub fn upsert_plugin(&self, plugin: &Plugin, source: &UpdateSource) -> Result<Plugin> {
-        self.upsert(plugin, source)
+        let mut plugin_to_upsert = plugin.clone();
+        if let Some(existing) = self.get_plugin_by_directory(&plugin.directory) {
+            plugin_to_upsert.id = existing.id;
+        }
+        self.upsert(&plugin_to_upsert, source)
     }
 }

crates/yaak-models/src/queries/websocket_requests.rs

@@ -1,7 +1,9 @@
 use super::dedupe_headers;
 use crate::db_context::DbContext;
 use crate::error::Result;
-use crate::models::{HttpRequestHeader, WebsocketRequest, WebsocketRequestIden};
+use crate::models::{
+    Folder, FolderIden, HttpRequestHeader, WebsocketRequest, WebsocketRequestIden,
+};
 use crate::util::UpdateSource;
 use serde_json::Value;
 use std::collections::BTreeMap;
@@ -15,6 +17,22 @@ impl<'a> DbContext<'a> {
         self.find_many(WebsocketRequestIden::WorkspaceId, workspace_id, None)
     }
 
+    pub fn list_websocket_requests_for_folder_recursive(
+        &self,
+        folder_id: &str,
+    ) -> Result<Vec<WebsocketRequest>> {
+        let mut children = Vec::new();
+        for folder in self.find_many::<Folder>(FolderIden::FolderId, folder_id, None)? {
+            children.extend(self.list_websocket_requests_for_folder_recursive(&folder.id)?);
+        }
+        for request in
+            self.find_many::<WebsocketRequest>(WebsocketRequestIden::FolderId, folder_id, None)?
+        {
+            children.push(request);
+        }
+        Ok(children)
+    }
+
     pub fn delete_websocket_request(
         &self,
         websocket_request: &WebsocketRequest,

crates/yaak-plugins/Cargo.toml

@@ -15,7 +15,6 @@ log = { workspace = true }
 md5 = "0.7.0"
 path-slash = "0.2.1"
 rand = "0.9.0"
-regex = "1.10.6"
 reqwest = { workspace = true, features = ["json"] }
 serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true }

crates/yaak-plugins/index.ts

@@ -24,3 +24,7 @@ export async function checkPluginUpdates() {
 export async function updateAllPlugins() {
   return invoke<PluginNameVersion[]>('cmd_plugins_update_all', {});
 }
+
+export async function installPluginFromDirectory(directory: string) {
+  return invoke<void>('cmd_plugins_install_from_directory', { directory });
+}

crates/yaak-plugins/src/api.rs

@@ -7,7 +7,7 @@ use serde::{Deserialize, Serialize};
 use std::path::Path;
 use std::str::FromStr;
 use ts_rs::TS;
-use yaak_models::models::Plugin;
+use yaak_models::models::{Plugin, PluginSource};
 
 /// Get plugin info from the registry.
 pub async fn get_plugin(
@@ -58,7 +58,7 @@ pub async fn check_plugin_updates(
 ) -> Result<PluginUpdatesResponse> {
     let name_versions: Vec<PluginNameVersion> = plugins
         .into_iter()
-        .filter(|p| p.url.is_some()) // Only check plugins with URLs (from registry)
+        .filter(|p| matches!(p.source, PluginSource::Registry)) // Only check registry-installed plugins
         .filter_map(|p| match get_plugin_meta(&Path::new(&p.directory)) {
             Ok(m) => Some(PluginNameVersion { name: m.name, version: m.version }),
             Err(e) => {

crates/yaak-plugins/src/events.rs

@@ -163,8 +163,8 @@ pub enum InternalEventPayload {
     WindowInfoRequest(WindowInfoRequest),
     WindowInfoResponse(WindowInfoResponse),
 
-    ListWorkspacesRequest(ListWorkspacesRequest),
-    ListWorkspacesResponse(ListWorkspacesResponse),
+    ListOpenWorkspacesRequest(ListOpenWorkspacesRequest),
+    ListOpenWorkspacesResponse(ListOpenWorkspacesResponse),
 
     GetHttpRequestByIdRequest(GetHttpRequestByIdRequest),
     GetHttpRequestByIdResponse(GetHttpRequestByIdResponse),
@@ -631,12 +631,12 @@ pub struct WindowInfoResponse {
 #[derive(Debug, Clone, Default, Serialize, Deserialize, TS)]
 #[serde(default, rename_all = "camelCase")]
 #[ts(export, export_to = "gen_events.ts")]
-pub struct ListWorkspacesRequest {}
+pub struct ListOpenWorkspacesRequest {}
 
 #[derive(Debug, Clone, Default, Serialize, Deserialize, TS)]
 #[serde(default, rename_all = "camelCase")]
 #[ts(export, export_to = "gen_events.ts")]
-pub struct ListWorkspacesResponse {
+pub struct ListOpenWorkspacesResponse {
     pub workspaces: Vec<WorkspaceInfo>,
 }
 

crates/yaak-plugins/src/install.rs

@@ -9,7 +9,7 @@ use log::info;
 use std::fs::{create_dir_all, remove_dir_all};
 use std::io::Cursor;
 use std::sync::Arc;
-use yaak_models::models::Plugin;
+use yaak_models::models::{Plugin, PluginSource};
 use yaak_models::query_manager::QueryManager;
 use yaak_models::util::UpdateSource;
 
@@ -78,6 +78,7 @@ pub async fn download_and_install(
                 directory: plugin_dir_str.clone(),
                 enabled: true,
                 url: Some(plugin_version.url.clone()),
+                source: PluginSource::Registry,
                 ..Default::default()
             },
             &UpdateSource::Background,

crates/yaak-plugins/src/manager.rs

@@ -21,9 +21,10 @@ use crate::events::{
 use crate::native_template_functions::{template_function_keyring, template_function_secure};
 use crate::nodejs::start_nodejs_plugin_runtime;
 use crate::plugin_handle::PluginHandle;
+use crate::plugin_meta::get_plugin_meta;
 use crate::server_ws::PluginRuntimeServerWebsocket;
 use log::{error, info, warn};
-use std::collections::HashMap;
+use std::collections::{HashMap, HashSet};
 use std::env;
 use std::path::{Path, PathBuf};
 use std::sync::Arc;
@@ -33,8 +34,9 @@ use tokio::net::TcpListener;
 use tokio::sync::mpsc::error::TrySendError;
 use tokio::sync::{Mutex, mpsc, oneshot};
 use tokio::time::{Instant, timeout};
-use yaak_models::models::Plugin;
-use yaak_models::util::generate_id;
+use yaak_models::models::{Plugin, PluginSource};
+use yaak_models::query_manager::QueryManager;
+use yaak_models::util::{UpdateSource, generate_id};
 use yaak_templates::error::Error::RenderError;
 use yaak_templates::error::Result as TemplateResult;
 
@@ -61,14 +63,18 @@ impl PluginManager {
     /// * `installed_plugin_dir` - Path to installed plugins directory
     /// * `node_bin_path` - Path to the yaaknode binary
     /// * `plugin_runtime_main` - Path to the plugin runtime index.cjs
+    /// * `query_manager` - Query manager for bundled plugin registration and loading
+    /// * `plugin_context` - Context to use while initializing plugins
     /// * `dev_mode` - Whether the app is in dev mode (affects plugin loading)
     pub async fn new(
         vendored_plugin_dir: PathBuf,
         installed_plugin_dir: PathBuf,
         node_bin_path: PathBuf,
         plugin_runtime_main: PathBuf,
+        query_manager: &QueryManager,
+        plugin_context: &PluginContext,
         dev_mode: bool,
-    ) -> PluginManager {
+    ) -> Result<PluginManager> {
         let (events_tx, mut events_rx) = mpsc::channel(2048);
         let (kill_server_tx, kill_server_rx) = tokio::sync::watch::channel(false);
         let (killed_tx, killed_rx) = oneshot::channel();
@@ -151,12 +157,41 @@ impl PluginManager {
             &kill_server_rx,
             killed_tx,
         )
-        .await
-        .unwrap();
+        .await?;
         info!("Waiting for plugins to initialize");
-        init_plugins_task.await.unwrap();
+        init_plugins_task.await.map_err(|e| PluginErr(e.to_string()))?;
 
-        plugin_manager
+        let bundled_dirs = plugin_manager.list_bundled_plugin_dirs().await?;
+        let db = query_manager.connect();
+        for dir in &bundled_dirs {
+            if db.get_plugin_by_directory(dir).is_none() {
+                db.upsert_plugin(
+                    &Plugin {
+                        directory: dir.clone(),
+                        enabled: true,
+                        url: None,
+                        source: PluginSource::Bundled,
+                        ..Default::default()
+                    },
+                    &UpdateSource::Background,
+                )?;
+            }
+        }
+
+        let plugins = db.list_plugins()?;
+        drop(db);
+
+        let init_errors = plugin_manager.initialize_all_plugins(plugins, plugin_context).await;
+        if !init_errors.is_empty() {
+            let joined = init_errors
+                .into_iter()
+                .map(|(dir, err)| format!("{dir}: {err}"))
+                .collect::<Vec<_>>()
+                .join("; ");
+            return Err(PluginErr(format!("Failed to initialize plugin(s): {joined}")));
+        }
+
+        Ok(plugin_manager)
     }
 
     /// Get the vendored plugin directory path (resolves dev mode path if applicable)
@@ -180,6 +215,57 @@ impl PluginManager {
         read_plugins_dir(&plugins_dir).await
     }
 
+    pub async fn resolve_plugins_for_runtime_from_db(&self, plugins: Vec<Plugin>) -> Vec<Plugin> {
+        let bundled_dirs = match self.list_bundled_plugin_dirs().await {
+            Ok(dirs) => dirs,
+            Err(err) => {
+                warn!("Failed to read bundled plugin dirs for resolution: {err:?}");
+                Vec::new()
+            }
+        };
+        self.resolve_plugins_for_runtime(plugins, bundled_dirs)
+    }
+
+    /// Resolve the plugin set for the current runtime instance.
+    ///
+    /// Rules:
+    /// - Drop bundled rows that are not present in this instance's bundled directory list.
+    /// - Deduplicate by plugin metadata name (fallback to directory key when metadata is unreadable).
+    /// - Prefer sources in this order: filesystem > registry > bundled.
+    /// - For same-source conflicts, prefer the most recently installed row (`created_at`).
+    fn resolve_plugins_for_runtime(
+        &self,
+        plugins: Vec<Plugin>,
+        bundled_dirs: Vec<String>,
+    ) -> Vec<Plugin> {
+        let bundled_dir_set: HashSet<String> = bundled_dirs.into_iter().collect();
+        let mut selected: HashMap<String, Plugin> = HashMap::new();
+
+        for plugin in plugins {
+            if matches!(plugin.source, PluginSource::Bundled)
+                && !bundled_dir_set.contains(&plugin.directory)
+            {
+                continue;
+            }
+
+            let key = match get_plugin_meta(Path::new(&plugin.directory)) {
+                Ok(meta) => meta.name,
+                Err(_) => format!("__dir__{}", plugin.directory),
+            };
+
+            match selected.get(&key) {
+                Some(existing) if !prefer_plugin(&plugin, existing) => {}
+                _ => {
+                    selected.insert(key, plugin);
+                }
+            }
+        }
+
+        let mut resolved = selected.into_values().collect::<Vec<_>>();
+        resolved.sort_by(|a, b| b.created_at.cmp(&a.created_at));
+        resolved
+    }
+
     pub async fn uninstall(&self, plugin_context: &PluginContext, dir: &str) -> Result<()> {
         let plugin = self.get_plugin_by_dir(dir).await.ok_or(PluginNotFoundErr(dir.to_string()))?;
         self.remove_plugin(plugin_context, &plugin).await
@@ -254,7 +340,8 @@ impl PluginManager {
         Ok(())
     }
 
-    /// Initialize all plugins from the provided list.
+    /// Initialize all plugins from the provided DB list.
+    /// Plugin candidates are resolved for this runtime instance before initialization.
     /// Returns a list of (plugin_directory, error_message) for any plugins that failed to initialize.
     pub async fn initialize_all_plugins(
         &self,
@@ -264,15 +351,18 @@ impl PluginManager {
         info!("Initializing all plugins");
         let start = Instant::now();
         let mut errors = Vec::new();
+        let plugins = self.resolve_plugins_for_runtime_from_db(plugins).await;
+
+        // Rebuild runtime handles from scratch to avoid stale/duplicate handles.
+        let existing_handles = { self.plugin_handles.lock().await.clone() };
+        for plugin_handle in existing_handles {
+            if let Err(e) = self.remove_plugin(plugin_context, &plugin_handle).await {
+                error!("Failed to remove plugin {} {e:?}", plugin_handle.dir);
+                errors.push((plugin_handle.dir.clone(), e.to_string()));
+            }
+        }
 
         for plugin in plugins {
-            // First remove the plugin if it exists and is enabled
-            if let Some(plugin_handle) = self.get_plugin_by_dir(&plugin.directory).await {
-                if let Err(e) = self.remove_plugin(plugin_context, &plugin_handle).await {
-                    error!("Failed to remove plugin {} {e:?}", plugin.directory);
-                    continue;
-                }
-            }
             if let Err(e) = self.add_plugin(plugin_context, &plugin).await {
                 warn!("Failed to add plugin {} {e:?}", plugin.directory);
                 errors.push((plugin.directory.clone(), e.to_string()));
@@ -1030,6 +1120,24 @@ impl PluginManager {
     }
 }
 
