Bump tar from 0.4.44 to 0.4.45

Bumps [tar](https://github.com/alexcrichton/tar-rs) from 0.4.44 to 0.4.45. - [Commits](https://github.com/alexcrichton/tar-rs/compare/0.4.44...0.4.45) --- updated-dependencies: - dependency-name: tar dependency-version: 0.4.45 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
Run oxfmt across repo, add format script and docs
2026-03-25 10:51:57 +01:00 · 2026-03-20 18:13:13 +00:00 · 2026-03-13 10:15:49 -07:00 · 2026-03-13 09:27:56 -07:00 · 2026-03-13 06:49:14 -07:00 · 2026-03-13 06:47:42 -07:00
744 changed files with 20429 additions and 16304 deletions
--- a/.claude-context.md
+++ b/.claude-context.md
@@ -1,9 +1,11 @@
 # Claude Context: Detaching Tauri from Yaak

 ## Goal
+
 Make Yaak runnable as a standalone CLI without Tauri as a dependency. The core Rust crates in `crates/` should be usable independently, while Tauri-specific code lives in `crates-tauri/`.

 ## Project Structure
+
 ```
 crates/           # Core crates - should NOT depend on Tauri
 crates-tauri/     # Tauri-specific crates (yaak-app, yaak-tauri-utils, etc.)
@@ -13,11 +15,13 @@ crates-cli/       # CLI crate (yaak-cli)
 ## Completed Work

 ### 1. Folder Restructure
+
 - Moved Tauri-dependent app code to `crates-tauri/yaak-app/`
 - Created `crates-tauri/yaak-tauri-utils/` for shared Tauri utilities (window traits, api_client, error handling)
 - Created `crates-cli/yaak-cli/` for the standalone CLI

 ### 2. Decoupled Crates (no longer depend on Tauri)
+
 - **yaak-models**: Uses `init_standalone()` pattern for CLI database access
 - **yaak-http**: Removed Tauri plugin, HttpConnectionManager initialized in yaak-app setup
 - **yaak-common**: Only contains Tauri-free utilities (serde, platform)
@@ -25,6 +29,7 @@ crates-cli/       # CLI crate (yaak-cli)
 - **yaak-grpc**: Replaced AppHandle with GrpcConfig struct, uses tokio::process::Command instead of Tauri sidecar

 ### 3. CLI Implementation
+
 - Basic CLI at `crates-cli/yaak-cli/src/main.rs`
 - Commands: workspaces, requests, send (by ID), get (ad-hoc URL), create
 - Uses same database as Tauri app via `yaak_models::init_standalone()`
@@ -32,12 +37,14 @@ crates-cli/       # CLI crate (yaak-cli)
 ## Remaining Work

 ### Crates Still Depending on Tauri (in `crates/`)
+
 1. **yaak-git** (3 files) - Moderate complexity
 2. **yaak-plugins** (13 files) - **Hardest** - deeply integrated with Tauri for plugin-to-window communication
 3. **yaak-sync** (4 files) - Moderate complexity
 4. **yaak-ws** (5 files) - Moderate complexity

 ### Pattern for Decoupling
+
 1. Remove Tauri plugin `init()` function from the crate
 2. Move commands to `yaak-app/src/commands.rs` or keep inline in `lib.rs`
 3. Move extension traits (e.g., `SomethingManagerExt`) to yaak-app or yaak-tauri-utils
@@ -47,6 +54,7 @@ crates-cli/       # CLI crate (yaak-cli)
 7. Replace `tauri::async_runtime::block_on` with `tokio::runtime::Handle::current().block_on()`

 ## Key Files
+
 - `crates-tauri/yaak-app/src/lib.rs` - Main Tauri app, setup block initializes managers
 - `crates-tauri/yaak-app/src/commands.rs` - Migrated Tauri commands
 - `crates-tauri/yaak-app/src/models_ext.rs` - Database plugin and extension traits
@@ -54,9 +62,11 @@ crates-cli/       # CLI crate (yaak-cli)
 - `crates/yaak-models/src/lib.rs` - Contains `init_standalone()` for CLI usage

 ## Git Branch
+
 Working on `detach-tauri` branch.

 ## Recent Commits
+
 ```
 c40cff40 Remove Tauri dependencies from yaak-crypto and yaak-grpc
 df495f1d Move Tauri utilities from yaak-common to yaak-tauri-utils
@@ -67,6 +77,7 @@ e718a5f1 Refactor models_ext to use init_standalone from yaak-models
 ```

 ## Testing
+
 - Run `cargo check -p <crate>` to verify a crate builds without Tauri
 - Run `npm run app-dev` to test the Tauri app still works
 - Run `cargo run -p yaak-cli -- --help` to test the CLI
--- a/.claude/commands/release/check-out-pr.md
+++ b/.claude/commands/release/check-out-pr.md
@@ -1,62 +0,0 @@
---
-description: Review a PR in a new worktree
-allowed-tools: Bash(git worktree:*), Bash(gh pr:*), Bash(git branch:*)
---
-
-Check out a GitHub pull request for review.
-
-## Usage
-
-```
-/check-out-pr <PR_NUMBER>
-```
-
-## What to do
-
-1. If no PR number is provided, list all open pull requests and ask the user to select one
-2. Get PR information using `gh pr view <PR_NUMBER> --json number,headRefName`
-3. **Ask the user** whether they want to:
-   - **A) Check out in current directory** — simple `gh pr checkout <PR_NUMBER>`
-   - **B) Create a new worktree** — isolated copy at `../yaak-worktrees/pr-<PR_NUMBER>`
-4. Follow the appropriate path below
-
-## Option A: Check out in current directory
-
-1. Run `gh pr checkout <PR_NUMBER>`
-2. Inform the user which branch they're now on
-
-## Option B: Create a new worktree
-
-1. Create a new worktree at `../yaak-worktrees/pr-<PR_NUMBER>` using `git worktree add` with a timeout of at least 300000ms (5 minutes) since the post-checkout hook runs a bootstrap script
-2. Checkout the PR branch in the new worktree using `gh pr checkout <PR_NUMBER>`
-3. The post-checkout hook will automatically:
-   - Create `.env.local` with unique ports
-   - Copy editor config folders
-   - Run `npm install && npm run bootstrap`
-4. Inform the user:
-   - Where the worktree was created
-   - What ports were assigned
-   - How to access it (cd command)
-   - How to run the dev server
-   - How to remove the worktree when done
-
-### Example worktree output
-
-```
-Created worktree for PR #123 at ../yaak-worktrees/pr-123
-Branch: feature-auth
-Ports: Vite (1421), MCP (64344)
-
-To start working:
-  cd ../yaak-worktrees/pr-123
-  npm run app-dev
-
-To remove when done:
-  git worktree remove ../yaak-worktrees/pr-123
-```
-
-## Error Handling
-
- If the PR doesn't exist, show a helpful error
- If the worktree already exists, inform the user and ask if they want to remove and recreate it
- If `gh` CLI is not available, inform the user to install it
--- a/.claude/commands/release/generate-release-notes.md
+++ b/.claude/commands/release/generate-release-notes.md
@@ -8,7 +8,7 @@ Generate formatted release notes for Yaak releases by analyzing git history and
 ## What to do

 1. Identifies the version tag and previous version
-2. Retrieves all commits between versions 
+2. Retrieves all commits between versions
   - If the version is a beta version, it retrieves commits between the beta version and previous beta version
   - If the version is a stable version, it retrieves commits between the stable version and the previous stable version
 3. Fetches PR descriptions for linked issues to find:
@@ -37,6 +37,7 @@ The skill generates markdown-formatted release notes following this structure:

 **IMPORTANT**: Always add a blank lines around the markdown code fence and output the markdown code block last
 **IMPORTANT**: PRs by `@gschier` should not mention the @username
+**IMPORTANT**: These are app release notes. Exclude CLI-only changes (commits prefixed with `cli:` or only touching `crates-cli/`) since the CLI has its own release process.

 ## After Generating Release Notes

--- a/.claude/skills/worktree.md
+++ b/.claude/skills/worktree.md
@@ -1,35 +0,0 @@
-# Worktree Management Skill
-
-## Creating Worktrees
-
-When creating git worktrees for this project, ALWAYS use the path format:
-```
-../yaak-worktrees/<NAME>
-```
-
-For example:
- `git worktree add ../yaak-worktrees/feature-auth`
- `git worktree add ../yaak-worktrees/bugfix-login`
- `git worktree add ../yaak-worktrees/refactor-api`
-
-## What Happens Automatically
-
-The post-checkout hook will automatically:
-1. Create `.env.local` with unique ports (YAAK_DEV_PORT and YAAK_PLUGIN_MCP_SERVER_PORT)
-2. Copy gitignored editor config folders (.zed, .idea, etc.)
-3. Run `npm install && npm run bootstrap`
-
-## Deleting Worktrees
-
-```bash
-git worktree remove ../yaak-worktrees/<NAME>
-```
-
-## Port Assignments
-
- Main worktree: 1420 (Vite), 64343 (MCP)
- First worktree: 1421, 64344
- Second worktree: 1422, 64345
- etc.
-
-Each worktree can run `npm run app-dev` simultaneously without conflicts.
--- a/.codex/skills/release-check-out-pr/SKILL.md
+++ b/.codex/skills/release-check-out-pr/SKILL.md
@@ -1,46 +0,0 @@
---
-name: release-check-out-pr
-description: Check out a GitHub pull request for review in this repo, either in the current directory or in a new isolated worktree at ../yaak-worktrees/pr-<PR_NUMBER>. Use when asked to run or replace the old Claude check-out-pr command.
---
-
-# Check Out PR
-
-Check out a PR by number and let the user choose between current-directory checkout and isolated worktree checkout.
-
-## Workflow
-
-1. Confirm `gh` CLI is available.
-2. If no PR number is provided, list open PRs (`gh pr list`) and ask the user to choose one.
-3. Read PR metadata:
-   - `gh pr view <PR_NUMBER> --json number,headRefName`
-4. Ask the user to choose:
-   - Option A: check out in the current directory
-   - Option B: create a new worktree at `../yaak-worktrees/pr-<PR_NUMBER>`
-
-## Option A: Current Directory
-
-1. Run:
-   - `gh pr checkout <PR_NUMBER>`
-2. Report the checked-out branch.
-
-## Option B: New Worktree
-
-1. Use path:
-   - `../yaak-worktrees/pr-<PR_NUMBER>`
-2. Create the worktree with a timeout of at least 5 minutes because checkout hooks run bootstrap.
-3. In the new worktree, run:
-   - `gh pr checkout <PR_NUMBER>`
-4. Report:
-   - Worktree path
-   - Assigned ports from `.env.local` if present
-   - How to start work:
-     - `cd ../yaak-worktrees/pr-<PR_NUMBER>`
-     - `npm run app-dev`
-   - How to remove when done:
-     - `git worktree remove ../yaak-worktrees/pr-<PR_NUMBER>`
-
-## Error Handling
-
- If PR does not exist, show a clear error.
- If worktree already exists, ask whether to reuse it or remove/recreate it.
- If `gh` is missing, instruct the user to install/authenticate it.
--- a/.codex/skills/release-generate-release-notes/SKILL.md
+++ b/.codex/skills/release-generate-release-notes/SKILL.md
@@ -32,6 +32,7 @@ Generate formatted markdown release notes for a Yaak tag.
 - Keep a blank line before and after the code fence.
 - Output the markdown code block last.
 - Do not append `by @gschier` for PRs authored by `@gschier`.
+- These are app release notes. Exclude CLI-only changes (commits prefixed with `cli:` or only touching `crates-cli/`) since the CLI has its own release process.

 ## Release Creation Prompt

--- a/.codex/skills/worktree-management/SKILL.md
+++ b/.codex/skills/worktree-management/SKILL.md
@@ -1,37 +0,0 @@
---
-name: worktree-management
-description: Manage Yaak git worktrees using the standard ../yaak-worktrees/<NAME> layout, including creation, removal, and expected automatic setup behavior and port assignments.
---
-
-# Worktree Management
-
-Use the Yaak-standard worktree path layout and lifecycle commands.
-
-## Path Convention
-
-Always create worktrees under:
-
-`../yaak-worktrees/<NAME>`
-
-Examples:
- `git worktree add ../yaak-worktrees/feature-auth`
- `git worktree add ../yaak-worktrees/bugfix-login`
- `git worktree add ../yaak-worktrees/refactor-api`
-
-## Automatic Setup After Checkout
-
-Project git hooks automatically:
-1. Create `.env.local` with unique `YAAK_DEV_PORT` and `YAAK_PLUGIN_MCP_SERVER_PORT`
-2. Copy gitignored editor config folders
-3. Run `npm install && npm run bootstrap`
-
-## Remove Worktree
-
-`git worktree remove ../yaak-worktrees/<NAME>`
-
-## Port Pattern
-
- Main worktree: Vite `1420`, MCP `64343`
- First extra worktree: `1421`, `64344`
- Second extra worktree: `1422`, `64345`
- Continue incrementally for additional worktrees
--- a/.github/ISSUE_TEMPLATE/bug_report.md
+++ b/.github/ISSUE_TEMPLATE/bug_report.md
@@ -1,10 +1,9 @@
 ---
 name: Bug report
 about: Create a report to help us improve
-title: ''
-labels: ''
-assignees: ''
-
+title: ""
+labels: ""
+assignees: ""
 ---

 **Describe the bug**
@@ -12,6 +11,7 @@ A clear and concise description of what the bug is.

 **To Reproduce**
 Steps to reproduce the behavior:
+
 1. Go to '...'
 2. Click on '....'
 3. Scroll down to '....'
@@ -24,15 +24,17 @@ A clear and concise description of what you expected to happen.
 If applicable, add screenshots to help explain your problem.

 **Desktop (please complete the following information):**
- - OS: [e.g. iOS]
- - Browser [e.g. chrome, safari]
- - Version [e.g. 22]
+
+- OS: [e.g. iOS]
+- Browser [e.g. chrome, safari]
+- Version [e.g. 22]

 **Smartphone (please complete the following information):**
- - Device: [e.g. iPhone6]
- - OS: [e.g. iOS8.1]
- - Browser [e.g. stock browser, safari]
- - Version [e.g. 22]
+
+- Device: [e.g. iPhone6]
+- OS: [e.g. iOS8.1]
+- Browser [e.g. stock browser, safari]
+- Version [e.g. 22]

 **Additional context**
 Add any other context about the problem here.
--- a/.github/pull_request_template.md
+++ b/.github/pull_request_template.md
@@ -11,6 +11,7 @@
 - [ ] I added or updated tests when reasonable.

 Approved feedback item (required if not a bug fix or small-scope improvement):
+
 <!-- https://yaak.app/feedback/... -->

 ## Related
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -14,17 +14,20 @@ jobs:
    runs-on: macos-latest
    steps:
      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: voidzero-dev/setup-vp@v1
+        with:
+          node-version: "24"
+          cache: true
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
        with:
          shared-key: ci
          cache-on-failure: true

-      - run: npm ci
+      - run: vp install
      - run: npm run bootstrap
      - run: npm run lint
      - name: Run JS Tests
-        run: npm test
+        run: vp test
      - name: Run Rust Tests
        run: cargo test --all
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -47,4 +47,3 @@ jobs:
          # See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
          # or https://code.claude.com/docs/en/cli-reference for available options
          # claude_args: '--allowed-tools Bash(gh pr:*)'
-
--- a/.github/workflows/release-app.yml
+++ b/.github/workflows/release-app.yml
@@ -50,8 +50,11 @@ jobs:
      - name: Checkout yaakapp/app
        uses: actions/checkout@v4

-      - name: Setup Node
-        uses: actions/setup-node@v4
+      - name: Setup Vite+
+        uses: voidzero-dev/setup-vp@v1
+        with:
+          node-version: "24"
+          cache: true

      - name: install Rust stable
        uses: dtolnay/rust-toolchain@stable
@@ -87,15 +90,15 @@ jobs:
          echo $dir >> $env:GITHUB_PATH
          & $exe --version

-      - run: npm ci
+      - run: vp install
      - run: npm run bootstrap
        env:
          YAAK_TARGET_ARCH: ${{ matrix.yaak_arch }}
      - run: npm run lint
      - name: Run JS Tests
-        run: npm test
+        run: vp test
      - name: Run Rust Tests
-        run: cargo test --all
+        run: cargo test --all --exclude yaak-cli

      - name: Set version
        run: npm run replace-version
--- a/.github/workflows/sponsors.yml
+++ b/.github/workflows/sponsors.yml
@@ -16,23 +16,23 @@ jobs:
        uses: JamesIves/github-sponsors-readme-action@v1
        with:
          token: ${{ secrets.SPONSORS_PAT }}
-          file: 'README.md'
+          file: "README.md"
          maximum: 1999
          template: '<a href="https://github.com/{{{ login }}}"><img src="{{{ avatarUrl }}}" width="50px" alt="User avatar: {{{ login }}}" /></a>&nbsp;&nbsp;'
          active-only: false
          include-private: true
-          marker: 'sponsors-base'
+          marker: "sponsors-base"

      - name: Generate Sponsors
        uses: JamesIves/github-sponsors-readme-action@v1
        with:
          token: ${{ secrets.SPONSORS_PAT }}
-          file: 'README.md'
+          file: "README.md"
          minimum: 2000
          template: '<a href="https://github.com/{{{ login }}}"><img src="{{{ avatarUrl }}}" width="80px" alt="User avatar: {{{ login }}}" /></a>&nbsp;&nbsp;'
          active-only: false
          include-private: true
-          marker: 'sponsors-premium'
+          marker: "sponsors-premium"

      # ⚠️ Note: You can use any deployment step here to automatically push the README
      # changes back to your branch.
@@ -41,4 +41,4 @@ jobs:
        with:
          branch: main
          force: false
-          folder: '.'
+          folder: "."
--- a/.gitignore
+++ b/.gitignore
@@ -54,3 +54,6 @@ flatpak/node-sources.json

 # Local Codex desktop env state
 .codex/environments/environment.toml
+
+# Claude Code local settings
+.claude/settings.local.json
--- a/.node-version
+++ b/.node-version
@@ -0,0 +1 @@
+24.14.0
--- a/.npmrc
+++ b/.npmrc
@@ -0,0 +1,2 @@
+# vite-plugin-wasm has not yet declared Vite 8 in its peerDependencies
+legacy-peer-deps=true
--- a/.oxfmtignore
+++ b/.oxfmtignore
@@ -0,0 +1,2 @@
+**/bindings/**
+crates/yaak-templates/pkg/**
--- a/.vite-hooks/post-checkout
+++ b/.vite-hooks/post-checkout
--- a/.vite-hooks/pre-commit
+++ b/.vite-hooks/pre-commit
@@ -0,0 +1 @@
+vp lint
--- a/.vscode/extensions.json
+++ b/.vscode/extensions.json
@@ -1,3 +1,7 @@
 {
-  "recommendations": ["biomejs.biome", "rust-lang.rust-analyzer", "bradlc.vscode-tailwindcss"]
+  "recommendations": [
+    "rust-lang.rust-analyzer",
+    "bradlc.vscode-tailwindcss",
+    "VoidZero.vite-plus-extension-pack"
+  ]
 }
--- a/.vscode/settings.json
+++ b/.vscode/settings.json
@@ -1,6 +1,8 @@
 {
-  "editor.defaultFormatter": "biomejs.biome",
+  "editor.defaultFormatter": "oxc.oxc-vscode",
  "editor.formatOnSave": true,
-  "biome.enabled": true,
-  "biome.lint.format.enable": true
+  "editor.formatOnSaveMode": "file",
+  "editor.codeActionsOnSave": {
+    "source.fixAll.oxc": "explicit"
+  }
 }
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -0,0 +1,2 @@
+- Tag safety: app releases use `v*` tags and CLI releases use `yaak-cli-*` tags; always confirm which one is requested before retagging.
+- Do not commit, push, or tag without explicit approval
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -173,6 +173,17 @@ version = "1.0.98"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e16d2d3311acee920a9eb8d33b8cbc1787ce4a264e85f964c2404b969bdcd487"

+[[package]]
+name = "apollo-parser"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "947e21ff51879f8a40d7519dfe619268de2afba4042a8a43878276de3cb910f0"
+dependencies = [
+ "memchr",
+ "rowan",
+ "thiserror 2.0.17",
+]
+
 [[package]]
 name = "append-only-vec"
 version = "0.1.8"
@@ -204,7 +215,7 @@ dependencies = [
 "objc2-foundation 0.3.1",
 "parking_lot",
 "percent-encoding",
- "windows-sys 0.59.0",
+ "windows-sys 0.52.0",
 "wl-clipboard-rs",
 "x11rb",
 ]
@@ -1136,7 +1147,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "117725a109d387c937a1533ce01b450cbde6b88abceea8473c4d7a85853cda3c"
 dependencies = [
 "lazy_static 1.5.0",
- "windows-sys 0.59.0",
+ "windows-sys 0.48.0",
 ]

 [[package]]
@@ -1200,7 +1211,7 @@ dependencies = [
 "encode_unicode",
 "libc",
 "once_cell",
- "unicode-width",
+ "unicode-width 0.2.2",
 "windows-sys 0.59.0",
 ]

@@ -1347,6 +1358,12 @@ dependencies = [
 "libc",
 ]

+[[package]]
+name = "countme"
+version = "3.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7704b5fdd17b18ae31c4c1da5a2e0305a2bf17b5249300a9ee9ed7b72114c636"
+
 [[package]]
 name = "cow-utils"
 version = "0.1.3"
@@ -1405,6 +1422,31 @@ version = "0.8.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d0a5c400df2834b80a4c3327b3aad3a4c4cd4de0629063962b03235697506a28"

+[[package]]
+name = "crossterm"
+version = "0.25.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e64e6c0fbe2c17357405f7c758c1ef960fce08bdfb2c03d88d2a18d7e09c4b67"
+dependencies = [
+ "bitflags 1.3.2",
+ "crossterm_winapi",
+ "libc",
+ "mio 0.8.11",
+ "parking_lot",
+ "signal-hook",
+ "signal-hook-mio",
+ "winapi",
+]
+
+[[package]]
+name = "crossterm_winapi"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "acdd7c62a3665c7f6830a51635d9ac9b23ed385797f70a83bb8bafe9c572ab2b"
+dependencies = [
+ "winapi",
+]
+
 [[package]]
 name = "crunchy"
 version = "0.2.3"
@@ -1914,7 +1956,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cea14ef9355e3beab063703aa9dab15afd25f0667c341310c1e5274bb1d0da18"
 dependencies = [
 "libc",
- "windows-sys 0.59.0",
+ "windows-sys 0.52.0",
 ]

 [[package]]
@@ -2294,6 +2336,15 @@ dependencies = [
 "slab",
 ]

+[[package]]
+name = "fuzzy-matcher"
+version = "0.3.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "54614a3312934d066701a80f20f15fa3b56d67ac7722b39eea5b4c9dd1d66c94"
+dependencies = [
+ "thread_local 1.1.9",
+]
+
 [[package]]
 name = "fxhash"
 version = "0.2.1"
@@ -3164,6 +3215,24 @@ dependencies = [
 "generic-array",
 ]

+[[package]]
+name = "inquire"
+version = "0.7.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fddf93031af70e75410a2511ec04d49e758ed2f26dad3404a934e0fb45cc12a"
+dependencies = [
+ "bitflags 2.11.0",
+ "crossterm",
+ "dyn-clone",
+ "fuzzy-matcher",
+ "fxhash",
+ "newline-converter",
+ "once_cell",
+ "tempfile",
+ "unicode-segmentation",
+ "unicode-width 0.1.14",
+]
+
 [[package]]
 name = "interfaces"
 version = "0.0.8"
@@ -3756,6 +3825,18 @@ dependencies = [
 "simd-adler32",
 ]

+[[package]]
+name = "mio"
+version = "0.8.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4a650543ca06a924e8b371db273b2756685faae30f8487da1b56505a8f78b0c"
+dependencies = [
+ "libc",
+ "log 0.4.29",
+ "wasi 0.11.0+wasi-snapshot-preview1",
+ "windows-sys 0.48.0",
+]
+
 [[package]]
 name = "mio"
 version = "1.0.4"
@@ -3851,6 +3932,15 @@ version = "1.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "650eef8c711430f1a879fdd01d4745a7deea475becfb90269c06775983bbf086"

+[[package]]
+name = "newline-converter"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47b6b097ecb1cbfed438542d16e84fd7ad9b0c76c8a65b7f9039212a3d14dc7f"
+dependencies = [
+ "unicode-segmentation",
+]
+
 [[package]]
 name = "nibble_vec"
 version = "0.1.0"
@@ -3942,7 +4032,7 @@ dependencies = [
 "kqueue",
 "libc",
 "log 0.4.29",
- "mio",
+ "mio 1.0.4",
 "notify-types",
 "walkdir",
 "windows-sys 0.59.0",
@@ -4483,7 +4573,7 @@ checksum = "75b1853bc34cadaa90aa09f95713d8b77ec0c0d3e2d90ccf7a74216f40d20850"
 dependencies = [
 "flate2",
 "postcard",
- "rustc-hash",
+ "rustc-hash 2.1.1",
 "serde",
 "serde_json",
 "thiserror 2.0.17",
@@ -4501,7 +4591,7 @@ dependencies = [
 "textwrap",
 "thiserror 2.0.17",
 "unicode-segmentation",
- "unicode-width",
+ "unicode-width 0.2.2",
 ]

 [[package]]
@@ -4526,7 +4616,7 @@ dependencies = [
 "hashbrown 0.16.1",
 "oxc_data_structures",
 "oxc_estree",
- "rustc-hash",
+ "rustc-hash 2.1.1",
 "serde",
 ]

@@ -4582,7 +4672,7 @@ dependencies = [
 "oxc_index",
 "oxc_syntax",
 "petgraph 0.8.3",
- "rustc-hash",
+ "rustc-hash 2.1.1",
 ]

 [[package]]
@@ -4603,7 +4693,7 @@ dependencies = [
 "oxc_sourcemap",
 "oxc_span",
 "oxc_syntax",
- "rustc-hash",
+ "rustc-hash 2.1.1",
 ]

 [[package]]
@@ -4615,7 +4705,7 @@ dependencies = [
 "cow-utils",
 "oxc-browserslist",
 "oxc_syntax",
- "rustc-hash",
+ "rustc-hash 2.1.1",
 "serde",
 ]

@@ -4690,7 +4780,7 @@ dependencies = [
 "oxc_ecmascript",
 "oxc_span",
 "oxc_syntax",
- "rustc-hash",
+ "rustc-hash 2.1.1",
 ]

 [[package]]
@@ -4707,7 +4797,7 @@ dependencies = [
 "oxc_semantic",
 "oxc_span",
 "oxc_syntax",
- "rustc-hash",
+ "rustc-hash 2.1.1",
 ]

 [[package]]
@@ -4732,7 +4822,7 @@ dependencies = [
 "oxc_span",
 "oxc_syntax",
 "oxc_traverse",
- "rustc-hash",
+ "rustc-hash 2.1.1",
 ]

 [[package]]
@@ -4754,7 +4844,7 @@ dependencies = [
 "oxc_regular_expression",
 "oxc_span",
 "oxc_syntax",
- "rustc-hash",
+ "rustc-hash 2.1.1",
 "seq-macro",
 ]

@@ -4770,7 +4860,7 @@ dependencies = [
 "oxc_diagnostics",
 "oxc_span",
 "phf 0.13.1",
- "rustc-hash",
+ "rustc-hash 2.1.1",
 "unicode-id-start",
 ]

@@ -4787,7 +4877,7 @@ dependencies = [
 "once_cell",
 "papaya",
 "pnp",
- "rustc-hash",
+ "rustc-hash 2.1.1",
 "self_cell",
 "serde",
 "serde_json",
@@ -4817,7 +4907,7 @@ dependencies = [
 "oxc_span",
 "oxc_syntax",
 "phf 0.13.1",
- "rustc-hash",
+ "rustc-hash 2.1.1",
 "self_cell",
 ]

@@ -4829,7 +4919,7 @@ checksum = "c7f89482522f3cd820817d48ee4ade5b10822060d6e5e4d419f05f6d8bd29d70"
 dependencies = [
 "base64-simd",
 "json-escape-simd",
- "rustc-hash",
+ "rustc-hash 2.1.1",
 "serde",
 "serde_json",
 ]
@@ -4893,7 +4983,7 @@ dependencies = [
 "oxc_span",
 "oxc_syntax",
 "oxc_traverse",
- "rustc-hash",
+ "rustc-hash 2.1.1",
 "serde",
 "serde_json",
 "sha1",
@@ -4918,7 +5008,7 @@ dependencies = [
 "oxc_syntax",
 "oxc_transformer",
 "oxc_traverse",
- "rustc-hash",
+ "rustc-hash 2.1.1",
 ]

 [[package]]
@@ -4936,7 +5026,7 @@ dependencies = [
 "oxc_semantic",
 "oxc_span",
 "oxc_syntax",
- "rustc-hash",
+ "rustc-hash 2.1.1",
 ]

 [[package]]
@@ -5341,7 +5431,7 @@ dependencies = [
 "nodejs-built-in-modules",
 "pathdiff",
 "radix_trie",
- "rustc-hash",
+ "rustc-hash 2.1.1",
 "serde",
 "serde_json",
 "thiserror 2.0.17",
@@ -5460,6 +5550,18 @@ dependencies = [
 "termtree",
 ]

+[[package]]
+name = "pretty_graphql"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ea8c38ecedb3d28a998ea783469a78587f5f984d61226cf071f6979861e9e6a9"
+dependencies = [
+ "apollo-parser",
+ "memchr",
+ "rowan",
+ "tiny_pretty",
+]
+
 [[package]]
 name = "proc-macro-crate"
 version = "1.3.1"
@@ -5640,7 +5742,7 @@ dependencies = [
 "pin-project-lite",
 "quinn-proto",
 "quinn-udp",
- "rustc-hash",
+ "rustc-hash 2.1.1",
 "rustls",
 "socket2 0.5.10",
 "thiserror 2.0.17",
@@ -5660,7 +5762,7 @@ dependencies = [
 "lru-slab",
 "rand 0.9.1",
 "ring",
- "rustc-hash",
+ "rustc-hash 2.1.1",
 "rustls",
 "rustls-pki-types",
 "slab",
@@ -5681,7 +5783,7 @@ dependencies = [
 "once_cell",
 "socket2 0.5.10",
 "tracing",
- "windows-sys 0.59.0",
+ "windows-sys 0.52.0",
 ]

 [[package]]
@@ -6154,7 +6256,7 @@ dependencies = [
 "rolldown_tracing",
 "rolldown_utils",
 "rolldown_watcher",
- "rustc-hash",
+ "rustc-hash 2.1.1",
 "serde",
 "serde_json",
 "string_wizard",
@@ -6171,7 +6273,7 @@ version = "0.5.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "77dff57c9de498bb1eb5b1ce682c2e3a0ae956b266fa0933c3e151b87b078967"
 dependencies = [
- "unicode-width",
+ "unicode-width 0.2.2",
 "yansi",
 ]

@@ -6196,7 +6298,7 @@ dependencies = [
 "kqueue",
 "libc",
 "log 0.4.29",
- "mio",
+ "mio 1.0.4",
 "rolldown-notify-types",
 "walkdir",
 "windows-sys 0.61.2",
@@ -6244,7 +6346,7 @@ dependencies = [
 "rolldown_sourcemap",
 "rolldown_std_utils",
 "rolldown_utils",
- "rustc-hash",
+ "rustc-hash 2.1.1",
 "serde",
 "serde_json",
 "simdutf8",
@@ -6262,7 +6364,7 @@ dependencies = [
 "blake3",
 "dashmap",
 "rolldown_debug_action",
- "rustc-hash",
+ "rustc-hash 2.1.1",
 "serde",
 "serde_json",
 "tracing",
@@ -6319,7 +6421,7 @@ dependencies = [
 "rolldown-ariadne",
 "rolldown_utils",
 "ropey",
- "rustc-hash",
+ "rustc-hash 2.1.1",
 "sugar_path",
 ]

@@ -6353,7 +6455,7 @@ dependencies = [
 "rolldown_resolver",
 "rolldown_sourcemap",
 "rolldown_utils",
- "rustc-hash",
+ "rustc-hash 2.1.1",
 "serde",
 "serde_json",
 "string_wizard",
@@ -6373,7 +6475,7 @@ dependencies = [
 "rolldown_common",
 "rolldown_plugin",
 "rolldown_utils",
- "rustc-hash",
+ "rustc-hash 2.1.1",
 "serde_json",
 "xxhash-rust",
 ]
@@ -6444,7 +6546,7 @@ dependencies = [
 "oxc",
 "oxc_sourcemap",
 "rolldown_utils",
- "rustc-hash",
+ "rustc-hash 2.1.1",
 ]

 [[package]]
@@ -6496,7 +6598,7 @@ dependencies = [
 "regex 1.11.1",
 "regress",
 "rolldown_std_utils",
- "rustc-hash",
+ "rustc-hash 2.1.1",
 "serde_json",
 "simdutf8",
 "sugar_path",
@@ -6526,6 +6628,18 @@ dependencies = [
 "str_indices",
 ]

+[[package]]
+name = "rowan"
+version = "0.16.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "417a3a9f582e349834051b8a10c8d71ca88da4211e4093528e36b9845f6b5f21"
+dependencies = [
+ "countme",
+ "hashbrown 0.14.5",
+ "rustc-hash 1.1.0",
+ "text-size",
+]
+
 [[package]]
 name = "rusqlite"
 version = "0.32.1"
@@ -6568,6 +6682,12 @@ dependencies = [
 "serde_json",
 ]

+[[package]]
+name = "rustc-hash"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
+
 [[package]]
 name = "rustc-hash"
 version = "2.1.1"
@@ -6593,7 +6713,7 @@ dependencies = [
 "errno",
 "libc",
 "linux-raw-sys 0.4.15",
- "windows-sys 0.59.0",
+ "windows-sys 0.52.0",
 ]

 [[package]]
@@ -6606,7 +6726,7 @@ dependencies = [
 "errno",
 "libc",
 "linux-raw-sys 0.9.4",
- "windows-sys 0.59.0",
+ "windows-sys 0.52.0",
 ]

 [[package]]
@@ -7173,6 +7293,27 @@ version = "1.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"

+[[package]]
+name = "signal-hook"
+version = "0.3.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d881a16cf4426aa584979d30bd82cb33429027e42122b169753d6ef1085ed6e2"
+dependencies = [
+ "libc",
+ "signal-hook-registry",
+]
+
+[[package]]
+name = "signal-hook-mio"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b75a19a7a740b25bc7944bdee6172368f988763b744e3d4dfe753f6b4ece40cc"
+dependencies = [
+ "libc",
+ "mio 0.8.11",
+ "signal-hook",
+]
+
 [[package]]
 name = "signal-hook-registry"
 version = "1.4.5"
@@ -7359,7 +7500,7 @@ dependencies = [
 "memchr",
 "oxc_index",
 "oxc_sourcemap",
- "rustc-hash",
+ "rustc-hash 2.1.1",
 "serde",
 ]

@@ -7551,9 +7692,9 @@ checksum = "55937e1799185b12863d447f42597ed69d9928686b8d88a1df17376a097d8369"

 [[package]]
 name = "tar"
-version = "0.4.44"
+version = "0.4.45"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d863878d212c87a19c1a610eb53bb01fe12951c0501cf5a0d65f724914a667a"
+checksum = "22692a6476a21fa75fdfc11d452fda482af402c008cdbaf3476414e122040973"
 dependencies = [
 "filetime",
 "libc",
@@ -8031,7 +8172,7 @@ dependencies = [
 "getrandom 0.3.3",
 "once_cell",
 "rustix 1.0.7",
- "windows-sys 0.59.0",
+ "windows-sys 0.52.0",
 ]

 [[package]]
@@ -8060,6 +8201,12 @@ version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8f50febec83f5ee1df3015341d8bd429f2d1cc62bcba7ea2076759d315084683"

+[[package]]
+name = "text-size"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f18aa187839b2bdb1ad2fa35ead8c4c2976b64e4363c386d45ac0f7ee85c9233"
+
 [[package]]
 name = "textwrap"
 version = "0.16.2"
@@ -8068,7 +8215,7 @@ checksum = "c13547615a44dc9c452a8a534638acdf07120d4b6847c8178705da06306a3057"
 dependencies = [
 "smawk",
 "unicode-linebreak",
- "unicode-width",
+ "unicode-width 0.2.2",
 ]

 [[package]]
@@ -8182,6 +8329,12 @@ dependencies = [
 "crunchy",
 ]

+[[package]]
+name = "tiny_pretty"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "650d82e943da333637be9f1567d33d605e76810a26464edfd7ae74f7ef181e95"
+
 [[package]]
 name = "tinystr"
 version = "0.8.1"
@@ -8215,7 +8368,7 @@ checksum = "ff360e02eab121e0bc37a2d3b4d4dc622e6eda3a8e5253d5435ecf5bd4c68408"
 dependencies = [
 "bytes",
 "libc",
- "mio",
+ "mio 1.0.4",
 "pin-project-lite",
 "signal-hook-registry",
 "socket2 0.6.1",
@@ -8785,6 +8938,12 @@ version = "1.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f6ccf251212114b54433ec949fd6a7841275f9ada20dddd2f29e9ceea4501493"

+[[package]]
+name = "unicode-width"
+version = "0.1.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7dd6e30e90baa6f72411720665d41d89b9a3d039dc45b8faea1ddd07f617f6af"
+
 [[package]]
 name = "unicode-width"
 version = "0.2.2"
@@ -9336,7 +9495,7 @@ version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cf221c93e13a30d793f7645a0e7762c55d169dbb0a49671918a2319d289b10bb"
 dependencies = [
- "windows-sys 0.59.0",
+ "windows-sys 0.48.0",
 ]

 [[package]]
@@ -9562,6 +9721,15 @@ dependencies = [
 "windows-targets 0.42.2",
 ]

+[[package]]
+name = "windows-sys"
+version = "0.48.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "677d2418bec65e3338edb076e806bc1ec15693c5d0104683f2efe857f61056a9"
+dependencies = [
+ "windows-targets 0.48.5",
+]
+
 [[package]]
 name = "windows-sys"
 version = "0.52.0"
@@ -10089,6 +10257,7 @@ dependencies = [
 "md5 0.8.0",
 "mime_guess",
 "openssl-sys",
+ "pretty_graphql",
 "r2d2",
 "r2d2_sqlite",
 "rand 0.9.1",
@@ -10141,6 +10310,7 @@ dependencies = [
 name = "yaak-cli"
 version = "0.1.0"
 dependencies = [
+ "arboard",
 "assert_cmd",
 "base64 0.22.1",
 "clap",
@@ -10150,6 +10320,7 @@ dependencies = [
 "futures",
 "hex",
 "include_dir",
+ "inquire",
 "keyring",
 "log 0.4.29",
 "oxc_resolver",
@@ -10166,6 +10337,7 @@ dependencies = [
 "walkdir",
 "webbrowser",
 "yaak",
+ "yaak-api",
 "yaak-crypto",
 "yaak-http",
 "yaak-models",
@@ -10287,6 +10459,7 @@ dependencies = [
 "urlencoding",
 "yaak-common",
 "yaak-models",
+ "yaak-templates",
 "yaak-tls",
 "zstd",
 ]
@@ -10359,7 +10532,6 @@ dependencies = [
 "md5 0.7.0",
 "path-slash",
 "rand 0.9.1",
- "regex 1.11.1",
 "reqwest",
 "serde",
 "serde_json",
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,30 +1,30 @@
 [workspace]
 resolver = "2"
 members = [
-    "crates/yaak",
-    # Shared crates (no Tauri dependency)
-    "crates/yaak-core",
-    "crates/yaak-common",
-    "crates/yaak-crypto",
-    "crates/yaak-git",
-    "crates/yaak-grpc",
-    "crates/yaak-http",
-    "crates/yaak-models",
-    "crates/yaak-plugins",
-    "crates/yaak-sse",
-    "crates/yaak-sync",
-    "crates/yaak-templates",
-    "crates/yaak-tls",
-    "crates/yaak-ws",
-    "crates/yaak-api",
-    # CLI crates
-    "crates-cli/yaak-cli",
-    # Tauri-specific crates
-    "crates-tauri/yaak-app",
-    "crates-tauri/yaak-fonts",
-    "crates-tauri/yaak-license",
-    "crates-tauri/yaak-mac-window",
-    "crates-tauri/yaak-tauri-utils",
+  "crates/yaak",
+  # Shared crates (no Tauri dependency)
+  "crates/yaak-core",
+  "crates/yaak-common",
+  "crates/yaak-crypto",
+  "crates/yaak-git",
+  "crates/yaak-grpc",
+  "crates/yaak-http",
+  "crates/yaak-models",
+  "crates/yaak-plugins",
+  "crates/yaak-sse",
+  "crates/yaak-sync",
+  "crates/yaak-templates",
+  "crates/yaak-tls",
+  "crates/yaak-ws",
+  "crates/yaak-api",
+  # CLI crates
+  "crates-cli/yaak-cli",
+  # Tauri-specific crates
+  "crates-tauri/yaak-app",
+  "crates-tauri/yaak-fonts",
+  "crates-tauri/yaak-license",
+  "crates-tauri/yaak-mac-window",
+  "crates-tauri/yaak-tauri-utils",
 ]

 [workspace.dependencies]
--- a/DEVELOPMENT.md
+++ b/DEVELOPMENT.md
@@ -1,24 +1,26 @@
 # Developer Setup

-Yaak is a combined Node.js and Rust monorepo. It is a [Tauri](https://tauri.app) project, so 
+Yaak is a combined Node.js and Rust monorepo. It is a [Tauri](https://tauri.app) project, so
 uses Rust and HTML/CSS/JS for the main application but there is also a plugin system powered
 by a Node.js sidecar that communicates to the app over gRPC.

-Because of the moving parts, there are a few setup steps required before development can 
+Because of the moving parts, there are a few setup steps required before development can
 begin.

 ## Prerequisites

 Make sure you have the following tools installed:

- [Node.js](https://nodejs.org/en/download/package-manager)
+- [Node.js](https://nodejs.org/en/download/package-manager) (v24+)
 - [Rust](https://www.rust-lang.org/tools/install)
+- [Vite+](https://vite.dev/guide/vite-plus) (`vp` CLI)

 Check the installations with the following commands:

 ```shell
 node -v
 npm -v
+vp --version
 rustc --version
 ```

@@ -45,12 +47,12 @@ npm start
 ## SQLite Migrations

 New migrations can be created from the `src-tauri/` directory:
-   
+
 ```shell
 npm run migration
 ```

-Rerun the app to apply the migrations. 
+Rerun the app to apply the migrations.

 _Note: For safety, development builds use a separate database location from production builds._

@@ -61,9 +63,9 @@ _Note: For safety, development builds use a separate database location from prod
 lezer-generator components/core/Editor/<LANG>/<LANG>.grammar > components/core/Editor/<LANG>/<LANG>.ts
 ```

-## Linting & Formatting
+## Linting and Formatting

-This repo uses Biome for linting and formatting (replacing ESLint + Prettier).
+This repo uses [Vite+](https://vite.dev/guide/vite-plus) for linting (oxlint) and formatting (oxfmt).

 - Lint the entire repo:

@@ -71,12 +73,6 @@ This repo uses Biome for linting and formatting (replacing ESLint + Prettier).
 npm run lint
 ```

- Auto-fix lint issues where possible:
-
-```sh
-npm run lint:fix
-```
-
 - Format code:

 ```sh
@@ -84,5 +80,7 @@ npm run format
 ```

 Notes:
- Many workspace packages also expose the same scripts (`lint`, `lint:fix`, and `format`).
- TypeScript type-checking still runs separately via `tsc --noEmit` in relevant packages.
+
+- A pre-commit hook runs `vp lint` automatically on commit.
+- Some workspace packages also run `tsc --noEmit` for type-checking.
+- VS Code users should install the recommended extensions for format-on-save support.
--- a/README.md
+++ b/README.md
@@ -16,8 +16,6 @@
 </p>
 <br>

-
-
 <p align="center">
  <!-- sponsors-premium --><a href="https://github.com/MVST-Solutions"><img src="https:&#x2F;&#x2F;github.com&#x2F;MVST-Solutions.png" width="80px" alt="User avatar: MVST-Solutions" /></a>&nbsp;&nbsp;<a href="https://github.com/dharsanb"><img src="https:&#x2F;&#x2F;github.com&#x2F;dharsanb.png" width="80px" alt="User avatar: dharsanb" /></a>&nbsp;&nbsp;<a href="https://github.com/railwayapp"><img src="https:&#x2F;&#x2F;github.com&#x2F;railwayapp.png" width="80px" alt="User avatar: railwayapp" /></a>&nbsp;&nbsp;<a href="https://github.com/caseyamcl"><img src="https:&#x2F;&#x2F;github.com&#x2F;caseyamcl.png" width="80px" alt="User avatar: caseyamcl" /></a>&nbsp;&nbsp;<a href="https://github.com/bytebase"><img src="https:&#x2F;&#x2F;github.com&#x2F;bytebase.png" width="80px" alt="User avatar: bytebase" /></a>&nbsp;&nbsp;<a href="https://github.com/"><img src="https:&#x2F;&#x2F;raw.githubusercontent.com&#x2F;JamesIves&#x2F;github-sponsors-readme-action&#x2F;dev&#x2F;.github&#x2F;assets&#x2F;placeholder.png" width="80px" alt="User avatar: " /></a>&nbsp;&nbsp;<!-- sponsors-premium -->
 </p>
@@ -27,12 +25,10 @@

 ![Yaak API Client](https://yaak.app/static/screenshot.png)

-
 ## Features

-Yaak is an offline-first API client designed to stay out of your way while giving you everything you need when you need it. 
-Built with [Tauri](https://tauri.app), Rust, and React, it’s fast, lightweight, and private. No telemetry, no VC funding, and no cloud lock-in.  
-
+Yaak is an offline-first API client designed to stay out of your way while giving you everything you need when you need it.
+Built with [Tauri](https://tauri.app), Rust, and React, it’s fast, lightweight, and private. No telemetry, no VC funding, and no cloud lock-in.

 ### 🌐 Work with any API

@@ -41,21 +37,23 @@ Built with [Tauri](https://tauri.app), Rust, and React, it’s fast, lightweight
 - Filter and inspect responses with JSONPath or XPath.

 ### 🔐 Stay secure
+
 - Use OAuth 2.0, JWT, Basic Auth, or custom plugins for authentication.
- Secure sensitive values with encrypted secrets. 
+- Secure sensitive values with encrypted secrets.
 - Store secrets in your OS keychain.

 ### ☁️ Organize & collaborate
+
 - Group requests into workspaces and nested folders.
 - Use environment variables to switch between dev, staging, and prod.
 - Mirror workspaces to your filesystem for versioning in Git or syncing with Dropbox.

 ### 🧩 Extend & customize
+
 - Insert dynamic values like UUIDs or timestamps with template tags.
 - Pick from built-in themes or build your own.
 - Create plugins to extend authentication, template tags, or the UI.

-
 ## Contribution Policy

 > [!IMPORTANT]
--- a/biome.json
+++ b/biome.json
@@ -1,54 +0,0 @@
-{
-  "$schema": "https://biomejs.dev/schemas/2.3.11/schema.json",
-  "linter": {
-    "enabled": true,
-    "rules": {
-      "recommended": true,
-      "a11y": {
-        "useKeyWithClickEvents": "off"
-      }
-    }
-  },
-  "formatter": {
-    "enabled": true,
-    "indentStyle": "space",
-    "indentWidth": 2,
-    "lineWidth": 100,
-    "bracketSpacing": true
-  },
-  "css": {
-    "parser": {
-      "tailwindDirectives": true
-    },
-    "linter": {
-      "enabled": false
-    }
-  },
-  "javascript": {
-    "formatter": {
-      "quoteStyle": "single",
-      "jsxQuoteStyle": "double",
-      "trailingCommas": "all",
-      "semicolons": "always"
-    }
-  },
-  "files": {
-    "includes": [
-      "**",
-      "!**/node_modules",
-      "!**/dist",
-      "!**/build",
-      "!target",
-      "!scripts",
-      "!crates",
-      "!crates-tauri",
-      "!src-web/tailwind.config.cjs",
-      "!src-web/postcss.config.cjs",
-      "!src-web/vite.config.ts",
-      "!src-web/routeTree.gen.ts",
-      "!packages/plugin-runtime-types/lib",
-      "!**/bindings",
-      "!flatpak"
-    ]
-  }
-}
--- a/crates-cli/yaak-cli/Cargo.toml
+++ b/crates-cli/yaak-cli/Cargo.toml
@@ -9,12 +9,14 @@ name = "yaak"
 path = "src/main.rs"

 [dependencies]
+arboard = "3"
 base64 = "0.22"
 clap = { version = "4", features = ["derive"] }
 console = "0.15"
 dirs = "6"
 env_logger = "0.11"
 futures = "0.3"
+inquire = { version = "0.7", features = ["editor"] }
 hex = { workspace = true }
 include_dir = "0.7"
 keyring = { workspace = true, features = ["apple-native", "windows-native", "sync-secret-service"] }
@@ -27,11 +29,19 @@ schemars = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }
 sha2 = { workspace = true }
-tokio = { workspace = true, features = ["rt-multi-thread", "macros", "io-util", "net", "signal", "time"] }
+tokio = { workspace = true, features = [
+  "rt-multi-thread",
+  "macros",
+  "io-util",
+  "net",
+  "signal",
+  "time",
+] }
 walkdir = "2"
 webbrowser = "1"
 zip = "4"
 yaak = { workspace = true }
+yaak-api = { workspace = true }
 yaak-crypto = { workspace = true }
 yaak-http = { workspace = true }
 yaak-models = { workspace = true }
--- a/crates-cli/yaak-cli/README.md
+++ b/crates-cli/yaak-cli/README.md
@@ -1,6 +1,6 @@
 # Yaak CLI

-The `yaak` CLI for publishing plugins and creating/updating/sending requests. 
+The `yaak` CLI for publishing plugins and creating/updating/sending requests.

 ## Installation

@@ -24,8 +24,8 @@ Use the `yaak` CLI with agents like Claude or Codex to do useful things for you.
 Here are some example prompts:

 ```text
-Scan my API routes and create a workspace (using yaak cli) with 
-all the requests needed for me to do manual testing?  
+Scan my API routes and create a workspace (using yaak cli) with
+all the requests needed for me to do manual testing?
 ```

 ```text
--- a/crates-cli/yaak-cli/src/cli.rs
+++ b/crates-cli/yaak-cli/src/cli.rs
@@ -21,6 +21,10 @@ pub struct Cli {
    #[arg(long, short, global = true)]
    pub environment: Option<String>,

+    /// Cookie jar ID to use when sending requests
+    #[arg(long = "cookie-jar", global = true, value_name = "COOKIE_JAR_ID")]
+    pub cookie_jar: Option<String>,
+
    /// Enable verbose send output (events and streamed response body)
    #[arg(long, short, global = true)]
    pub verbose: bool,
@@ -47,9 +51,20 @@ pub enum Commands {
    #[command(hide = true)]
    Dev(PluginPathArg),

+    /// Backward-compatible alias for `plugin generate`
+    #[command(hide = true)]
+    Generate(GenerateArgs),
+
+    /// Backward-compatible alias for `plugin publish`
+    #[command(hide = true)]
+    Publish(PluginPathArg),
+
    /// Send a request, folder, or workspace by ID
    Send(SendArgs),

+    /// Cookie jar commands
+    CookieJar(CookieJarArgs),
+
    /// Workspace commands
    Workspace(WorkspaceArgs),

@@ -77,6 +92,22 @@ pub struct SendArgs {
    pub fail_fast: bool,
 }

+#[derive(Args)]
+#[command(disable_help_subcommand = true)]
+pub struct CookieJarArgs {
+    #[command(subcommand)]
+    pub command: CookieJarCommands,
+}
+
+#[derive(Subcommand)]
+pub enum CookieJarCommands {
+    /// List cookie jars in a workspace
+    List {
+        /// Workspace ID (optional when exactly one workspace exists)
+        workspace_id: Option<String>,
+    },
+}
+
 #[derive(Args)]
 #[command(disable_help_subcommand = true)]
 pub struct WorkspaceArgs {
@@ -150,8 +181,8 @@ pub struct RequestArgs {
 pub enum RequestCommands {
    /// List requests in a workspace
    List {
-        /// Workspace ID
-        workspace_id: String,
+        /// Workspace ID (optional when exactly one workspace exists)
+        workspace_id: Option<String>,
    },

    /// Show a request as JSON
@@ -259,8 +290,8 @@ pub struct FolderArgs {
 pub enum FolderCommands {
    /// List folders in a workspace
    List {
-        /// Workspace ID
-        workspace_id: String,
+        /// Workspace ID (optional when exactly one workspace exists)
+        workspace_id: Option<String>,
    },

    /// Show a folder as JSON
@@ -316,8 +347,8 @@ pub struct EnvironmentArgs {
 pub enum EnvironmentCommands {
    /// List environments in a workspace
    List {
-        /// Workspace ID
-        workspace_id: String,
+        /// Workspace ID (optional when exactly one workspace exists)
+        workspace_id: Option<String>,
    },

    /// Output JSON schema for environment create/update payloads
@@ -413,6 +444,9 @@ pub enum PluginCommands {
    /// Generate a "Hello World" Yaak plugin
    Generate(GenerateArgs),

+    /// Install a plugin from a local directory or from the registry
+    Install(InstallPluginArgs),
+
    /// Publish a Yaak plugin version to the plugin registry
    Publish(PluginPathArg),
 }
@@ -433,3 +467,9 @@ pub struct GenerateArgs {
    #[arg(long)]
    pub dir: Option<PathBuf>,
 }
+
+#[derive(Args, Clone)]
+pub struct InstallPluginArgs {
+    /// Local plugin directory path, or registry plugin spec (@org/plugin[@version])
+    pub source: String,
+}
--- a/crates-cli/yaak-cli/src/commands/cookie_jar.rs
+++ b/crates-cli/yaak-cli/src/commands/cookie_jar.rs
@@ -0,0 +1,42 @@
+use crate::cli::{CookieJarArgs, CookieJarCommands};
+use crate::context::CliContext;
+use crate::utils::workspace::resolve_workspace_id;
+
+type CommandResult<T = ()> = std::result::Result<T, String>;
+
+pub fn run(ctx: &CliContext, args: CookieJarArgs) -> i32 {
+    let result = match args.command {
+        CookieJarCommands::List { workspace_id } => list(ctx, workspace_id.as_deref()),
+    };
+
+    match result {
+        Ok(()) => 0,
+        Err(error) => {
+            eprintln!("Error: {error}");
+            1
+        }
+    }
+}
+
+fn list(ctx: &CliContext, workspace_id: Option<&str>) -> CommandResult {
+    let workspace_id = resolve_workspace_id(ctx, workspace_id, "cookie-jar list")?;
+    let cookie_jars = ctx
+        .db()
+        .list_cookie_jars(&workspace_id)
+        .map_err(|e| format!("Failed to list cookie jars: {e}"))?;
+
+    if cookie_jars.is_empty() {
+        println!("No cookie jars found in workspace {}", workspace_id);
+    } else {
+        for cookie_jar in cookie_jars {
+            println!(
+                "{} - {} ({} cookies)",
+                cookie_jar.id,
+                cookie_jar.name,
+                cookie_jar.cookies.len()
+            );
+        }
+    }
+
+    Ok(())
+}
--- a/crates-cli/yaak-cli/src/commands/environment.rs
+++ b/crates-cli/yaak-cli/src/commands/environment.rs
@@ -6,6 +6,7 @@ use crate::utils::json::{
    parse_required_json, require_id, validate_create_id,
 };
 use crate::utils::schema::append_agent_hints;
+use crate::utils::workspace::resolve_workspace_id;
 use schemars::schema_for;
 use yaak_models::models::Environment;
 use yaak_models::util::UpdateSource;
@@ -14,7 +15,7 @@ type CommandResult<T = ()> = std::result::Result<T, String>;

 pub fn run(ctx: &CliContext, args: EnvironmentArgs) -> i32 {
    let result = match args.command {
-        EnvironmentCommands::List { workspace_id } => list(ctx, &workspace_id),
+        EnvironmentCommands::List { workspace_id } => list(ctx, workspace_id.as_deref()),
        EnvironmentCommands::Schema { pretty } => schema(pretty),
        EnvironmentCommands::Show { environment_id } => show(ctx, &environment_id),
        EnvironmentCommands::Create { workspace_id, name, json } => {
@@ -45,10 +46,11 @@ fn schema(pretty: bool) -> CommandResult {
    Ok(())
 }

-fn list(ctx: &CliContext, workspace_id: &str) -> CommandResult {
+fn list(ctx: &CliContext, workspace_id: Option<&str>) -> CommandResult {
+    let workspace_id = resolve_workspace_id(ctx, workspace_id, "environment list")?;
    let environments = ctx
        .db()
-        .list_environments_ensure_base(workspace_id)
+        .list_environments_ensure_base(&workspace_id)
        .map_err(|e| format!("Failed to list environments: {e}"))?;

    if environments.is_empty() {
@@ -92,8 +94,14 @@ fn create(
        validate_create_id(&payload, "environment")?;
        let mut environment: Environment = serde_json::from_value(payload)
            .map_err(|e| format!("Failed to parse environment create JSON: {e}"))?;
+        let fallback_workspace_id =
+            if workspace_id_arg.is_none() && environment.workspace_id.is_empty() {
+                Some(resolve_workspace_id(ctx, None, "environment create")?)
+            } else {
+                None
+            };
        merge_workspace_id_arg(
-            workspace_id_arg.as_deref(),
+            workspace_id_arg.as_deref().or(fallback_workspace_id.as_deref()),
            &mut environment.workspace_id,
            "environment create",
        )?;
@@ -111,9 +119,8 @@ fn create(
        return Ok(());
    }

-    let workspace_id = workspace_id_arg.ok_or_else(|| {
-        "environment create requires workspace_id unless JSON payload is provided".to_string()
-    })?;
+    let workspace_id =
+        resolve_workspace_id(ctx, workspace_id_arg.as_deref(), "environment create")?;
    let name = name.ok_or_else(|| {
        "environment create requires --name unless JSON payload is provided".to_string()
    })?;
--- a/crates-cli/yaak-cli/src/commands/folder.rs
+++ b/crates-cli/yaak-cli/src/commands/folder.rs
@@ -5,6 +5,7 @@ use crate::utils::json::{
    apply_merge_patch, is_json_shorthand, merge_workspace_id_arg, parse_optional_json,
    parse_required_json, require_id, validate_create_id,
 };
+use crate::utils::workspace::resolve_workspace_id;
 use yaak_models::models::Folder;
 use yaak_models::util::UpdateSource;

@@ -12,7 +13,7 @@ type CommandResult<T = ()> = std::result::Result<T, String>;

 pub fn run(ctx: &CliContext, args: FolderArgs) -> i32 {
    let result = match args.command {
-        FolderCommands::List { workspace_id } => list(ctx, &workspace_id),
+        FolderCommands::List { workspace_id } => list(ctx, workspace_id.as_deref()),
        FolderCommands::Show { folder_id } => show(ctx, &folder_id),
        FolderCommands::Create { workspace_id, name, json } => {
            create(ctx, workspace_id, name, json)
@@ -30,9 +31,10 @@ pub fn run(ctx: &CliContext, args: FolderArgs) -> i32 {
    }
 }

-fn list(ctx: &CliContext, workspace_id: &str) -> CommandResult {
+fn list(ctx: &CliContext, workspace_id: Option<&str>) -> CommandResult {
+    let workspace_id = resolve_workspace_id(ctx, workspace_id, "folder list")?;
    let folders =
-        ctx.db().list_folders(workspace_id).map_err(|e| format!("Failed to list folders: {e}"))?;
+        ctx.db().list_folders(&workspace_id).map_err(|e| format!("Failed to list folders: {e}"))?;
    if folders.is_empty() {
        println!("No folders found in workspace {}", workspace_id);
    } else {
@@ -72,8 +74,14 @@ fn create(
        validate_create_id(&payload, "folder")?;
        let mut folder: Folder = serde_json::from_value(payload)
            .map_err(|e| format!("Failed to parse folder create JSON: {e}"))?;
+        let fallback_workspace_id = if workspace_id_arg.is_none() && folder.workspace_id.is_empty()
+        {
+            Some(resolve_workspace_id(ctx, None, "folder create")?)
+        } else {
+            None
+        };
        merge_workspace_id_arg(
-            workspace_id_arg.as_deref(),
+            workspace_id_arg.as_deref().or(fallback_workspace_id.as_deref()),
            &mut folder.workspace_id,
            "folder create",
        )?;
@@ -87,9 +95,7 @@ fn create(
        return Ok(());
    }

-    let workspace_id = workspace_id_arg.ok_or_else(|| {
-        "folder create requires workspace_id unless JSON payload is provided".to_string()
-    })?;
+    let workspace_id = resolve_workspace_id(ctx, workspace_id_arg.as_deref(), "folder create")?;
    let name = name.ok_or_else(|| {
        "folder create requires --name unless JSON payload is provided".to_string()
    })?;
--- a/crates-cli/yaak-cli/src/commands/mod.rs
+++ b/crates-cli/yaak-cli/src/commands/mod.rs
@@ -1,4 +1,5 @@
 pub mod auth;
+pub mod cookie_jar;
 pub mod environment;
 pub mod folder;
 pub mod plugin;
--- a/crates-cli/yaak-cli/src/commands/plugin.rs
+++ b/crates-cli/yaak-cli/src/commands/plugin.rs
@@ -1,11 +1,12 @@
-use crate::cli::{GenerateArgs, PluginArgs, PluginCommands, PluginPathArg};
+use crate::cli::{GenerateArgs, InstallPluginArgs, PluginPathArg};
+use crate::context::CliContext;
 use crate::ui;
 use crate::utils::http;
 use keyring::Entry;
 use rand::Rng;
 use rolldown::{
-    Bundler, BundlerOptions, ExperimentalOptions, InputItem, LogLevel, OutputFormat, Platform,
-    WatchOption, Watcher,
+    BundleEvent, Bundler, BundlerOptions, ExperimentalOptions, InputItem, LogLevel, OutputFormat,
+    Platform, WatchOption, Watcher, WatcherEvent,
 };
 use serde::Deserialize;
 use std::collections::HashSet;
@@ -15,6 +16,11 @@ use std::path::{Path, PathBuf};
 use std::sync::Arc;
 use tokio::sync::Mutex;
 use walkdir::WalkDir;
+use yaak_api::{ApiClientKind, yaak_api_client};
+use yaak_models::models::{Plugin, PluginSource};
+use yaak_models::util::UpdateSource;
+use yaak_plugins::events::PluginContext;
+use yaak_plugins::install::download_and_install;
 use zip::CompressionMethod;
 use zip::write::SimpleFileOptions;

@@ -57,12 +63,13 @@ pub async fn run_build(args: PluginPathArg) -> i32 {
    }
 }

-pub async fn run(args: PluginArgs) -> i32 {
-    match args.command {
-        PluginCommands::Build(args) => run_build(args).await,
-        PluginCommands::Dev(args) => run_dev(args).await,
-        PluginCommands::Generate(args) => run_generate(args).await,
-        PluginCommands::Publish(args) => run_publish(args).await,
+pub async fn run_install(context: &CliContext, args: InstallPluginArgs) -> i32 {
+    match install(context, args).await {
+        Ok(()) => 0,
+        Err(error) => {
+            ui::error(&error);
+            1
+        }
    }
 }

@@ -114,12 +121,53 @@ async fn dev(args: PluginPathArg) -> CommandResult {
    ensure_plugin_build_inputs(&plugin_dir)?;

    ui::info(&format!("Watching plugin {}...", plugin_dir.display()));
-    ui::info("Press Ctrl-C to stop");

    let bundler = Bundler::new(bundler_options(&plugin_dir, true))
        .map_err(|err| format!("Failed to initialize Rolldown watcher: {err}"))?;
    let watcher = Watcher::new(vec![Arc::new(Mutex::new(bundler))], None)
        .map_err(|err| format!("Failed to start Rolldown watcher: {err}"))?;
+    let emitter = watcher.emitter();
+    let watch_root = plugin_dir.clone();
+    let _event_logger = tokio::spawn(async move {
+        loop {
+            let event = {
+                let rx = emitter.rx.lock().await;
+                rx.recv()
+            };
+
+            let Ok(event) = event else {
+                break;
+            };
+
+            match event {
+                WatcherEvent::Change(change) => {
+                    let changed_path = Path::new(change.path.as_str());
+                    let display_path = changed_path
+                        .strip_prefix(&watch_root)
+                        .map(|p| p.display().to_string())
+                        .unwrap_or_else(|_| {
+                            changed_path
+                                .file_name()
+                                .map(|name| name.to_string_lossy().into_owned())
+                                .unwrap_or_else(|| "unknown".to_string())
+                        });
+                    ui::info(&format!("Rebuilding plugin {display_path}"));
+                }
+                WatcherEvent::Event(BundleEvent::BundleEnd(_)) => {}
+                WatcherEvent::Event(BundleEvent::Error(event)) => {
+                    if event.error.diagnostics.is_empty() {
+                        ui::error("Plugin build failed");
+                    } else {
+                        for diagnostic in event.error.diagnostics {
+                            ui::error(&diagnostic.to_string());
+                        }
+                    }
+                }
+                WatcherEvent::Close => break,
+                _ => {}
+            }
+        }
+    });

    watcher.start().await;
    Ok(())
@@ -209,6 +257,113 @@ async fn publish(args: PluginPathArg) -> CommandResult {
    Ok(())
 }

+async fn install(context: &CliContext, args: InstallPluginArgs) -> CommandResult {
+    if args.source.starts_with('@') {
+        let (name, version) =
+            parse_registry_install_spec(args.source.as_str()).ok_or_else(|| {
+                "Invalid registry plugin spec. Expected format: @org/plugin or @org/plugin@version"
+                    .to_string()
+            })?;
+        return install_from_registry(context, name, version).await;
+    }
+
+    install_from_directory(context, args.source.as_str()).await
+}
+
+async fn install_from_registry(
+    context: &CliContext,
+    name: String,
+    version: Option<String>,
+) -> CommandResult {
+    let current_version = crate::version::cli_version();
+    let http_client = yaak_api_client(ApiClientKind::Cli, current_version)
+        .map_err(|err| format!("Failed to initialize API client: {err}"))?;
+    let installing_version = version.clone().unwrap_or_else(|| "latest".to_string());
+    ui::info(&format!("Installing registry plugin {name}@{installing_version}"));
+
+    let plugin_context = PluginContext::new(Some("cli".to_string()), None);
+    let installed = download_and_install(
+        context.plugin_manager(),
+        context.query_manager(),
+        &http_client,
+        &plugin_context,
+        name.as_str(),
+        version,
+    )
+    .await
+    .map_err(|err| format!("Failed to install plugin: {err}"))?;
+
+    ui::success(&format!("Installed plugin {}@{}", installed.name, installed.version));
+    Ok(())
+}
+
+async fn install_from_directory(context: &CliContext, source: &str) -> CommandResult {
+    let plugin_dir = resolve_plugin_dir(Some(PathBuf::from(source)))?;
+    let plugin_dir_str = plugin_dir
+        .to_str()
+        .ok_or_else(|| {
+            format!("Plugin directory path is not valid UTF-8: {}", plugin_dir.display())
+        })?
+        .to_string();
+    ui::info(&format!("Installing plugin from directory {}", plugin_dir.display()));
+
+    let plugin = context
+        .db()
+        .upsert_plugin(
+            &Plugin {
+                directory: plugin_dir_str,
+                url: None,
+                enabled: true,
+                source: PluginSource::Filesystem,
+                ..Default::default()
+            },
+            &UpdateSource::Background,
+        )
+        .map_err(|err| format!("Failed to save plugin in database: {err}"))?;
+
+    let plugin_context = PluginContext::new(Some("cli".to_string()), None);
+    context
+        .plugin_manager()
+        .add_plugin(&plugin_context, &plugin)
+        .await
+        .map_err(|err| format!("Failed to load plugin runtime: {err}"))?;
+
+    ui::success(&format!("Installed plugin from {}", plugin.directory));
+    Ok(())
+}
+
+fn parse_registry_install_spec(source: &str) -> Option<(String, Option<String>)> {
+    if !source.starts_with('@') || !source.contains('/') {
+        return None;
+    }
+
+    let rest = source.get(1..)?;
+    let version_split = rest.rfind('@').map(|idx| idx + 1);
+    let (name, version) = match version_split {
+        Some(at_idx) => {
+            let (name, version) = source.split_at(at_idx);
+            let version = version.strip_prefix('@').unwrap_or_default();
+            if version.is_empty() {
+                return None;
+            }
+            (name.to_string(), Some(version.to_string()))
+        }
+        None => (source.to_string(), None),
+    };
+
+    if !name.starts_with('@') {
+        return None;
+    }
+
+    let without_scope = name.get(1..)?;
+    let (scope, plugin_name) = without_scope.split_once('/')?;
+    if scope.is_empty() || plugin_name.is_empty() {
+        return None;
+    }
+
+    Some((name, version))
+}
+
 #[derive(Deserialize)]
 struct PublishResponse {
    version: String,
--- a/crates-cli/yaak-cli/src/commands/request.rs
+++ b/crates-cli/yaak-cli/src/commands/request.rs
@@ -6,6 +6,7 @@ use crate::utils::json::{
    parse_required_json, require_id, validate_create_id,
 };
 use crate::utils::schema::append_agent_hints;
+use crate::utils::workspace::resolve_workspace_id;
 use schemars::schema_for;
 use serde_json::{Map, Value, json};
 use std::collections::HashMap;
@@ -24,13 +25,16 @@ pub async fn run(
    ctx: &CliContext,
    args: RequestArgs,
    environment: Option<&str>,
+    cookie_jar_id: Option<&str>,
    verbose: bool,
 ) -> i32 {
    let result = match args.command {
-        RequestCommands::List { workspace_id } => list(ctx, &workspace_id),
+        RequestCommands::List { workspace_id } => list(ctx, workspace_id.as_deref()),
        RequestCommands::Show { request_id } => show(ctx, &request_id),
        RequestCommands::Send { request_id } => {
-            return match send_request_by_id(ctx, &request_id, environment, verbose).await {
+            return match send_request_by_id(ctx, &request_id, environment, cookie_jar_id, verbose)
+                .await
+            {
                Ok(()) => 0,
                Err(error) => {
                    eprintln!("Error: {error}");
@@ -63,10 +67,11 @@ pub async fn run(
    }
 }

-fn list(ctx: &CliContext, workspace_id: &str) -> CommandResult {
+fn list(ctx: &CliContext, workspace_id: Option<&str>) -> CommandResult {
+    let workspace_id = resolve_workspace_id(ctx, workspace_id, "request list")?;
    let requests = ctx
        .db()
-        .list_http_requests(workspace_id)
+        .list_http_requests(&workspace_id)
        .map_err(|e| format!("Failed to list requests: {e}"))?;
    if requests.is_empty() {
        println!("No requests found in workspace {}", workspace_id);
@@ -350,8 +355,14 @@ fn create(
        validate_create_id(&payload, "request")?;
        let mut request: HttpRequest = serde_json::from_value(payload)
            .map_err(|e| format!("Failed to parse request create JSON: {e}"))?;
+        let fallback_workspace_id = if workspace_id_arg.is_none() && request.workspace_id.is_empty()
+        {
+            Some(resolve_workspace_id(ctx, None, "request create")?)
+        } else {
+            None
+        };
        merge_workspace_id_arg(
-            workspace_id_arg.as_deref(),
+            workspace_id_arg.as_deref().or(fallback_workspace_id.as_deref()),
            &mut request.workspace_id,
            "request create",
        )?;
@@ -365,9 +376,7 @@ fn create(
        return Ok(());
    }

-    let workspace_id = workspace_id_arg.ok_or_else(|| {
-        "request create requires workspace_id unless JSON payload is provided".to_string()
-    })?;
+    let workspace_id = resolve_workspace_id(ctx, workspace_id_arg.as_deref(), "request create")?;
    let name = name.unwrap_or_default();
    let url = url.unwrap_or_default();
    let method = method.unwrap_or_else(|| "GET".to_string());
@@ -436,6 +445,7 @@ pub async fn send_request_by_id(
    ctx: &CliContext,
    request_id: &str,
    environment: Option<&str>,
+    cookie_jar_id: Option<&str>,
    verbose: bool,
 ) -> Result<(), String> {
    let request =
@@ -447,6 +457,7 @@ pub async fn send_request_by_id(
                &http_request.id,
                &http_request.workspace_id,
                environment,
+                cookie_jar_id,
                verbose,
            )
            .await
@@ -465,9 +476,13 @@ async fn send_http_request_by_id(
    request_id: &str,
    workspace_id: &str,
    environment: Option<&str>,
+    cookie_jar_id: Option<&str>,
    verbose: bool,
 ) -> Result<(), String> {
-    let plugin_context = PluginContext::new(None, Some(workspace_id.to_string()));
+    let cookie_jar_id = resolve_cookie_jar_id(ctx, workspace_id, cookie_jar_id)?;
+
+    let plugin_context =
+        PluginContext::new(Some("cli".to_string()), Some(workspace_id.to_string()));

    let (event_tx, mut event_rx) = mpsc::channel::<SenderHttpResponseEvent>(100);
    let (body_chunk_tx, mut body_chunk_rx) = mpsc::unbounded_channel::<Vec<u8>>();
@@ -495,7 +510,7 @@ async fn send_http_request_by_id(
        request_id,
        environment_id: environment,
        update_source: UpdateSource::Sync,
-        cookie_jar_id: None,
+        cookie_jar_id,
        response_dir: &response_dir,
        emit_events_to: Some(event_tx),
        emit_response_body_chunks_to: Some(body_chunk_tx),
@@ -512,3 +527,22 @@ async fn send_http_request_by_id(
    result.map_err(|e| e.to_string())?;
    Ok(())
 }
+
+pub(crate) fn resolve_cookie_jar_id(
+    ctx: &CliContext,
+    workspace_id: &str,
+    explicit_cookie_jar_id: Option<&str>,
+) -> Result<Option<String>, String> {
+    if let Some(cookie_jar_id) = explicit_cookie_jar_id {
+        return Ok(Some(cookie_jar_id.to_string()));
+    }
+
+    let default_cookie_jar = ctx
+        .db()
+        .list_cookie_jars(workspace_id)
+        .map_err(|e| format!("Failed to list cookie jars: {e}"))?
+        .into_iter()
+        .min_by_key(|jar| jar.created_at)
+        .map(|jar| jar.id);
+    Ok(default_cookie_jar)
+}
--- a/crates-cli/yaak-cli/src/commands/send.rs
+++ b/crates-cli/yaak-cli/src/commands/send.rs
@@ -2,6 +2,7 @@ use crate::cli::SendArgs;
 use crate::commands::request;
 use crate::context::CliContext;
 use futures::future::join_all;
+use yaak_models::queries::any_request::AnyRequest;

 enum ExecutionMode {
    Sequential,
@@ -12,9 +13,10 @@ pub async fn run(
    ctx: &CliContext,
    args: SendArgs,
    environment: Option<&str>,
+    cookie_jar_id: Option<&str>,
    verbose: bool,
 ) -> i32 {
-    match send_target(ctx, args, environment, verbose).await {
+    match send_target(ctx, args, environment, cookie_jar_id, verbose).await {
        Ok(()) => 0,
        Err(error) => {
            eprintln!("Error: {error}");
@@ -27,30 +29,70 @@ async fn send_target(
    ctx: &CliContext,
    args: SendArgs,
    environment: Option<&str>,
+    cookie_jar_id: Option<&str>,
    verbose: bool,
 ) -> Result<(), String> {
    let mode = if args.parallel { ExecutionMode::Parallel } else { ExecutionMode::Sequential };

-    if ctx.db().get_any_request(&args.id).is_ok() {
-        return request::send_request_by_id(ctx, &args.id, environment, verbose).await;
+    if let Ok(request) = ctx.db().get_any_request(&args.id) {
+        let workspace_id = match &request {
+            AnyRequest::HttpRequest(r) => r.workspace_id.clone(),
+            AnyRequest::GrpcRequest(r) => r.workspace_id.clone(),
+            AnyRequest::WebsocketRequest(r) => r.workspace_id.clone(),
+        };
+        let resolved_cookie_jar_id =
+            request::resolve_cookie_jar_id(ctx, &workspace_id, cookie_jar_id)?;
+
+        return request::send_request_by_id(
+            ctx,
+            &args.id,
+            environment,
+            resolved_cookie_jar_id.as_deref(),
+            verbose,
+        )
+        .await;
    }

-    if ctx.db().get_folder(&args.id).is_ok() {
+    if let Ok(folder) = ctx.db().get_folder(&args.id) {
+        let resolved_cookie_jar_id =
+            request::resolve_cookie_jar_id(ctx, &folder.workspace_id, cookie_jar_id)?;
+
        let request_ids = collect_folder_request_ids(ctx, &args.id)?;
        if request_ids.is_empty() {
            println!("No requests found in folder {}", args.id);
            return Ok(());
        }
-        return send_many(ctx, request_ids, mode, args.fail_fast, environment, verbose).await;
+        return send_many(
+            ctx,
+            request_ids,
+            mode,
+            args.fail_fast,
+            environment,
+            resolved_cookie_jar_id.as_deref(),
+            verbose,
+        )
+        .await;
    }

-    if ctx.db().get_workspace(&args.id).is_ok() {
+    if let Ok(workspace) = ctx.db().get_workspace(&args.id) {
+        let resolved_cookie_jar_id =
+            request::resolve_cookie_jar_id(ctx, &workspace.id, cookie_jar_id)?;
+
        let request_ids = collect_workspace_request_ids(ctx, &args.id)?;
        if request_ids.is_empty() {
            println!("No requests found in workspace {}", args.id);
            return Ok(());
        }
-        return send_many(ctx, request_ids, mode, args.fail_fast, environment, verbose).await;
+        return send_many(
+            ctx,
+            request_ids,
+            mode,
+            args.fail_fast,
+            environment,
+            resolved_cookie_jar_id.as_deref(),
+            verbose,
+        )
+        .await;
    }

    Err(format!("Could not resolve ID '{}' as request, folder, or workspace", args.id))
@@ -131,6 +173,7 @@ async fn send_many(
    mode: ExecutionMode,
    fail_fast: bool,
    environment: Option<&str>,
+    cookie_jar_id: Option<&str>,
    verbose: bool,
 ) -> Result<(), String> {
    let mut success_count = 0usize;
@@ -139,7 +182,15 @@ async fn send_many(
    match mode {
        ExecutionMode::Sequential => {
            for request_id in request_ids {
-                match request::send_request_by_id(ctx, &request_id, environment, verbose).await {
+                match request::send_request_by_id(
+                    ctx,
+                    &request_id,
+                    environment,
+                    cookie_jar_id,
+                    verbose,
+                )
+                .await
+                {
                    Ok(()) => success_count += 1,
                    Err(error) => {
                        failures.push((request_id, error));
@@ -156,7 +207,14 @@ async fn send_many(
                .map(|request_id| async move {
                    (
                        request_id.clone(),
-                        request::send_request_by_id(ctx, request_id, environment, verbose).await,
+                        request::send_request_by_id(
+                            ctx,
+                            request_id,
+                            environment,
+                            cookie_jar_id,
+                            verbose,
+                        )
+                        .await,
                    )
                })
                .collect::<Vec<_>>();
--- a/crates-cli/yaak-cli/src/commands/workspace.rs
+++ b/crates-cli/yaak-cli/src/commands/workspace.rs
@@ -31,18 +31,13 @@ pub fn run(ctx: &CliContext, args: WorkspaceArgs) -> i32 {
 }

 fn schema(pretty: bool) -> CommandResult {
-    let mut schema =
-        serde_json::to_value(schema_for!(Workspace)).map_err(|e| format!(
-            "Failed to serialize workspace schema: {e}"
-        ))?;
+    let mut schema = serde_json::to_value(schema_for!(Workspace))
+        .map_err(|e| format!("Failed to serialize workspace schema: {e}"))?;
    append_agent_hints(&mut schema);

-    let output = if pretty {
-        serde_json::to_string_pretty(&schema)
-    } else {
-        serde_json::to_string(&schema)
-    }
-    .map_err(|e| format!("Failed to format workspace schema JSON: {e}"))?;
+    let output =
+        if pretty { serde_json::to_string_pretty(&schema) } else { serde_json::to_string(&schema) }
+            .map_err(|e| format!("Failed to format workspace schema JSON: {e}"))?;
    println!("{output}");
    Ok(())
 }
--- a/crates-cli/yaak-cli/src/context.rs
+++ b/crates-cli/yaak-cli/src/context.rs
@@ -18,6 +18,14 @@ const EMBEDDED_PLUGIN_RUNTIME: &str = include_str!(concat!(
 static EMBEDDED_VENDORED_PLUGINS: Dir<'_> =
    include_dir!("$CARGO_MANIFEST_DIR/../../crates-tauri/yaak-app/vendored/plugins");

+#[derive(Clone, Debug, Default)]
+pub struct CliExecutionContext {
+    pub request_id: Option<String>,
+    pub workspace_id: Option<String>,
+    pub environment_id: Option<String>,
+    pub cookie_jar_id: Option<String>,
+}
+
 pub struct CliContext {
    data_dir: PathBuf,
    query_manager: QueryManager,
@@ -28,63 +36,71 @@ pub struct CliContext {
 }

 impl CliContext {
-    pub async fn initialize(data_dir: PathBuf, app_id: &str, with_plugins: bool) -> Self {
+    pub fn new(data_dir: PathBuf, app_id: &str) -> Self {
        let db_path = data_dir.join("db.sqlite");
        let blob_path = data_dir.join("blobs.sqlite");
-
-        let (query_manager, blob_manager, _rx) = yaak_models::init_standalone(&db_path, &blob_path)
-            .expect("Failed to initialize database");
-
-        let encryption_manager = Arc::new(EncryptionManager::new(query_manager.clone(), app_id));
-
-        let plugin_manager = if with_plugins {
-            let vendored_plugin_dir = data_dir.join("vendored-plugins");
-            let installed_plugin_dir = data_dir.join("installed-plugins");
-            let node_bin_path = PathBuf::from("node");
-
-            prepare_embedded_vendored_plugins(&vendored_plugin_dir)
-                .expect("Failed to prepare bundled plugins");
-
-            let plugin_runtime_main =
-                std::env::var("YAAK_PLUGIN_RUNTIME").map(PathBuf::from).unwrap_or_else(|_| {
-                    prepare_embedded_plugin_runtime(&data_dir)
-                        .expect("Failed to prepare embedded plugin runtime")
-                });
-
-            match PluginManager::new(
-                vendored_plugin_dir,
-                installed_plugin_dir,
-                node_bin_path,
-                plugin_runtime_main,
-                &query_manager,
-                &PluginContext::new_empty(),
-                false,
-            )
-            .await
-            {
-                Ok(plugin_manager) => Some(Arc::new(plugin_manager)),
+        let (query_manager, blob_manager, _rx) =
+            match yaak_models::init_standalone(&db_path, &blob_path) {
+                Ok(v) => v,
                Err(err) => {
-                    eprintln!("Warning: Failed to initialize plugins: {err}");
-                    None
+                    eprintln!("Error: Failed to initialize database: {err}");
+                    std::process::exit(1);
                }
-            }
-        } else {
-            None
-        };
-
-        let plugin_event_bridge = if let Some(plugin_manager) = &plugin_manager {
-            Some(CliPluginEventBridge::start(plugin_manager.clone(), query_manager.clone()).await)
-        } else {
-            None
-        };
+            };
+        let encryption_manager = Arc::new(EncryptionManager::new(query_manager.clone(), app_id));

        Self {
            data_dir,
            query_manager,
            blob_manager,
            encryption_manager,
-            plugin_manager,
-            plugin_event_bridge: Mutex::new(plugin_event_bridge),
+            plugin_manager: None,
+            plugin_event_bridge: Mutex::new(None),
+        }
+    }
+
+    pub async fn init_plugins(&mut self, execution_context: CliExecutionContext) {
+        let vendored_plugin_dir = self.data_dir.join("vendored-plugins");
+        let installed_plugin_dir = self.data_dir.join("installed-plugins");
+        let node_bin_path = PathBuf::from("node");
+
+        prepare_embedded_vendored_plugins(&vendored_plugin_dir)
+            .expect("Failed to prepare bundled plugins");
+
+        let plugin_runtime_main =
+            std::env::var("YAAK_PLUGIN_RUNTIME").map(PathBuf::from).unwrap_or_else(|_| {
+                prepare_embedded_plugin_runtime(&self.data_dir)
+                    .expect("Failed to prepare embedded plugin runtime")
+            });
+
+        match PluginManager::new(
+            vendored_plugin_dir,
+            installed_plugin_dir,
+            node_bin_path,
+            plugin_runtime_main,
+            &self.query_manager,
+            &PluginContext::new_empty(),
+            false,
+        )
+        .await
+        {
+            Ok(plugin_manager) => {
+                let plugin_manager = Arc::new(plugin_manager);
+                let plugin_event_bridge = CliPluginEventBridge::start(
+                    plugin_manager.clone(),
+                    self.query_manager.clone(),
+                    self.blob_manager.clone(),
+                    self.encryption_manager.clone(),
+                    self.data_dir.clone(),
+                    execution_context,
+                )
+                .await;
+                self.plugin_manager = Some(plugin_manager);
+                *self.plugin_event_bridge.lock().await = Some(plugin_event_bridge);
+            }
+            Err(err) => {
+                eprintln!("Warning: Failed to initialize plugins: {err}");
+            }
        }
    }

--- a/crates-cli/yaak-cli/src/main.rs
+++ b/crates-cli/yaak-cli/src/main.rs
@@ -5,14 +5,17 @@ mod plugin_events;
 mod ui;
 mod utils;
 mod version;
+mod version_check;

 use clap::Parser;
-use cli::{Cli, Commands, RequestCommands};
-use context::CliContext;
+use cli::{Cli, Commands, PluginCommands, RequestCommands};
+use context::{CliContext, CliExecutionContext};
+use std::path::PathBuf;
+use yaak_models::queries::any_request::AnyRequest;

 #[tokio::main]
 async fn main() {
-    let Cli { data_dir, environment, verbose, log, command } = Cli::parse();
+    let Cli { data_dir, environment, cookie_jar, verbose, log, command } = Cli::parse();

    if let Some(log_level) = log {
        match log_level {
@@ -28,74 +31,253 @@ async fn main() {

    let app_id = if cfg!(debug_assertions) { "app.yaak.desktop.dev" } else { "app.yaak.desktop" };

-    let data_dir = data_dir.unwrap_or_else(|| {
-        dirs::data_dir().expect("Could not determine data directory").join(app_id)
-    });
+    let data_dir = data_dir.unwrap_or_else(|| resolve_data_dir(app_id));

-    let needs_context = matches!(
-        &command,
-        Commands::Send(_)
-            | Commands::Workspace(_)
-            | Commands::Request(_)
-            | Commands::Folder(_)
-            | Commands::Environment(_)
-    );
-
-    let needs_plugins = matches!(
-        &command,
-        Commands::Send(_)
-            | Commands::Request(cli::RequestArgs {
-                command: RequestCommands::Send { .. } | RequestCommands::Schema { .. },
-            })
-    );
-
-    let context = if needs_context {
-        Some(CliContext::initialize(data_dir, app_id, needs_plugins).await)
-    } else {
-        None
-    };
+    version_check::maybe_check_for_updates().await;

    let exit_code = match command {
        Commands::Auth(args) => commands::auth::run(args).await,
-        Commands::Plugin(args) => commands::plugin::run(args).await,
+        Commands::Plugin(args) => match args.command {
+            PluginCommands::Build(args) => commands::plugin::run_build(args).await,
+            PluginCommands::Dev(args) => commands::plugin::run_dev(args).await,
+            PluginCommands::Generate(args) => commands::plugin::run_generate(args).await,
+            PluginCommands::Publish(args) => commands::plugin::run_publish(args).await,
+            PluginCommands::Install(install_args) => {
+                let mut context = CliContext::new(data_dir.clone(), app_id);
+                context.init_plugins(CliExecutionContext::default()).await;
+                let exit_code = commands::plugin::run_install(&context, install_args).await;
+                context.shutdown().await;
+                exit_code
+            }
+        },
        Commands::Build(args) => commands::plugin::run_build(args).await,
        Commands::Dev(args) => commands::plugin::run_dev(args).await,
+        Commands::Generate(args) => commands::plugin::run_generate(args).await,
+        Commands::Publish(args) => commands::plugin::run_publish(args).await,
        Commands::Send(args) => {
-            commands::send::run(
-                context.as_ref().expect("context initialized for send"),
-                args,
+            let mut context = CliContext::new(data_dir.clone(), app_id);
+            match resolve_send_execution_context(
+                &context,
+                &args.id,
                environment.as_deref(),
-                verbose,
-            )
-            .await
+                cookie_jar.as_deref(),
+            ) {
+                Ok(execution_context) => {
+                    context.init_plugins(execution_context).await;
+                    let exit_code = commands::send::run(
+                        &context,
+                        args,
+                        environment.as_deref(),
+                        cookie_jar.as_deref(),
+                        verbose,
+                    )
+                    .await;
+                    context.shutdown().await;
+                    exit_code
+                }
+                Err(error) => {
+                    eprintln!("Error: {error}");
+                    1
+                }
+            }
+        }
+        Commands::CookieJar(args) => {
+            let context = CliContext::new(data_dir.clone(), app_id);
+            let exit_code = commands::cookie_jar::run(&context, args);
+            context.shutdown().await;
+            exit_code
+        }
+        Commands::Workspace(args) => {
+            let context = CliContext::new(data_dir.clone(), app_id);
+            let exit_code = commands::workspace::run(&context, args);
+            context.shutdown().await;
+            exit_code
        }
-        Commands::Workspace(args) => commands::workspace::run(
-            context.as_ref().expect("context initialized for workspace"),
-            args,
-        ),
        Commands::Request(args) => {
-            commands::request::run(
-                context.as_ref().expect("context initialized for request"),
-                args,
-                environment.as_deref(),
-                verbose,
-            )
-            .await
+            let mut context = CliContext::new(data_dir.clone(), app_id);
+            let execution_context_result = match &args.command {
+                RequestCommands::Send { request_id } => resolve_request_execution_context(
+                    &context,
+                    request_id,
+                    environment.as_deref(),
+                    cookie_jar.as_deref(),
+                ),
+                _ => Ok(CliExecutionContext::default()),
+            };
+            match execution_context_result {
+                Ok(execution_context) => {
+                    let with_plugins = matches!(
+                        &args.command,
+                        RequestCommands::Send { .. } | RequestCommands::Schema { .. }
+                    );
+                    if with_plugins {
+                        context.init_plugins(execution_context).await;
+                    }
+                    let exit_code = commands::request::run(
+                        &context,
+                        args,
+                        environment.as_deref(),
+                        cookie_jar.as_deref(),
+                        verbose,
+                    )
+                    .await;
+                    context.shutdown().await;
+                    exit_code
+                }
+                Err(error) => {
+                    eprintln!("Error: {error}");
+                    1
+                }
+            }
        }
        Commands::Folder(args) => {
-            commands::folder::run(context.as_ref().expect("context initialized for folder"), args)
+            let context = CliContext::new(data_dir.clone(), app_id);
+            let exit_code = commands::folder::run(&context, args);
+            context.shutdown().await;
+            exit_code
+        }
+        Commands::Environment(args) => {
+            let context = CliContext::new(data_dir.clone(), app_id);
+            let exit_code = commands::environment::run(&context, args);
+            context.shutdown().await;
+            exit_code
        }
-        Commands::Environment(args) => commands::environment::run(
-            context.as_ref().expect("context initialized for environment"),
-            args,
-        ),
    };