+fn source_priority(source: &PluginSource) -> i32 {
+    match source {
+        PluginSource::Filesystem => 3,
+        PluginSource::Registry => 2,
+        PluginSource::Bundled => 1,
+    }
+}
+
+fn prefer_plugin(candidate: &Plugin, existing: &Plugin) -> bool {
+    let candidate_priority = source_priority(&candidate.source);
+    let existing_priority = source_priority(&existing.source);
+    if candidate_priority != existing_priority {
+        return candidate_priority > existing_priority;
+    }
+
+    candidate.created_at > existing.created_at
+}
+
 async fn read_plugins_dir(dir: &PathBuf) -> Result<Vec<String>> {
     let mut result = read_dir(dir).await?;
     let mut dirs: Vec<String> = vec![];
@@ -1048,16 +1156,10 @@ async fn read_plugins_dir(dir: &PathBuf) -> Result<Vec<String>> {
 fn fix_windows_paths(p: &PathBuf) -> String {
     use dunce;
     use path_slash::PathBufExt;
-    use regex::Regex;
 
-    // 1. Remove UNC prefix for Windows paths to pass to sidecar
-    let safe_path = dunce::simplified(p.as_path()).to_string_lossy().to_string();
+    // 1. Remove UNC prefix for Windows paths
+    let safe_path = dunce::simplified(p.as_path());
 
-    // 2. Remove the drive letter
-    let safe_path = Regex::new("^[a-zA-Z]:").unwrap().replace(safe_path.as_str(), "");
-
-    // 3. Convert backslashes to forward
-    let safe_path = PathBuf::from(safe_path.to_string()).to_slash_lossy().to_string();
-
-    safe_path
+    // 2. Convert backslashes to forward slashes for Node.js compatibility
+    PathBuf::from(safe_path).to_slash_lossy().to_string()
 }

crates/yaak-templates/pkg/yaak_templates.d.ts

@@ -1,5 +1,5 @@
 /* tslint:disable */
 /* eslint-disable */
-export function unescape_template(template: string): any;
-export function parse_template(template: string): any;
 export function escape_template(template: string): any;
+export function parse_template(template: string): any;
+export function unescape_template(template: string): any;

crates/yaak-templates/pkg/yaak_templates_bg.js

@@ -165,10 +165,10 @@ function takeFromExternrefTable0(idx) {
  * @param {string} template
  * @returns {any}
  */
-export function unescape_template(template) {
+export function escape_template(template) {
     const ptr0 = passStringToWasm0(template, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
     const len0 = WASM_VECTOR_LEN;
-    const ret = wasm.unescape_template(ptr0, len0);
+    const ret = wasm.escape_template(ptr0, len0);
     if (ret[2]) {
         throw takeFromExternrefTable0(ret[1]);
     }
@@ -193,10 +193,10 @@ export function parse_template(template) {
  * @param {string} template
  * @returns {any}
  */
-export function escape_template(template) {
+export function unescape_template(template) {
     const ptr0 = passStringToWasm0(template, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
     const len0 = WASM_VECTOR_LEN;
-    const ret = wasm.escape_template(ptr0, len0);
+    const ret = wasm.unescape_template(ptr0, len0);
     if (ret[2]) {
         throw takeFromExternrefTable0(ret[1]);
     }

crates/yaak-tls/src/lib.rs

@@ -273,6 +273,5 @@ pub fn find_client_certificate(
         });
     }
 
-    debug!("No matching client certificate found for {}", url_string);
     None
 }

crates/yaak/Cargo.toml

@@ -17,3 +17,6 @@ yaak-models = { workspace = true }
 yaak-plugins = { workspace = true }
 yaak-templates = { workspace = true }
 yaak-tls = { workspace = true }
+
+[dev-dependencies]
+tempfile = "3"

crates/yaak/src/lib.rs

@@ -1,4 +1,5 @@
 pub mod error;
+pub mod plugin_events;
 pub mod render;
 pub mod send;
 