-    if let Some(context) = &context {
-        context.shutdown().await;
-    }
-
    if exit_code != 0 {
        std::process::exit(exit_code);
    }
 }
+
+fn resolve_send_execution_context(
+    context: &CliContext,
+    id: &str,
+    environment: Option<&str>,
+    explicit_cookie_jar_id: Option<&str>,
+) -> Result<CliExecutionContext, String> {
+    if let Ok(request) = context.db().get_any_request(id) {
+        let (request_id, workspace_id) = match request {
+            AnyRequest::HttpRequest(r) => (Some(r.id), r.workspace_id),
+            AnyRequest::GrpcRequest(r) => (Some(r.id), r.workspace_id),
+            AnyRequest::WebsocketRequest(r) => (Some(r.id), r.workspace_id),
+        };
+        let cookie_jar_id = resolve_cookie_jar_id(context, &workspace_id, explicit_cookie_jar_id)?;
+        return Ok(CliExecutionContext {
+            request_id,
+            workspace_id: Some(workspace_id),
+            environment_id: environment.map(str::to_string),
+            cookie_jar_id,
+        });
+    }
+
+    if let Ok(folder) = context.db().get_folder(id) {
+        let cookie_jar_id =
+            resolve_cookie_jar_id(context, &folder.workspace_id, explicit_cookie_jar_id)?;
+        return Ok(CliExecutionContext {
+            request_id: None,
+            workspace_id: Some(folder.workspace_id),
+            environment_id: environment.map(str::to_string),
+            cookie_jar_id,
+        });
+    }
+
+    if let Ok(workspace) = context.db().get_workspace(id) {
+        let cookie_jar_id = resolve_cookie_jar_id(context, &workspace.id, explicit_cookie_jar_id)?;
+        return Ok(CliExecutionContext {
+            request_id: None,
+            workspace_id: Some(workspace.id),
+            environment_id: environment.map(str::to_string),
+            cookie_jar_id,
+        });
+    }
+
+    Err(format!("Could not resolve ID '{}' as request, folder, or workspace", id))
+}
+
+fn resolve_request_execution_context(
+    context: &CliContext,
+    request_id: &str,
+    environment: Option<&str>,
+    explicit_cookie_jar_id: Option<&str>,
+) -> Result<CliExecutionContext, String> {
+    let request = context
+        .db()
+        .get_any_request(request_id)
+        .map_err(|e| format!("Failed to get request: {e}"))?;
+
+    let workspace_id = match request {
+        AnyRequest::HttpRequest(r) => r.workspace_id,
+        AnyRequest::GrpcRequest(r) => r.workspace_id,
+        AnyRequest::WebsocketRequest(r) => r.workspace_id,
+    };
+    let cookie_jar_id = resolve_cookie_jar_id(context, &workspace_id, explicit_cookie_jar_id)?;
+
+    Ok(CliExecutionContext {
+        request_id: Some(request_id.to_string()),
+        workspace_id: Some(workspace_id),
+        environment_id: environment.map(str::to_string),
+        cookie_jar_id,
+    })
+}
+
+fn resolve_cookie_jar_id(
+    context: &CliContext,
+    workspace_id: &str,
+    explicit_cookie_jar_id: Option<&str>,
+) -> Result<Option<String>, String> {
+    if let Some(cookie_jar_id) = explicit_cookie_jar_id {
+        return Ok(Some(cookie_jar_id.to_string()));
+    }
+
+    let default_cookie_jar = context
+        .db()
+        .list_cookie_jars(workspace_id)
+        .map_err(|e| format!("Failed to list cookie jars: {e}"))?
+        .into_iter()
+        .min_by_key(|jar| jar.created_at)
+        .map(|jar| jar.id);
+    Ok(default_cookie_jar)
+}
+
+fn resolve_data_dir(app_id: &str) -> PathBuf {
+    if let Some(dir) = wsl_data_dir(app_id) {
+        return dir;
+    }
+    dirs::data_dir().expect("Could not determine data directory").join(app_id)
+}
+
+/// Detect WSL and resolve the Windows AppData\Roaming path for the Yaak data directory.
+fn wsl_data_dir(app_id: &str) -> Option<PathBuf> {
+    if !cfg!(target_os = "linux") {
+        return None;
+    }
+
+    let proc_version = std::fs::read_to_string("/proc/version").ok()?;
+    let is_wsl = proc_version.to_lowercase().contains("microsoft");
+    if !is_wsl {
+        return None;
+    }
+
+    // We're in WSL, so try to resolve the Yaak app's data directory in Windows
+
+    // Get the Windows %APPDATA% path via cmd.exe
+    let appdata_output =
+        std::process::Command::new("cmd.exe").args(["/C", "echo", "%APPDATA%"]).output().ok()?;
+
+    let win_path = String::from_utf8(appdata_output.stdout).ok()?.trim().to_string();
+    if win_path.is_empty() || win_path == "%APPDATA%" {
+        return None;
+    }
+
+    // Convert Windows path to WSL path using wslpath (handles custom mount points)
+    let wslpath_output = std::process::Command::new("wslpath").arg(&win_path).output().ok()?;
+
+    let wsl_appdata = String::from_utf8(wslpath_output.stdout).ok()?.trim().to_string();
+    if wsl_appdata.is_empty() {
+        return None;
+    }
+
+    let wsl_path = PathBuf::from(wsl_appdata).join(app_id);
+
+    if wsl_path.exists() { Some(wsl_path) } else { None }
+}
--- a/crates-cli/yaak-cli/src/plugin_events.rs
+++ b/crates-cli/yaak-cli/src/plugin_events.rs
--- a/crates-cli/yaak-cli/src/ui.rs
+++ b/crates-cli/yaak-cli/src/ui.rs
@@ -17,6 +17,14 @@ pub fn warning(message: &str) {
    }
 }

+pub fn warning_stderr(message: &str) {
+    if io::stderr().is_terminal() {
+        eprintln!("{:<8} {}", style("WARNING").yellow().bold(), style(message).yellow());
+    } else {
+        eprintln!("WARNING  {message}");
+    }
+}
+
 pub fn success(message: &str) {
    if io::stdout().is_terminal() {
        println!("{:<8} {}", style("SUCCESS").green().bold(), style(message).green());
--- a/crates-cli/yaak-cli/src/utils/mod.rs
+++ b/crates-cli/yaak-cli/src/utils/mod.rs
@@ -2,3 +2,4 @@ pub mod confirm;
 pub mod http;
 pub mod json;
 pub mod schema;
+pub mod workspace;
--- a/crates-cli/yaak-cli/src/utils/workspace.rs
+++ b/crates-cli/yaak-cli/src/utils/workspace.rs
@@ -0,0 +1,19 @@
+use crate::context::CliContext;
+
+pub fn resolve_workspace_id(
+    ctx: &CliContext,
+    workspace_id: Option<&str>,
+    command_name: &str,
+) -> Result<String, String> {
+    if let Some(workspace_id) = workspace_id {
+        return Ok(workspace_id.to_string());
+    }
+
+    let workspaces =
+        ctx.db().list_workspaces().map_err(|e| format!("Failed to list workspaces: {e}"))?;
+    match workspaces.as_slice() {
+        [] => Err(format!("No workspaces found. {command_name} requires a workspace ID.")),
+        [workspace] => Ok(workspace.id.clone()),
+        _ => Err(format!("Multiple workspaces found. {command_name} requires a workspace ID.")),
+    }
+}
--- a/crates-cli/yaak-cli/src/version_check.rs
+++ b/crates-cli/yaak-cli/src/version_check.rs
@@ -0,0 +1,226 @@
+use crate::ui;
+use crate::version;
+use serde::{Deserialize, Serialize};
+use std::fs;
+use std::io::IsTerminal;
+use std::path::{Path, PathBuf};
+use std::time::{Duration, SystemTime, UNIX_EPOCH};
+use yaak_api::{ApiClientKind, yaak_api_client};
+
+const CACHE_FILE_NAME: &str = "cli-version-check.json";
+const CHECK_INTERVAL_SECS: u64 = 24 * 60 * 60;
+const REQUEST_TIMEOUT: Duration = Duration::from_millis(800);
+
+#[derive(Debug, Clone, Serialize, Deserialize, Default)]
+#[serde(default)]
+struct VersionCheckResponse {
+    outdated: bool,
+    latest_version: Option<String>,
+    upgrade_hint: Option<String>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(default)]
+struct CacheRecord {
+    checked_at_epoch_secs: u64,
+    response: VersionCheckResponse,
+    last_warned_at_epoch_secs: Option<u64>,
+    last_warned_version: Option<String>,
+}
+
+impl Default for CacheRecord {
+    fn default() -> Self {
+        Self {
+            checked_at_epoch_secs: 0,
+            response: VersionCheckResponse::default(),
+            last_warned_at_epoch_secs: None,
+            last_warned_version: None,
+        }
+    }
+}
+
+#[derive(Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+struct VersionCheckRequest<'a> {
+    current_version: &'a str,
+    channel: String,
+    install_source: String,
+    platform: &'a str,
+    arch: &'a str,
+}
+
+pub async fn maybe_check_for_updates() {
+    if should_skip_check() {
+        return;
+    }
+
+    let now = unix_epoch_secs();
+    let cache_path = cache_path();
+    let cached = read_cache(&cache_path);
+
+    if let Some(cache) = cached.as_ref().filter(|c| !is_expired(c.checked_at_epoch_secs, now)) {
+        let mut record = cache.clone();
+        maybe_warn_outdated(&mut record, now);
+        write_cache(&cache_path, &record);
+        return;
+    }
+
+    let fresh = fetch_version_check().await;
+    match fresh {
+        Some(response) => {
+            let mut record = CacheRecord {
+                checked_at_epoch_secs: now,
+                response: response.clone(),
+                last_warned_at_epoch_secs: cached
+                    .as_ref()
+                    .and_then(|c| c.last_warned_at_epoch_secs),
+                last_warned_version: cached.as_ref().and_then(|c| c.last_warned_version.clone()),
+            };
+            maybe_warn_outdated(&mut record, now);
+            write_cache(&cache_path, &record);
+        }
+        None => {
+            let fallback = cached.as_ref().map(|cache| cache.response.clone()).unwrap_or_default();
+            let mut record = CacheRecord {
+                checked_at_epoch_secs: now,
+                response: fallback,
+                last_warned_at_epoch_secs: cached
+                    .as_ref()
+                    .and_then(|c| c.last_warned_at_epoch_secs),
+                last_warned_version: cached.as_ref().and_then(|c| c.last_warned_version.clone()),
+            };
+            maybe_warn_outdated(&mut record, now);
+            write_cache(&cache_path, &record);
+        }
+    }
+}
+
+fn should_skip_check() -> bool {
+    if std::env::var("YAAK_CLI_NO_UPDATE_CHECK")
+        .is_ok_and(|v| v == "1" || v.eq_ignore_ascii_case("true"))
+    {
+        return true;
+    }
+
+    if std::env::var("CI").is_ok() {
+        return true;
+    }
+
+    !std::io::stdout().is_terminal()
+}
+
+async fn fetch_version_check() -> Option<VersionCheckResponse> {
+    let api_url = format!("{}/cli/check", update_base_url());
+    let current_version = version::cli_version();
+    let payload = VersionCheckRequest {
+        current_version,
+        channel: release_channel(current_version),
+        install_source: install_source(),
+        platform: std::env::consts::OS,
+        arch: std::env::consts::ARCH,
+    };
+
+    let client = yaak_api_client(ApiClientKind::Cli, current_version).ok()?;
+    let request = client.post(api_url).json(&payload);
+
+    let response = tokio::time::timeout(REQUEST_TIMEOUT, request.send()).await.ok()?.ok()?;
+    if !response.status().is_success() {
+        return None;
+    }
+
+    tokio::time::timeout(REQUEST_TIMEOUT, response.json::<VersionCheckResponse>()).await.ok()?.ok()
+}
+
+fn release_channel(version: &str) -> String {
+    version
+        .split_once('-')
+        .and_then(|(_, suffix)| suffix.split('.').next())
+        .unwrap_or("stable")
+        .to_string()
+}
+
+fn install_source() -> String {
+    std::env::var("YAAK_CLI_INSTALL_SOURCE")
+        .ok()
+        .filter(|s| !s.trim().is_empty())
+        .unwrap_or_else(|| "source".to_string())
+}
+
+fn update_base_url() -> &'static str {
+    match std::env::var("ENVIRONMENT").ok().as_deref() {
+        Some("development") => "http://localhost:9444",
+        _ => "https://update.yaak.app",
+    }
+}
+
+fn maybe_warn_outdated(record: &mut CacheRecord, now: u64) {
+    if !record.response.outdated {
+        return;
+    }
+
+    let latest =
+        record.response.latest_version.clone().unwrap_or_else(|| "a newer release".to_string());
+    let warn_suppressed = record.last_warned_version.as_deref() == Some(latest.as_str())
+        && record.last_warned_at_epoch_secs.is_some_and(|t| !is_expired(t, now));
+    if warn_suppressed {
+        return;
+    }
+
+    let hint = record.response.upgrade_hint.clone().unwrap_or_else(default_upgrade_hint);
+    ui::warning_stderr(&format!("A newer Yaak CLI version is available ({latest}). {hint}"));
+    record.last_warned_version = Some(latest);
+    record.last_warned_at_epoch_secs = Some(now);
+}
+
+fn default_upgrade_hint() -> String {
+    if install_source() == "npm" {
+        let channel = release_channel(version::cli_version());
+        if channel == "stable" {
+            return "Run `npm install -g @yaakapp/cli@latest` to update.".to_string();
+        }
+        return format!("Run `npm install -g @yaakapp/cli@{channel}` to update.");
+    }
+
+    "Update your Yaak CLI installation to the latest release.".to_string()
+}
+
+fn cache_path() -> PathBuf {
+    std::env::temp_dir().join("yaak-cli").join(format!("{}-{CACHE_FILE_NAME}", environment_name()))
+}
+
+fn environment_name() -> &'static str {
+    match std::env::var("ENVIRONMENT").ok().as_deref() {
+        Some("staging") => "staging",
+        Some("development") => "development",
+        _ => "production",
+    }
+}
+
+fn read_cache(path: &Path) -> Option<CacheRecord> {
+    let contents = fs::read_to_string(path).ok()?;
+    serde_json::from_str::<CacheRecord>(&contents).ok()
+}
+
+fn write_cache(path: &Path, record: &CacheRecord) {
+    let Some(parent) = path.parent() else {
+        return;
+    };
+    if fs::create_dir_all(parent).is_err() {
+        return;
+    }
+    let Ok(json) = serde_json::to_string(record) else {
+        return;
+    };
+    let _ = fs::write(path, json);
+}
+
+fn is_expired(checked_at_epoch_secs: u64, now: u64) -> bool {
+    now.saturating_sub(checked_at_epoch_secs) >= CHECK_INTERVAL_SECS
+}
+
+fn unix_epoch_secs() -> u64 {
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .unwrap_or_else(|_| Duration::from_secs(0))
+        .as_secs()
+}
--- a/crates-cli/yaak-cli/tests/common/http_server.rs
+++ b/crates-cli/yaak-cli/tests/common/http_server.rs
@@ -1,9 +1,14 @@
 use std::io::{Read, Write};
-use std::net::TcpListener;
+use std::net::{SocketAddr, TcpListener, TcpStream};
+use std::sync::Arc;
+use std::sync::atomic::{AtomicBool, Ordering};
 use std::thread;
+use std::time::Duration;

 pub struct TestHttpServer {
    pub url: String,
+    addr: SocketAddr,
+    shutdown: Arc<AtomicBool>,
    handle: Option<thread::JoinHandle<()>>,
 }

@@ -12,29 +17,46 @@ impl TestHttpServer {
        let listener = TcpListener::bind("127.0.0.1:0").expect("Failed to bind test HTTP server");
        let addr = listener.local_addr().expect("Failed to get local addr");
        let url = format!("http://{addr}/test");
+        listener.set_nonblocking(true).expect("Failed to set test server listener nonblocking");
+
+        let shutdown = Arc::new(AtomicBool::new(false));
+        let shutdown_signal = Arc::clone(&shutdown);
        let body_bytes = body.as_bytes().to_vec();

        let handle = thread::spawn(move || {
-            if let Ok((mut stream, _)) = listener.accept() {
-                let mut request_buf = [0u8; 4096];
-                let _ = stream.read(&mut request_buf);
+            while !shutdown_signal.load(Ordering::Relaxed) {
+                match listener.accept() {
+                    Ok((mut stream, _)) => {
+                        let _ = stream.set_read_timeout(Some(Duration::from_secs(1)));
+                        let mut request_buf = [0u8; 4096];
+                        let _ = stream.read(&mut request_buf);

-                let response = format!(
-                    "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nContent-Length: {}\r\nConnection: close\r\n\r\n",
-                    body_bytes.len()
-                );
-                let _ = stream.write_all(response.as_bytes());
-                let _ = stream.write_all(&body_bytes);
-                let _ = stream.flush();
+                        let response = format!(
+                            "HTTP/1.1 200 OK\r\nContent-Type: text/plain\r\nContent-Length: {}\r\nConnection: close\r\n\r\n",
+                            body_bytes.len()
+                        );
+                        let _ = stream.write_all(response.as_bytes());
+                        let _ = stream.write_all(&body_bytes);
+                        let _ = stream.flush();
+                        break;
+                    }
+                    Err(err) if err.kind() == std::io::ErrorKind::WouldBlock => {
+                        thread::sleep(Duration::from_millis(10));
+                    }
+                    Err(_) => break,
+                }
            }
        });

-        Self { url, handle: Some(handle) }
+        Self { url, addr, shutdown, handle: Some(handle) }
    }
 }

 impl Drop for TestHttpServer {
    fn drop(&mut self) {
+        self.shutdown.store(true, Ordering::Relaxed);
+        let _ = TcpStream::connect(self.addr);
+
        if let Some(handle) = self.handle.take() {
            let _ = handle.join();
        }
--- a/crates-cli/yaak-cli/tests/workspace_commands.rs
+++ b/crates-cli/yaak-cli/tests/workspace_commands.rs
@@ -70,6 +70,8 @@ fn workspace_schema_outputs_json_schema() {
        .stdout(contains("\"type\":\"object\""))
        .stdout(contains("\"x-yaak-agent-hints\""))
        .stdout(contains("\"templateVariableSyntax\":\"${[ my_var ]}\""))
-        .stdout(contains("\"templateFunctionSyntax\":\"${[ namespace.my_func(a='aaa',b='bbb') ]}\""))
+        .stdout(contains(
+            "\"templateFunctionSyntax\":\"${[ namespace.my_func(a='aaa',b='bbb') ]}\"",
+        ))
        .stdout(contains("\"name\""));
 }
--- a/crates-tauri/yaak-app/Cargo.toml
+++ b/crates-tauri/yaak-app/Cargo.toml
@@ -30,11 +30,21 @@ eventsource-client = { git = "https://github.com/yaakapp/rust-eventsource-client
 http = { version = "1.2.0", default-features = false }
 log = { workspace = true }
 md5 = "0.8.0"
+pretty_graphql = "0.2"
 r2d2 = "0.8.10"
 r2d2_sqlite = "0.25.0"
 mime_guess = "2.0.5"
 rand = "0.9.0"
-reqwest = { workspace = true, features = ["multipart", "gzip", "brotli", "deflate", "json", "rustls-tls-manual-roots-no-provider", "socks", "http2"] }
+reqwest = { workspace = true, features = [
+  "multipart",
+  "gzip",
+  "brotli",
+  "deflate",
+  "json",
+  "rustls-tls-manual-roots-no-provider",
+  "socks",
+  "http2",
+] }
 serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true, features = ["raw_value"] }
 tauri = { workspace = true, features = ["devtools", "protocol-asset"] }
--- a/crates-tauri/yaak-app/capabilities/default.json
+++ b/crates-tauri/yaak-app/capabilities/default.json
@@ -1,9 +1,7 @@
 {
  "identifier": "default",
  "description": "Default capabilities for all build variants",
-  "windows": [
-    "*"
-  ],
+  "windows": ["*"],
  "permissions": [
    "core:app:allow-identifier",
    "core:event:allow-emit",
--- a/crates-tauri/yaak-app/package.json
+++ b/crates-tauri/yaak-app/package.json
@@ -1,6 +1,6 @@
 {
  "name": "@yaakapp-internal/tauri",
-  "private": true,
  "version": "1.0.0",
+  "private": true,
  "main": "bindings/index.ts"
 }
--- a/crates-tauri/yaak-app/src/lib.rs
+++ b/crates-tauri/yaak-app/src/lib.rs
@@ -31,14 +31,16 @@ use tauri_plugin_window_state::{AppHandleExt, StateFlags};
 use tokio::sync::Mutex;
 use tokio::task::block_in_place;
 use tokio::time;
+use yaak_common::command::new_checked_command;
 use yaak_crypto::manager::EncryptionManager;
 use yaak_grpc::manager::{GrpcConfig, GrpcHandle};
+use yaak_templates::strip_json_comments::strip_json_comments;
 use yaak_grpc::{Code, ServiceDefinition, serialize_message};
 use yaak_mac_window::AppHandleMacWindowExt;
 use yaak_models::models::{
    AnyModel, CookieJar, Environment, GrpcConnection, GrpcConnectionState, GrpcEvent,
-    GrpcEventType, HttpRequest, HttpResponse, HttpResponseEvent, HttpResponseState, Plugin,
-    Workspace, WorkspaceMeta,
+    GrpcEventType, HttpRequest, HttpResponse, HttpResponseEvent, HttpResponseState, Workspace,
+    WorkspaceMeta,
 };
 use yaak_models::util::{BatchUpsertResult, UpdateSource, get_workspace_export_resources};
 use yaak_plugins::events::{
@@ -97,6 +99,7 @@ impl<R: Runtime> PluginContextExt<R> for WebviewWindow<R> {
 struct AppMetaData {
    is_dev: bool,
    version: String,
+    cli_version: Option<String>,
    name: String,
    app_data_dir: String,
    app_log_dir: String,
@@ -113,9 +116,11 @@ async fn cmd_metadata(app_handle: AppHandle) -> YaakResult<AppMetaData> {
    let vendored_plugin_dir =
        app_handle.path().resolve("vendored/plugins", BaseDirectory::Resource)?;
    let default_project_dir = app_handle.path().home_dir()?.join("YaakProjects");
+    let cli_version = detect_cli_version().await;
    Ok(AppMetaData {
        is_dev: is_dev(),
        version: app_handle.package_info().version.to_string(),
+        cli_version,
        name: app_handle.package_info().name.to_string(),
        app_data_dir: app_data_dir.to_string_lossy().to_string(),
        app_log_dir: app_log_dir.to_string_lossy().to_string(),
@@ -126,6 +131,24 @@ async fn cmd_metadata(app_handle: AppHandle) -> YaakResult<AppMetaData> {
    })
 }

+async fn detect_cli_version() -> Option<String> {
+    detect_cli_version_for_binary("yaak").await
+}
+
+async fn detect_cli_version_for_binary(program: &str) -> Option<String> {
+    let mut cmd = new_checked_command(program, "--version").await.ok()?;
+    let out = cmd.arg("--version").output().await.ok()?;
+    if !out.status.success() {
+        return None;
+    }
+
+    let line = String::from_utf8(out.stdout).ok()?;
+    let line = line.lines().find(|l| !l.trim().is_empty())?.trim();
+    let mut parts = line.split_whitespace();
+    let _name = parts.next();
+    Some(parts.next().unwrap_or(line).to_string())
+}
+
 #[tauri::command]
 async fn cmd_template_tokens_to_string<R: Runtime>(
    window: WebviewWindow<R>,
@@ -411,6 +434,7 @@ async fn cmd_grpc_go<R: Runtime>(
                            result.expect("Failed to render template")
                        })
                    });
+                    let msg = strip_json_comments(&msg);
                    in_msg_tx.try_send(msg.clone()).unwrap();
                }
                Ok(IncomingMsg::Commit) => {
@@ -446,6 +470,7 @@ async fn cmd_grpc_go<R: Runtime>(
            &RenderOptions { error_behavior: RenderErrorBehavior::Throw },
        )
        .await?;
+        let msg = strip_json_comments(&msg);

        app_handle.db().upsert_grpc_event(
            &GrpcEvent {
@@ -847,6 +872,14 @@ async fn cmd_format_json(text: &str) -> YaakResult<String> {
    Ok(format_json(text, "  "))
 }

+#[tauri::command]
+async fn cmd_format_graphql(text: &str) -> YaakResult<String> {
+    match pretty_graphql::format_text(text, &Default::default()) {
+        Ok(formatted) => Ok(formatted),
+        Err(_) => Ok(text.to_string()),
+    }
+}
+
 #[tauri::command]
 async fn cmd_http_response_body<R: Runtime>(
    window: WebviewWindow<R>,
@@ -1345,41 +1378,17 @@ async fn cmd_send_http_request<R: Runtime>(
    Ok(r)
 }

-#[tauri::command]
-async fn cmd_install_plugin<R: Runtime>(
-    directory: &str,
-    url: Option<String>,
-    plugin_manager: State<'_, PluginManager>,
-    app_handle: AppHandle<R>,
-    window: WebviewWindow<R>,
-) -> YaakResult<Plugin> {
-    let plugin = app_handle.db().upsert_plugin(
-        &Plugin { directory: directory.into(), url, enabled: true, ..Default::default() },
-        &UpdateSource::from_window_label(window.label()),
-    )?;
-
-    plugin_manager
-        .add_plugin(
-            &PluginContext::new(Some(window.label().to_string()), window.workspace_id()),
-            &plugin,
-        )
-        .await?;
-
-    Ok(plugin)
-}
-
 #[tauri::command]
 async fn cmd_reload_plugins<R: Runtime>(
    app_handle: AppHandle<R>,
    window: WebviewWindow<R>,
    plugin_manager: State<'_, PluginManager>,
-) -> YaakResult<()> {
+) -> YaakResult<Vec<(String, String)>> {
    let plugins = app_handle.db().list_plugins()?;
    let plugin_context =
        PluginContext::new(Some(window.label().to_string()), window.workspace_id());
-    let _errors = plugin_manager.initialize_all_plugins(plugins, &plugin_context).await;
-    // Note: errors are returned but we don't show toasts here since this is a manual reload
-    Ok(())
+    let errors = plugin_manager.initialize_all_plugins(plugins, &plugin_context).await;
+    Ok(errors)
 }

 #[tauri::command]
@@ -1639,6 +1648,7 @@ pub fn run() {
            cmd_http_request_body,
            cmd_http_response_body,
            cmd_format_json,
+            cmd_format_graphql,
            cmd_get_http_authentication_summaries,
            cmd_get_http_authentication_config,
            cmd_get_sse_events,
@@ -1652,7 +1662,6 @@ pub fn run() {
            cmd_workspace_actions,
            cmd_folder_actions,
            cmd_import_data,
-            cmd_install_plugin,
            cmd_metadata,
            cmd_new_child_window,
            cmd_new_main_window,
@@ -1721,6 +1730,8 @@ pub fn run() {
            git_ext::cmd_git_rm_remote,
            //
            // Plugin commands
+            plugins_ext::cmd_plugin_init_errors,
+            plugins_ext::cmd_plugins_install_from_directory,
            plugins_ext::cmd_plugins_search,
            plugins_ext::cmd_plugins_install,
            plugins_ext::cmd_plugins_uninstall,
--- a/crates-tauri/yaak-app/src/models_ext.rs
+++ b/crates-tauri/yaak-app/src/models_ext.rs
@@ -15,6 +15,7 @@ use yaak_models::error::Result;
 use yaak_models::models::{AnyModel, GraphQlIntrospection, GrpcEvent, Settings, WebsocketEvent};
 use yaak_models::query_manager::QueryManager;
 use yaak_models::util::UpdateSource;
+use yaak_plugins::manager::PluginManager;

 const MODEL_CHANGES_RETENTION_HOURS: i64 = 1;
 const MODEL_CHANGES_POLL_INTERVAL_MS: u64 = 1000;
@@ -255,23 +256,32 @@ pub(crate) fn models_upsert_graphql_introspection<R: Runtime>(
 }

 #[tauri::command]
-pub(crate) fn models_workspace_models<R: Runtime>(
+pub(crate) async fn models_workspace_models<R: Runtime>(
    window: WebviewWindow<R>,
    workspace_id: Option<&str>,
+    plugin_manager: State<'_, PluginManager>,
 ) -> Result<String> {
-    let db = window.db();
    let mut l: Vec<AnyModel> = Vec::new();

-    // Add the settings
-    l.push(db.get_settings().into());
+    // Add the global models
+    {
+        let db = window.db();
+        l.push(db.get_settings().into());
+        l.append(&mut db.list_workspaces()?.into_iter().map(Into::into).collect());
+        l.append(&mut db.list_key_values()?.into_iter().map(Into::into).collect());
+    }

-    // Add global models
-    l.append(&mut db.list_workspaces()?.into_iter().map(Into::into).collect());
-    l.append(&mut db.list_key_values()?.into_iter().map(Into::into).collect());
-    l.append(&mut db.list_plugins()?.into_iter().map(Into::into).collect());
+    let plugins = {
+        let db = window.db();
+        db.list_plugins()?
+    };
+
+    let plugins = plugin_manager.resolve_plugins_for_runtime_from_db(plugins).await;
+    l.append(&mut plugins.into_iter().map(Into::into).collect());

    // Add the workspace children
    if let Some(wid) = workspace_id {
+        let db = window.db();
        l.append(&mut db.list_cookie_jars(wid)?.into_iter().map(Into::into).collect());
        l.append(&mut db.list_environments_ensure_base(wid)?.into_iter().map(Into::into).collect());
        l.append(&mut db.list_folders(wid)?.into_iter().map(Into::into).collect());
--- a/crates-tauri/yaak-app/src/notifications.rs
+++ b/crates-tauri/yaak-app/src/notifications.rs
@@ -8,7 +8,7 @@ use serde::{Deserialize, Serialize};
 use std::time::Instant;
 use tauri::{AppHandle, Emitter, Manager, Runtime, WebviewWindow};
 use ts_rs::TS;
-use yaak_api::yaak_api_client;
+use yaak_api::{ApiClientKind, yaak_api_client};
 use yaak_common::platform::get_os_str;
 use yaak_models::util::UpdateSource;

@@ -102,7 +102,7 @@ impl YaakNotifier {

        let launch_info = get_or_upsert_launch_info(app_handle);
        let app_version = app_handle.package_info().version.to_string();
-        let req = yaak_api_client(&app_version)?
+        let req = yaak_api_client(ApiClientKind::App, &app_version)?
            .request(Method::GET, "https://notify.yaak.app/notifications")
            .query(&[
                ("version", &launch_info.current_version),
--- a/crates-tauri/yaak-app/src/plugin_events.rs
+++ b/crates-tauri/yaak-app/src/plugin_events.rs
@@ -19,13 +19,13 @@ use yaak::plugin_events::{
    GroupedPluginEvent, HostRequest, SharedPluginEventContext, handle_shared_plugin_event,
 };
 use yaak_crypto::manager::EncryptionManager;
-use yaak_models::models::{AnyModel, HttpResponse, Plugin};
+use yaak_models::models::{HttpResponse, Plugin};
 use yaak_models::queries::any_request::AnyRequest;
 use yaak_models::util::UpdateSource;
 use yaak_plugins::error::Error::PluginErr;
 use yaak_plugins::events::{
-    Color, EmptyPayload, ErrorResponse, FindHttpResponsesResponse, GetCookieValueResponse, Icon,
-    InternalEvent, InternalEventPayload, ListCookieNamesResponse, ListOpenWorkspacesResponse,
+    Color, EmptyPayload, ErrorResponse, GetCookieValueResponse, Icon, InternalEvent,
+    InternalEventPayload, ListCookieNamesResponse, ListOpenWorkspacesResponse,
    RenderGrpcRequestResponse, RenderHttpRequestResponse, SendHttpRequestResponse,
    ShowToastRequest, TemplateRenderResponse, WindowInfoResponse, WindowNavigateEvent,
    WorkspaceInfo,
@@ -118,7 +118,7 @@ async fn handle_host_plugin_request<R: Runtime>(
                    &InternalEventPayload::ShowToastRequest(ShowToastRequest {
                        message: format!("Reloaded plugin {}@{}", info.name, info.version),
                        icon: Some(Icon::Info),
-                        timeout: Some(3000),
+                        timeout: Some(5000),
                        ..Default::default()
                    }),
                    None,
@@ -190,71 +190,6 @@ async fn handle_host_plugin_request<R: Runtime>(
                Ok(None)
            }
        }
-        HostRequest::FindHttpResponses(req) => {
-            let http_responses = app_handle
-                .db()
-                .list_http_responses_for_request(&req.request_id, req.limit.map(|l| l as u64))
-                .unwrap_or_default();
-            Ok(Some(InternalEventPayload::FindHttpResponsesResponse(FindHttpResponsesResponse {
-                http_responses,
-            })))
-        }
-        HostRequest::UpsertModel(req) => {
-            use AnyModel::*;
-            let model = match &req.model {
-                HttpRequest(m) => {
-                    HttpRequest(app_handle.db().upsert_http_request(m, &UpdateSource::Plugin)?)
-                }
-                GrpcRequest(m) => {
-                    GrpcRequest(app_handle.db().upsert_grpc_request(m, &UpdateSource::Plugin)?)
-                }
-                WebsocketRequest(m) => WebsocketRequest(
-                    app_handle.db().upsert_websocket_request(m, &UpdateSource::Plugin)?,
-                ),
-                Folder(m) => Folder(app_handle.db().upsert_folder(m, &UpdateSource::Plugin)?),
-                Environment(m) => {
-                    Environment(app_handle.db().upsert_environment(m, &UpdateSource::Plugin)?)
-                }
-                Workspace(m) => {
-                    Workspace(app_handle.db().upsert_workspace(m, &UpdateSource::Plugin)?)
-                }
-                _ => {
-                    return Err(PluginErr("Upsert not supported for this model type".into()).into());
-                }
-            };
-
-            Ok(Some(InternalEventPayload::UpsertModelResponse(
-                yaak_plugins::events::UpsertModelResponse { model },
-            )))
-        }
-        HostRequest::DeleteModel(req) => {
-            let model = match req.model.as_str() {
-                "http_request" => AnyModel::HttpRequest(
-                    app_handle.db().delete_http_request_by_id(&req.id, &UpdateSource::Plugin)?,
-                ),
-                "grpc_request" => AnyModel::GrpcRequest(
-                    app_handle.db().delete_grpc_request_by_id(&req.id, &UpdateSource::Plugin)?,
-                ),
-                "websocket_request" => AnyModel::WebsocketRequest(
-                    app_handle
-                        .db()
-                        .delete_websocket_request_by_id(&req.id, &UpdateSource::Plugin)?,
-                ),
-                "folder" => AnyModel::Folder(
-                    app_handle.db().delete_folder_by_id(&req.id, &UpdateSource::Plugin)?,
-                ),
-                "environment" => AnyModel::Environment(
-                    app_handle.db().delete_environment_by_id(&req.id, &UpdateSource::Plugin)?,
-                ),
-                _ => {
-                    return Err(PluginErr("Delete not supported for this model type".into()).into());
-                }
-            };
-
-            Ok(Some(InternalEventPayload::DeleteModelResponse(
-                yaak_plugins::events::DeleteModelResponse { model },
-            )))
-        }
        HostRequest::RenderGrpcRequest(req) => {
            let window = get_window_from_plugin_context(app_handle, plugin_context)?;

--- a/crates-tauri/yaak-app/src/plugins_ext.rs
+++ b/crates-tauri/yaak-app/src/plugins_ext.rs
@@ -21,8 +21,9 @@ use tauri::{
 };
 use tokio::sync::Mutex;
 use ts_rs::TS;
-use yaak_api::yaak_api_client;
-use yaak_models::models::Plugin;
+use yaak_api::{ApiClientKind, yaak_api_client};
+use yaak_models::models::{Plugin, PluginSource};
+use yaak_models::util::UpdateSource;
 use yaak_plugins::api::{
    PluginNameVersion, PluginSearchResponse, PluginUpdatesResponse, check_plugin_updates,
    search_plugins,
@@ -72,7 +73,7 @@ impl PluginUpdater {
        info!("Checking for plugin updates");

        let app_version = window.app_handle().package_info().version.to_string();
-        let http_client = yaak_api_client(&app_version)?;
+        let http_client = yaak_api_client(ApiClientKind::App, &app_version)?;
        let plugins = window.app_handle().db().list_plugins()?;
        let updates = check_plugin_updates(&http_client, plugins.clone()).await?;

@@ -137,7 +138,7 @@ pub async fn cmd_plugins_search<R: Runtime>(
    query: &str,
 ) -> Result<PluginSearchResponse> {
    let app_version = app_handle.package_info().version.to_string();
-    let http_client = yaak_api_client(&app_version)?;
+    let http_client = yaak_api_client(ApiClientKind::App, &app_version)?;
    Ok(search_plugins(&http_client, query).await?)
 }

@@ -149,7 +150,7 @@ pub async fn cmd_plugins_install<R: Runtime>(
 ) -> Result<()> {
    let plugin_manager = Arc::new((*window.state::<PluginManager>()).clone());
    let app_version = window.app_handle().package_info().version.to_string();
-    let http_client = yaak_api_client(&app_version)?;
+    let http_client = yaak_api_client(ApiClientKind::App, &app_version)?;
    let query_manager = window.state::<yaak_models::query_manager::QueryManager>();
    let plugin_context = window.plugin_context();
    download_and_install(
@@ -164,6 +165,28 @@ pub async fn cmd_plugins_install<R: Runtime>(
    Ok(())
 }

+#[command]
+pub async fn cmd_plugins_install_from_directory<R: Runtime>(
+    window: WebviewWindow<R>,
+    directory: &str,
+) -> Result<Plugin> {
+    let plugin = window.db().upsert_plugin(
+        &Plugin {
+            directory: directory.into(),
+            url: None,
+            enabled: true,
+            source: PluginSource::Filesystem,
+            ..Default::default()
+        },
+        &UpdateSource::from_window_label(window.label()),
+    )?;
+
+    let plugin_manager = Arc::new((*window.state::<PluginManager>()).clone());
+    plugin_manager.add_plugin(&window.plugin_context(), &plugin).await?;
+
+    Ok(plugin)
+}
+
 #[command]
 pub async fn cmd_plugins_uninstall<R: Runtime>(
    plugin_id: &str,
@@ -175,12 +198,19 @@ pub async fn cmd_plugins_uninstall<R: Runtime>(
    Ok(delete_and_uninstall(plugin_manager, &query_manager, &plugin_context, plugin_id).await?)
 }

+#[command]
+pub async fn cmd_plugin_init_errors(
+    plugin_manager: State<'_, PluginManager>,
+) -> Result<Vec<(String, String)>> {
+    Ok(plugin_manager.take_init_errors().await)
+}
+
 #[command]
 pub async fn cmd_plugins_updates<R: Runtime>(
    app_handle: AppHandle<R>,
 ) -> Result<PluginUpdatesResponse> {
    let app_version = app_handle.package_info().version.to_string();
-    let http_client = yaak_api_client(&app_version)?;
+    let http_client = yaak_api_client(ApiClientKind::App, &app_version)?;
    let plugins = app_handle.db().list_plugins()?;
    Ok(check_plugin_updates(&http_client, plugins).await?)
 }
@@ -190,7 +220,7 @@ pub async fn cmd_plugins_update_all<R: Runtime>(
    window: WebviewWindow<R>,
 ) -> Result<Vec<PluginNameVersion>> {
    let app_version = window.app_handle().package_info().version.to_string();
-    let http_client = yaak_api_client(&app_version)?;
+    let http_client = yaak_api_client(ApiClientKind::App, &app_version)?;
    let plugins = window.db().list_plugins()?;

    // Get list of available updates (already filtered to only registry plugins)
@@ -283,7 +313,7 @@ pub fn init<R: Runtime>() -> TauriPlugin<R> {
                    dev_mode,
                )
                .await
-                .expect("Failed to initialize plugins");
+                .expect("Failed to start plugin runtime");

                app_handle_clone.manage(manager);
            });
--- a/crates-tauri/yaak-app/src/render.rs
+++ b/crates-tauri/yaak-app/src/render.rs
@@ -1,8 +1,6 @@
-use log::info;
 use serde_json::Value;
-use std::collections::BTreeMap;
-pub use yaak::render::render_http_request;
-use yaak_models::models::{Environment, GrpcRequest, HttpRequestHeader};
+pub use yaak::render::{render_grpc_request, render_http_request};
+use yaak_models::models::Environment;
 use yaak_models::render::make_vars_hashmap;
 use yaak_templates::{RenderOptions, TemplateCallback, parse_and_render, render_json_value_raw};

@@ -25,61 +23,3 @@ pub async fn render_json_value<T: TemplateCallback>(
    let vars = &make_vars_hashmap(environment_chain);
    render_json_value_raw(value, vars, cb, opt).await
 }
-
-pub async fn render_grpc_request<T: TemplateCallback>(
-    r: &GrpcRequest,
-    environment_chain: Vec<Environment>,
-    cb: &T,
-    opt: &RenderOptions,
-) -> yaak_templates::error::Result<GrpcRequest> {
-    let vars = &make_vars_hashmap(environment_chain);
-
-    let mut metadata = Vec::new();
-    for p in r.metadata.clone() {
-        if !p.enabled {
-            continue;
-        }
-        metadata.push(HttpRequestHeader {
-            enabled: p.enabled,
-            name: parse_and_render(p.name.as_str(), vars, cb, &opt).await?,
-            value: parse_and_render(p.value.as_str(), vars, cb, &opt).await?,
-            id: p.id,
-        })
-    }
-
-    let authentication = {
-        let mut disabled = false;
-        let mut auth = BTreeMap::new();
-        match r.authentication.get("disabled") {
-            Some(Value::Bool(true)) => {
-                disabled = true;
-            }
-            Some(Value::String(tmpl)) => {
-                disabled = parse_and_render(tmpl.as_str(), vars, cb, &opt)
-                    .await
-                    .unwrap_or_default()
-                    .is_empty();
-                info!(
-                    "Rendering authentication.disabled as a template: {disabled} from \"{tmpl}\""
-                );
-            }
-            _ => {}
-        }
-        if disabled {
-            auth.insert("disabled".to_string(), Value::Bool(true));
-        } else {
-            for (k, v) in r.authentication.clone() {
-                if k == "disabled" {
-                    auth.insert(k, Value::Bool(false));
-                } else {
-                    auth.insert(k, render_json_value_raw(v, vars, cb, &opt).await?);
-                }
-            }
-        }
-        auth
-    };
-
-    let url = parse_and_render(r.url.as_str(), vars, cb, &opt).await?;
-
-    Ok(GrpcRequest { url, metadata, authentication, ..r.to_owned() })
-}
--- a/crates-tauri/yaak-app/src/uri_scheme.rs
+++ b/crates-tauri/yaak-app/src/uri_scheme.rs
@@ -8,7 +8,7 @@ use std::fs;
 use std::sync::Arc;
 use tauri::{AppHandle, Emitter, Manager, Runtime, Url};
 use tauri_plugin_dialog::{DialogExt, MessageDialogButtons, MessageDialogKind};
-use yaak_api::yaak_api_client;
+use yaak_api::{ApiClientKind, yaak_api_client};
 use yaak_models::util::generate_id;
 use yaak_plugins::events::{Color, ShowToastRequest};
 use yaak_plugins::install::download_and_install;
@@ -47,7 +47,7 @@ pub(crate) async fn handle_deep_link<R: Runtime>(
            let plugin_manager = Arc::new((*window.state::<PluginManager>()).clone());
            let query_manager = app_handle.db_manager();
            let app_version = app_handle.package_info().version.to_string();
-            let http_client = yaak_api_client(&app_version)?;
+            let http_client = yaak_api_client(ApiClientKind::App, &app_version)?;
            let plugin_context = window.plugin_context();
            let pv = download_and_install(
                plugin_manager,
@@ -88,7 +88,8 @@ pub(crate) async fn handle_deep_link<R: Runtime>(
                }

                let app_version = app_handle.package_info().version.to_string();
-                let resp = yaak_api_client(&app_version)?.get(file_url).send().await?;
+                let resp =
+                    yaak_api_client(ApiClientKind::App, &app_version)?.get(file_url).send().await?;
                let json = resp.bytes().await?;
                let p = app_handle
                    .path()
--- a/crates-tauri/yaak-app/src/ws_ext.rs
+++ b/crates-tauri/yaak-app/src/ws_ext.rs
@@ -24,6 +24,7 @@ use yaak_models::util::UpdateSource;
 use yaak_plugins::events::{CallHttpAuthenticationRequest, HttpHeader, RenderPurpose};
 use yaak_plugins::manager::PluginManager;
 use yaak_plugins::template_callback::PluginTemplateCallback;
+use yaak_templates::strip_json_comments::maybe_strip_json_comments;
 use yaak_templates::{RenderErrorBehavior, RenderOptions};
 use yaak_tls::find_client_certificate;
 use yaak_ws::{WebsocketManager, render_websocket_request};
@@ -72,8 +73,10 @@ pub async fn cmd_ws_send<R: Runtime>(
    )
    .await?;

+    let message = maybe_strip_json_comments(&request.message);
+
    let mut ws_manager = ws_manager.lock().await;
-    ws_manager.send(&connection.id, Message::Text(request.message.clone().into())).await?;
+    ws_manager.send(&connection.id, Message::Text(message.clone().into())).await?;

    app_handle.db().upsert_websocket_event(
        &WebsocketEvent {
@@ -82,7 +85,7 @@ pub async fn cmd_ws_send<R: Runtime>(
            workspace_id: connection.workspace_id.clone(),
            is_server: false,
            message_type: WebsocketEventType::Text,
-            message: request.message.into(),
+            message: message.into(),
            ..Default::default()
        },
        &UpdateSource::from_window_label(window.label()),
--- a/crates-tauri/yaak-app/tauri.conf.json
+++ b/crates-tauri/yaak-app/tauri.conf.json
@@ -14,10 +14,7 @@
      "assetProtocol": {
        "enable": true,
        "scope": {
-          "allow": [
-            "$APPDATA/responses/*",
-            "$RESOURCE/static/*"
-          ]
+          "allow": ["$APPDATA/responses/*", "$RESOURCE/static/*"]
        }
      }
    }
@@ -25,9 +22,7 @@
  "plugins": {
    "deep-link": {
      "desktop": {
-        "schemes": [
-          "yaak"
-        ]
+        "schemes": ["yaak"]
      }
    }
  },
--- a/crates-tauri/yaak-app/tauri.release.conf.json
+++ b/crates-tauri/yaak-app/tauri.release.conf.json
@@ -16,9 +16,7 @@
  },
  "plugins": {
    "updater": {
-      "endpoints": [
-        "https://update.yaak.app/check/{{target}}/{{arch}}/{{current_version}}"
-      ],
+      "endpoints": ["https://update.yaak.app/check/{{target}}/{{arch}}/{{current_version}}"],
      "pubkey": "dW50cnVzdGVkIGNvbW1lbnQ6IG1pbmlzaWduIHB1YmxpYyBrZXk6IEVGRkFGMjQxRUNEOTQ3MzAKUldRd1I5bnNRZkw2NzRtMnRlWTN3R24xYUR3aGRsUjJzWGwvdHdEcGljb3ZJMUNlMjFsaHlqVU4K"
    }
  },
--- a/crates-tauri/yaak-fonts/index.ts
+++ b/crates-tauri/yaak-fonts/index.ts
@@ -1,14 +1,14 @@
-import { useQuery } from '@tanstack/react-query';
-import { invoke } from '@tauri-apps/api/core';
-import { Fonts } from './bindings/gen_fonts';
+import { useQuery } from "@tanstack/react-query";
+import { invoke } from "@tauri-apps/api/core";
+import { Fonts } from "./bindings/gen_fonts";

 export async function listFonts() {
-  return invoke<Fonts>('plugin:yaak-fonts|list', {});
+  return invoke<Fonts>("plugin:yaak-fonts|list", {});
 }

 export function useFonts() {
  return useQuery({
-    queryKey: ['list_fonts'],
+    queryKey: ["list_fonts"],
    queryFn: () => listFonts(),
  });
 }
--- a/crates-tauri/yaak-fonts/package.json
+++ b/crates-tauri/yaak-fonts/package.json
@@ -1,6 +1,6 @@
 {
  "name": "@yaakapp-internal/fonts",
-  "private": true,
  "version": "1.0.0",
+  "private": true,
  "main": "index.ts"
 }
--- a/crates-tauri/yaak-license/index.ts
+++ b/crates-tauri/yaak-license/index.ts
@@ -1,35 +1,35 @@
-import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query';
-import { invoke } from '@tauri-apps/api/core';
-import { listen } from '@tauri-apps/api/event';
-import { appInfo } from '@yaakapp/app/lib/appInfo';
-import { useEffect } from 'react';
-import { LicenseCheckStatus } from './bindings/license';
+import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
+import { invoke } from "@tauri-apps/api/core";
+import { listen } from "@tauri-apps/api/event";
+import { appInfo } from "@yaakapp/app/lib/appInfo";
+import { useEffect } from "react";
+import { LicenseCheckStatus } from "./bindings/license";

-export * from './bindings/license';
+export * from "./bindings/license";

-const CHECK_QUERY_KEY = ['license.check'];
+const CHECK_QUERY_KEY = ["license.check"];

 export function useLicense() {
  const queryClient = useQueryClient();
  const activate = useMutation<void, string, { licenseKey: string }>({
-    mutationKey: ['license.activate'],
-    mutationFn: (payload) => invoke('plugin:yaak-license|activate', payload),
+    mutationKey: ["license.activate"],
+    mutationFn: (payload) => invoke("plugin:yaak-license|activate", payload),
    onSuccess: () => queryClient.invalidateQueries({ queryKey: CHECK_QUERY_KEY }),
  });

  const deactivate = useMutation<void, string, void>({
-    mutationKey: ['license.deactivate'],
-    mutationFn: () => invoke('plugin:yaak-license|deactivate'),
+    mutationKey: ["license.deactivate"],
+    mutationFn: () => invoke("plugin:yaak-license|deactivate"),
    onSuccess: () => queryClient.invalidateQueries({ queryKey: CHECK_QUERY_KEY }),
  });

  // Check the license again after a license is activated
  useEffect(() => {
-    const unlisten = listen('license-activated', async () => {
+    const unlisten = listen("license-activated", async () => {
      await queryClient.invalidateQueries({ queryKey: CHECK_QUERY_KEY });
    });
    return () => {
-      unlisten.then((fn) => fn());
+      void unlisten.then((fn) => fn());
    };
  }, []);

@@ -41,7 +41,7 @@ export function useLicense() {
      if (!appInfo.featureLicense) {
        return null;
      }
-      return invoke<LicenseCheckStatus>('plugin:yaak-license|check');
+      return invoke<LicenseCheckStatus>("plugin:yaak-license|check");
    },
  });

--- a/crates-tauri/yaak-license/package.json
+++ b/crates-tauri/yaak-license/package.json
@@ -1,6 +1,6 @@
 {
  "name": "@yaakapp-internal/license",
-  "private": true,
  "version": "1.0.0",
+  "private": true,
  "main": "index.ts"
 }
--- a/crates-tauri/yaak-license/src/license.rs
+++ b/crates-tauri/yaak-license/src/license.rs
@@ -7,7 +7,7 @@ use std::ops::Add;
 use std::time::Duration;
 use tauri::{AppHandle, Emitter, Manager, Runtime, WebviewWindow, is_dev};
 use ts_rs::TS;
-use yaak_api::yaak_api_client;
+use yaak_api::{ApiClientKind, yaak_api_client};
 use yaak_common::platform::get_os_str;
 use yaak_models::db_context::DbContext;
 use yaak_models::query_manager::QueryManager;
@@ -119,7 +119,7 @@ pub async fn activate_license<R: Runtime>(
 ) -> Result<()> {
    info!("Activating license {}", license_key);
    let app_version = window.app_handle().package_info().version.to_string();
-    let client = yaak_api_client(&app_version)?;
+    let client = yaak_api_client(ApiClientKind::App, &app_version)?;
    let payload = ActivateLicenseRequestPayload {
        license_key: license_key.to_string(),
        app_platform: get_os_str().to_string(),
@@ -157,7 +157,7 @@ pub async fn deactivate_license<R: Runtime>(window: &WebviewWindow<R>) -> Result
    let activation_id = get_activation_id(app_handle).await;

    let app_version = window.app_handle().package_info().version.to_string();
-    let client = yaak_api_client(&app_version)?;
+    let client = yaak_api_client(ApiClientKind::App, &app_version)?;
    let path = format!("/licenses/activations/{}/deactivate", activation_id);
    let payload =
        DeactivateLicenseRequestPayload { app_platform: get_os_str().to_string(), app_version };
@@ -203,7 +203,7 @@ pub async fn check_license<R: Runtime>(window: &WebviewWindow<R>) -> Result<Lice
        (true, _) => {
            info!("Checking license activation");
            // A license has been activated, so let's check the license server
-            let client = yaak_api_client(&payload.app_version)?;
+            let client = yaak_api_client(ApiClientKind::App, &payload.app_version)?;
            let path = format!("/licenses/activations/{activation_id}/check-v2");
            let response = client.post(build_url(&path)).json(&payload).send().await?;

--- a/crates-tauri/yaak-mac-window/index.ts
+++ b/crates-tauri/yaak-mac-window/index.ts
@@ -1,9 +1,9 @@
-import { invoke } from '@tauri-apps/api/core';
+import { invoke } from "@tauri-apps/api/core";

 export function setWindowTitle(title: string) {
-  invoke('plugin:yaak-mac-window|set_title', { title }).catch(console.error);
+  invoke("plugin:yaak-mac-window|set_title", { title }).catch(console.error);
 }

 export function setWindowTheme(bgColor: string) {
-  invoke('plugin:yaak-mac-window|set_theme', { bgColor }).catch(console.error);
+  invoke("plugin:yaak-mac-window|set_theme", { bgColor }).catch(console.error);
 }
--- a/crates-tauri/yaak-mac-window/package.json
+++ b/crates-tauri/yaak-mac-window/package.json
@@ -1,6 +1,6 @@
 {
  "name": "@yaakapp-internal/mac-window",
-  "private": true,
  "version": "1.0.0",
+  "private": true,
  "main": "index.ts"
 }
--- a/crates-tauri/yaak-mac-window/permissions/default.toml
+++ b/crates-tauri/yaak-mac-window/permissions/default.toml
@@ -1,6 +1,3 @@
 [default]
 description = "Default permissions for the plugin"
-permissions = [
-    "allow-set-title",
-    "allow-set-theme",
-]
+permissions = ["allow-set-title", "allow-set-theme"]
--- a/crates-tauri/yaak-mac-window/src/mac.rs
+++ b/crates-tauri/yaak-mac-window/src/mac.rs
@@ -12,6 +12,11 @@ unsafe impl Sync for UnsafeWindowHandle {}

 const WINDOW_CONTROL_PAD_X: f64 = 13.0;
 const WINDOW_CONTROL_PAD_Y: f64 = 18.0;
+/// Extra pixels to add to the title bar height when the default title bar is
+/// already as tall as button_height + PAD_Y (i.e. macOS Tahoe 26+, where the
+/// default is 32px and 14 + 18 = 32). On pre-Tahoe this is unused because the
+/// default title bar is shorter than button_height + PAD_Y.
+const TITLEBAR_EXTRA_HEIGHT: f64 = 4.0;
 const MAIN_WINDOW_PREFIX: &str = "main_";

 pub(crate) fn update_window_title<R: Runtime>(window: Window<R>, title: String) {
@@ -95,12 +100,29 @@ fn position_traffic_lights(ns_window_handle: UnsafeWindowHandle, x: f64, y: f64,
            ns_window.standardWindowButton_(NSWindowButton::NSWindowMiniaturizeButton);
        let zoom = ns_window.standardWindowButton_(NSWindowButton::NSWindowZoomButton);

-        let title_bar_container_view = close.superview().superview();
-
        let close_rect: NSRect = msg_send![close, frame];
        let button_height = close_rect.size.height;

-        let title_bar_frame_height = button_height + y;
+        let title_bar_container_view = close.superview().superview();
+
+        // Capture the OS default title bar height on the first call, before
+        // we've modified it. This avoids the height growing on repeated calls.
+        use std::sync::OnceLock;
+        static DEFAULT_TITLEBAR_HEIGHT: OnceLock<f64> = OnceLock::new();
+        let default_height =
+            *DEFAULT_TITLEBAR_HEIGHT.get_or_init(|| NSView::frame(title_bar_container_view).size.height);
+
+        // On pre-Tahoe, button_height + y is larger than the default title bar
+        // height, so the resize works as before. On Tahoe (26+), the default is
+        // already 32px and button_height + y = 32, so nothing changes. In that
+        // case, add TITLEBAR_EXTRA_HEIGHT extra pixels to push the buttons down.
+        let desired = button_height + y;
+        let title_bar_frame_height = if desired > default_height {
+            desired
+        } else {
+            default_height + TITLEBAR_EXTRA_HEIGHT
+        };
+
        let mut title_bar_rect = NSView::frame(title_bar_container_view);
        title_bar_rect.size.height = title_bar_frame_height;
        title_bar_rect.origin.y = NSView::frame(ns_window).size.height - title_bar_frame_height;
--- a/crates/yaak-api/src/lib.rs
+++ b/crates/yaak-api/src/lib.rs
@@ -8,14 +8,24 @@ use reqwest::header::{HeaderMap, HeaderValue};
 use std::time::Duration;
 use yaak_common::platform::{get_ua_arch, get_ua_platform};

+#[derive(Debug, Clone, Copy, Eq, PartialEq)]
+pub enum ApiClientKind {
+    App,
+    Cli,
+}
+
 /// Build a reqwest Client configured for Yaak's own API calls.
 ///
 /// Includes a custom User-Agent, JSON accept header, 20s timeout, gzip,
 /// and automatic OS-level proxy detection via sysproxy.
-pub fn yaak_api_client(version: &str) -> Result<Client> {
+pub fn yaak_api_client(kind: ApiClientKind, version: &str) -> Result<Client> {
    let platform = get_ua_platform();
    let arch = get_ua_arch();
-    let ua = format!("Yaak/{version} ({platform}; {arch})");
+    let product = match kind {
+        ApiClientKind::App => "Yaak",
+        ApiClientKind::Cli => "YaakCli",
+    };
+    let ua = format!("{product}/{version} ({platform}; {arch})");

    let mut default_headers = HeaderMap::new();
    default_headers.insert("Accept", HeaderValue::from_str("application/json").unwrap());
--- a/crates/yaak-common/src/command.rs
+++ b/crates/yaak-common/src/command.rs
@@ -1,4 +1,6 @@
-use std::ffi::OsStr;
+use std::ffi::{OsStr, OsString};
+use std::io::{self, ErrorKind};
+use std::process::Stdio;

 #[cfg(target_os = "windows")]
 const CREATE_NO_WINDOW: u32 = 0x0800_0000;
@@ -14,3 +16,27 @@ pub fn new_xplatform_command<S: AsRef<OsStr>>(program: S) -> tokio::process::Com
    }
    cmd
 }
+
+/// Creates a command only if the binary exists and can be invoked with the given probe argument.
+pub async fn new_checked_command<S: AsRef<OsStr>>(
+    program: S,
+    probe_arg: &str,
+) -> io::Result<tokio::process::Command> {
+    let program: OsString = program.as_ref().to_os_string();
+
+    let mut probe = new_xplatform_command(&program);
+    probe.arg(probe_arg).stdin(Stdio::null()).stdout(Stdio::null()).stderr(Stdio::null());
+
+    let status = probe.status().await?;
+    if !status.success() {
+        return Err(io::Error::new(
+            ErrorKind::NotFound,
+            format!(
+                "'{}' is not available on PATH or failed to execute",
+                program.to_string_lossy()
+            ),
+        ));
+    }
+
+    Ok(new_xplatform_command(&program))
+}
--- a/crates/yaak-common/src/serde.rs
+++ b/crates/yaak-common/src/serde.rs
@@ -21,3 +21,10 @@ pub fn get_str_map<'a>(v: &'a BTreeMap<String, Value>, key: &str) -> &'a str {
        Some(v) => v.as_str().unwrap_or_default(),
    }
 }
+
+pub fn get_bool_map(v: &BTreeMap<String, Value>, key: &str, fallback: bool) -> bool {
+    match v.get(key) {
+        None => fallback,
+        Some(v) => v.as_bool().unwrap_or(fallback),
+    }
+}
--- a/crates/yaak-crypto/index.ts
+++ b/crates/yaak-crypto/index.ts
@@ -1,17 +1,17 @@
-import { invoke } from '@tauri-apps/api/core';
+import { invoke } from "@tauri-apps/api/core";

 export function enableEncryption(workspaceId: string) {
-  return invoke<void>('cmd_enable_encryption', { workspaceId });
+  return invoke<void>("cmd_enable_encryption", { workspaceId });
 }

 export function revealWorkspaceKey(workspaceId: string) {
-  return invoke<string>('cmd_reveal_workspace_key', { workspaceId });
+  return invoke<string>("cmd_reveal_workspace_key", { workspaceId });
 }

 export function setWorkspaceKey(args: { workspaceId: string; key: string }) {
-  return invoke<void>('cmd_set_workspace_key', args);
+  return invoke<void>("cmd_set_workspace_key", args);
 }

 export function disableEncryption(workspaceId: string) {
-  return invoke<void>('cmd_disable_encryption', { workspaceId });
+  return invoke<void>("cmd_disable_encryption", { workspaceId });
 }
--- a/crates/yaak-crypto/package.json
+++ b/crates/yaak-crypto/package.json
@@ -1,6 +1,6 @@
 {
  "name": "@yaakapp-internal/crypto",
-  "private": true,
  "version": "1.0.0",
+  "private": true,
  "main": "index.ts"
 }
--- a/crates/yaak-git/index.ts
+++ b/crates/yaak-git/index.ts
@@ -1,60 +1,66 @@
-import { useQuery } from '@tanstack/react-query';
-import { invoke } from '@tauri-apps/api/core';
-import { createFastMutation } from '@yaakapp/app/hooks/useFastMutation';
-import { queryClient } from '@yaakapp/app/lib/queryClient';
-import { useMemo } from 'react';
-import { BranchDeleteResult, CloneResult, GitCommit, GitRemote, GitStatusSummary, PullResult, PushResult } from './bindings/gen_git';
-import { showToast } from '@yaakapp/app/lib/toast';
+import { useQuery } from "@tanstack/react-query";
+import { invoke } from "@tauri-apps/api/core";
+import { createFastMutation } from "@yaakapp/app/hooks/useFastMutation";
+import { queryClient } from "@yaakapp/app/lib/queryClient";
+import { useMemo } from "react";
+import {
+  BranchDeleteResult,
+  CloneResult,
+  GitCommit,
+  GitRemote,
+  GitStatusSummary,
+  PullResult,
+  PushResult,
+} from "./bindings/gen_git";
+import { showToast } from "@yaakapp/app/lib/toast";