crates/yaak/src/plugin_events.rs

@@ -0,0 +1,647 @@
+use yaak_models::models::AnyModel;
+use yaak_models::query_manager::QueryManager;
+use yaak_models::util::UpdateSource;
+use yaak_plugins::events::{
+    CloseWindowRequest, CopyTextRequest, DeleteKeyValueRequest, DeleteKeyValueResponse,
+    DeleteModelRequest, DeleteModelResponse, ErrorResponse, FindHttpResponsesRequest,
+    FindHttpResponsesResponse, GetCookieValueRequest, GetHttpRequestByIdRequest,
+    GetHttpRequestByIdResponse, GetKeyValueRequest, GetKeyValueResponse, InternalEventPayload,
+    ListCookieNamesRequest, ListFoldersRequest, ListFoldersResponse, ListHttpRequestsRequest,
+    ListHttpRequestsResponse, ListOpenWorkspacesRequest, OpenExternalUrlRequest, OpenWindowRequest,
+    PromptFormRequest, PromptTextRequest, ReloadResponse, RenderGrpcRequestRequest,
+    RenderHttpRequestRequest, SendHttpRequestRequest, SetKeyValueRequest, ShowToastRequest,
+    TemplateRenderRequest, UpsertModelRequest, UpsertModelResponse, WindowInfoRequest,
+};
+
+pub struct SharedPluginEventContext<'a> {
+    pub plugin_name: &'a str,
+    pub workspace_id: Option<&'a str>,
+}
+
+#[derive(Debug)]
+pub enum GroupedPluginEvent<'a> {
+    Handled(Option<InternalEventPayload>),
+    ToHandle(HostRequest<'a>),
+}
+
+#[derive(Debug)]
+pub enum GroupedPluginRequest<'a> {
+    Shared(SharedRequest<'a>),
+    Host(HostRequest<'a>),
+    Ignore,
+}
+
+#[derive(Debug)]
+pub enum SharedRequest<'a> {
+    GetKeyValue(&'a GetKeyValueRequest),
+    SetKeyValue(&'a SetKeyValueRequest),
+    DeleteKeyValue(&'a DeleteKeyValueRequest),
+    GetHttpRequestById(&'a GetHttpRequestByIdRequest),
+    ListFolders(&'a ListFoldersRequest),
+    ListHttpRequests(&'a ListHttpRequestsRequest),
+    FindHttpResponses(&'a FindHttpResponsesRequest),
+    UpsertModel(&'a UpsertModelRequest),
+    DeleteModel(&'a DeleteModelRequest),
+}
+
+#[derive(Debug)]
+pub enum HostRequest<'a> {
+    ShowToast(&'a ShowToastRequest),
+    CopyText(&'a CopyTextRequest),
+    PromptText(&'a PromptTextRequest),
+    PromptForm(&'a PromptFormRequest),
+    RenderGrpcRequest(&'a RenderGrpcRequestRequest),
+    RenderHttpRequest(&'a RenderHttpRequestRequest),
+    TemplateRender(&'a TemplateRenderRequest),
+    SendHttpRequest(&'a SendHttpRequestRequest),
+    OpenWindow(&'a OpenWindowRequest),
+    CloseWindow(&'a CloseWindowRequest),
+    OpenExternalUrl(&'a OpenExternalUrlRequest),
+    ListOpenWorkspaces(&'a ListOpenWorkspacesRequest),
+    ListCookieNames(&'a ListCookieNamesRequest),
+    GetCookieValue(&'a GetCookieValueRequest),
+    WindowInfo(&'a WindowInfoRequest),
+    ErrorResponse(&'a ErrorResponse),
+    ReloadResponse(&'a ReloadResponse),
+    OtherRequest(&'a InternalEventPayload),
+}
+
+impl HostRequest<'_> {
+    pub fn type_name(&self) -> String {
+        match self {
+            HostRequest::ShowToast(_) => "show_toast_request".to_string(),
+            HostRequest::CopyText(_) => "copy_text_request".to_string(),
+            HostRequest::PromptText(_) => "prompt_text_request".to_string(),
+            HostRequest::PromptForm(_) => "prompt_form_request".to_string(),
+            HostRequest::RenderGrpcRequest(_) => "render_grpc_request_request".to_string(),
+            HostRequest::RenderHttpRequest(_) => "render_http_request_request".to_string(),
+            HostRequest::TemplateRender(_) => "template_render_request".to_string(),
+            HostRequest::SendHttpRequest(_) => "send_http_request_request".to_string(),
+            HostRequest::OpenWindow(_) => "open_window_request".to_string(),
+            HostRequest::CloseWindow(_) => "close_window_request".to_string(),
+            HostRequest::OpenExternalUrl(_) => "open_external_url_request".to_string(),
+            HostRequest::ListOpenWorkspaces(_) => "list_open_workspaces_request".to_string(),
+            HostRequest::ListCookieNames(_) => "list_cookie_names_request".to_string(),
+            HostRequest::GetCookieValue(_) => "get_cookie_value_request".to_string(),
+            HostRequest::WindowInfo(_) => "window_info_request".to_string(),
+            HostRequest::ErrorResponse(_) => "error_response".to_string(),
+            HostRequest::ReloadResponse(_) => "reload_response".to_string(),
+            HostRequest::OtherRequest(payload) => payload.type_name(),
+        }
+    }
+}
+
+impl<'a> From<&'a InternalEventPayload> for GroupedPluginRequest<'a> {
+    fn from(payload: &'a InternalEventPayload) -> Self {
+        match payload {
+            InternalEventPayload::GetKeyValueRequest(req) => {
+                GroupedPluginRequest::Shared(SharedRequest::GetKeyValue(req))
+            }
+            InternalEventPayload::SetKeyValueRequest(req) => {
+                GroupedPluginRequest::Shared(SharedRequest::SetKeyValue(req))
+            }
+            InternalEventPayload::DeleteKeyValueRequest(req) => {
+                GroupedPluginRequest::Shared(SharedRequest::DeleteKeyValue(req))
+            }
+            InternalEventPayload::GetHttpRequestByIdRequest(req) => {
+                GroupedPluginRequest::Shared(SharedRequest::GetHttpRequestById(req))
+            }
+            InternalEventPayload::ErrorResponse(resp) => {
+                GroupedPluginRequest::Host(HostRequest::ErrorResponse(resp))
+            }
+            InternalEventPayload::ReloadResponse(req) => {
+                GroupedPluginRequest::Host(HostRequest::ReloadResponse(req))
+            }
+            InternalEventPayload::ListOpenWorkspacesRequest(req) => {
+                GroupedPluginRequest::Host(HostRequest::ListOpenWorkspaces(req))
+            }
+            InternalEventPayload::ListFoldersRequest(req) => {
+                GroupedPluginRequest::Shared(SharedRequest::ListFolders(req))
+            }
+            InternalEventPayload::ListHttpRequestsRequest(req) => {
+                GroupedPluginRequest::Shared(SharedRequest::ListHttpRequests(req))
+            }
+            InternalEventPayload::ShowToastRequest(req) => {
+                GroupedPluginRequest::Host(HostRequest::ShowToast(req))
+            }
+            InternalEventPayload::CopyTextRequest(req) => {
+                GroupedPluginRequest::Host(HostRequest::CopyText(req))
+            }
+            InternalEventPayload::PromptTextRequest(req) => {
+                GroupedPluginRequest::Host(HostRequest::PromptText(req))
+            }
+            InternalEventPayload::PromptFormRequest(req) => {
+                GroupedPluginRequest::Host(HostRequest::PromptForm(req))
+            }
+            InternalEventPayload::FindHttpResponsesRequest(req) => {
+                GroupedPluginRequest::Shared(SharedRequest::FindHttpResponses(req))
+            }
+            InternalEventPayload::UpsertModelRequest(req) => {
+                GroupedPluginRequest::Shared(SharedRequest::UpsertModel(req))
+            }
+            InternalEventPayload::DeleteModelRequest(req) => {
+                GroupedPluginRequest::Shared(SharedRequest::DeleteModel(req))
+            }
+            InternalEventPayload::RenderGrpcRequestRequest(req) => {
+                GroupedPluginRequest::Host(HostRequest::RenderGrpcRequest(req))
+            }
+            InternalEventPayload::RenderHttpRequestRequest(req) => {
+                GroupedPluginRequest::Host(HostRequest::RenderHttpRequest(req))
+            }
+            InternalEventPayload::TemplateRenderRequest(req) => {
+                GroupedPluginRequest::Host(HostRequest::TemplateRender(req))
+            }
+            InternalEventPayload::SendHttpRequestRequest(req) => {
+                GroupedPluginRequest::Host(HostRequest::SendHttpRequest(req))
+            }
+            InternalEventPayload::OpenWindowRequest(req) => {
+                GroupedPluginRequest::Host(HostRequest::OpenWindow(req))
+            }
+            InternalEventPayload::CloseWindowRequest(req) => {
+                GroupedPluginRequest::Host(HostRequest::CloseWindow(req))
+            }
+            InternalEventPayload::OpenExternalUrlRequest(req) => {
+                GroupedPluginRequest::Host(HostRequest::OpenExternalUrl(req))
+            }
+            InternalEventPayload::ListCookieNamesRequest(req) => {
+                GroupedPluginRequest::Host(HostRequest::ListCookieNames(req))
+            }
+            InternalEventPayload::GetCookieValueRequest(req) => {
+                GroupedPluginRequest::Host(HostRequest::GetCookieValue(req))
+            }
+            InternalEventPayload::WindowInfoRequest(req) => {
+                GroupedPluginRequest::Host(HostRequest::WindowInfo(req))
+            }
+            payload if payload.type_name().ends_with("_request") => {
+                GroupedPluginRequest::Host(HostRequest::OtherRequest(payload))
+            }
+            _ => GroupedPluginRequest::Ignore,
+        }
+    }
+}
+
+pub fn handle_shared_plugin_event<'a>(
+    query_manager: &QueryManager,
+    payload: &'a InternalEventPayload,
+    context: SharedPluginEventContext<'_>,
+) -> GroupedPluginEvent<'a> {
+    match GroupedPluginRequest::from(payload) {
+        GroupedPluginRequest::Shared(req) => {
+            GroupedPluginEvent::Handled(Some(build_shared_reply(query_manager, req, context)))
+        }
+        GroupedPluginRequest::Host(req) => GroupedPluginEvent::ToHandle(req),
+        GroupedPluginRequest::Ignore => GroupedPluginEvent::Handled(None),
+    }
+}
+
+fn build_shared_reply(
+    query_manager: &QueryManager,
+    request: SharedRequest<'_>,
+    context: SharedPluginEventContext<'_>,
+) -> InternalEventPayload {
+    match request {
+        SharedRequest::GetKeyValue(req) => {
+            let value = query_manager
+                .connect()
+                .get_plugin_key_value(context.plugin_name, &req.key)
+                .map(|v| v.value);
+            InternalEventPayload::GetKeyValueResponse(GetKeyValueResponse { value })
+        }
+        SharedRequest::SetKeyValue(req) => {
+            query_manager.connect().set_plugin_key_value(context.plugin_name, &req.key, &req.value);
+            InternalEventPayload::SetKeyValueResponse(yaak_plugins::events::SetKeyValueResponse {})
+        }
+        SharedRequest::DeleteKeyValue(req) => {
+            match query_manager.connect().delete_plugin_key_value(context.plugin_name, &req.key) {
+                Ok(deleted) => {
+                    InternalEventPayload::DeleteKeyValueResponse(DeleteKeyValueResponse { deleted })
+                }
+                Err(err) => InternalEventPayload::ErrorResponse(ErrorResponse {
+                    error: format!("Failed to delete plugin key '{}' : {err}", req.key),
+                }),
+            }
+        }
+        SharedRequest::GetHttpRequestById(req) => {
+            let http_request = query_manager.connect().get_http_request(&req.id).ok();
+            InternalEventPayload::GetHttpRequestByIdResponse(GetHttpRequestByIdResponse {
+                http_request,
+            })
+        }
+        SharedRequest::ListFolders(_) => {
+            let Some(workspace_id) = context.workspace_id else {
+                return InternalEventPayload::ErrorResponse(ErrorResponse {
+                    error: "workspace_id is required for list_folders_request".to_string(),
+                });
+            };
+            let folders = match query_manager.connect().list_folders(workspace_id) {
+                Ok(folders) => folders,
+                Err(err) => {
+                    return InternalEventPayload::ErrorResponse(ErrorResponse {
+                        error: format!("Failed to list folders: {err}"),
+                    });
+                }
+            };
+            InternalEventPayload::ListFoldersResponse(ListFoldersResponse { folders })
+        }
+        SharedRequest::ListHttpRequests(req) => {
+            let http_requests = if let Some(folder_id) = req.folder_id.as_deref() {
+                match query_manager.connect().list_http_requests_for_folder_recursive(folder_id) {
+                    Ok(http_requests) => http_requests,
+                    Err(err) => {
+                        return InternalEventPayload::ErrorResponse(ErrorResponse {
+                            error: format!("Failed to list HTTP requests for folder: {err}"),
+                        });
+                    }
+                }
+            } else {
+                let Some(workspace_id) = context.workspace_id else {
+                    return InternalEventPayload::ErrorResponse(ErrorResponse {
+                        error:
+                            "workspace_id is required for list_http_requests_request without folder_id"
+                                .to_string(),
+                    });
+                };
+                match query_manager.connect().list_http_requests(workspace_id) {
+                    Ok(http_requests) => http_requests,
+                    Err(err) => {
+                        return InternalEventPayload::ErrorResponse(ErrorResponse {
+                            error: format!("Failed to list HTTP requests: {err}"),
+                        });
+                    }
+                }
+            };
+            InternalEventPayload::ListHttpRequestsResponse(ListHttpRequestsResponse {
+                http_requests,
+            })
+        }
+        SharedRequest::FindHttpResponses(req) => {
+            let http_responses = query_manager
+                .connect()
+                .list_http_responses_for_request(&req.request_id, req.limit.map(|l| l as u64))
+                .unwrap_or_default();
+            InternalEventPayload::FindHttpResponsesResponse(FindHttpResponsesResponse {
+                http_responses,
+            })
+        }
+        SharedRequest::UpsertModel(req) => {
+            use AnyModel::*;
+
+            let model = match &req.model {
+                HttpRequest(m) => {
+                    match query_manager.connect().upsert_http_request(m, &UpdateSource::Plugin) {
+                        Ok(model) => HttpRequest(model),
+                        Err(err) => {
+                            return InternalEventPayload::ErrorResponse(ErrorResponse {
+                                error: format!("Failed to upsert HTTP request: {err}"),
+                            });
+                        }
+                    }
+                }
+                GrpcRequest(m) => {
+                    match query_manager.connect().upsert_grpc_request(m, &UpdateSource::Plugin) {
+                        Ok(model) => GrpcRequest(model),
+                        Err(err) => {
+                            return InternalEventPayload::ErrorResponse(ErrorResponse {
+                                error: format!("Failed to upsert gRPC request: {err}"),
+                            });
+                        }
+                    }
+                }
+                WebsocketRequest(m) => {
+                    match query_manager.connect().upsert_websocket_request(m, &UpdateSource::Plugin)
+                    {
+                        Ok(model) => WebsocketRequest(model),
+                        Err(err) => {
+                            return InternalEventPayload::ErrorResponse(ErrorResponse {
+                                error: format!("Failed to upsert WebSocket request: {err}"),
+                            });
+                        }
+                    }
+                }
+                Folder(m) => {
+                    match query_manager.connect().upsert_folder(m, &UpdateSource::Plugin) {
+                        Ok(model) => Folder(model),
+                        Err(err) => {
+                            return InternalEventPayload::ErrorResponse(ErrorResponse {
+                                error: format!("Failed to upsert folder: {err}"),
+                            });
+                        }
+                    }
+                }
+                Environment(m) => {
+                    match query_manager.connect().upsert_environment(m, &UpdateSource::Plugin) {
+                        Ok(model) => Environment(model),
+                        Err(err) => {
+                            return InternalEventPayload::ErrorResponse(ErrorResponse {
+                                error: format!("Failed to upsert environment: {err}"),
+                            });
+                        }
+                    }
+                }
+                Workspace(m) => {
+                    match query_manager.connect().upsert_workspace(m, &UpdateSource::Plugin) {
+                        Ok(model) => Workspace(model),
+                        Err(err) => {
+                            return InternalEventPayload::ErrorResponse(ErrorResponse {
+                                error: format!("Failed to upsert workspace: {err}"),
+                            });
+                        }
+                    }
+                }
+                _ => {
+                    return InternalEventPayload::ErrorResponse(ErrorResponse {
+                        error: "Upsert not supported for this model type".to_string(),
+                    });
+                }
+            };
+
+            InternalEventPayload::UpsertModelResponse(UpsertModelResponse { model })
+        }
+        SharedRequest::DeleteModel(req) => {
+            let model = match req.model.as_str() {
+                "http_request" => {
+                    match query_manager
+                        .connect()
+                        .delete_http_request_by_id(&req.id, &UpdateSource::Plugin)
+                    {
+                        Ok(model) => AnyModel::HttpRequest(model),
+                        Err(err) => {
+                            return InternalEventPayload::ErrorResponse(ErrorResponse {
+                                error: format!("Failed to delete HTTP request: {err}"),
+                            });
+                        }
+                    }
+                }
+                "grpc_request" => {
+                    match query_manager
+                        .connect()
+                        .delete_grpc_request_by_id(&req.id, &UpdateSource::Plugin)
+                    {
+                        Ok(model) => AnyModel::GrpcRequest(model),
+                        Err(err) => {
+                            return InternalEventPayload::ErrorResponse(ErrorResponse {
+                                error: format!("Failed to delete gRPC request: {err}"),
+                            });
+                        }
+                    }
+                }
+                "websocket_request" => {
+                    match query_manager
+                        .connect()
+                        .delete_websocket_request_by_id(&req.id, &UpdateSource::Plugin)
+                    {
+                        Ok(model) => AnyModel::WebsocketRequest(model),
+                        Err(err) => {
+                            return InternalEventPayload::ErrorResponse(ErrorResponse {
+                                error: format!("Failed to delete WebSocket request: {err}"),
+                            });
+                        }
+                    }
+                }
+                "folder" => match query_manager
+                    .connect()
+                    .delete_folder_by_id(&req.id, &UpdateSource::Plugin)
+                {
+                    Ok(model) => AnyModel::Folder(model),
+                    Err(err) => {
+                        return InternalEventPayload::ErrorResponse(ErrorResponse {
+                            error: format!("Failed to delete folder: {err}"),
+                        });
+                    }
+                },
+                "environment" => {
+                    match query_manager
+                        .connect()
+                        .delete_environment_by_id(&req.id, &UpdateSource::Plugin)
+                    {
+                        Ok(model) => AnyModel::Environment(model),
+                        Err(err) => {
+                            return InternalEventPayload::ErrorResponse(ErrorResponse {
+                                error: format!("Failed to delete environment: {err}"),
+                            });
+                        }
+                    }
+                }
+                _ => {
+                    return InternalEventPayload::ErrorResponse(ErrorResponse {
+                        error: "Delete not supported for this model type".to_string(),
+                    });
+                }
+            };
+
+            InternalEventPayload::DeleteModelResponse(DeleteModelResponse { model })
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use tempfile::TempDir;
+    use yaak_models::models::{AnyModel, Folder, HttpRequest, Workspace};
+    use yaak_models::util::UpdateSource;
+
+    fn seed_query_manager() -> (QueryManager, TempDir) {
+        let temp_dir = TempDir::new().expect("Failed to create temp dir");
+        let db_path = temp_dir.path().join("db.sqlite");
+        let blob_path = temp_dir.path().join("blobs.sqlite");
+        let (query_manager, _blob_manager, _rx) =
+            yaak_models::init_standalone(&db_path, &blob_path).expect("Failed to initialize DB");
+
+        query_manager
+            .connect()
+            .upsert_workspace(
+                &Workspace {
+                    id: "wk_test".to_string(),
+                    name: "Workspace".to_string(),
+                    ..Default::default()
+                },
+                &UpdateSource::Sync,
+            )
+            .expect("Failed to seed workspace");
+
+        query_manager
+            .connect()
+            .upsert_folder(
+                &Folder {
+                    id: "fl_test".to_string(),
+                    workspace_id: "wk_test".to_string(),
+                    name: "Folder".to_string(),
+                    ..Default::default()
+                },
+                &UpdateSource::Sync,
+            )
+            .expect("Failed to seed folder");
+
+        query_manager
+            .connect()
+            .upsert_http_request(
+                &HttpRequest {
+                    id: "rq_test".to_string(),
+                    workspace_id: "wk_test".to_string(),
+                    folder_id: Some("fl_test".to_string()),
+                    name: "Request".to_string(),
+                    method: "GET".to_string(),
+                    url: "https://example.com".to_string(),
+                    ..Default::default()
+                },
+                &UpdateSource::Sync,
+            )
+            .expect("Failed to seed request");
+
+        (query_manager, temp_dir)
+    }
+
+    #[test]
+    fn list_requests_requires_workspace_when_folder_missing() {
+        let (query_manager, _temp_dir) = seed_query_manager();
+        let payload = InternalEventPayload::ListHttpRequestsRequest(
+            yaak_plugins::events::ListHttpRequestsRequest { folder_id: None },
+        );
+        let result = handle_shared_plugin_event(
+            &query_manager,
+            &payload,
+            SharedPluginEventContext { plugin_name: "@yaak/test", workspace_id: None },
+        );
+
+        assert!(matches!(
+            result,
+            GroupedPluginEvent::Handled(Some(InternalEventPayload::ErrorResponse(_)))
+        ));
+    }
+
+    #[test]
+    fn list_requests_by_workspace_and_folder() {
+        let (query_manager, _temp_dir) = seed_query_manager();
+
+        let by_workspace_payload = InternalEventPayload::ListHttpRequestsRequest(
+            yaak_plugins::events::ListHttpRequestsRequest { folder_id: None },
+        );
+        let by_workspace = handle_shared_plugin_event(
+            &query_manager,
+            &by_workspace_payload,
+            SharedPluginEventContext { plugin_name: "@yaak/test", workspace_id: Some("wk_test") },
+        );
+        match by_workspace {
+            GroupedPluginEvent::Handled(Some(InternalEventPayload::ListHttpRequestsResponse(
+                resp,
+            ))) => {
+                assert_eq!(resp.http_requests.len(), 1);
+            }
+            other => panic!("unexpected workspace response: {other:?}"),
+        }
+
+        let by_folder_payload = InternalEventPayload::ListHttpRequestsRequest(
+            yaak_plugins::events::ListHttpRequestsRequest {
+                folder_id: Some("fl_test".to_string()),
+            },
+        );
+        let by_folder = handle_shared_plugin_event(
+            &query_manager,
+            &by_folder_payload,
+            SharedPluginEventContext { plugin_name: "@yaak/test", workspace_id: None },
+        );
+        match by_folder {
+            GroupedPluginEvent::Handled(Some(InternalEventPayload::ListHttpRequestsResponse(
+                resp,
+            ))) => {
+                assert_eq!(resp.http_requests.len(), 1);
+            }
+            other => panic!("unexpected folder response: {other:?}"),
+        }
+    }
+
+    #[test]
+    fn find_http_responses_is_shared_handled() {
+        let (query_manager, _temp_dir) = seed_query_manager();
+        let payload = InternalEventPayload::FindHttpResponsesRequest(FindHttpResponsesRequest {
+            request_id: "rq_test".to_string(),
+            limit: Some(1),
+        });
+
+        let result = handle_shared_plugin_event(
+            &query_manager,
+            &payload,
+            SharedPluginEventContext { plugin_name: "@yaak/test", workspace_id: Some("wk_test") },
+        );
+
+        match result {
+            GroupedPluginEvent::Handled(Some(InternalEventPayload::FindHttpResponsesResponse(
+                resp,
+            ))) => {
+                assert!(resp.http_responses.is_empty());
+            }
+            other => panic!("unexpected find responses result: {other:?}"),
+        }
+    }
+
+    #[test]
+    fn upsert_and_delete_model_are_shared_handled() {
+        let (query_manager, _temp_dir) = seed_query_manager();
+
+        let existing = query_manager
+            .connect()
+            .get_http_request("rq_test")
+            .expect("Failed to load seeded request");
+        let upsert_payload = InternalEventPayload::UpsertModelRequest(UpsertModelRequest {
+            model: AnyModel::HttpRequest(HttpRequest {
+                name: "Request Updated".to_string(),
+                ..existing
+            }),
+        });
+
+        let upsert_result = handle_shared_plugin_event(
+            &query_manager,
+            &upsert_payload,
+            SharedPluginEventContext { plugin_name: "@yaak/test", workspace_id: Some("wk_test") },
+        );
+        match upsert_result {
+            GroupedPluginEvent::Handled(Some(InternalEventPayload::UpsertModelResponse(resp))) => {
+                match resp.model {
+                    AnyModel::HttpRequest(r) => assert_eq!(r.name, "Request Updated"),
+                    other => panic!("unexpected upsert model type: {other:?}"),
+                }
+            }
+            other => panic!("unexpected upsert result: {other:?}"),
+        }
+
+        let delete_payload = InternalEventPayload::DeleteModelRequest(DeleteModelRequest {
+            model: "http_request".to_string(),
+            id: "rq_test".to_string(),
+        });
+        let delete_result = handle_shared_plugin_event(
+            &query_manager,
+            &delete_payload,
+            SharedPluginEventContext { plugin_name: "@yaak/test", workspace_id: Some("wk_test") },
+        );
+        match delete_result {
+            GroupedPluginEvent::Handled(Some(InternalEventPayload::DeleteModelResponse(resp))) => {
+                match resp.model {
+                    AnyModel::HttpRequest(r) => assert_eq!(r.id, "rq_test"),
+                    other => panic!("unexpected delete model type: {other:?}"),
+                }
+            }
+            other => panic!("unexpected delete result: {other:?}"),
+        }
+    }
+
+    #[test]
+    fn host_request_classification_works() {
+        let (query_manager, _temp_dir) = seed_query_manager();
+        let payload = InternalEventPayload::WindowInfoRequest(WindowInfoRequest {
+            label: "main".to_string(),
+        });
+        let result = handle_shared_plugin_event(
+            &query_manager,
+            &payload,
+            SharedPluginEventContext { plugin_name: "@yaak/test", workspace_id: None },
+        );
+
+        match result {
+            GroupedPluginEvent::ToHandle(HostRequest::WindowInfo(req)) => {
+                assert_eq!(req.label, "main")
+            }
+            other => panic!("unexpected host classification: {other:?}"),
+        }
+    }
+}