-export * from './bindings/gen_git';
-export * from './bindings/gen_models';
+export * from "./bindings/gen_git";
+export * from "./bindings/gen_models";

 export interface GitCredentials {
  username: string;
  password: string;
 }

-export type DivergedStrategy = 'force_reset' | 'merge' | 'cancel';
+export type DivergedStrategy = "force_reset" | "merge" | "cancel";

-export type UncommittedChangesStrategy = 'reset' | 'cancel';
+export type UncommittedChangesStrategy = "reset" | "cancel";

 export interface GitCallbacks {
  addRemote: () => Promise<GitRemote | null>;
  promptCredentials: (
-    result: Extract<PushResult, { type: 'needs_credentials' }>,
+    result: Extract<PushResult, { type: "needs_credentials" }>,
  ) => Promise<GitCredentials | null>;
-  promptDiverged: (
-    result: Extract<PullResult, { type: 'diverged' }>,
-  ) => Promise<DivergedStrategy>;
+  promptDiverged: (result: Extract<PullResult, { type: "diverged" }>) => Promise<DivergedStrategy>;
  promptUncommittedChanges: () => Promise<UncommittedChangesStrategy>;
  forceSync: () => Promise<void>;
 }

-const onSuccess = () => queryClient.invalidateQueries({ queryKey: ['git'] });
+const onSuccess = () => queryClient.invalidateQueries({ queryKey: ["git"] });

 export function useGit(dir: string, callbacks: GitCallbacks, refreshKey?: string) {
  const mutations = useMemo(() => gitMutations(dir, callbacks), [dir, callbacks]);
  const fetchAll = useQuery<void, string>({
-    queryKey: ['git', 'fetch_all', dir, refreshKey],
-    queryFn: () => invoke('cmd_git_fetch_all', { dir }),
+    queryKey: ["git", "fetch_all", dir, refreshKey],
+    queryFn: () => invoke("cmd_git_fetch_all", { dir }),
    refetchInterval: 10 * 60_000,
  });
  return [
    {
      remotes: useQuery<GitRemote[], string>({
-        queryKey: ['git', 'remotes', dir, refreshKey],
+        queryKey: ["git", "remotes", dir, refreshKey],
        queryFn: () => getRemotes(dir),
        placeholderData: (prev) => prev,
      }),
      log: useQuery<GitCommit[], string>({
-        queryKey: ['git', 'log', dir, refreshKey],
-        queryFn: () => invoke('cmd_git_log', { dir }),
+        queryKey: ["git", "log", dir, refreshKey],
+        queryFn: () => invoke("cmd_git_log", { dir }),
        placeholderData: (prev) => prev,
      }),
      status: useQuery<GitStatusSummary, string>({
        refetchOnMount: true,
-        queryKey: ['git', 'status', dir, refreshKey, fetchAll.dataUpdatedAt],
-        queryFn: () => invoke('cmd_git_status', { dir }),
+        queryKey: ["git", "status", dir, refreshKey, fetchAll.dataUpdatedAt],
+        queryFn: () => invoke("cmd_git_status", { dir }),
        placeholderData: (prev) => prev,
      }),
    },
@@ -67,151 +73,167 @@ export const gitMutations = (dir: string, callbacks: GitCallbacks) => {
    const remotes = await getRemotes(dir);
    if (remotes.length === 0) {
      const remote = await callbacks.addRemote();
-      if (remote == null) throw new Error('No remote found');
+      if (remote == null) throw new Error("No remote found");
    }

-    const result = await invoke<PushResult>('cmd_git_push', { dir });
-    if (result.type !== 'needs_credentials') return result;
+    const result = await invoke<PushResult>("cmd_git_push", { dir });
+    if (result.type !== "needs_credentials") return result;

    // Needs credentials, prompt for them
    const creds = await callbacks.promptCredentials(result);
-    if (creds == null) throw new Error('Canceled');
+    if (creds == null) throw new Error("Canceled");

-    await invoke('cmd_git_add_credential', {
+    await invoke("cmd_git_add_credential", {
      remoteUrl: result.url,
      username: creds.username,
      password: creds.password,
    });

    // Push again
-    return invoke<PushResult>('cmd_git_push', { dir });
+    return invoke<PushResult>("cmd_git_push", { dir });
  };

  const handleError = (err: unknown) => {
    showToast({
-      id: `${err}`,
-      message: `${err}`,
-      color: 'danger',
+      id: err instanceof Error ? err.message : String(err),
+      message: err instanceof Error ? err.message : String(err),
+      color: "danger",
      timeout: 5000,
    });
-  }
+  };

  return {
    init: createFastMutation<void, string, void>({
-      mutationKey: ['git', 'init'],
-      mutationFn: () => invoke('cmd_git_initialize', { dir }),
+      mutationKey: ["git", "init"],
+      mutationFn: () => invoke("cmd_git_initialize", { dir }),
      onSuccess,
    }),
    add: createFastMutation<void, string, { relaPaths: string[] }>({
-      mutationKey: ['git', 'add', dir],
-      mutationFn: (args) => invoke('cmd_git_add', { dir, ...args }),
+      mutationKey: ["git", "add", dir],
+      mutationFn: (args) => invoke("cmd_git_add", { dir, ...args }),
      onSuccess,
    }),
    addRemote: createFastMutation<GitRemote, string, GitRemote>({
-      mutationKey: ['git', 'add-remote'],
-      mutationFn: (args) => invoke('cmd_git_add_remote', { dir, ...args }),
+      mutationKey: ["git", "add-remote"],
+      mutationFn: (args) => invoke("cmd_git_add_remote", { dir, ...args }),
      onSuccess,
    }),
    rmRemote: createFastMutation<void, string, { name: string }>({
-      mutationKey: ['git', 'rm-remote', dir],
-      mutationFn: (args) => invoke('cmd_git_rm_remote', { dir, ...args }),
+      mutationKey: ["git", "rm-remote", dir],
+      mutationFn: (args) => invoke("cmd_git_rm_remote", { dir, ...args }),
      onSuccess,
    }),
    createBranch: createFastMutation<void, string, { branch: string; base?: string }>({
-      mutationKey: ['git', 'branch', dir],
-      mutationFn: (args) => invoke('cmd_git_branch', { dir, ...args }),
+      mutationKey: ["git", "branch", dir],
+      mutationFn: (args) => invoke("cmd_git_branch", { dir, ...args }),
      onSuccess,
    }),
    mergeBranch: createFastMutation<void, string, { branch: string }>({
-      mutationKey: ['git', 'merge', dir],
-      mutationFn: (args) => invoke('cmd_git_merge_branch', { dir, ...args }),
+      mutationKey: ["git", "merge", dir],
+      mutationFn: (args) => invoke("cmd_git_merge_branch", { dir, ...args }),
      onSuccess,
    }),
-    deleteBranch: createFastMutation<BranchDeleteResult, string, { branch: string, force?: boolean }>({
-      mutationKey: ['git', 'delete-branch', dir],
-      mutationFn: (args) => invoke('cmd_git_delete_branch', { dir, ...args }),
+    deleteBranch: createFastMutation<
+      BranchDeleteResult,
+      string,
+      { branch: string; force?: boolean }
+    >({
+      mutationKey: ["git", "delete-branch", dir],
+      mutationFn: (args) => invoke("cmd_git_delete_branch", { dir, ...args }),
      onSuccess,
    }),
    deleteRemoteBranch: createFastMutation<void, string, { branch: string }>({
-      mutationKey: ['git', 'delete-remote-branch', dir],
-      mutationFn: (args) => invoke('cmd_git_delete_remote_branch', { dir, ...args }),
+      mutationKey: ["git", "delete-remote-branch", dir],
+      mutationFn: (args) => invoke("cmd_git_delete_remote_branch", { dir, ...args }),
      onSuccess,
    }),
-    renameBranch: createFastMutation<void, string, { oldName: string, newName: string }>({
-      mutationKey: ['git', 'rename-branch', dir],
-      mutationFn: (args) => invoke('cmd_git_rename_branch', { dir, ...args }),
+    renameBranch: createFastMutation<void, string, { oldName: string; newName: string }>({
+      mutationKey: ["git", "rename-branch", dir],
+      mutationFn: (args) => invoke("cmd_git_rename_branch", { dir, ...args }),
      onSuccess,
    }),
    checkout: createFastMutation<string, string, { branch: string; force: boolean }>({
-      mutationKey: ['git', 'checkout', dir],
-      mutationFn: (args) => invoke('cmd_git_checkout', { dir, ...args }),
+      mutationKey: ["git", "checkout", dir],
+      mutationFn: (args) => invoke("cmd_git_checkout", { dir, ...args }),
      onSuccess,
    }),
    commit: createFastMutation<void, string, { message: string }>({
-      mutationKey: ['git', 'commit', dir],
-      mutationFn: (args) => invoke('cmd_git_commit', { dir, ...args }),
+      mutationKey: ["git", "commit", dir],
+      mutationFn: (args) => invoke("cmd_git_commit", { dir, ...args }),
      onSuccess,
    }),
    commitAndPush: createFastMutation<PushResult, string, { message: string }>({
-      mutationKey: ['git', 'commit_push', dir],
+      mutationKey: ["git", "commit_push", dir],
      mutationFn: async (args) => {
-        await invoke('cmd_git_commit', { dir, ...args });
+        await invoke("cmd_git_commit", { dir, ...args });
        return push();
      },
      onSuccess,
    }),

    push: createFastMutation<PushResult, string, void>({
-      mutationKey: ['git', 'push', dir],
+      mutationKey: ["git", "push", dir],
      mutationFn: push,
      onSuccess,
    }),
    pull: createFastMutation<PullResult, string, void>({
-      mutationKey: ['git', 'pull', dir],
+      mutationKey: ["git", "pull", dir],
      async mutationFn() {
-        const result = await invoke<PullResult>('cmd_git_pull', { dir });
+        const result = await invoke<PullResult>("cmd_git_pull", { dir });

-        if (result.type === 'needs_credentials') {
+        if (result.type === "needs_credentials") {
          const creds = await callbacks.promptCredentials(result);
-          if (creds == null) throw new Error('Canceled');
+          if (creds == null) throw new Error("Canceled");

-          await invoke('cmd_git_add_credential', {
+          await invoke("cmd_git_add_credential", {
            remoteUrl: result.url,
            username: creds.username,
            password: creds.password,
          });

          // Pull again after credentials
-          return invoke<PullResult>('cmd_git_pull', { dir });
+          return invoke<PullResult>("cmd_git_pull", { dir });
        }

-        if (result.type === 'uncommitted_changes') {
-          callbacks.promptUncommittedChanges().then(async (strategy) => {
-            if (strategy === 'cancel') return;
+        if (result.type === "uncommitted_changes") {
+          void callbacks
+            .promptUncommittedChanges()
+            .then(async (strategy) => {
+              if (strategy === "cancel") return;

-            await invoke('cmd_git_reset_changes', { dir });
-            return invoke<PullResult>('cmd_git_pull', { dir });
-          }).then(async () => { onSuccess(); await callbacks.forceSync(); }, handleError);
+              await invoke("cmd_git_reset_changes", { dir });
+              return invoke<PullResult>("cmd_git_pull", { dir });
+            })
+            .then(async () => {
+              await onSuccess();
+              await callbacks.forceSync();
+            }, handleError);
        }

-        if (result.type === 'diverged') {
-          callbacks.promptDiverged(result).then((strategy) => {
-            if (strategy === 'cancel') return;
+        if (result.type === "diverged") {
+          void callbacks
+            .promptDiverged(result)
+            .then((strategy) => {
+              if (strategy === "cancel") return;

-            if (strategy === 'force_reset') {
-              return invoke<PullResult>('cmd_git_pull_force_reset', {
+              if (strategy === "force_reset") {
+                return invoke<PullResult>("cmd_git_pull_force_reset", {
+                  dir,
+                  remote: result.remote,
+                  branch: result.branch,
+                });
+              }
+
+              return invoke<PullResult>("cmd_git_pull_merge", {
                dir,
                remote: result.remote,
                branch: result.branch,
              });
-            }
-
-            return invoke<PullResult>('cmd_git_pull_merge', {
-              dir,
-              remote: result.remote,
-              branch: result.branch,
-            });
-          }).then(async () => { onSuccess(); await callbacks.forceSync(); }, handleError);
+            })
+            .then(async () => {
+              await onSuccess();
+              await callbacks.forceSync();
+            }, handleError);
        }

        return result;
@@ -219,20 +241,20 @@ export const gitMutations = (dir: string, callbacks: GitCallbacks) => {
      onSuccess,
    }),
    unstage: createFastMutation<void, string, { relaPaths: string[] }>({
-      mutationKey: ['git', 'unstage', dir],
-      mutationFn: (args) => invoke('cmd_git_unstage', { dir, ...args }),
+      mutationKey: ["git", "unstage", dir],
+      mutationFn: (args) => invoke("cmd_git_unstage", { dir, ...args }),
      onSuccess,
    }),
    resetChanges: createFastMutation<void, string, void>({
-      mutationKey: ['git', 'reset-changes', dir],
-      mutationFn: () => invoke('cmd_git_reset_changes', { dir }),
+      mutationKey: ["git", "reset-changes", dir],
+      mutationFn: () => invoke("cmd_git_reset_changes", { dir }),
      onSuccess,
    }),
  } as const;
 };

 async function getRemotes(dir: string) {
-  return invoke<GitRemote[]>('cmd_git_remotes', { dir });
+  return invoke<GitRemote[]>("cmd_git_remotes", { dir });
 }

 /**
@@ -241,21 +263,24 @@ async function getRemotes(dir: string) {
 export async function gitClone(
  url: string,
  dir: string,
-  promptCredentials: (args: { url: string; error: string | null }) => Promise<GitCredentials | null>,
+  promptCredentials: (args: {
+    url: string;
+    error: string | null;
+  }) => Promise<GitCredentials | null>,
 ): Promise<CloneResult> {
-  const result = await invoke<CloneResult>('cmd_git_clone', { url, dir });
-  if (result.type !== 'needs_credentials') return result;
+  const result = await invoke<CloneResult>("cmd_git_clone", { url, dir });
+  if (result.type !== "needs_credentials") return result;

  // Prompt for credentials
  const creds = await promptCredentials({ url: result.url, error: result.error });
-  if (creds == null) return {type: 'cancelled'};
+  if (creds == null) return { type: "cancelled" };

  // Store credentials and retry
-  await invoke('cmd_git_add_credential', {
+  await invoke("cmd_git_add_credential", {
    remoteUrl: result.url,
    username: creds.username,
    password: creds.password,
  });

-  return invoke<CloneResult>('cmd_git_clone', { url, dir });
+  return invoke<CloneResult>("cmd_git_clone", { url, dir });
 }
--- a/crates/yaak-git/package.json
+++ b/crates/yaak-git/package.json
@@ -1,6 +1,6 @@
 {
  "name": "@yaakapp-internal/git",
-  "private": true,
  "version": "1.0.0",
+  "private": true,
  "main": "index.ts"
 }
--- a/crates/yaak-git/src/binary.rs
+++ b/crates/yaak-git/src/binary.rs
@@ -1,9 +1,8 @@
 use crate::error::Error::GitNotFound;
 use crate::error::Result;
 use std::path::Path;
-use std::process::Stdio;
 use tokio::process::Command;
-use yaak_common::command::new_xplatform_command;
+use yaak_common::command::new_checked_command;

 /// Create a git command that runs in the specified directory
 pub(crate) async fn new_binary_command(dir: &Path) -> Result<Command> {
@@ -14,17 +13,5 @@ pub(crate) async fn new_binary_command(dir: &Path) -> Result<Command> {

 /// Create a git command without a specific directory (for global operations)
 pub(crate) async fn new_binary_command_global() -> Result<Command> {
-    // 1. Probe that `git` exists and is runnable
-    let mut probe = new_xplatform_command("git");
-    probe.arg("--version").stdin(Stdio::null()).stdout(Stdio::null()).stderr(Stdio::null());
-
-    let status = probe.status().await.map_err(|_| GitNotFound)?;
-
-    if !status.success() {
-        return Err(GitNotFound);
-    }
-
-    // 2. Build the reusable git command
-    let cmd = new_xplatform_command("git");
-    Ok(cmd)
+    new_checked_command("git", "--version").await.map_err(|_| GitNotFound)
 }
--- a/crates/yaak-http/Cargo.toml
+++ b/crates/yaak-http/Cargo.toml
@@ -19,7 +19,12 @@ hyper-util = { version = "0.1.17", default-features = false, features = ["client
 log = { workspace = true }
 mime_guess = "2.0.5"
 regex = "1.11.1"
-reqwest = { workspace = true, features = ["rustls-tls-manual-roots-no-provider", "socks", "http2", "stream"] }
+reqwest = { workspace = true, features = [
+  "rustls-tls-manual-roots-no-provider",
+  "socks",
+  "http2",
+  "stream",
+] }
 serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true }
 thiserror = { workspace = true }
@@ -29,4 +34,5 @@ tower-service = "0.3.3"
 urlencoding = "2.1.3"
 yaak-common = { workspace = true }
 yaak-models = { workspace = true }
+yaak-templates = { workspace = true }
 yaak-tls = { workspace = true }
--- a/crates/yaak-http/src/manager.rs
+++ b/crates/yaak-http/src/manager.rs
@@ -1,7 +1,6 @@
 use crate::client::HttpConnectionOptions;
 use crate::dns::LocalhostResolver;
 use crate::error::Result;
-use log::info;
 use reqwest::Client;
 use std::collections::BTreeMap;
 use std::sync::Arc;
--- a/crates/yaak-http/src/sender.rs
+++ b/crates/yaak-http/src/sender.rs
@@ -30,6 +30,8 @@ pub enum HttpResponseEvent {
        url: String,
        status: u16,
        behavior: RedirectBehavior,
+        dropped_body: bool,
+        dropped_headers: Vec<String>,
    },
    SendUrl {
        method: String,
@@ -67,12 +69,28 @@ impl Display for HttpResponseEvent {
        match self {
            HttpResponseEvent::Setting(name, value) => write!(f, "* Setting {}={}", name, value),
            HttpResponseEvent::Info(s) => write!(f, "* {}", s),
-            HttpResponseEvent::Redirect { url, status, behavior } => {
+            HttpResponseEvent::Redirect {
+                url,
+                status,
+                behavior,
+                dropped_body,
+                dropped_headers,
+            } => {
                let behavior_str = match behavior {
                    RedirectBehavior::Preserve => "preserve",
                    RedirectBehavior::DropBody => "drop body",
                };
-                write!(f, "* Redirect {} -> {} ({})", status, url, behavior_str)
+                let body_str = if *dropped_body { ", body dropped" } else { "" };
+                let headers_str = if dropped_headers.is_empty() {
+                    String::new()
+                } else {
+                    format!(", headers dropped: {}", dropped_headers.join(", "))
+                };
+                write!(
+                    f,
+                    "* Redirect {} -> {} ({}{}{})",
+                    status, url, behavior_str, body_str, headers_str
+                )
            }
            HttpResponseEvent::SendUrl {
                method,
@@ -130,13 +148,21 @@ impl From<HttpResponseEvent> for yaak_models::models::HttpResponseEventData {
        match event {
            HttpResponseEvent::Setting(name, value) => D::Setting { name, value },
            HttpResponseEvent::Info(message) => D::Info { message },
-            HttpResponseEvent::Redirect { url, status, behavior } => D::Redirect {
+            HttpResponseEvent::Redirect {
+                url,
+                status,
+                behavior,
+                dropped_body,
+                dropped_headers,
+            } => D::Redirect {
                url,
                status,
                behavior: match behavior {
                    RedirectBehavior::Preserve => "preserve".to_string(),
                    RedirectBehavior::DropBody => "drop_body".to_string(),
                },
+                dropped_body,
+                dropped_headers,
            },
            HttpResponseEvent::SendUrl {
                method,
--- a/crates/yaak-http/src/transaction.rs
+++ b/crates/yaak-http/src/transaction.rs
@@ -1,7 +1,7 @@
 use crate::cookies::CookieStore;
 use crate::error::Result;
 use crate::sender::{HttpResponse, HttpResponseEvent, HttpSender, RedirectBehavior};
-use crate::types::SendableHttpRequest;
+use crate::types::{SendableBody, SendableHttpRequest};
 use log::debug;
 use tokio::sync::mpsc;
 use tokio::sync::watch::Receiver;
@@ -87,6 +87,11 @@ impl<S: HttpSender> HttpTransaction<S> {
            };

            // Build request for this iteration
+            let preserved_body = match &current_body {
+                Some(SendableBody::Bytes(b)) => Some(SendableBody::Bytes(b.clone())),
+                _ => None,
+            };
+            let request_had_body = current_body.is_some();
            let req = SendableHttpRequest {
                url: current_url.clone(),
                method: current_method.clone(),
@@ -182,8 +187,6 @@ impl<S: HttpSender> HttpTransaction<S> {
                format!("{}/{}", base_path, location)
            };

-            Self::remove_sensitive_headers(&mut current_headers, &previous_url, &current_url);
-
            // Determine redirect behavior based on status code and method
            let behavior = if status == 303 {
                // 303 See Other always changes to GET
@@ -197,11 +200,8 @@ impl<S: HttpSender> HttpTransaction<S> {
                RedirectBehavior::Preserve
            };

-            send_event(HttpResponseEvent::Redirect {
-                url: current_url.clone(),
-                status,
-                behavior: behavior.clone(),
-            });
+            let mut dropped_headers =
+                Self::remove_sensitive_headers(&mut current_headers, &previous_url, &current_url);

            // Handle method changes for certain redirect codes
            if matches!(behavior, RedirectBehavior::DropBody) {
@@ -211,13 +211,40 @@ impl<S: HttpSender> HttpTransaction<S> {
                // Remove content-related headers
                current_headers.retain(|h| {
                    let name_lower = h.0.to_lowercase();
-                    !name_lower.starts_with("content-") && name_lower != "transfer-encoding"
+                    let should_drop =
+                        name_lower.starts_with("content-") || name_lower == "transfer-encoding";
+                    if should_drop {
+                        Self::push_header_if_missing(&mut dropped_headers, &h.0);
+                    }
+                    !should_drop
                });
            }

-            // Reset body for next iteration (since it was moved in the send call)
-            // For redirects that change method to GET or for all redirects since body was consumed
-            current_body = None;
+            // Restore body for Preserve redirects (307/308), drop for others.
+            // Stream bodies can't be replayed (same limitation as reqwest).
+            current_body = if matches!(behavior, RedirectBehavior::Preserve) {
+                if request_had_body && preserved_body.is_none() {
+                    // Stream body was consumed and can't be replayed (same as reqwest)
+                    return Err(crate::error::Error::RequestError(
+                        "Cannot follow redirect: request body was a stream and cannot be resent"
+                            .to_string(),
+                    ));
+                }
+                preserved_body
+            } else {
+                None
+            };
+
+            // Body was dropped if the request had one but we can't resend it
+            let dropped_body = request_had_body && current_body.is_none();
+
+            send_event(HttpResponseEvent::Redirect {
+                url: current_url.clone(),
+                status,
+                behavior: behavior.clone(),
+                dropped_body,
+                dropped_headers,
+            });

            redirect_count += 1;
        }
@@ -231,7 +258,8 @@ impl<S: HttpSender> HttpTransaction<S> {
        headers: &mut Vec<(String, String)>,
        previous_url: &str,
        next_url: &str,
-    ) {
+    ) -> Vec<String> {
+        let mut dropped_headers = Vec::new();
        let previous_host = Url::parse(previous_url).ok().and_then(|u| {
            u.host_str().map(|h| format!("{}:{}", h, u.port_or_known_default().unwrap_or(0)))
        });
@@ -241,13 +269,24 @@ impl<S: HttpSender> HttpTransaction<S> {
        if previous_host != next_host {
            headers.retain(|h| {
                let name_lower = h.0.to_lowercase();
-                name_lower != "authorization"
-                    && name_lower != "cookie"
-                    && name_lower != "cookie2"
-                    && name_lower != "proxy-authorization"
-                    && name_lower != "www-authenticate"
+                let should_drop = name_lower == "authorization"
+                    || name_lower == "cookie"
+                    || name_lower == "cookie2"
+                    || name_lower == "proxy-authorization"
+                    || name_lower == "www-authenticate";
+                if should_drop {
+                    Self::push_header_if_missing(&mut dropped_headers, &h.0);
+                }
+                !should_drop
            });
        }
+        dropped_headers
+    }
+
+    fn push_header_if_missing(headers: &mut Vec<String>, name: &str) {
+        if !headers.iter().any(|h| h.eq_ignore_ascii_case(name)) {
+            headers.push(name.to_string());
+        }
    }

    /// Check if a status code indicates a redirect
--- a/crates/yaak-http/src/types.rs
+++ b/crates/yaak-http/src/types.rs
@@ -9,8 +9,9 @@ use std::collections::BTreeMap;
 use std::pin::Pin;
 use std::time::Duration;
 use tokio::io::AsyncRead;
-use yaak_common::serde::{get_bool, get_str, get_str_map};
+use yaak_common::serde::{get_bool, get_bool_map, get_str, get_str_map};
 use yaak_models::models::HttpRequest;
+use yaak_templates::strip_json_comments::{maybe_strip_json_comments, strip_json_comments};

 pub(crate) const MULTIPART_BOUNDARY: &str = "------YaakFormBoundary";

@@ -134,16 +135,69 @@ pub fn append_query_params(url: &str, params: Vec<(String, String)>) -> String {
    result
 }

+fn strip_query_params(url: &str, names: &[&str]) -> String {
+    // Split off fragment
+    let (base_and_query, fragment) = if let Some(hash_pos) = url.find('#') {
+        (&url[..hash_pos], Some(&url[hash_pos..]))
+    } else {
+        (url, None)
+    };
+
+    let result = if let Some(q_pos) = base_and_query.find('?') {
+        let base = &base_and_query[..q_pos];
+        let query = &base_and_query[q_pos + 1..];
+        let filtered: Vec<&str> = query
+            .split('&')
+            .filter(|pair| {
+                let key = pair.split('=').next().unwrap_or("");
+                let decoded = urlencoding::decode(key).unwrap_or_default();
+                !names.contains(&decoded.as_ref())
+            })
+            .collect();
+        if filtered.is_empty() {
+            base.to_string()
+        } else {
+            format!("{}?{}", base, filtered.join("&"))
+        }
+    } else {
+        base_and_query.to_string()
+    };
+
+    match fragment {
+        Some(f) => format!("{}{}", result, f),
+        None => result,
+    }
+}
+
 fn build_url(r: &HttpRequest) -> String {
    let (url_string, params) = apply_path_placeholders(&ensure_proto(&r.url), &r.url_parameters);
-    append_query_params(
+    let mut url = append_query_params(
        &url_string,
        params
            .iter()
            .filter(|p| p.enabled && !p.name.is_empty())
            .map(|p| (p.name.clone(), p.value.clone()))
            .collect(),
-    )
+    );
+
+    // GraphQL GET requests encode query/variables as URL query parameters
+    if r.method.to_lowercase() == "get" && r.body_type.as_deref() == Some("graphql") {
+        url = append_graphql_query_params(&url, &r.body);
+    }
+
+    url
+}
+
+fn append_graphql_query_params(url: &str, body: &BTreeMap<String, serde_json::Value>) -> String {
+    let query = get_str_map(body, "query").to_string();
+    let variables = strip_json_comments(&get_str_map(body, "variables"));
+    let mut params = vec![("query".to_string(), query)];
+    if !variables.trim().is_empty() {
+        params.push(("variables".to_string(), variables));
+    }
+    // Strip existing query/variables params to avoid duplicates
+    let url = strip_query_params(url, &["query", "variables"]);
+    append_query_params(&url, params)
 }

 fn build_headers(r: &HttpRequest) -> Vec<(String, String)> {
@@ -177,7 +231,7 @@ async fn build_body(
            (build_form_body(&body), Some("application/x-www-form-urlencoded".to_string()))
        }
        "multipart/form-data" => build_multipart_body(&body, &headers).await?,
-        _ if body.contains_key("text") => (build_text_body(&body), None),
+        _ if body.contains_key("text") => (build_text_body(&body, body_type), None),
        t => {
            warn!("Unsupported body type: {}", t);
            (None, None)
@@ -252,13 +306,20 @@ async fn build_binary_body(
    }))
 }

-fn build_text_body(body: &BTreeMap<String, serde_json::Value>) -> Option<SendableBodyWithMeta> {
+fn build_text_body(body: &BTreeMap<String, serde_json::Value>, body_type: &str) -> Option<SendableBodyWithMeta> {
    let text = get_str_map(body, "text");
    if text.is_empty() {
-        None
-    } else {
-        Some(SendableBodyWithMeta::Bytes(Bytes::from(text.to_string())))
+        return None;
    }
+
+    let send_comments = get_bool_map(body, "sendJsonComments", false);
+    let text = if !send_comments && body_type == "application/json" {
+        maybe_strip_json_comments(text)
+    } else {
+        text.to_string()
+    };
+
+    Some(SendableBodyWithMeta::Bytes(Bytes::from(text)))
 }

 fn build_graphql_body(
@@ -266,7 +327,7 @@ fn build_graphql_body(
    body: &BTreeMap<String, serde_json::Value>,
 ) -> Option<SendableBodyWithMeta> {
    let query = get_str_map(body, "query");
-    let variables = get_str_map(body, "variables");
+    let variables = strip_json_comments(&get_str_map(body, "variables"));

    if method.to_lowercase() == "get" {
        // GraphQL GET requests use query parameters, not a body
@@ -684,7 +745,7 @@ mod tests {
        let mut body = BTreeMap::new();
        body.insert("text".to_string(), json!("Hello, World!"));

-        let result = build_text_body(&body);
+        let result = build_text_body(&body, "application/json");
        match result {
            Some(SendableBodyWithMeta::Bytes(bytes)) => {
                assert_eq!(bytes, Bytes::from("Hello, World!"))
@@ -698,7 +759,7 @@ mod tests {
        let mut body = BTreeMap::new();
        body.insert("text".to_string(), json!(""));

-        let result = build_text_body(&body);
+        let result = build_text_body(&body, "application/json");
        assert!(result.is_none());
    }

@@ -706,10 +767,57 @@ mod tests {
    async fn test_text_body_missing() {
        let body = BTreeMap::new();

-        let result = build_text_body(&body);
+        let result = build_text_body(&body, "application/json");
        assert!(result.is_none());
    }

+    #[tokio::test]
+    async fn test_text_body_strips_json_comments_by_default() {
+        let mut body = BTreeMap::new();
+        body.insert("text".to_string(), json!("{\n  // comment\n  \"foo\": \"bar\"\n}"));
+
+        let result = build_text_body(&body, "application/json");
+        match result {
+            Some(SendableBodyWithMeta::Bytes(bytes)) => {
+                let text = String::from_utf8_lossy(&bytes);
+                assert!(!text.contains("// comment"));
+                assert!(text.contains("\"foo\": \"bar\""));
+            }
+            _ => panic!("Expected Some(SendableBody::Bytes)"),
+        }
+    }
+
+    #[tokio::test]
+    async fn test_text_body_send_json_comments_when_opted_in() {
+        let mut body = BTreeMap::new();
+        body.insert("text".to_string(), json!("{\n  // comment\n  \"foo\": \"bar\"\n}"));
+        body.insert("sendJsonComments".to_string(), json!(true));
+
+        let result = build_text_body(&body, "application/json");
+        match result {
+            Some(SendableBodyWithMeta::Bytes(bytes)) => {
+                let text = String::from_utf8_lossy(&bytes);
+                assert!(text.contains("// comment"));
+            }
+            _ => panic!("Expected Some(SendableBody::Bytes)"),
+        }
+    }
+
+    #[tokio::test]
+    async fn test_text_body_no_strip_for_non_json() {
+        let mut body = BTreeMap::new();
+        body.insert("text".to_string(), json!("// not json\nsome text"));
+
+        let result = build_text_body(&body, "text/plain");
+        match result {
+            Some(SendableBodyWithMeta::Bytes(bytes)) => {
+                let text = String::from_utf8_lossy(&bytes);
+                assert!(text.contains("// not json"));
+            }
+            _ => panic!("Expected Some(SendableBody::Bytes)"),
+        }
+    }
+
    #[tokio::test]
    async fn test_form_urlencoded_body() -> Result<()> {
        let mut body = BTreeMap::new();
--- a/crates/yaak-models/bindings/gen_models.ts
+++ b/crates/yaak-models/bindings/gen_models.ts
@@ -49,7 +49,7 @@ export type HttpResponseEvent = { model: "http_response_event", id: string, crea
 * This mirrors `yaak_http::sender::HttpResponseEvent` but with serde support.
 * The `From` impl is in yaak-http to avoid circular dependencies.
 */
-export type HttpResponseEventData = { "type": "setting", name: string, value: string, } | { "type": "info", message: string, } | { "type": "redirect", url: string, status: number, behavior: string, } | { "type": "send_url", method: string, scheme: string, username: string, password: string, host: string, port: number, path: string, query: string, fragment: string, } | { "type": "receive_url", version: string, status: string, } | { "type": "header_up", name: string, value: string, } | { "type": "header_down", name: string, value: string, } | { "type": "chunk_sent", bytes: number, } | { "type": "chunk_received", bytes: number, } | { "type": "dns_resolved", hostname: string, addresses: Array<string>, duration: bigint, overridden: boolean, };
+export type HttpResponseEventData = { "type": "setting", name: string, value: string, } | { "type": "info", message: string, } | { "type": "redirect", url: string, status: number, behavior: string, dropped_body: boolean, dropped_headers: Array<string>, } | { "type": "send_url", method: string, scheme: string, username: string, password: string, host: string, port: number, path: string, query: string, fragment: string, } | { "type": "receive_url", version: string, status: string, } | { "type": "header_up", name: string, value: string, } | { "type": "header_down", name: string, value: string, } | { "type": "chunk_sent", bytes: number, } | { "type": "chunk_received", bytes: number, } | { "type": "dns_resolved", hostname: string, addresses: Array<string>, duration: bigint, overridden: boolean, };

 export type HttpResponseHeader = { name: string, value: string, };

@@ -67,7 +67,9 @@ export type ParentAuthentication = { authentication: Record<string, any>, authen

 export type ParentHeaders = { headers: Array<HttpRequestHeader>, };

-export type Plugin = { model: "plugin", id: string, createdAt: string, updatedAt: string, checkedAt: string | null, directory: string, enabled: boolean, url: string | null, };
+export type Plugin = { model: "plugin", id: string, createdAt: string, updatedAt: string, checkedAt: string | null, directory: string, enabled: boolean, url: string | null, source: PluginSource, };
+
+export type PluginSource = "bundled" | "filesystem" | "registry";

 export type PluginKeyValue = { model: "plugin_key_value", createdAt: string, updatedAt: string, pluginName: string, key: string, value: string, };

--- a/crates/yaak-models/guest-js/atoms.ts
+++ b/crates/yaak-models/guest-js/atoms.ts
@@ -1,35 +1,39 @@
-import { atom } from 'jotai';
+import { atom } from "jotai";

-import { selectAtom } from 'jotai/utils';
-import type { AnyModel } from '../bindings/gen_models';
-import { ExtractModel } from './types';
-import { newStoreData } from './util';
+import { selectAtom } from "jotai/utils";
+import type { AnyModel } from "../bindings/gen_models";
+import { ExtractModel } from "./types";
+import { newStoreData } from "./util";

 export const modelStoreDataAtom = atom(newStoreData());

-export const cookieJarsAtom = createOrderedModelAtom('cookie_jar', 'name', 'asc');
-export const environmentsAtom = createOrderedModelAtom('environment', 'sortPriority', 'asc');
-export const foldersAtom = createModelAtom('folder');
-export const grpcConnectionsAtom = createOrderedModelAtom('grpc_connection', 'createdAt', 'desc');
-export const grpcEventsAtom = createOrderedModelAtom('grpc_event', 'createdAt', 'asc');
-export const grpcRequestsAtom = createModelAtom('grpc_request');
-export const httpRequestsAtom = createModelAtom('http_request');
-export const httpResponsesAtom = createOrderedModelAtom('http_response', 'createdAt', 'desc');
-export const httpResponseEventsAtom = createOrderedModelAtom('http_response_event', 'createdAt', 'asc');
-export const keyValuesAtom = createModelAtom('key_value');
-export const pluginsAtom = createModelAtom('plugin');
-export const settingsAtom = createSingularModelAtom('settings');
-export const websocketRequestsAtom = createModelAtom('websocket_request');
-export const websocketEventsAtom = createOrderedModelAtom('websocket_event', 'createdAt', 'asc');
-export const websocketConnectionsAtom = createOrderedModelAtom(
-  'websocket_connection',
-  'createdAt',
-  'desc',
+export const cookieJarsAtom = createOrderedModelAtom("cookie_jar", "name", "asc");
+export const environmentsAtom = createOrderedModelAtom("environment", "sortPriority", "asc");
+export const foldersAtom = createModelAtom("folder");
+export const grpcConnectionsAtom = createOrderedModelAtom("grpc_connection", "createdAt", "desc");
+export const grpcEventsAtom = createOrderedModelAtom("grpc_event", "createdAt", "asc");
+export const grpcRequestsAtom = createModelAtom("grpc_request");
+export const httpRequestsAtom = createModelAtom("http_request");
+export const httpResponsesAtom = createOrderedModelAtom("http_response", "createdAt", "desc");
+export const httpResponseEventsAtom = createOrderedModelAtom(
+  "http_response_event",
+  "createdAt",
+  "asc",
 );
-export const workspaceMetasAtom = createModelAtom('workspace_meta');
-export const workspacesAtom = createOrderedModelAtom('workspace', 'name', 'asc');
+export const keyValuesAtom = createModelAtom("key_value");
+export const pluginsAtom = createModelAtom("plugin");
+export const settingsAtom = createSingularModelAtom("settings");
+export const websocketRequestsAtom = createModelAtom("websocket_request");
+export const websocketEventsAtom = createOrderedModelAtom("websocket_event", "createdAt", "asc");
+export const websocketConnectionsAtom = createOrderedModelAtom(
+  "websocket_connection",
+  "createdAt",
+  "desc",
+);
+export const workspaceMetasAtom = createModelAtom("workspace_meta");
+export const workspacesAtom = createOrderedModelAtom("workspace", "name", "asc");

-export function createModelAtom<M extends AnyModel['model']>(modelType: M) {
+export function createModelAtom<M extends AnyModel["model"]>(modelType: M) {
  return selectAtom(
    modelStoreDataAtom,
    (data) => Object.values(data[modelType] ?? {}),
@@ -37,19 +41,19 @@ export function createModelAtom<M extends AnyModel['model']>(modelType: M) {
  );
 }

-export function createSingularModelAtom<M extends AnyModel['model']>(modelType: M) {
+export function createSingularModelAtom<M extends AnyModel["model"]>(modelType: M) {
  return selectAtom(modelStoreDataAtom, (data) => {
    const modelData = Object.values(data[modelType] ?? {});
    const item = modelData[0];
-    if (item == null) throw new Error('Failed creating singular model with no data: ' + modelType);
+    if (item == null) throw new Error("Failed creating singular model with no data: " + modelType);
    return item;
  });
 }

-export function createOrderedModelAtom<M extends AnyModel['model']>(
+export function createOrderedModelAtom<M extends AnyModel["model"]>(
  modelType: M,
  field: keyof ExtractModel<AnyModel, M>,
-  order: 'asc' | 'desc',
+  order: "asc" | "desc",
 ) {
  return selectAtom(
    modelStoreDataAtom,
@@ -58,7 +62,7 @@ export function createOrderedModelAtom<M extends AnyModel['model']>(
      return Object.values(modelData).sort(
        (a: ExtractModel<AnyModel, M>, b: ExtractModel<AnyModel, M>) => {
          const n = a[field] > b[field] ? 1 : -1;
-          return order === 'desc' ? n * -1 : n;
+          return order === "desc" ? n * -1 : n;
        },
      );
    },
--- a/crates/yaak-models/guest-js/index.ts
+++ b/crates/yaak-models/guest-js/index.ts
@@ -1,11 +1,11 @@
-import { AnyModel } from '../bindings/gen_models';
+import { AnyModel } from "../bindings/gen_models";

-export * from '../bindings/gen_models';
-export * from '../bindings/gen_util';
-export * from './store';
-export * from './atoms';
+export * from "../bindings/gen_models";
+export * from "../bindings/gen_util";
+export * from "./store";
+export * from "./atoms";

 export function modelTypeLabel(m: AnyModel): string {
  const capitalize = (str: string) => str.charAt(0).toUpperCase() + str.slice(1);
-  return m.model.split('_').map(capitalize).join(' ');
+  return m.model.split("_").map(capitalize).join(" ");
 }
--- a/crates/yaak-models/guest-js/store.ts
+++ b/crates/yaak-models/guest-js/store.ts
@@ -1,10 +1,10 @@
-import { invoke } from '@tauri-apps/api/core';
-import { getCurrentWebviewWindow } from '@tauri-apps/api/webviewWindow';
-import { resolvedModelName } from '@yaakapp/app/lib/resolvedModelName';
-import { AnyModel, ModelPayload } from '../bindings/gen_models';
-import { modelStoreDataAtom } from './atoms';
-import { ExtractModel, JotaiStore, ModelStoreData } from './types';
-import { newStoreData } from './util';
+import { invoke } from "@tauri-apps/api/core";
+import { getCurrentWebviewWindow } from "@tauri-apps/api/webviewWindow";
+import { resolvedModelName } from "@yaakapp/app/lib/resolvedModelName";
+import { AnyModel, ModelPayload } from "../bindings/gen_models";
+import { modelStoreDataAtom } from "./atoms";
+import { ExtractModel, JotaiStore, ModelStoreData } from "./types";
+import { newStoreData } from "./util";

 let _store: JotaiStore | null = null;

@@ -12,11 +12,11 @@ export function initModelStore(store: JotaiStore) {
  _store = store;

  getCurrentWebviewWindow()
-    .listen<ModelPayload>('model_write', ({ payload }) => {
+    .listen<ModelPayload>("model_write", ({ payload }) => {
      if (shouldIgnoreModel(payload)) return;

      mustStore().set(modelStoreDataAtom, (prev: ModelStoreData) => {
-        if (payload.change.type === 'upsert') {
+        if (payload.change.type === "upsert") {
          return {
            ...prev,
            [payload.model.model]: {
@@ -36,7 +36,7 @@ export function initModelStore(store: JotaiStore) {

 function mustStore(): JotaiStore {
  if (_store == null) {
-    throw new Error('Model store was not initialized');
+    throw new Error("Model store was not initialized");
  }

  return _store;
@@ -45,8 +45,8 @@ function mustStore(): JotaiStore {
 let _activeWorkspaceId: string | null = null;

 export async function changeModelStoreWorkspace(workspaceId: string | null) {
-  console.log('Syncing models with new workspace', workspaceId);
-  const workspaceModelsStr = await invoke<string>('models_workspace_models', {
+  console.log("Syncing models with new workspace", workspaceId);
+  const workspaceModelsStr = await invoke<string>("models_workspace_models", {
    workspaceId, // NOTE: if no workspace id provided, it will just fetch global models
  });
  const workspaceModels = JSON.parse(workspaceModelsStr) as AnyModel[];
@@ -57,12 +57,12 @@ export async function changeModelStoreWorkspace(workspaceId: string | null) {

  mustStore().set(modelStoreDataAtom, data);

-  console.log('Synced model store with workspace', workspaceId, data);
+  console.log("Synced model store with workspace", workspaceId, data);

  _activeWorkspaceId = workspaceId;
 }

-export function listModels<M extends AnyModel['model'], T extends ExtractModel<AnyModel, M>>(
+export function listModels<M extends AnyModel["model"], T extends ExtractModel<AnyModel, M>>(
  modelType: M | ReadonlyArray<M>,
 ): T[] {
  let data = mustStore().get(modelStoreDataAtom);
@@ -70,7 +70,7 @@ export function listModels<M extends AnyModel['model'], T extends ExtractModel<A
  return types.flatMap((t) => Object.values(data[t]) as T[]);
 }

-export function getModel<M extends AnyModel['model'], T extends ExtractModel<AnyModel, M>>(
+export function getModel<M extends AnyModel["model"], T extends ExtractModel<AnyModel, M>>(
  modelType: M | ReadonlyArray<M>,
  id: string,
 ): T | null {
@@ -83,18 +83,17 @@ export function getModel<M extends AnyModel['model'], T extends ExtractModel<Any
  return null;
 }

-export function getAnyModel(
-  id: string,
-): AnyModel | null {
+export function getAnyModel(id: string): AnyModel | null {
  let data = mustStore().get(modelStoreDataAtom);
  for (const t of Object.keys(data)) {
+    // oxlint-disable-next-line no-explicit-any
    let v = (data as any)[t]?.[id];
    if (v?.model === t) return v;
  }
  return null;
 }

-export function patchModelById<M extends AnyModel['model'], T extends ExtractModel<AnyModel, M>>(
+export function patchModelById<M extends AnyModel["model"], T extends ExtractModel<AnyModel, M>>(
  model: M,
  id: string,
  patch: Partial<T> | ((prev: T) => T),
@@ -104,54 +103,54 @@ export function patchModelById<M extends AnyModel['model'], T extends ExtractMod
    throw new Error(`Failed to get model to patch id=${id} model=${model}`);
  }

-  const newModel = typeof patch === 'function' ? patch(prev) : { ...prev, ...patch };
+  const newModel = typeof patch === "function" ? patch(prev) : { ...prev, ...patch };
  return updateModel(newModel);
 }

-export async function patchModel<M extends AnyModel['model'], T extends ExtractModel<AnyModel, M>>(
-  base: Pick<T, 'id' | 'model'>,
+export async function patchModel<M extends AnyModel["model"], T extends ExtractModel<AnyModel, M>>(
+  base: Pick<T, "id" | "model">,
  patch: Partial<T>,
 ): Promise<string> {
  return patchModelById<M, T>(base.model, base.id, patch);
 }

-export async function updateModel<M extends AnyModel['model'], T extends ExtractModel<AnyModel, M>>(
+export async function updateModel<M extends AnyModel["model"], T extends ExtractModel<AnyModel, M>>(
  model: T,
 ): Promise<string> {
-  return invoke<string>('models_upsert', { model });
+  return invoke<string>("models_upsert", { model });
 }

 export async function deleteModelById<
-  M extends AnyModel['model'],
+  M extends AnyModel["model"],
  T extends ExtractModel<AnyModel, M>,
 >(modelType: M | M[], id: string) {
  let model = getModel<M, T>(modelType, id);
  await deleteModel(model);
 }

-export async function deleteModel<M extends AnyModel['model'], T extends ExtractModel<AnyModel, M>>(
+export async function deleteModel<M extends AnyModel["model"], T extends ExtractModel<AnyModel, M>>(
  model: T | null,
 ) {
  if (model == null) {
-    throw new Error('Failed to delete null model');
+    throw new Error("Failed to delete null model");
  }
-  await invoke<string>('models_delete', { model });
+  await invoke<string>("models_delete", { model });
 }

-export function duplicateModel<M extends AnyModel['model'], T extends ExtractModel<AnyModel, M>>(
+export function duplicateModel<M extends AnyModel["model"], T extends ExtractModel<AnyModel, M>>(
  model: T | null,
 ) {
  if (model == null) {
-    throw new Error('Failed to duplicate null model');
+    throw new Error("Failed to duplicate null model");
  }

  // If the model has a name, try to duplicate it with a name that doesn't conflict
-  let name = 'name' in model ? resolvedModelName(model) : undefined;
+  let name = "name" in model ? resolvedModelName(model) : undefined;
  if (name != null) {
    const existingModels = listModels(model.model);
    for (let i = 0; i < 100; i++) {
      const hasConflict = existingModels.some((m) => {
-        if ('folderId' in m && 'folderId' in model && model.folderId !== m.folderId) {
+        if ("folderId" in m && "folderId" in model && model.folderId !== m.folderId) {
          return false;
        } else if (resolvedModelName(m) !== name) {
          return false;
@@ -165,7 +164,7 @@ export function duplicateModel<M extends AnyModel['model'], T extends ExtractMod
      // Name conflict. Try another one
      const m: RegExpMatchArray | null = name.match(/ Copy( (?<n>\d+))?$/);
      if (m != null && m.groups?.n == null) {
-        name = name.substring(0, m.index) + ' Copy 2';
+        name = name.substring(0, m.index) + " Copy 2";
      } else if (m != null && m.groups?.n != null) {
        name = name.substring(0, m.index) + ` Copy ${parseInt(m.groups.n) + 1}`;
      } else {
@@ -174,23 +173,23 @@ export function duplicateModel<M extends AnyModel['model'], T extends ExtractMod
    }
  }

-  return invoke<string>('models_duplicate', { model: { ...model, name } });
+  return invoke<string>("models_duplicate", { model: { ...model, name } });
 }

 export async function createGlobalModel<T extends Exclude<AnyModel, { workspaceId: string }>>(
-  patch: Partial<T> & Pick<T, 'model'>,
+  patch: Partial<T> & Pick<T, "model">,
 ): Promise<string> {
-  return invoke<string>('models_upsert', { model: patch });
+  return invoke<string>("models_upsert", { model: patch });
 }

 export async function createWorkspaceModel<T extends Extract<AnyModel, { workspaceId: string }>>(
-  patch: Partial<T> & Pick<T, 'model' | 'workspaceId'>,
+  patch: Partial<T> & Pick<T, "model" | "workspaceId">,
 ): Promise<string> {
-  return invoke<string>('models_upsert', { model: patch });
+  return invoke<string>("models_upsert", { model: patch });
 }

 export function replaceModelsInStore<
-  M extends AnyModel['model'],
+  M extends AnyModel["model"],
  T extends Extract<AnyModel, { model: M }>,
 >(model: M, models: T[]) {
  const newModels: Record<string, T> = {};
@@ -207,7 +206,7 @@ export function replaceModelsInStore<
 }

 export function mergeModelsInStore<
-  M extends AnyModel['model'],
+  M extends AnyModel["model"],
  T extends Extract<AnyModel, { model: M }>,
 >(model: M, models: T[], filter?: (model: T) => boolean) {
  mustStore().set(modelStoreDataAtom, (prev: ModelStoreData) => {
@@ -236,7 +235,7 @@ export function mergeModelsInStore<

 function shouldIgnoreModel({ model, updateSource }: ModelPayload) {
  // Never ignore updates from non-user sources
-  if (updateSource.type !== 'window') {
+  if (updateSource.type !== "window") {
    return false;
  }

@@ -246,11 +245,11 @@ function shouldIgnoreModel({ model, updateSource }: ModelPayload) {
  }

  // Only sync models that belong to this workspace, if a workspace ID is present
-  if ('workspaceId' in model && model.workspaceId !== _activeWorkspaceId) {
+  if ("workspaceId" in model && model.workspaceId !== _activeWorkspaceId) {
    return true;
  }

-  if (model.model === 'key_value' && model.namespace === 'no_sync') {
+  if (model.model === "key_value" && model.namespace === "no_sync") {
    return true;
  }

--- a/crates/yaak-models/guest-js/types.ts
+++ b/crates/yaak-models/guest-js/types.ts
@@ -1,8 +1,8 @@
-import { createStore } from 'jotai';
-import { AnyModel } from '../bindings/gen_models';
+import { createStore } from "jotai";
+import { AnyModel } from "../bindings/gen_models";

 export type ExtractModel<T, M> = T extends { model: M } ? T : never;
 export type ModelStoreData<T extends AnyModel = AnyModel> = {
-  [M in T['model']]: Record<string, Extract<T, { model: M }>>;
+  [M in T["model"]]: Record<string, Extract<T, { model: M }>>;
 };
 export type JotaiStore = ReturnType<typeof createStore>;
--- a/crates/yaak-models/guest-js/util.ts
+++ b/crates/yaak-models/guest-js/util.ts
@@ -1,4 +1,4 @@
-import { ModelStoreData } from './types';
+import { ModelStoreData } from "./types";

 export function newStoreData(): ModelStoreData {
  return {
--- a/crates/yaak-models/migrations/20260301000000_plugin-source-and-unique-directory.sql
+++ b/crates/yaak-models/migrations/20260301000000_plugin-source-and-unique-directory.sql
@@ -0,0 +1,33 @@
+ALTER TABLE plugins
+    ADD COLUMN source TEXT DEFAULT 'filesystem' NOT NULL;
+
+-- Existing registry installs have a URL; classify them first.
+UPDATE plugins
+SET source = 'registry'
+WHERE url IS NOT NULL;
+
+-- Best-effort bundled backfill for legacy rows.
+UPDATE plugins
+SET source = 'bundled'
+WHERE source = 'filesystem'
+  AND (
+    -- Normalize separators so this also works for Windows paths.
+    replace(directory, '\', '/') LIKE '%/vendored/plugins/%'
+        OR replace(directory, '\', '/') LIKE '%/vendored-plugins/%'
+    );
+
+-- Keep one row per exact directory before adding uniqueness.
+-- Tie-break by recency.
+WITH ranked AS (SELECT id,
+                       ROW_NUMBER() OVER (
+                           PARTITION BY directory
+                           ORDER BY updated_at DESC,
+                               created_at DESC
+                           ) AS row_num
+                FROM plugins)
+DELETE
+FROM plugins
+WHERE id IN (SELECT id FROM ranked WHERE row_num > 1);
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_plugins_directory_unique
+    ON plugins (directory);
--- a/crates/yaak-models/package.json
+++ b/crates/yaak-models/package.json
@@ -1,6 +1,6 @@
 {
  "name": "@yaakapp-internal/models",
-  "private": true,
  "version": "1.0.0",
+  "private": true,
  "main": "guest-js/index.ts"
 }
--- a/crates/yaak-models/src/models.rs
+++ b/crates/yaak-models/src/models.rs
@@ -1499,6 +1499,10 @@ pub enum HttpResponseEventData {
        url: String,
        status: u16,
        behavior: String,
+        #[serde(default)]
+        dropped_body: bool,
+        #[serde(default)]
+        dropped_headers: Vec<String>,
    },
    SendUrl {
        method: String,
@@ -2074,6 +2078,46 @@ pub struct Plugin {
    pub directory: String,
    pub enabled: bool,
    pub url: Option<String>,
+    pub source: PluginSource,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, TS)]
+#[serde(rename_all = "snake_case")]
+#[ts(export, export_to = "gen_models.ts")]
+pub enum PluginSource {
+    Bundled,
+    Filesystem,
+    Registry,
+}
+
+impl FromStr for PluginSource {
+    type Err = crate::error::Error;
+
+    fn from_str(s: &str) -> Result<Self> {
+        match s {
+            "bundled" => Ok(Self::Bundled),
+            "filesystem" => Ok(Self::Filesystem),
+            "registry" => Ok(Self::Registry),
+            _ => Ok(Self::default()),
+        }
+    }
+}
+
+impl Display for PluginSource {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        let str = match self {
+            PluginSource::Bundled => "bundled".to_string(),
+            PluginSource::Filesystem => "filesystem".to_string(),
+            PluginSource::Registry => "registry".to_string(),
+        };
+        write!(f, "{}", str)
+    }
+}
+
+impl Default for PluginSource {
+    fn default() -> Self {
+        Self::Filesystem
+    }
 }

 impl UpsertModelInfo for Plugin {
@@ -2109,6 +2153,7 @@ impl UpsertModelInfo for Plugin {
            (Directory, self.directory.into()),
            (Url, self.url.into()),
            (Enabled, self.enabled.into()),
+            (Source, self.source.to_string().into()),
        ])
    }

@@ -2119,6 +2164,7 @@ impl UpsertModelInfo for Plugin {
            PluginIden::Directory,
            PluginIden::Url,
            PluginIden::Enabled,
+            PluginIden::Source,
        ]
    }

@@ -2135,6 +2181,7 @@ impl UpsertModelInfo for Plugin {
            url: row.get("url")?,
            directory: row.get("directory")?,
            enabled: row.get("enabled")?,
+            source: PluginSource::from_str(row.get::<_, String>("source")?.as_str()).unwrap(),
        })
    }
 }
--- a/crates/yaak-models/src/queries/plugins.rs
+++ b/crates/yaak-models/src/queries/plugins.rs
@@ -26,6 +26,10 @@ impl<'a> DbContext<'a> {
    }

    pub fn upsert_plugin(&self, plugin: &Plugin, source: &UpdateSource) -> Result<Plugin> {
-        self.upsert(plugin, source)
+        let mut plugin_to_upsert = plugin.clone();
+        if let Some(existing) = self.get_plugin_by_directory(&plugin.directory) {
+            plugin_to_upsert.id = existing.id;
+        }
+        self.upsert(&plugin_to_upsert, source)
    }
 }
--- a/crates/yaak-plugins/Cargo.toml
+++ b/crates/yaak-plugins/Cargo.toml
@@ -15,7 +15,6 @@ log = { workspace = true }
 md5 = "0.7.0"
 path-slash = "0.2.1"
 rand = "0.9.0"
-regex = "1.10.6"
 reqwest = { workspace = true, features = ["json"] }
 serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true }
--- a/crates/yaak-plugins/bindings/gen_events.ts
+++ b/crates/yaak-plugins/bindings/gen_events.ts
@@ -18,12 +18,12 @@ export type CallHttpAuthenticationActionRequest = { index: number, pluginRefId:

 export type CallHttpAuthenticationRequest = { contextId: string, values: { [key in string]?: JsonPrimitive }, method: string, url: string, headers: Array<HttpHeader>, };

-export type CallHttpAuthenticationResponse = { 
+export type CallHttpAuthenticationResponse = {
 /**
 * HTTP headers to add to the request. Existing headers will be replaced, while
 * new headers will be added.
 */
-setHeaders?: Array<HttpHeader>, 
+setHeaders?: Array<HttpHeader>,
 /**
 * Query parameters to add to the request. Existing params will be replaced, while
 * new params will be added.
@@ -78,7 +78,7 @@ export type ExportHttpRequestRequest = { httpRequest: HttpRequest, };

 export type ExportHttpRequestResponse = { content: string, };

-export type FileFilter = { name: string, 
+export type FileFilter = { name: string,
 /**
 * File extensions to require
 */
@@ -100,149 +100,149 @@ export type FormInputAccordion = { label: string, inputs?: Array<FormInput>, hid

 export type FormInputBanner = { inputs?: Array<FormInput>, hidden?: boolean, color?: Color, };

-export type FormInputBase = { 
+export type FormInputBase = {
 /**
 * The name of the input. The value will be stored at this object attribute in the resulting data
 */
-name: string, 
+name: string,
 /**
 * Whether this input is visible for the given configuration. Use this to
 * make branching forms.
 */
-hidden?: boolean, 
+hidden?: boolean,
 /**
 * Whether the user must fill in the argument
 */
-optional?: boolean, 
+optional?: boolean,
 /**
 * The label of the input
 */
-label?: string, 
+label?: string,
 /**
 * Visually hide the label of the input
 */
-hideLabel?: boolean, 
+hideLabel?: boolean,
 /**
 * The default value
 */
-defaultValue?: string, disabled?: boolean, 
+defaultValue?: string, disabled?: boolean,
 /**
 * Longer description of the input, likely shown in a tooltip
 */
 description?: string, };