crates/yaak/src/send.rs

@@ -239,6 +239,7 @@ pub struct SendHttpRequestByIdParams<'a, T: TemplateCallback> {
     pub cookie_jar_id: Option<String>,
     pub response_dir: &'a Path,
     pub emit_events_to: Option<mpsc::Sender<SenderHttpResponseEvent>>,
+    pub emit_response_body_chunks_to: Option<mpsc::UnboundedSender<Vec<u8>>>,
     pub cancelled_rx: Option<watch::Receiver<bool>>,
     pub prepare_sendable_request: Option<&'a dyn PrepareSendableRequest>,
     pub executor: Option<&'a dyn SendRequestExecutor>,
@@ -255,6 +256,7 @@ pub struct SendHttpRequestParams<'a, T: TemplateCallback> {
     pub cookie_jar_id: Option<String>,
     pub response_dir: &'a Path,
     pub emit_events_to: Option<mpsc::Sender<SenderHttpResponseEvent>>,
+    pub emit_response_body_chunks_to: Option<mpsc::UnboundedSender<Vec<u8>>>,
     pub cancelled_rx: Option<watch::Receiver<bool>>,
     pub auth_context_id: Option<String>,
     pub existing_response: Option<HttpResponse>,
@@ -271,6 +273,7 @@ pub struct SendHttpRequestWithPluginsParams<'a> {
     pub cookie_jar_id: Option<String>,
     pub response_dir: &'a Path,
     pub emit_events_to: Option<mpsc::Sender<SenderHttpResponseEvent>>,
+    pub emit_response_body_chunks_to: Option<mpsc::UnboundedSender<Vec<u8>>>,
     pub existing_response: Option<HttpResponse>,
     pub plugin_manager: Arc<PluginManager>,
     pub encryption_manager: Arc<EncryptionManager>,
@@ -288,6 +291,7 @@ pub struct SendHttpRequestByIdWithPluginsParams<'a> {
     pub cookie_jar_id: Option<String>,
     pub response_dir: &'a Path,
     pub emit_events_to: Option<mpsc::Sender<SenderHttpResponseEvent>>,
+    pub emit_response_body_chunks_to: Option<mpsc::UnboundedSender<Vec<u8>>>,
     pub plugin_manager: Arc<PluginManager>,
     pub encryption_manager: Arc<EncryptionManager>,
     pub plugin_context: &'a PluginContext,
@@ -353,6 +357,7 @@ pub async fn send_http_request_by_id_with_plugins(
         cookie_jar_id: params.cookie_jar_id,
         response_dir: params.response_dir,
         emit_events_to: params.emit_events_to,
+        emit_response_body_chunks_to: params.emit_response_body_chunks_to,
         existing_response: None,
         plugin_manager: params.plugin_manager,
         encryption_manager: params.encryption_manager,
@@ -397,6 +402,7 @@ pub async fn send_http_request_with_plugins(
         cookie_jar_id: params.cookie_jar_id,
         response_dir: params.response_dir,
         emit_events_to: params.emit_events_to,
+        emit_response_body_chunks_to: params.emit_response_body_chunks_to,
         cancelled_rx: params.cancelled_rx,
         auth_context_id: None,
         existing_response: params.existing_response,
@@ -427,6 +433,7 @@ pub async fn send_http_request_by_id<T: TemplateCallback>(
         cookie_jar_id: params.cookie_jar_id,
         response_dir: params.response_dir,
         emit_events_to: params.emit_events_to,
+        emit_response_body_chunks_to: params.emit_response_body_chunks_to,
         cancelled_rx: params.cancelled_rx,
         existing_response: None,
         prepare_sendable_request: params.prepare_sendable_request,
@@ -607,6 +614,13 @@ pub async fn send_http_request<T: TemplateCallback>(
     };
 
     let headers_elapsed = duration_to_i32(started_at.elapsed());
+    std::fs::create_dir_all(params.response_dir).map_err(|source| {
+        SendHttpRequestError::CreateResponseDirectory {
+            path: params.response_dir.to_path_buf(),
+            source,
+        }
+    })?;
+    let body_path = params.response_dir.join(&response.id);
     let connected_response = HttpResponse {
         state: HttpResponseState::Connected,
         elapsed_headers: headers_elapsed,
@@ -616,6 +630,8 @@ pub async fn send_http_request<T: TemplateCallback>(
         remote_addr: http_response.remote_addr.clone(),
         version: http_response.version.clone(),
         elapsed_dns: dns_elapsed.load(Ordering::Relaxed),
+        body_path: Some(body_path.to_string_lossy().to_string()),
+        content_length: http_response.content_length.map(u64_to_i32),
         headers: http_response
             .headers
             .iter()
@@ -638,14 +654,6 @@ pub async fn send_http_request<T: TemplateCallback>(
         response = connected_response;
     }
 
-    std::fs::create_dir_all(params.response_dir).map_err(|source| {
-        SendHttpRequestError::CreateResponseDirectory {
-            path: params.response_dir.to_path_buf(),
-            source,
-        }
-    })?;
-
-    let body_path = params.response_dir.join(&response.id);
     let mut file =
         File::options().create(true).truncate(true).write(true).open(&body_path).await.map_err(
             |source| SendHttpRequestError::WriteResponseBody { path: body_path.clone(), source },
@@ -686,9 +694,17 @@ pub async fn send_http_request<T: TemplateCallback>(
             Ok(n) => {
                 written_bytes += n;
                 let start_idx = response_body.len() - n;
-                file.write_all(&response_body[start_idx..]).await.map_err(|source| {
+                let chunk = &response_body[start_idx..];
+                file.write_all(chunk).await.map_err(|source| {
                     SendHttpRequestError::WriteResponseBody { path: body_path.clone(), source }
                 })?;
+                file.flush().await.map_err(|source| SendHttpRequestError::WriteResponseBody {
+                    path: body_path.clone(),
+                    source,
+                })?;
+                if let Some(tx) = params.emit_response_body_chunks_to.as_ref() {
+                    let _ = tx.send(chunk.to_vec());
+                }
 
                 let now = Instant::now();
                 let should_update = now.duration_since(last_progress_update).as_millis()

npm/cli-darwin-arm64/package.json

@@ -0,0 +1,10 @@
+{
+  "name": "@yaakapp/cli-darwin-arm64",
+  "version": "0.0.1",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/mountain-loop/yaak.git"
+  },
+  "os": ["darwin"],
+  "cpu": ["arm64"]
+}

npm/cli-darwin-x64/package.json

@@ -0,0 +1,10 @@
+{
+  "name": "@yaakapp/cli-darwin-x64",
+  "version": "0.0.1",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/mountain-loop/yaak.git"
+  },
+  "os": ["darwin"],
+  "cpu": ["x64"]
+}

npm/cli-linux-arm64/package.json

@@ -0,0 +1,10 @@
+{
+  "name": "@yaakapp/cli-linux-arm64",
+  "version": "0.0.1",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/mountain-loop/yaak.git"
+  },
+  "os": ["linux"],
+  "cpu": ["arm64"]
+}

npm/cli-linux-x64/package.json

@@ -0,0 +1,10 @@
+{
+  "name": "@yaakapp/cli-linux-x64",
+  "version": "0.0.1",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/mountain-loop/yaak.git"
+  },
+  "os": ["linux"],
+  "cpu": ["x64"]
+}

npm/cli-win32-arm64/package.json

@@ -0,0 +1,10 @@
+{
+  "name": "@yaakapp/cli-win32-arm64",
+  "version": "0.0.1",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/mountain-loop/yaak.git"
+  },
+  "os": ["win32"],
+  "cpu": ["arm64"]
+}

npm/cli-win32-x64/package.json

@@ -0,0 +1,10 @@
+{
+  "name": "@yaakapp/cli-win32-x64",
+  "version": "0.0.1",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/mountain-loop/yaak.git"
+  },
+  "os": ["win32"],
+  "cpu": ["x64"]
+}

npm/cli/.gitignore

@@ -0,0 +1,2 @@
+yaak
+yaak.exe

npm/cli/bin/cli.js

@@ -0,0 +1,31 @@
+#!/usr/bin/env node
+
+const path = require("path");
+const childProcess = require("child_process");
+const { BINARY_NAME, PLATFORM_SPECIFIC_PACKAGE_NAME } = require("../common");
+
+function getBinaryPath() {
+  try {
+    if (!PLATFORM_SPECIFIC_PACKAGE_NAME) {
+      throw new Error("unsupported platform");
+    }
+    return require.resolve(`${PLATFORM_SPECIFIC_PACKAGE_NAME}/bin/${BINARY_NAME}`);
+  } catch (_) {
+    return path.join(__dirname, "..", BINARY_NAME);
+  }
+}
+
+const result = childProcess.spawnSync(getBinaryPath(), process.argv.slice(2), {
+  stdio: "inherit",
+  env: { ...process.env, YAAK_CLI_INSTALL_SOURCE: process.env.YAAK_CLI_INSTALL_SOURCE ?? "npm" },
+});
+
+if (result.error) {
+  throw result.error;
+}
+
+if (result.signal) {
+  process.kill(process.pid, result.signal);
+}
+
+process.exit(result.status ?? 1);

npm/cli/common.js

@@ -0,0 +1,20 @@
+const BINARY_DISTRIBUTION_PACKAGES = {
+  darwin_arm64: "@yaakapp/cli-darwin-arm64",
+  darwin_x64: "@yaakapp/cli-darwin-x64",
+  linux_arm64: "@yaakapp/cli-linux-arm64",
+  linux_x64: "@yaakapp/cli-linux-x64",
+  win32_x64: "@yaakapp/cli-win32-x64",
+  win32_arm64: "@yaakapp/cli-win32-arm64"
+};
+
+const BINARY_DISTRIBUTION_VERSION = require("./package.json").version;
+const BINARY_NAME = process.platform === "win32" ? "yaak.exe" : "yaak";
+const PLATFORM_SPECIFIC_PACKAGE_NAME =
+  BINARY_DISTRIBUTION_PACKAGES[`${process.platform}_${process.arch}`];
+
+module.exports = {
+  BINARY_DISTRIBUTION_PACKAGES,
+  BINARY_DISTRIBUTION_VERSION,
+  BINARY_NAME,
+  PLATFORM_SPECIFIC_PACKAGE_NAME
+};

npm/cli/index.js

@@ -0,0 +1,21 @@
+const path = require("path");
+const childProcess = require("child_process");
+const { PLATFORM_SPECIFIC_PACKAGE_NAME, BINARY_NAME } = require("./common");
+
+function getBinaryPath() {
+  try {
+    if (!PLATFORM_SPECIFIC_PACKAGE_NAME) {
+      throw new Error("unsupported platform");
+    }
+    return require.resolve(`${PLATFORM_SPECIFIC_PACKAGE_NAME}/bin/${BINARY_NAME}`);
+  } catch (_) {
+    return path.join(__dirname, BINARY_NAME);
+  }
+}
+
+module.exports.runBinary = function runBinary(...args) {
+  childProcess.execFileSync(getBinaryPath(), args, {
+    stdio: "inherit",
+    env: { ...process.env, YAAK_CLI_INSTALL_SOURCE: process.env.YAAK_CLI_INSTALL_SOURCE ?? "npm" },
+  });
+};

npm/cli/install.js

@@ -0,0 +1,97 @@
+const fs = require("node:fs");
+const path = require("node:path");
+const zlib = require("node:zlib");
+const https = require("node:https");
+const {
+  BINARY_DISTRIBUTION_VERSION,
+  BINARY_NAME,
+  PLATFORM_SPECIFIC_PACKAGE_NAME
+} = require("./common");
+
+const fallbackBinaryPath = path.join(__dirname, BINARY_NAME);
+
+function makeRequest(url) {
+  return new Promise((resolve, reject) => {
+    https
+      .get(url, (response) => {
+        if (response.statusCode >= 200 && response.statusCode < 300) {
+          const chunks = [];
+          response.on("data", (chunk) => chunks.push(chunk));
+          response.on("end", () => resolve(Buffer.concat(chunks)));
+        } else if (
+          response.statusCode >= 300 &&
+          response.statusCode < 400 &&
+          response.headers.location
+        ) {
+          makeRequest(response.headers.location).then(resolve, reject);
+        } else {
+          reject(
+            new Error(
+              `npm responded with status code ${response.statusCode} when downloading package ${url}`
+            )
+          );
+        }
+      })
+      .on("error", (error) => reject(error));
+  });
+}
+
+function extractFileFromTarball(tarballBuffer, filepath) {
+  let offset = 0;
+  while (offset < tarballBuffer.length) {
+    const header = tarballBuffer.subarray(offset, offset + 512);
+    offset += 512;
+
+    const fileName = header.toString("utf-8", 0, 100).replace(/\0.*/g, "");
+    const fileSize = parseInt(header.toString("utf-8", 124, 136).replace(/\0.*/g, ""), 8);
+
+    if (fileName === filepath) {
+      return tarballBuffer.subarray(offset, offset + fileSize);
+    }
+
+    offset = (offset + fileSize + 511) & ~511;
+  }
+
+  return null;
+}
+
+async function downloadBinaryFromNpm() {
+  if (!PLATFORM_SPECIFIC_PACKAGE_NAME) {
+    throw new Error(`Unsupported platform: ${process.platform}/${process.arch}`);
+  }
+
+  const packageNameWithoutScope = PLATFORM_SPECIFIC_PACKAGE_NAME.split("/")[1];
+  const tarballUrl = `https://registry.npmjs.org/${PLATFORM_SPECIFIC_PACKAGE_NAME}/-/${packageNameWithoutScope}-${BINARY_DISTRIBUTION_VERSION}.tgz`;
+  const tarballDownloadBuffer = await makeRequest(tarballUrl);
+  const tarballBuffer = zlib.unzipSync(tarballDownloadBuffer);
+
+  const binary = extractFileFromTarball(tarballBuffer, `package/bin/${BINARY_NAME}`);
+  if (!binary) {
+    throw new Error(`Could not find package/bin/${BINARY_NAME} in tarball`);
+  }
+
+  fs.writeFileSync(fallbackBinaryPath, binary);
+  fs.chmodSync(fallbackBinaryPath, "755");
+}
+
+function isPlatformSpecificPackageInstalled() {
+  try {
+    if (!PLATFORM_SPECIFIC_PACKAGE_NAME) {
+      return false;
+    }
+    require.resolve(`${PLATFORM_SPECIFIC_PACKAGE_NAME}/bin/${BINARY_NAME}`);
+    return true;
+  } catch (_) {
+    return false;
+  }
+}
+
+if (!isPlatformSpecificPackageInstalled()) {
+  console.log("Platform package missing. Downloading Yaak CLI binary from npm...");
+  downloadBinaryFromNpm().catch((err) => {
+    console.error("Failed to install Yaak CLI binary:", err);
+    process.exitCode = 1;
+  });
+} else {
+  console.log("Platform package present. Using bundled Yaak CLI binary.");
+}

npm/cli/package.json

@@ -0,0 +1,25 @@
+{
+  "name": "@yaakapp/cli",
+  "version": "0.0.1",
+  "main": "./index.js",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/mountain-loop/yaak.git"
+  },
+  "scripts": {
+    "postinstall": "node ./install.js",
+    "prepublishOnly": "node ./prepublish.js"
+  },
+  "bin": {
+    "yaak": "bin/cli.js",
+    "yaakcli": "bin/cli.js"
+  },
+  "optionalDependencies": {
+    "@yaakapp/cli-darwin-x64": "0.0.1",
+    "@yaakapp/cli-darwin-arm64": "0.0.1",
+    "@yaakapp/cli-linux-arm64": "0.0.1",
+    "@yaakapp/cli-linux-x64": "0.0.1",
+    "@yaakapp/cli-win32-x64": "0.0.1",
+    "@yaakapp/cli-win32-arm64": "0.0.1"
+  }
+}

npm/cli/prepublish.js

@@ -0,0 +1,5 @@
+const fs = require("node:fs");
+const path = require("node:path");
+
+const cliReadme = path.join(__dirname, "..", "..", "crates-cli", "yaak-cli", "README.md");
+fs.copyFileSync(cliReadme, path.join(__dirname, "README.md"));

npm/prepare-publish.js

@@ -0,0 +1,77 @@
+const { chmodSync, copyFileSync, existsSync, readFileSync, writeFileSync } = require("node:fs");
+const { join } = require("node:path");
+
+const version = process.env.YAAK_CLI_VERSION?.replace(/^v/, "");
+if (!version) {
+  console.error("YAAK_CLI_VERSION is not set");
+  process.exit(1);
+}
+
+const packages = [
+  "cli",
+  "cli-darwin-arm64",
+  "cli-darwin-x64",
+  "cli-linux-arm64",
+  "cli-linux-x64",
+  "cli-win32-arm64",
+  "cli-win32-x64"
+];
+
+const binaries = [
+  {
+    src: join(__dirname, "dist", "cli-darwin-arm64", "yaak"),
+    dest: join(__dirname, "cli-darwin-arm64", "bin", "yaak")
+  },
+  {
+    src: join(__dirname, "dist", "cli-darwin-x64", "yaak"),
+    dest: join(__dirname, "cli-darwin-x64", "bin", "yaak")
+  },
+  {
+    src: join(__dirname, "dist", "cli-linux-arm64", "yaak"),
+    dest: join(__dirname, "cli-linux-arm64", "bin", "yaak")
+  },
+  {
+    src: join(__dirname, "dist", "cli-linux-x64", "yaak"),
+    dest: join(__dirname, "cli-linux-x64", "bin", "yaak")
+  },
+  {
+    src: join(__dirname, "dist", "cli-win32-arm64", "yaak.exe"),
+    dest: join(__dirname, "cli-win32-arm64", "bin", "yaak.exe")
+  },
+  {
+    src: join(__dirname, "dist", "cli-win32-x64", "yaak.exe"),
+    dest: join(__dirname, "cli-win32-x64", "bin", "yaak.exe")
+  }
+];
+
+for (const { src, dest } of binaries) {
+  if (!existsSync(src)) {
+    console.error(`Missing binary artifact: ${src}`);
+    process.exit(1);
+  }
+  copyFileSync(src, dest);
+  if (!dest.endsWith(".exe")) {
+    chmodSync(dest, 0o755);
+  }
+}
+
+for (const pkg of packages) {
+  const filepath = join(__dirname, pkg, "package.json");
+  const json = JSON.parse(readFileSync(filepath, "utf-8"));
+  json.version = version;
+
+  if (json.name === "@yaakapp/cli") {
+    json.optionalDependencies = {
+      "@yaakapp/cli-darwin-x64": version,
+      "@yaakapp/cli-darwin-arm64": version,
+      "@yaakapp/cli-linux-arm64": version,
+      "@yaakapp/cli-linux-x64": version,
+      "@yaakapp/cli-win32-x64": version,
+      "@yaakapp/cli-win32-arm64": version
+    };
+  }
+
+  writeFileSync(filepath, `${JSON.stringify(json, null, 2)}\n`);
+}
+
+console.log(`Prepared @yaakapp/cli npm packages for ${version}`);

package-lock.json

@@ -73,7 +73,7 @@
       "devDependencies": {
         "@biomejs/biome": "^2.3.13",
         "@tauri-apps/cli": "^2.9.6",
-        "@yaakapp/cli": "^0.3.4",
+        "@yaakapp/cli": "^0.4.0",
         "dotenv-cli": "^11.0.0",
         "husky": "^9.1.7",
         "nodejs-file-downloader": "^4.13.0",
@@ -1491,29 +1491,6 @@
         "hono": "^4"
       }
     },
-    "node_modules/@isaacs/balanced-match": {
-      "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/@isaacs/balanced-match/-/balanced-match-4.0.1.tgz",
-      "integrity": "sha512-yzMTt9lEb8Gv7zRioUilSglI0c0smZ9k5D65677DLWLtWJaXIS3CqcGyUFByYKlnUj6TkjLVs54fBl6+TiGQDQ==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": "20 || >=22"
-      }
-    },
-    "node_modules/@isaacs/brace-expansion": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/@isaacs/brace-expansion/-/brace-expansion-5.0.0.tgz",
-      "integrity": "sha512-ZT55BDLV0yv0RBm2czMiZ+SqCGO7AvmOM3G/w2xhVPH+te0aKgFjmBvGlL1dH+ql2tgGO3MVrbb3jCKyvpgnxA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@isaacs/balanced-match": "^4.0.1"
-      },
-      "engines": {
-        "node": "20 || >=22"
-      }
-    },
     "node_modules/@isaacs/cliui": {
       "version": "8.0.2",
       "resolved": "https://registry.npmjs.org/@isaacs/cliui/-/cliui-8.0.2.tgz",
@@ -2242,9 +2219,9 @@
       "license": "MIT"
     },
     "node_modules/@rollup/rollup-android-arm-eabi": {
-      "version": "4.55.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm-eabi/-/rollup-android-arm-eabi-4.55.1.tgz",
-      "integrity": "sha512-9R0DM/ykwfGIlNu6+2U09ga0WXeZ9MRC2Ter8jnz8415VbuIykVuc6bhdrbORFZANDmTDvq26mJrEVTl8TdnDg==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm-eabi/-/rollup-android-arm-eabi-4.59.0.tgz",
+      "integrity": "sha512-upnNBkA6ZH2VKGcBj9Fyl9IGNPULcjXRlg0LLeaioQWueH30p6IXtJEbKAgvyv+mJaMxSm1l6xwDXYjpEMiLMg==",
       "cpu": [
         "arm"
       ],
@@ -2256,9 +2233,9 @@
       ]
     },
     "node_modules/@rollup/rollup-android-arm64": {
-      "version": "4.55.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm64/-/rollup-android-arm64-4.55.1.tgz",
-      "integrity": "sha512-eFZCb1YUqhTysgW3sj/55du5cG57S7UTNtdMjCW7LwVcj3dTTcowCsC8p7uBdzKsZYa8J7IDE8lhMI+HX1vQvg==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm64/-/rollup-android-arm64-4.59.0.tgz",
+      "integrity": "sha512-hZ+Zxj3SySm4A/DylsDKZAeVg0mvi++0PYVceVyX7hemkw7OreKdCvW2oQ3T1FMZvCaQXqOTHb8qmBShoqk69Q==",
       "cpu": [
         "arm64"
       ],
@@ -2270,9 +2247,9 @@
       ]
     },
     "node_modules/@rollup/rollup-darwin-arm64": {
-      "version": "4.55.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-arm64/-/rollup-darwin-arm64-4.55.1.tgz",
-      "integrity": "sha512-p3grE2PHcQm2e8PSGZdzIhCKbMCw/xi9XvMPErPhwO17vxtvCN5FEA2mSLgmKlCjHGMQTP6phuQTYWUnKewwGg==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-arm64/-/rollup-darwin-arm64-4.59.0.tgz",
+      "integrity": "sha512-W2Psnbh1J8ZJw0xKAd8zdNgF9HRLkdWwwdWqubSVk0pUuQkoHnv7rx4GiF9rT4t5DIZGAsConRE3AxCdJ4m8rg==",
       "cpu": [
         "arm64"
       ],
@@ -2284,9 +2261,9 @@
       ]
     },
     "node_modules/@rollup/rollup-darwin-x64": {
-      "version": "4.55.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-x64/-/rollup-darwin-x64-4.55.1.tgz",
-      "integrity": "sha512-rDUjG25C9qoTm+e02Esi+aqTKSBYwVTaoS1wxcN47/Luqef57Vgp96xNANwt5npq9GDxsH7kXxNkJVEsWEOEaQ==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-x64/-/rollup-darwin-x64-4.59.0.tgz",
+      "integrity": "sha512-ZW2KkwlS4lwTv7ZVsYDiARfFCnSGhzYPdiOU4IM2fDbL+QGlyAbjgSFuqNRbSthybLbIJ915UtZBtmuLrQAT/w==",
       "cpu": [
         "x64"
       ],
@@ -2298,9 +2275,9 @@
       ]
     },
     "node_modules/@rollup/rollup-freebsd-arm64": {
-      "version": "4.55.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-arm64/-/rollup-freebsd-arm64-4.55.1.tgz",
-      "integrity": "sha512-+JiU7Jbp5cdxekIgdte0jfcu5oqw4GCKr6i3PJTlXTCU5H5Fvtkpbs4XJHRmWNXF+hKmn4v7ogI5OQPaupJgOg==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-arm64/-/rollup-freebsd-arm64-4.59.0.tgz",
+      "integrity": "sha512-EsKaJ5ytAu9jI3lonzn3BgG8iRBjV4LxZexygcQbpiU0wU0ATxhNVEpXKfUa0pS05gTcSDMKpn3Sx+QB9RlTTA==",
       "cpu": [
         "arm64"
       ],
@@ -2312,9 +2289,9 @@
       ]
     },
     "node_modules/@rollup/rollup-freebsd-x64": {
-      "version": "4.55.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-x64/-/rollup-freebsd-x64-4.55.1.tgz",
-      "integrity": "sha512-V5xC1tOVWtLLmr3YUk2f6EJK4qksksOYiz/TCsFHu/R+woubcLWdC9nZQmwjOAbmExBIVKsm1/wKmEy4z4u4Bw==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-x64/-/rollup-freebsd-x64-4.59.0.tgz",
+      "integrity": "sha512-d3DuZi2KzTMjImrxoHIAODUZYoUUMsuUiY4SRRcJy6NJoZ6iIqWnJu9IScV9jXysyGMVuW+KNzZvBLOcpdl3Vg==",
       "cpu": [
         "x64"
       ],
@@ -2326,9 +2303,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-arm-gnueabihf": {
-      "version": "4.55.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-gnueabihf/-/rollup-linux-arm-gnueabihf-4.55.1.tgz",
-      "integrity": "sha512-Rn3n+FUk2J5VWx+ywrG/HGPTD9jXNbicRtTM11e/uorplArnXZYsVifnPPqNNP5BsO3roI4n8332ukpY/zN7rQ==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-gnueabihf/-/rollup-linux-arm-gnueabihf-4.59.0.tgz",
+      "integrity": "sha512-t4ONHboXi/3E0rT6OZl1pKbl2Vgxf9vJfWgmUoCEVQVxhW6Cw/c8I6hbbu7DAvgp82RKiH7TpLwxnJeKv2pbsw==",
       "cpu": [
         "arm"
       ],
@@ -2340,9 +2317,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-arm-musleabihf": {
-      "version": "4.55.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-musleabihf/-/rollup-linux-arm-musleabihf-4.55.1.tgz",
-      "integrity": "sha512-grPNWydeKtc1aEdrJDWk4opD7nFtQbMmV7769hiAaYyUKCT1faPRm2av8CX1YJsZ4TLAZcg9gTR1KvEzoLjXkg==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-musleabihf/-/rollup-linux-arm-musleabihf-4.59.0.tgz",
+      "integrity": "sha512-CikFT7aYPA2ufMD086cVORBYGHffBo4K8MQ4uPS/ZnY54GKj36i196u8U+aDVT2LX4eSMbyHtyOh7D7Zvk2VvA==",
       "cpu": [
         "arm"
       ],
@@ -2354,9 +2331,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-arm64-gnu": {
-      "version": "4.55.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-gnu/-/rollup-linux-arm64-gnu-4.55.1.tgz",
-      "integrity": "sha512-a59mwd1k6x8tXKcUxSyISiquLwB5pX+fJW9TkWU46lCqD/GRDe9uDN31jrMmVP3feI3mhAdvcCClhV8V5MhJFQ==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-gnu/-/rollup-linux-arm64-gnu-4.59.0.tgz",
+      "integrity": "sha512-jYgUGk5aLd1nUb1CtQ8E+t5JhLc9x5WdBKew9ZgAXg7DBk0ZHErLHdXM24rfX+bKrFe+Xp5YuJo54I5HFjGDAA==",
       "cpu": [
         "arm64"
       ],
@@ -2368,9 +2345,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-arm64-musl": {
-      "version": "4.55.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-musl/-/rollup-linux-arm64-musl-4.55.1.tgz",
-      "integrity": "sha512-puS1MEgWX5GsHSoiAsF0TYrpomdvkaXm0CofIMG5uVkP6IBV+ZO9xhC5YEN49nsgYo1DuuMquF9+7EDBVYu4uA==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-musl/-/rollup-linux-arm64-musl-4.59.0.tgz",
+      "integrity": "sha512-peZRVEdnFWZ5Bh2KeumKG9ty7aCXzzEsHShOZEFiCQlDEepP1dpUl/SrUNXNg13UmZl+gzVDPsiCwnV1uI0RUA==",
       "cpu": [
         "arm64"
       ],
@@ -2382,9 +2359,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-loong64-gnu": {
-      "version": "4.55.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-gnu/-/rollup-linux-loong64-gnu-4.55.1.tgz",
-      "integrity": "sha512-r3Wv40in+lTsULSb6nnoudVbARdOwb2u5fpeoOAZjFLznp6tDU8kd+GTHmJoqZ9lt6/Sys33KdIHUaQihFcu7g==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-gnu/-/rollup-linux-loong64-gnu-4.59.0.tgz",
+      "integrity": "sha512-gbUSW/97f7+r4gHy3Jlup8zDG190AuodsWnNiXErp9mT90iCy9NKKU0Xwx5k8VlRAIV2uU9CsMnEFg/xXaOfXg==",
       "cpu": [
         "loong64"
       ],
@@ -2396,9 +2373,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-loong64-musl": {
-      "version": "4.55.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-musl/-/rollup-linux-loong64-musl-4.55.1.tgz",
-      "integrity": "sha512-MR8c0+UxAlB22Fq4R+aQSPBayvYa3+9DrwG/i1TKQXFYEaoW3B5b/rkSRIypcZDdWjWnpcvxbNaAJDcSbJU3Lw==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-musl/-/rollup-linux-loong64-musl-4.59.0.tgz",
+      "integrity": "sha512-yTRONe79E+o0FWFijasoTjtzG9EBedFXJMl888NBEDCDV9I2wGbFFfJQQe63OijbFCUZqxpHz1GzpbtSFikJ4Q==",
       "cpu": [
         "loong64"
       ],
@@ -2410,9 +2387,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-ppc64-gnu": {
-      "version": "4.55.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-gnu/-/rollup-linux-ppc64-gnu-4.55.1.tgz",
-      "integrity": "sha512-3KhoECe1BRlSYpMTeVrD4sh2Pw2xgt4jzNSZIIPLFEsnQn9gAnZagW9+VqDqAHgm1Xc77LzJOo2LdigS5qZ+gw==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-gnu/-/rollup-linux-ppc64-gnu-4.59.0.tgz",
+      "integrity": "sha512-sw1o3tfyk12k3OEpRddF68a1unZ5VCN7zoTNtSn2KndUE+ea3m3ROOKRCZxEpmT9nsGnogpFP9x6mnLTCaoLkA==",
       "cpu": [
         "ppc64"
       ],
@@ -2424,9 +2401,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-ppc64-musl": {
-      "version": "4.55.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-musl/-/rollup-linux-ppc64-musl-4.55.1.tgz",
-      "integrity": "sha512-ziR1OuZx0vdYZZ30vueNZTg73alF59DicYrPViG0NEgDVN8/Jl87zkAPu4u6VjZST2llgEUjaiNl9JM6HH1Vdw==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-musl/-/rollup-linux-ppc64-musl-4.59.0.tgz",
+      "integrity": "sha512-+2kLtQ4xT3AiIxkzFVFXfsmlZiG5FXYW7ZyIIvGA7Bdeuh9Z0aN4hVyXS/G1E9bTP/vqszNIN/pUKCk/BTHsKA==",
       "cpu": [
         "ppc64"
       ],
@@ -2438,9 +2415,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-riscv64-gnu": {
-      "version": "4.55.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-gnu/-/rollup-linux-riscv64-gnu-4.55.1.tgz",
-      "integrity": "sha512-uW0Y12ih2XJRERZ4jAfKamTyIHVMPQnTZcQjme2HMVDAHY4amf5u414OqNYC+x+LzRdRcnIG1YodLrrtA8xsxw==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-gnu/-/rollup-linux-riscv64-gnu-4.59.0.tgz",
+      "integrity": "sha512-NDYMpsXYJJaj+I7UdwIuHHNxXZ/b/N2hR15NyH3m2qAtb/hHPA4g4SuuvrdxetTdndfj9b1WOmy73kcPRoERUg==",
       "cpu": [
         "riscv64"
       ],
@@ -2452,9 +2429,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-riscv64-musl": {
-      "version": "4.55.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-musl/-/rollup-linux-riscv64-musl-4.55.1.tgz",
-      "integrity": "sha512-u9yZ0jUkOED1BFrqu3BwMQoixvGHGZ+JhJNkNKY/hyoEgOwlqKb62qu+7UjbPSHYjiVy8kKJHvXKv5coH4wDeg==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-musl/-/rollup-linux-riscv64-musl-4.59.0.tgz",
+      "integrity": "sha512-nLckB8WOqHIf1bhymk+oHxvM9D3tyPndZH8i8+35p/1YiVoVswPid2yLzgX7ZJP0KQvnkhM4H6QZ5m0LzbyIAg==",
       "cpu": [
         "riscv64"
       ],
@@ -2466,9 +2443,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-s390x-gnu": {
-      "version": "4.55.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-s390x-gnu/-/rollup-linux-s390x-gnu-4.55.1.tgz",
-      "integrity": "sha512-/0PenBCmqM4ZUd0190j7J0UsQ/1nsi735iPRakO8iPciE7BQ495Y6msPzaOmvx0/pn+eJVVlZrNrSh4WSYLxNg==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-s390x-gnu/-/rollup-linux-s390x-gnu-4.59.0.tgz",
+      "integrity": "sha512-oF87Ie3uAIvORFBpwnCvUzdeYUqi2wY6jRFWJAy1qus/udHFYIkplYRW+wo+GRUP4sKzYdmE1Y3+rY5Gc4ZO+w==",
       "cpu": [
         "s390x"
       ],
@@ -2480,9 +2457,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-x64-gnu": {
-      "version": "4.55.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-gnu/-/rollup-linux-x64-gnu-4.55.1.tgz",
-      "integrity": "sha512-a8G4wiQxQG2BAvo+gU6XrReRRqj+pLS2NGXKm8io19goR+K8lw269eTrPkSdDTALwMmJp4th2Uh0D8J9bEV1vg==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-gnu/-/rollup-linux-x64-gnu-4.59.0.tgz",
+      "integrity": "sha512-3AHmtQq/ppNuUspKAlvA8HtLybkDflkMuLK4DPo77DfthRb71V84/c4MlWJXixZz4uruIH4uaa07IqoAkG64fg==",
       "cpu": [
         "x64"
       ],
@@ -2494,9 +2471,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-x64-musl": {
-      "version": "4.55.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-musl/-/rollup-linux-x64-musl-4.55.1.tgz",
-      "integrity": "sha512-bD+zjpFrMpP/hqkfEcnjXWHMw5BIghGisOKPj+2NaNDuVT+8Ds4mPf3XcPHuat1tz89WRL+1wbcxKY3WSbiT7w==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-musl/-/rollup-linux-x64-musl-4.59.0.tgz",
+      "integrity": "sha512-2UdiwS/9cTAx7qIUZB/fWtToJwvt0Vbo0zmnYt7ED35KPg13Q0ym1g442THLC7VyI6JfYTP4PiSOWyoMdV2/xg==",
       "cpu": [
         "x64"
       ],
@@ -2508,9 +2485,9 @@
       ]
     },
     "node_modules/@rollup/rollup-openbsd-x64": {
-      "version": "4.55.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-openbsd-x64/-/rollup-openbsd-x64-4.55.1.tgz",
-      "integrity": "sha512-eLXw0dOiqE4QmvikfQ6yjgkg/xDM+MdU9YJuP4ySTibXU0oAvnEWXt7UDJmD4UkYialMfOGFPJnIHSe/kdzPxg==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-openbsd-x64/-/rollup-openbsd-x64-4.59.0.tgz",
+      "integrity": "sha512-M3bLRAVk6GOwFlPTIxVBSYKUaqfLrn8l0psKinkCFxl4lQvOSz8ZrKDz2gxcBwHFpci0B6rttydI4IpS4IS/jQ==",
       "cpu": [
         "x64"
       ],
@@ -2522,9 +2499,9 @@
       ]
     },
     "node_modules/@rollup/rollup-openharmony-arm64": {
-      "version": "4.55.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-openharmony-arm64/-/rollup-openharmony-arm64-4.55.1.tgz",
-      "integrity": "sha512-xzm44KgEP11te3S2HCSyYf5zIzWmx3n8HDCc7EE59+lTcswEWNpvMLfd9uJvVX8LCg9QWG67Xt75AuHn4vgsXw==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-openharmony-arm64/-/rollup-openharmony-arm64-4.59.0.tgz",
+      "integrity": "sha512-tt9KBJqaqp5i5HUZzoafHZX8b5Q2Fe7UjYERADll83O4fGqJ49O1FsL6LpdzVFQcpwvnyd0i+K/VSwu/o/nWlA==",
       "cpu": [
         "arm64"
       ],
@@ -2536,9 +2513,9 @@
       ]
     },
     "node_modules/@rollup/rollup-win32-arm64-msvc": {
-      "version": "4.55.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-arm64-msvc/-/rollup-win32-arm64-msvc-4.55.1.tgz",
-      "integrity": "sha512-yR6Bl3tMC/gBok5cz/Qi0xYnVbIxGx5Fcf/ca0eB6/6JwOY+SRUcJfI0OpeTpPls7f194as62thCt/2BjxYN8g==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-arm64-msvc/-/rollup-win32-arm64-msvc-4.59.0.tgz",
+      "integrity": "sha512-V5B6mG7OrGTwnxaNUzZTDTjDS7F75PO1ae6MJYdiMu60sq0CqN5CVeVsbhPxalupvTX8gXVSU9gq+Rx1/hvu6A==",
       "cpu": [
         "arm64"
       ],
@@ -2550,9 +2527,9 @@
       ]
     },
     "node_modules/@rollup/rollup-win32-ia32-msvc": {
-      "version": "4.55.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-ia32-msvc/-/rollup-win32-ia32-msvc-4.55.1.tgz",
-      "integrity": "sha512-3fZBidchE0eY0oFZBnekYCfg+5wAB0mbpCBuofh5mZuzIU/4jIVkbESmd2dOsFNS78b53CYv3OAtwqkZZmU5nA==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-ia32-msvc/-/rollup-win32-ia32-msvc-4.59.0.tgz",
+      "integrity": "sha512-UKFMHPuM9R0iBegwzKF4y0C4J9u8C6MEJgFuXTBerMk7EJ92GFVFYBfOZaSGLu6COf7FxpQNqhNS4c4icUPqxA==",
       "cpu": [
         "ia32"
       ],
@@ -2564,9 +2541,9 @@
       ]
     },
     "node_modules/@rollup/rollup-win32-x64-gnu": {
-      "version": "4.55.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-gnu/-/rollup-win32-x64-gnu-4.55.1.tgz",
-      "integrity": "sha512-xGGY5pXj69IxKb4yv/POoocPy/qmEGhimy/FoTpTSVju3FYXUQQMFCaZZXJVidsmGxRioZAwpThl/4zX41gRKg==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-gnu/-/rollup-win32-x64-gnu-4.59.0.tgz",
+      "integrity": "sha512-laBkYlSS1n2L8fSo1thDNGrCTQMmxjYY5G0WFWjFFYZkKPjsMBsgJfGf4TLxXrF6RyhI60L8TMOjBMvXiTcxeA==",
       "cpu": [
         "x64"
       ],
@@ -2578,9 +2555,9 @@
       ]
     },
     "node_modules/@rollup/rollup-win32-x64-msvc": {
-      "version": "4.55.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-msvc/-/rollup-win32-x64-msvc-4.55.1.tgz",
-      "integrity": "sha512-SPEpaL6DX4rmcXtnhdrQYgzQ5W2uW3SCJch88lB2zImhJRhIIK44fkUrgIV/Q8yUNfw5oyZ5vkeQsZLhCb06lw==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-msvc/-/rollup-win32-x64-msvc-4.59.0.tgz",
+      "integrity": "sha512-2HRCml6OztYXyJXAvdDXPKcawukWY2GpR5/nxKp4iBgiO3wcoEGkAaqctIbZcNB6KlUQBIqt8VYkNSj2397EfA==",
       "cpu": [
         "x64"
       ],
@@ -4326,27 +4303,28 @@
       "link": true
     },
     "node_modules/@yaakapp/cli": {
-      "version": "0.3.4",
-      "resolved": "https://registry.npmjs.org/@yaakapp/cli/-/cli-0.3.4.tgz",
-      "integrity": "sha512-bSSL3noEfyoPC0M+bj34jbBZbB+gwYLCHL9cf6BYHgkRQKlHFpvN6z8M2jQZljb+CTQdHK0NzosmwHLpjMmAVA==",
+      "version": "0.4.0",
+      "resolved": "https://registry.npmjs.org/@yaakapp/cli/-/cli-0.4.0.tgz",
+      "integrity": "sha512-8xnu2oFWlgV+xeIAHMuEgsqX6Sxq4UYrSH2WbafwDLbSep6fxpO74tiBH7xp4wakt/7Bcy9a2Q5R9nkAc1ZUdA==",
       "dev": true,
       "hasInstallScript": true,
       "bin": {
+        "yaak": "bin/cli.js",
         "yaakcli": "bin/cli.js"
       },
       "optionalDependencies": {
-        "@yaakapp/cli-darwin-arm64": "0.3.4",
-        "@yaakapp/cli-darwin-x64": "0.3.4",
-        "@yaakapp/cli-linux-arm64": "0.3.4",
-        "@yaakapp/cli-linux-x64": "0.3.4",
-        "@yaakapp/cli-win32-arm64": "0.3.4",
-        "@yaakapp/cli-win32-x64": "0.3.4"
+        "@yaakapp/cli-darwin-arm64": "0.4.0",
+        "@yaakapp/cli-darwin-x64": "0.4.0",
+        "@yaakapp/cli-linux-arm64": "0.4.0",
+        "@yaakapp/cli-linux-x64": "0.4.0",
+        "@yaakapp/cli-win32-arm64": "0.4.0",
+        "@yaakapp/cli-win32-x64": "0.4.0"
       }
     },
     "node_modules/@yaakapp/cli-darwin-arm64": {
-      "version": "0.3.4",
-      "resolved": "https://registry.npmjs.org/@yaakapp/cli-darwin-arm64/-/cli-darwin-arm64-0.3.4.tgz",
-      "integrity": "sha512-iTohEO7XSVZwSvTgEQE9my3wGyWtTl1q8yfol7hHwVFTX7G8Geh8X2j2vVokHhj7J9OZL9jtYQWIsM1ekOHSEQ==",
+      "version": "0.4.0",
+      "resolved": "https://registry.npmjs.org/@yaakapp/cli-darwin-arm64/-/cli-darwin-arm64-0.4.0.tgz",
+      "integrity": "sha512-bl8+VQNPMabXNGQCa7u6w0JGe3CmzYZPsGE8Q+5wGSxa3trGf1bmq/fMW5JXrMi1P7Laepnyad0TGGP/2C8uwQ==",
       "cpu": [
         "arm64"
       ],
@@ -4357,9 +4335,9 @@
       ]
     },
     "node_modules/@yaakapp/cli-darwin-x64": {
-      "version": "0.3.4",
-      "resolved": "https://registry.npmjs.org/@yaakapp/cli-darwin-x64/-/cli-darwin-x64-0.3.4.tgz",
-      "integrity": "sha512-gz7IcjFGKA0cCAum1Aq8kmVg7erYYSrZ9pliDw0NZyObjrBysJcsDXLodEU437u0pihtdCfoLsq3rsYYs8uwCA==",
+      "version": "0.4.0",
+      "resolved": "https://registry.npmjs.org/@yaakapp/cli-darwin-x64/-/cli-darwin-x64-0.4.0.tgz",
+      "integrity": "sha512-R+ETXNBWvmA3W88ZoTk/JtG/PZaUb85y3SwBgMbwcgdhBVwNS/g+DbCspcTFI5zs8Txsf5VuiFU+dW9M9olZ6A==",
       "cpu": [
         "x64"
       ],
@@ -4370,9 +4348,9 @@
       ]
     },
     "node_modules/@yaakapp/cli-linux-arm64": {
-      "version": "0.3.4",
-      "resolved": "https://registry.npmjs.org/@yaakapp/cli-linux-arm64/-/cli-linux-arm64-0.3.4.tgz",
-      "integrity": "sha512-Yiwz8PBkXngmr0lTMW1pgy+F/kUISkzvqofdoBseXTrS/GDxoW3ILnG3If30LuIyWWPgqpuU+qKMtbVDzuncPQ==",
+      "version": "0.4.0",
+      "resolved": "https://registry.npmjs.org/@yaakapp/cli-linux-arm64/-/cli-linux-arm64-0.4.0.tgz",
+      "integrity": "sha512-Pf7VyQf4r85FsI0qYnnst7URQF8/RxSZZj79cXLai0FnN3fDiypX4CmHx765bJxgfQZlBvqVmvPAaMW/TeiJEQ==",
       "cpu": [
         "arm64"
       ],
@@ -4383,9 +4361,9 @@
       ]
     },
     "node_modules/@yaakapp/cli-linux-x64": {
-      "version": "0.3.4",
-      "resolved": "https://registry.npmjs.org/@yaakapp/cli-linux-x64/-/cli-linux-x64-0.3.4.tgz",
-      "integrity": "sha512-j7/r18UYNlFChDVU5N5ye3mmL+OR9Uu3LY72JxW+s/SyV69Bo8Griii75Wt19z/jj2ES8pxD+4IJq56VF3wJ7w==",
+      "version": "0.4.0",
+      "resolved": "https://registry.npmjs.org/@yaakapp/cli-linux-x64/-/cli-linux-x64-0.4.0.tgz",
+      "integrity": "sha512-bYWWfHAIW81A+ydJChjH1Qo3+aihz9gFLh7/9MOa6CJgnC6H3V5cnapmh50Hddt9l5ic02aA1FB8ORQOXxb01A==",
       "cpu": [
         "x64"
       ],
@@ -4396,9 +4374,9 @@
       ]
     },
     "node_modules/@yaakapp/cli-win32-arm64": {
-      "version": "0.3.4",
-      "resolved": "https://registry.npmjs.org/@yaakapp/cli-win32-arm64/-/cli-win32-arm64-0.3.4.tgz",
-      "integrity": "sha512-OUSKOKrSnzrTAGW0c+2ZCwA4yhgw/bA+gyeTvpf7cELVuB0qooGkEcJ3lM7fPMKmUbFU0r+K/Ggq1QMUr7cJLQ==",
+      "version": "0.4.0",
+      "resolved": "https://registry.npmjs.org/@yaakapp/cli-win32-arm64/-/cli-win32-arm64-0.4.0.tgz",
+      "integrity": "sha512-8X12xkyidyYZ5vtarZGFSYR6HJbUMFUsNxYPNQccnYJIY+soNkjJHOWDjaRvBzCbR8MLT9N04Y5PE/Jv20gXpA==",
       "cpu": [
         "arm64"
       ],
@@ -4409,9 +4387,9 @@
       ]
     },
     "node_modules/@yaakapp/cli-win32-x64": {
-      "version": "0.3.4",
-      "resolved": "https://registry.npmjs.org/@yaakapp/cli-win32-x64/-/cli-win32-x64-0.3.4.tgz",
-      "integrity": "sha512-sVYnW1rROLbzFUCyeZ++ibN+8gJS7FdPnBRHIE0KORfeI4e7Gw/aMUji2qpSZ1gt3DrAU95DDNjBkDvGBAgqag==",
+      "version": "0.4.0",
+      "resolved": "https://registry.npmjs.org/@yaakapp/cli-win32-x64/-/cli-win32-x64-0.4.0.tgz",
+      "integrity": "sha512-wansfrCCycFcFclowQQxfsNLIAyATyqnnbITED5gUfUrBf8NFHrG0sWVCWlXUhHU7YvpmqL7CsdtlMkIGiZCPQ==",
       "cpu": [
         "x64"
       ],
@@ -5798,17 +5776,40 @@
         "npm": ">=10"
       }
     },
+    "node_modules/cpx2/node_modules/balanced-match": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
+      "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "18 || 20 || >=22"
+      }
+    },
+    "node_modules/cpx2/node_modules/brace-expansion": {
+      "version": "5.0.3",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.3.tgz",
+      "integrity": "sha512-fy6KJm2RawA5RcHkLa1z/ScpBeA762UF9KmZQxwIbDtRJrgLzM10depAiEQ+CXYcoiqW1/m96OAAoke2nE9EeA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^4.0.2"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
+      }
+    },
     "node_modules/cpx2/node_modules/minimatch": {
-      "version": "10.1.1",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.1.1.tgz",
-      "integrity": "sha512-enIvLvRAFZYXJzkCYG5RKmPfrFArdLv+R+lbQ53BmIMLIry74bjKzX6iHAm8WYamJkhSSEabrWN5D97XnKObjQ==",
+      "version": "10.2.4",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.4.tgz",
+      "integrity": "sha512-oRjTw/97aTBN0RHbYCdtF1MQfvusSIBQM0IZEgzl6426+8jSC0nF1a/GmnVLpfB9yyr6g6FTqWqiZVbxrtaCIg==",
       "dev": true,
       "license": "BlueOak-1.0.0",
       "dependencies": {
-        "@isaacs/brace-expansion": "^5.0.0"
+        "brace-expansion": "^5.0.2"
       },
       "engines": {
-        "node": "20 || >=22"
+        "node": "18 || 20 || >=22"
       },
       "funding": {
         "url": "https://github.com/sponsors/isaacs"
@@ -7635,17 +7636,40 @@
         "node": ">= 6"
       }
     },
+    "node_modules/glob/node_modules/balanced-match": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
+      "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "18 || 20 || >=22"
+      }
+    },
+    "node_modules/glob/node_modules/brace-expansion": {
+      "version": "5.0.3",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.3.tgz",
+      "integrity": "sha512-fy6KJm2RawA5RcHkLa1z/ScpBeA762UF9KmZQxwIbDtRJrgLzM10depAiEQ+CXYcoiqW1/m96OAAoke2nE9EeA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^4.0.2"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
+      }
+    },
     "node_modules/glob/node_modules/minimatch": {
-      "version": "10.1.1",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.1.1.tgz",
-      "integrity": "sha512-enIvLvRAFZYXJzkCYG5RKmPfrFArdLv+R+lbQ53BmIMLIry74bjKzX6iHAm8WYamJkhSSEabrWN5D97XnKObjQ==",
+      "version": "10.2.4",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.4.tgz",
+      "integrity": "sha512-oRjTw/97aTBN0RHbYCdtF1MQfvusSIBQM0IZEgzl6426+8jSC0nF1a/GmnVLpfB9yyr6g6FTqWqiZVbxrtaCIg==",
       "dev": true,
       "license": "BlueOak-1.0.0",
       "dependencies": {
-        "@isaacs/brace-expansion": "^5.0.0"
+        "brace-expansion": "^5.0.2"
       },
       "engines": {
-        "node": "20 || >=22"
+        "node": "18 || 20 || >=22"
       },
       "funding": {
         "url": "https://github.com/sponsors/isaacs"
@@ -7984,9 +8008,9 @@
       }
     },
     "node_modules/hono": {
-      "version": "4.11.7",
-      "resolved": "https://registry.npmjs.org/hono/-/hono-4.11.7.tgz",
-      "integrity": "sha512-l7qMiNee7t82bH3SeyUCt9UF15EVmaBvsppY2zQtrbIhl/yzBTny+YUxsVjSjQ6gaqaeVtZmGocom8TzBlA4Yw==",
+      "version": "4.11.10",
+      "resolved": "https://registry.npmjs.org/hono/-/hono-4.11.10.tgz",
+      "integrity": "sha512-kyWP5PAiMooEvGrA9jcD3IXF7ATu8+o7B3KCbPXid5se52NPqnOpM/r9qeW2heMnOekF4kqR1fXJqCYeCLKrZg==",
       "license": "MIT",
       "engines": {
         "node": ">=16.9.0"
@@ -10523,9 +10547,9 @@
       "license": "ISC"
     },
     "node_modules/minimatch": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
-      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -12950,6 +12974,29 @@
         "url": "https://github.com/sponsors/isaacs"
       }
     },
+    "node_modules/rimraf/node_modules/balanced-match": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
+      "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "18 || 20 || >=22"
+      }
+    },
+    "node_modules/rimraf/node_modules/brace-expansion": {
+      "version": "5.0.3",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.3.tgz",
+      "integrity": "sha512-fy6KJm2RawA5RcHkLa1z/ScpBeA762UF9KmZQxwIbDtRJrgLzM10depAiEQ+CXYcoiqW1/m96OAAoke2nE9EeA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^4.0.2"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
+      }
+    },
     "node_modules/rimraf/node_modules/glob": {
       "version": "13.0.0",
       "resolved": "https://registry.npmjs.org/glob/-/glob-13.0.0.tgz",
@@ -12969,25 +13016,25 @@
       }
     },
     "node_modules/rimraf/node_modules/minimatch": {
-      "version": "10.1.1",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.1.1.tgz",
-      "integrity": "sha512-enIvLvRAFZYXJzkCYG5RKmPfrFArdLv+R+lbQ53BmIMLIry74bjKzX6iHAm8WYamJkhSSEabrWN5D97XnKObjQ==",
+      "version": "10.2.4",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.4.tgz",
+      "integrity": "sha512-oRjTw/97aTBN0RHbYCdtF1MQfvusSIBQM0IZEgzl6426+8jSC0nF1a/GmnVLpfB9yyr6g6FTqWqiZVbxrtaCIg==",
       "dev": true,
       "license": "BlueOak-1.0.0",
       "dependencies": {
-        "@isaacs/brace-expansion": "^5.0.0"
+        "brace-expansion": "^5.0.2"
       },
       "engines": {
-        "node": "20 || >=22"
+        "node": "18 || 20 || >=22"
       },
       "funding": {
         "url": "https://github.com/sponsors/isaacs"
       }
     },
     "node_modules/rollup": {
-      "version": "4.55.1",
-      "resolved": "https://registry.npmjs.org/rollup/-/rollup-4.55.1.tgz",
-      "integrity": "sha512-wDv/Ht1BNHB4upNbK74s9usvl7hObDnvVzknxqY/E/O3X6rW1U1rV1aENEfJ54eFZDTNo7zv1f5N4edCluH7+A==",
+      "version": "4.59.0",
+      "resolved": "https://registry.npmjs.org/rollup/-/rollup-4.59.0.tgz",
+      "integrity": "sha512-2oMpl67a3zCH9H79LeMcbDhXW/UmWG/y2zuqnF2jQq5uq9TbM9TVyXvA4+t+ne2IIkBdrLpAaRQAvo7YI/Yyeg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -13001,31 +13048,31 @@
         "npm": ">=8.0.0"
       },
       "optionalDependencies": {
-        "@rollup/rollup-android-arm-eabi": "4.55.1",
-        "@rollup/rollup-android-arm64": "4.55.1",
-        "@rollup/rollup-darwin-arm64": "4.55.1",
-        "@rollup/rollup-darwin-x64": "4.55.1",
-        "@rollup/rollup-freebsd-arm64": "4.55.1",
-        "@rollup/rollup-freebsd-x64": "4.55.1",
-        "@rollup/rollup-linux-arm-gnueabihf": "4.55.1",
-        "@rollup/rollup-linux-arm-musleabihf": "4.55.1",
-        "@rollup/rollup-linux-arm64-gnu": "4.55.1",
-        "@rollup/rollup-linux-arm64-musl": "4.55.1",
-        "@rollup/rollup-linux-loong64-gnu": "4.55.1",
-        "@rollup/rollup-linux-loong64-musl": "4.55.1",
-        "@rollup/rollup-linux-ppc64-gnu": "4.55.1",
-        "@rollup/rollup-linux-ppc64-musl": "4.55.1",
-        "@rollup/rollup-linux-riscv64-gnu": "4.55.1",
-        "@rollup/rollup-linux-riscv64-musl": "4.55.1",
-        "@rollup/rollup-linux-s390x-gnu": "4.55.1",
-        "@rollup/rollup-linux-x64-gnu": "4.55.1",
-        "@rollup/rollup-linux-x64-musl": "4.55.1",
-        "@rollup/rollup-openbsd-x64": "4.55.1",
-        "@rollup/rollup-openharmony-arm64": "4.55.1",
-        "@rollup/rollup-win32-arm64-msvc": "4.55.1",
-        "@rollup/rollup-win32-ia32-msvc": "4.55.1",
-        "@rollup/rollup-win32-x64-gnu": "4.55.1",
-        "@rollup/rollup-win32-x64-msvc": "4.55.1",
+        "@rollup/rollup-android-arm-eabi": "4.59.0",
+        "@rollup/rollup-android-arm64": "4.59.0",
+        "@rollup/rollup-darwin-arm64": "4.59.0",
+        "@rollup/rollup-darwin-x64": "4.59.0",
+        "@rollup/rollup-freebsd-arm64": "4.59.0",
+        "@rollup/rollup-freebsd-x64": "4.59.0",
+        "@rollup/rollup-linux-arm-gnueabihf": "4.59.0",
+        "@rollup/rollup-linux-arm-musleabihf": "4.59.0",
+        "@rollup/rollup-linux-arm64-gnu": "4.59.0",
+        "@rollup/rollup-linux-arm64-musl": "4.59.0",
+        "@rollup/rollup-linux-loong64-gnu": "4.59.0",
+        "@rollup/rollup-linux-loong64-musl": "4.59.0",
+        "@rollup/rollup-linux-ppc64-gnu": "4.59.0",
+        "@rollup/rollup-linux-ppc64-musl": "4.59.0",
+        "@rollup/rollup-linux-riscv64-gnu": "4.59.0",
+        "@rollup/rollup-linux-riscv64-musl": "4.59.0",
+        "@rollup/rollup-linux-s390x-gnu": "4.59.0",
+        "@rollup/rollup-linux-x64-gnu": "4.59.0",
+        "@rollup/rollup-linux-x64-musl": "4.59.0",
+        "@rollup/rollup-openbsd-x64": "4.59.0",
+        "@rollup/rollup-openharmony-arm64": "4.59.0",
+        "@rollup/rollup-win32-arm64-msvc": "4.59.0",
+        "@rollup/rollup-win32-ia32-msvc": "4.59.0",
+        "@rollup/rollup-win32-x64-gnu": "4.59.0",
+        "@rollup/rollup-win32-x64-msvc": "4.59.0",
         "fsevents": "~2.3.2"
       }
     },
@@ -16019,7 +16066,7 @@
         "@hono/mcp": "^0.2.3",
         "@hono/node-server": "^1.19.7",
         "@modelcontextprotocol/sdk": "^1.26.0",
-        "hono": "^4.11.7",
+        "hono": "^4.11.10",
         "zod": "^3.25.76"
       },
       "devDependencies": {
@@ -16087,7 +16134,13 @@
     },
     "plugins/auth-oauth2": {
       "name": "@yaak/auth-oauth2",
-      "version": "0.1.0"
+      "version": "0.1.0",
+      "dependencies": {
+        "jsonwebtoken": "^9.0.2"
+      },
+      "devDependencies": {
+        "@types/jsonwebtoken": "^9.0.7"
+      }
     },
     "plugins/filter-jsonpath": {
       "name": "@yaak/filter-jsonpath",

package.json

@@ -70,7 +70,6 @@
     "app-dev": "node scripts/run-dev.mjs",
     "migration": "node scripts/create-migration.cjs",
     "build": "npm run --workspaces --if-present build",
-    "build-plugins": "npm run --workspaces --if-present build",
     "test": "npm run --workspaces --if-present test",
     "icons": "run-p icons:*",
     "icons:dev": "tauri icon crates-tauri/yaak-app/icons/icon-dev.png --output crates-tauri/yaak-app/icons/dev",
@@ -98,7 +97,7 @@
   "devDependencies": {
     "@biomejs/biome": "^2.3.13",
     "@tauri-apps/cli": "^2.9.6",
-    "@yaakapp/cli": "^0.3.4",
+    "@yaakapp/cli": "^0.4.0",
     "dotenv-cli": "^11.0.0",
     "husky": "^9.1.7",
     "nodejs-file-downloader": "^4.13.0",

packages/plugin-runtime-types/package.json

@@ -27,7 +27,6 @@
     "build:copy-types": "run-p build:copy-types:*",
     "build:copy-types:root": "cpy --flat ../../crates/yaak-plugins/bindings/*.ts ./src/bindings",
     "build:copy-types:next": "cpy --flat ../../crates/yaak-plugins/bindings/serde_json/*.ts ./src/bindings/serde_json",
-    "publish": "npm publish",
     "prepublishOnly": "npm run build"
   },
   "dependencies": {