-export type FormInputCheckbox = { 
+export type FormInputCheckbox = {
 /**
 * The name of the input. The value will be stored at this object attribute in the resulting data
 */
-name: string, 
+name: string,
 /**
 * Whether this input is visible for the given configuration. Use this to
 * make branching forms.
 */
-hidden?: boolean, 
+hidden?: boolean,
 /**
 * Whether the user must fill in the argument
 */
-optional?: boolean, 
+optional?: boolean,
 /**
 * The label of the input
 */
-label?: string, 
+label?: string,
 /**
 * Visually hide the label of the input
 */
-hideLabel?: boolean, 
+hideLabel?: boolean,
 /**
 * The default value
 */
-defaultValue?: string, disabled?: boolean, 
+defaultValue?: string, disabled?: boolean,
 /**
 * Longer description of the input, likely shown in a tooltip
 */
 description?: string, };

-export type FormInputEditor = { 
+export type FormInputEditor = {
 /**
 * Placeholder for the text input
 */
-placeholder?: string | null, 
+placeholder?: string | null,
 /**
 * Don't show the editor gutter (line numbers, folds, etc.)
 */
-hideGutter?: boolean, 
+hideGutter?: boolean,
 /**
 * Language for syntax highlighting
 */
-language?: EditorLanguage, readOnly?: boolean, 
+language?: EditorLanguage, readOnly?: boolean,
 /**
 * Fixed number of visible rows
 */
-rows?: number, completionOptions?: Array<GenericCompletionOption>, 
+rows?: number, completionOptions?: Array<GenericCompletionOption>,
 /**
 * The name of the input. The value will be stored at this object attribute in the resulting data
 */
-name: string, 
+name: string,
 /**
 * Whether this input is visible for the given configuration. Use this to
 * make branching forms.
 */
-hidden?: boolean, 
+hidden?: boolean,
 /**
 * Whether the user must fill in the argument
 */
-optional?: boolean, 
+optional?: boolean,
 /**
 * The label of the input
 */
-label?: string, 
+label?: string,
 /**
 * Visually hide the label of the input
 */
-hideLabel?: boolean, 
+hideLabel?: boolean,
 /**
 * The default value
 */
-defaultValue?: string, disabled?: boolean, 
+defaultValue?: string, disabled?: boolean,
 /**
 * Longer description of the input, likely shown in a tooltip
 */
 description?: string, };

-export type FormInputFile = { 
+export type FormInputFile = {
 /**
 * The title of the file selection window
 */
-title: string, 
+title: string,
 /**
 * Allow selecting multiple files
 */
-multiple?: boolean, directory?: boolean, defaultPath?: string, filters?: Array<FileFilter>, 
+multiple?: boolean, directory?: boolean, defaultPath?: string, filters?: Array<FileFilter>,
 /**
 * The name of the input. The value will be stored at this object attribute in the resulting data
 */
-name: string, 
+name: string,
 /**
 * Whether this input is visible for the given configuration. Use this to
 * make branching forms.
 */
-hidden?: boolean, 
+hidden?: boolean,
 /**
 * Whether the user must fill in the argument
 */
-optional?: boolean, 
+optional?: boolean,
 /**
 * The label of the input
 */
-label?: string, 
+label?: string,
 /**
 * Visually hide the label of the input
 */
-hideLabel?: boolean, 
+hideLabel?: boolean,
 /**
 * The default value
 */
-defaultValue?: string, disabled?: boolean, 
+defaultValue?: string, disabled?: boolean,
 /**
 * Longer description of the input, likely shown in a tooltip
 */
@@ -250,63 +250,63 @@ description?: string, };

 export type FormInputHStack = { inputs?: Array<FormInput>, hidden?: boolean, };

-export type FormInputHttpRequest = { 
+export type FormInputHttpRequest = {
 /**
 * The name of the input. The value will be stored at this object attribute in the resulting data
 */
-name: string, 
+name: string,
 /**
 * Whether this input is visible for the given configuration. Use this to
 * make branching forms.
 */
-hidden?: boolean, 
+hidden?: boolean,
 /**
 * Whether the user must fill in the argument
 */
-optional?: boolean, 
+optional?: boolean,
 /**
 * The label of the input
 */
-label?: string, 
+label?: string,
 /**
 * Visually hide the label of the input
 */
-hideLabel?: boolean, 
+hideLabel?: boolean,
 /**
 * The default value
 */
-defaultValue?: string, disabled?: boolean, 
+defaultValue?: string, disabled?: boolean,
 /**
 * Longer description of the input, likely shown in a tooltip
 */
 description?: string, };

-export type FormInputKeyValue = { 
+export type FormInputKeyValue = {
 /**
 * The name of the input. The value will be stored at this object attribute in the resulting data
 */
-name: string, 
+name: string,
 /**
 * Whether this input is visible for the given configuration. Use this to
 * make branching forms.
 */
-hidden?: boolean, 
+hidden?: boolean,
 /**
 * Whether the user must fill in the argument
 */
-optional?: boolean, 
+optional?: boolean,
 /**
 * The label of the input
 */
-label?: string, 
+label?: string,
 /**
 * Visually hide the label of the input
 */
-hideLabel?: boolean, 
+hideLabel?: boolean,
 /**
 * The default value
 */
-defaultValue?: string, disabled?: boolean, 
+defaultValue?: string, disabled?: boolean,
 /**
 * Longer description of the input, likely shown in a tooltip
 */
@@ -314,36 +314,36 @@ description?: string, };

 export type FormInputMarkdown = { content: string, hidden?: boolean, };

-export type FormInputSelect = { 
+export type FormInputSelect = {
 /**
 * The options that will be available in the select input
 */
-options: Array<FormInputSelectOption>, 
+options: Array<FormInputSelectOption>,
 /**
 * The name of the input. The value will be stored at this object attribute in the resulting data
 */
-name: string, 
+name: string,
 /**
 * Whether this input is visible for the given configuration. Use this to
 * make branching forms.
 */
-hidden?: boolean, 
+hidden?: boolean,
 /**
 * Whether the user must fill in the argument
 */
-optional?: boolean, 
+optional?: boolean,
 /**
 * The label of the input
 */
-label?: string, 
+label?: string,
 /**
 * Visually hide the label of the input
 */
-hideLabel?: boolean, 
+hideLabel?: boolean,
 /**
 * The default value
 */
-defaultValue?: string, disabled?: boolean, 
+defaultValue?: string, disabled?: boolean,
 /**
 * Longer description of the input, likely shown in a tooltip
 */
@@ -351,44 +351,44 @@ description?: string, };

 export type FormInputSelectOption = { label: string, value: string, };

-export type FormInputText = { 
+export type FormInputText = {
 /**
 * Placeholder for the text input
 */
-placeholder?: string | null, 
+placeholder?: string | null,
 /**
 * Placeholder for the text input
 */
-password?: boolean, 
+password?: boolean,
 /**
 * Whether to allow newlines in the input, like a <textarea/>
 */
-multiLine?: boolean, completionOptions?: Array<GenericCompletionOption>, 
+multiLine?: boolean, completionOptions?: Array<GenericCompletionOption>,
 /**
 * The name of the input. The value will be stored at this object attribute in the resulting data
 */
-name: string, 
+name: string,
 /**
 * Whether this input is visible for the given configuration. Use this to
 * make branching forms.
 */
-hidden?: boolean, 
+hidden?: boolean,
 /**
 * Whether the user must fill in the argument
 */
-optional?: boolean, 
+optional?: boolean,
 /**
 * The label of the input
 */
-label?: string, 
+label?: string,
 /**
 * Visually hide the label of the input
 */
-hideLabel?: boolean, 
+hideLabel?: boolean,
 /**
 * The default value
 */
-defaultValue?: string, disabled?: boolean, 
+defaultValue?: string, disabled?: boolean,
 /**
 * Longer description of the input, likely shown in a tooltip
 */
@@ -474,7 +474,7 @@ export type ListOpenWorkspacesResponse = { workspaces: Array<WorkspaceInfo>, };

 export type OpenExternalUrlRequest = { url: string, };

-export type OpenWindowRequest = { url: string, 
+export type OpenWindowRequest = { url: string,
 /**
 * Label for the window. If not provided, a random one will be generated.
 */
@@ -486,15 +486,15 @@ export type PromptFormRequest = { id: string, title: string, description?: strin

 export type PromptFormResponse = { values: { [key in string]?: JsonPrimitive } | null, done?: boolean, };

-export type PromptTextRequest = { id: string, title: string, label: string, description?: string, defaultValue?: string, placeholder?: string, 
+export type PromptTextRequest = { id: string, title: string, label: string, description?: string, defaultValue?: string, placeholder?: string,
 /**
 * Text to add to the confirmation button
 */
-confirmText?: string, password?: boolean, 
+confirmText?: string, password?: boolean,
 /**
 * Text to add to the cancel button
 */
-cancelText?: string, 
+cancelText?: string,
 /**
 * Require the user to enter a non-empty value
 */
@@ -524,12 +524,12 @@ export type SetKeyValueResponse = {};

 export type ShowToastRequest = { message: string, color?: Color, icon?: Icon, timeout?: number, };

-export type TemplateFunction = { name: string, previewType?: TemplateFunctionPreviewType, description?: string, 
+export type TemplateFunction = { name: string, previewType?: TemplateFunctionPreviewType, description?: string,
 /**
 * Also support alternative names. This is useful for not breaking existing
 * tags when changing the `name` property
 */
-aliases?: Array<string>, args: Array<TemplateFunctionArg>, 
+aliases?: Array<string>, args: Array<TemplateFunctionArg>,
 /**
 * A list of arg names to show in the inline preview. If not provided, none will be shown (for privacy reasons).
 */
@@ -546,23 +546,23 @@ export type TemplateRenderRequest = { data: JsonValue, purpose: RenderPurpose, }

 export type TemplateRenderResponse = { data: JsonValue, };

-export type Theme = { 
+export type Theme = {
 /**
 * How the theme is identified. This should never be changed
 */
-id: string, 
+id: string,
 /**
 * The friendly name of the theme to be displayed to the user
 */
-label: string, 
+label: string,
 /**
 * Whether the theme will be used for dark or light appearance
 */
-dark: boolean, 
+dark: boolean,
 /**
 * The default top-level colors for the theme
 */
-base: ThemeComponentColors, 
+base: ThemeComponentColors,
 /**
 * Optionally override theme for individual UI components for more control
 */
--- a/crates/yaak-plugins/bindings/gen_models.ts
+++ b/crates/yaak-plugins/bindings/gen_models.ts
@@ -18,7 +18,12 @@ export type EditorKeymap = "default" | "vim" | "vscode" | "emacs";

 export type EncryptedKey = { encryptedKey: string, };

-export type Environment = { model: "environment", id: string, workspaceId: string, createdAt: string, updatedAt: string, name: string, public: boolean, parentModel: string, parentId: string | null, variables: Array<EnvironmentVariable>, color: string | null, sortPriority: number, };
+export type Environment = { model: "environment", id: string, workspaceId: string, createdAt: string, updatedAt: string, name: string, public: boolean, parentModel: string, parentId: string | null, 
+/**
+ * Variables defined in this environment scope.
+ * Child environments override parent variables by name.
+ */
+variables: Array<EnvironmentVariable>, color: string | null, sortPriority: number, };

 export type EnvironmentVariable = { enabled?: boolean, name: string, value: string, id?: string, };

@@ -34,9 +39,17 @@ export type GrpcEvent = { model: "grpc_event", id: string, createdAt: string, up

 export type GrpcEventType = "info" | "error" | "client_message" | "server_message" | "connection_start" | "connection_end";

-export type GrpcRequest = { model: "grpc_request", id: string, createdAt: string, updatedAt: string, workspaceId: string, folderId: string | null, authenticationType: string | null, authentication: Record<string, any>, description: string, message: string, metadata: Array<HttpRequestHeader>, method: string | null, name: string, service: string | null, sortPriority: number, url: string, };
+export type GrpcRequest = { model: "grpc_request", id: string, createdAt: string, updatedAt: string, workspaceId: string, folderId: string | null, authenticationType: string | null, authentication: Record<string, any>, description: string, message: string, metadata: Array<HttpRequestHeader>, method: string | null, name: string, service: string | null, sortPriority: number, 
+/**
+ * Server URL (http for plaintext or https for secure)
+ */
+url: string, };

-export type HttpRequest = { model: "http_request", id: string, createdAt: string, updatedAt: string, workspaceId: string, folderId: string | null, authentication: Record<string, any>, authenticationType: string | null, body: Record<string, any>, bodyType: string | null, description: string, headers: Array<HttpRequestHeader>, method: string, name: string, sortPriority: number, url: string, urlParameters: Array<HttpUrlParameter>, };
+export type HttpRequest = { model: "http_request", id: string, createdAt: string, updatedAt: string, workspaceId: string, folderId: string | null, authentication: Record<string, any>, authenticationType: string | null, body: Record<string, any>, bodyType: string | null, description: string, headers: Array<HttpRequestHeader>, method: string, name: string, sortPriority: number, url: string, 
+/**
+ * URL parameters used for both path placeholders (`:id`) and query string entries.
+ */
+urlParameters: Array<HttpUrlParameter>, };

 export type HttpRequestHeader = { enabled?: boolean, name: string, value: string, id?: string, };

@@ -49,17 +62,24 @@ export type HttpResponseEvent = { model: "http_response_event", id: string, crea
 * This mirrors `yaak_http::sender::HttpResponseEvent` but with serde support.
 * The `From` impl is in yaak-http to avoid circular dependencies.
 */
-export type HttpResponseEventData = { "type": "setting", name: string, value: string, } | { "type": "info", message: string, } | { "type": "redirect", url: string, status: number, behavior: string, } | { "type": "send_url", method: string, scheme: string, username: string, password: string, host: string, port: number, path: string, query: string, fragment: string, } | { "type": "receive_url", version: string, status: string, } | { "type": "header_up", name: string, value: string, } | { "type": "header_down", name: string, value: string, } | { "type": "chunk_sent", bytes: number, } | { "type": "chunk_received", bytes: number, } | { "type": "dns_resolved", hostname: string, addresses: Array<string>, duration: bigint, overridden: boolean, };
+export type HttpResponseEventData = { "type": "setting", name: string, value: string, } | { "type": "info", message: string, } | { "type": "redirect", url: string, status: number, behavior: string, dropped_body: boolean, dropped_headers: Array<string>, } | { "type": "send_url", method: string, scheme: string, username: string, password: string, host: string, port: number, path: string, query: string, fragment: string, } | { "type": "receive_url", version: string, status: string, } | { "type": "header_up", name: string, value: string, } | { "type": "header_down", name: string, value: string, } | { "type": "chunk_sent", bytes: number, } | { "type": "chunk_received", bytes: number, } | { "type": "dns_resolved", hostname: string, addresses: Array<string>, duration: bigint, overridden: boolean, };

 export type HttpResponseHeader = { name: string, value: string, };

 export type HttpResponseState = "initialized" | "connected" | "closed";

-export type HttpUrlParameter = { enabled?: boolean, name: string, value: string, id?: string, };
+export type HttpUrlParameter = { enabled?: boolean, 
+/**
+ * Colon-prefixed parameters are treated as path parameters if they match, like `/users/:id`
+ * Other entries are appended as query parameters
+ */
+name: string, value: string, id?: string, };

 export type KeyValue = { model: "key_value", id: string, createdAt: string, updatedAt: string, key: string, namespace: string, value: string, };

-export type Plugin = { model: "plugin", id: string, createdAt: string, updatedAt: string, checkedAt: string | null, directory: string, enabled: boolean, url: string | null, };
+export type Plugin = { model: "plugin", id: string, createdAt: string, updatedAt: string, checkedAt: string | null, directory: string, enabled: boolean, url: string | null, source: PluginSource, };
+
+export type PluginSource = "bundled" | "filesystem" | "registry";

 export type ProxySetting = { "type": "enabled", http: string, https: string, auth: ProxySettingAuth | null, bypass: string, disabled: boolean, } | { "type": "disabled" };

@@ -77,7 +97,11 @@ export type WebsocketEvent = { model: "websocket_event", id: string, createdAt:

 export type WebsocketEventType = "binary" | "close" | "frame" | "open" | "ping" | "pong" | "text";

-export type WebsocketRequest = { model: "websocket_request", id: string, createdAt: string, updatedAt: string, workspaceId: string, folderId: string | null, authentication: Record<string, any>, authenticationType: string | null, description: string, headers: Array<HttpRequestHeader>, message: string, name: string, sortPriority: number, url: string, urlParameters: Array<HttpUrlParameter>, };
+export type WebsocketRequest = { model: "websocket_request", id: string, createdAt: string, updatedAt: string, workspaceId: string, folderId: string | null, authentication: Record<string, any>, authenticationType: string | null, description: string, headers: Array<HttpRequestHeader>, message: string, name: string, sortPriority: number, url: string, 
+/**
+ * URL parameters used for both path placeholders (`:id`) and query string entries.
+ */
+urlParameters: Array<HttpUrlParameter>, };

 export type Workspace = { model: "workspace", id: string, createdAt: string, updatedAt: string, authentication: Record<string, any>, authenticationType: string | null, description: string, headers: Array<HttpRequestHeader>, name: string, encryptionKeyChallenge: string | null, settingValidateCertificates: boolean, settingFollowRedirects: boolean, settingRequestTimeout: number, settingDnsOverrides: Array<DnsOverride>, };

--- a/crates/yaak-plugins/index.ts
+++ b/crates/yaak-plugins/index.ts
@@ -1,26 +1,30 @@
-import { invoke } from '@tauri-apps/api/core';
-import { PluginNameVersion, PluginSearchResponse, PluginUpdatesResponse } from './bindings/gen_api';
+import { invoke } from "@tauri-apps/api/core";
+import { PluginNameVersion, PluginSearchResponse, PluginUpdatesResponse } from "./bindings/gen_api";

-export * from './bindings/gen_models';
-export * from './bindings/gen_events';
-export * from './bindings/gen_search';
+export * from "./bindings/gen_models";
+export * from "./bindings/gen_events";
+export * from "./bindings/gen_search";

 export async function searchPlugins(query: string) {
-  return invoke<PluginSearchResponse>('cmd_plugins_search', { query });
+  return invoke<PluginSearchResponse>("cmd_plugins_search", { query });
 }

 export async function installPlugin(name: string, version: string | null) {
-  return invoke<void>('cmd_plugins_install', { name, version });
+  return invoke<void>("cmd_plugins_install", { name, version });
 }

 export async function uninstallPlugin(pluginId: string) {
-  return invoke<void>('cmd_plugins_uninstall', { pluginId });
+  return invoke<void>("cmd_plugins_uninstall", { pluginId });
 }

 export async function checkPluginUpdates() {
-  return invoke<PluginUpdatesResponse>('cmd_plugins_updates', {});
+  return invoke<PluginUpdatesResponse>("cmd_plugins_updates", {});
 }

 export async function updateAllPlugins() {
-  return invoke<PluginNameVersion[]>('cmd_plugins_update_all', {});
+  return invoke<PluginNameVersion[]>("cmd_plugins_update_all", {});
+}
+
+export async function installPluginFromDirectory(directory: string) {
+  return invoke<void>("cmd_plugins_install_from_directory", { directory });
 }
--- a/crates/yaak-plugins/package.json
+++ b/crates/yaak-plugins/package.json
@@ -1,6 +1,6 @@
 {
  "name": "@yaakapp-internal/plugins",
-  "private": true,
  "version": "1.0.0",
+  "private": true,
  "main": "index.ts"
 }
--- a/crates/yaak-plugins/src/api.rs
+++ b/crates/yaak-plugins/src/api.rs
@@ -7,7 +7,7 @@ use serde::{Deserialize, Serialize};
 use std::path::Path;
 use std::str::FromStr;
 use ts_rs::TS;
-use yaak_models::models::Plugin;
+use yaak_models::models::{Plugin, PluginSource};

 /// Get plugin info from the registry.
 pub async fn get_plugin(
@@ -58,7 +58,7 @@ pub async fn check_plugin_updates(
 ) -> Result<PluginUpdatesResponse> {
    let name_versions: Vec<PluginNameVersion> = plugins
        .into_iter()
-        .filter(|p| p.url.is_some()) // Only check plugins with URLs (from registry)
+        .filter(|p| matches!(p.source, PluginSource::Registry)) // Only check registry-installed plugins
        .filter_map(|p| match get_plugin_meta(&Path::new(&p.directory)) {
            Ok(m) => Some(PluginNameVersion { name: m.name, version: m.version }),
            Err(e) => {
--- a/crates/yaak-plugins/src/install.rs
+++ b/crates/yaak-plugins/src/install.rs
@@ -9,7 +9,7 @@ use log::info;
 use std::fs::{create_dir_all, remove_dir_all};
 use std::io::Cursor;
 use std::sync::Arc;
-use yaak_models::models::Plugin;
+use yaak_models::models::{Plugin, PluginSource};
 use yaak_models::query_manager::QueryManager;
 use yaak_models::util::UpdateSource;

@@ -78,6 +78,7 @@ pub async fn download_and_install(
                directory: plugin_dir_str.clone(),
                enabled: true,
                url: Some(plugin_version.url.clone()),
+                source: PluginSource::Registry,
                ..Default::default()
            },
            &UpdateSource::Background,
--- a/crates/yaak-plugins/src/manager.rs
+++ b/crates/yaak-plugins/src/manager.rs
@@ -21,9 +21,10 @@ use crate::events::{
 use crate::native_template_functions::{template_function_keyring, template_function_secure};
 use crate::nodejs::start_nodejs_plugin_runtime;
 use crate::plugin_handle::PluginHandle;
+use crate::plugin_meta::get_plugin_meta;
 use crate::server_ws::PluginRuntimeServerWebsocket;
 use log::{error, info, warn};
-use std::collections::HashMap;
+use std::collections::{HashMap, HashSet};
 use std::env;
 use std::path::{Path, PathBuf};
 use std::sync::Arc;
@@ -33,7 +34,7 @@ use tokio::net::TcpListener;
 use tokio::sync::mpsc::error::TrySendError;
 use tokio::sync::{Mutex, mpsc, oneshot};
 use tokio::time::{Instant, timeout};
-use yaak_models::models::Plugin;
+use yaak_models::models::{Plugin, PluginSource};
 use yaak_models::query_manager::QueryManager;
 use yaak_models::util::{UpdateSource, generate_id};
 use yaak_templates::error::Error::RenderError;
@@ -49,6 +50,8 @@ pub struct PluginManager {
    vendored_plugin_dir: PathBuf,
    pub(crate) installed_plugin_dir: PathBuf,
    dev_mode: bool,
+    /// Errors from plugin initialization, retrievable once via `take_init_errors`.
+    init_errors: Arc<Mutex<Vec<(String, String)>>>,
 }

 /// Callback for plugin initialization events (e.g., toast notifications)
@@ -92,6 +95,7 @@ impl PluginManager {
            vendored_plugin_dir,
            installed_plugin_dir,
            dev_mode,
+            init_errors: Default::default(),
        };

        // Forward events to subscribers
@@ -162,13 +166,14 @@ impl PluginManager {

        let bundled_dirs = plugin_manager.list_bundled_plugin_dirs().await?;
        let db = query_manager.connect();
-        for dir in bundled_dirs {
-            if db.get_plugin_by_directory(&dir).is_none() {
+        for dir in &bundled_dirs {
+            if db.get_plugin_by_directory(dir).is_none() {
                db.upsert_plugin(
                    &Plugin {
-                        directory: dir,
+                        directory: dir.clone(),
                        enabled: true,
                        url: None,
+                        source: PluginSource::Bundled,
                        ..Default::default()
                    },
                    &UpdateSource::Background,
@@ -181,17 +186,21 @@ impl PluginManager {

        let init_errors = plugin_manager.initialize_all_plugins(plugins, plugin_context).await;
        if !init_errors.is_empty() {
-            let joined = init_errors
-                .into_iter()
-                .map(|(dir, err)| format!("{dir}: {err}"))
-                .collect::<Vec<_>>()
-                .join("; ");
-            return Err(PluginErr(format!("Failed to initialize plugin(s): {joined}")));
+            for (dir, err) in &init_errors {
+                warn!("Plugin failed to initialize: {dir}: {err}");
+            }
+            *plugin_manager.init_errors.lock().await = init_errors;
        }

        Ok(plugin_manager)
    }

+    /// Take any initialization errors, clearing them from the manager.
+    /// Returns a list of `(plugin_directory, error_message)` pairs.
+    pub async fn take_init_errors(&self) -> Vec<(String, String)> {
+        std::mem::take(&mut *self.init_errors.lock().await)
+    }
+
    /// Get the vendored plugin directory path (resolves dev mode path if applicable)
    pub fn get_plugins_dir(&self) -> PathBuf {
        if self.dev_mode {
@@ -213,6 +222,57 @@ impl PluginManager {
        read_plugins_dir(&plugins_dir).await
    }

+    pub async fn resolve_plugins_for_runtime_from_db(&self, plugins: Vec<Plugin>) -> Vec<Plugin> {
+        let bundled_dirs = match self.list_bundled_plugin_dirs().await {
+            Ok(dirs) => dirs,
+            Err(err) => {
+                warn!("Failed to read bundled plugin dirs for resolution: {err:?}");
+                Vec::new()
+            }
+        };
+        self.resolve_plugins_for_runtime(plugins, bundled_dirs)
+    }
+
+    /// Resolve the plugin set for the current runtime instance.
+    ///
+    /// Rules:
+    /// - Drop bundled rows that are not present in this instance's bundled directory list.
+    /// - Deduplicate by plugin metadata name (fallback to directory key when metadata is unreadable).
+    /// - Prefer sources in this order: filesystem > registry > bundled.
+    /// - For same-source conflicts, prefer the most recently installed row (`created_at`).
+    fn resolve_plugins_for_runtime(
+        &self,
+        plugins: Vec<Plugin>,
+        bundled_dirs: Vec<String>,
+    ) -> Vec<Plugin> {
+        let bundled_dir_set: HashSet<String> = bundled_dirs.into_iter().collect();
+        let mut selected: HashMap<String, Plugin> = HashMap::new();
+
+        for plugin in plugins {
+            if matches!(plugin.source, PluginSource::Bundled)
+                && !bundled_dir_set.contains(&plugin.directory)
+            {
+                continue;
+            }
+
+            let key = match get_plugin_meta(Path::new(&plugin.directory)) {
+                Ok(meta) => meta.name,
+                Err(_) => format!("__dir__{}", plugin.directory),
+            };
+
+            match selected.get(&key) {
+                Some(existing) if !prefer_plugin(&plugin, existing) => {}
+                _ => {
+                    selected.insert(key, plugin);
+                }
+            }
+        }
+
+        let mut resolved = selected.into_values().collect::<Vec<_>>();
+        resolved.sort_by(|a, b| b.created_at.cmp(&a.created_at));
+        resolved
+    }
+
    pub async fn uninstall(&self, plugin_context: &PluginContext, dir: &str) -> Result<()> {
        let plugin = self.get_plugin_by_dir(dir).await.ok_or(PluginNotFoundErr(dir.to_string()))?;
        self.remove_plugin(plugin_context, &plugin).await
@@ -287,7 +347,8 @@ impl PluginManager {
        Ok(())
    }

-    /// Initialize all plugins from the provided list.
+    /// Initialize all plugins from the provided DB list.
+    /// Plugin candidates are resolved for this runtime instance before initialization.
    /// Returns a list of (plugin_directory, error_message) for any plugins that failed to initialize.
    pub async fn initialize_all_plugins(
        &self,
@@ -297,15 +358,18 @@ impl PluginManager {
        info!("Initializing all plugins");
        let start = Instant::now();
        let mut errors = Vec::new();
+        let plugins = self.resolve_plugins_for_runtime_from_db(plugins).await;
+
+        // Rebuild runtime handles from scratch to avoid stale/duplicate handles.
+        let existing_handles = { self.plugin_handles.lock().await.clone() };
+        for plugin_handle in existing_handles {
+            if let Err(e) = self.remove_plugin(plugin_context, &plugin_handle).await {
+                error!("Failed to remove plugin {} {e:?}", plugin_handle.dir);
+                errors.push((plugin_handle.dir.clone(), e.to_string()));
+            }
+        }

        for plugin in plugins {
-            // First remove the plugin if it exists and is enabled
-            if let Some(plugin_handle) = self.get_plugin_by_dir(&plugin.directory).await {
-                if let Err(e) = self.remove_plugin(plugin_context, &plugin_handle).await {
-                    error!("Failed to remove plugin {} {e:?}", plugin.directory);
-                    continue;
-                }
-            }
            if let Err(e) = self.add_plugin(plugin_context, &plugin).await {
                warn!("Failed to add plugin {} {e:?}", plugin.directory);
                errors.push((plugin.directory.clone(), e.to_string()));
@@ -1063,6 +1127,24 @@ impl PluginManager {
    }
 }

+fn source_priority(source: &PluginSource) -> i32 {
+    match source {
+        PluginSource::Filesystem => 3,
+        PluginSource::Registry => 2,
+        PluginSource::Bundled => 1,
+    }
+}
+
+fn prefer_plugin(candidate: &Plugin, existing: &Plugin) -> bool {
+    let candidate_priority = source_priority(&candidate.source);
+    let existing_priority = source_priority(&existing.source);
+    if candidate_priority != existing_priority {
+        return candidate_priority > existing_priority;
+    }
+
+    candidate.created_at > existing.created_at
+}
+
 async fn read_plugins_dir(dir: &PathBuf) -> Result<Vec<String>> {
    let mut result = read_dir(dir).await?;
    let mut dirs: Vec<String> = vec![];
@@ -1081,16 +1163,10 @@ async fn read_plugins_dir(dir: &PathBuf) -> Result<Vec<String>> {
 fn fix_windows_paths(p: &PathBuf) -> String {
    use dunce;
    use path_slash::PathBufExt;
-    use regex::Regex;

-    // 1. Remove UNC prefix for Windows paths to pass to sidecar
-    let safe_path = dunce::simplified(p.as_path()).to_string_lossy().to_string();
+    // 1. Remove UNC prefix for Windows paths
+    let safe_path = dunce::simplified(p.as_path());

-    // 2. Remove the drive letter
-    let safe_path = Regex::new("^[a-zA-Z]:").unwrap().replace(safe_path.as_str(), "");
-
-    // 3. Convert backslashes to forward
-    let safe_path = PathBuf::from(safe_path.to_string()).to_slash_lossy().to_string();
-
-    safe_path
+    // 2. Convert backslashes to forward slashes for Node.js compatibility
+    PathBuf::from(safe_path).to_slash_lossy().to_string()
 }
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
dependabot[bot]	ed90c88b9f	Bump tar from 0.4.44 to 0.4.45 Bumps [tar](https://github.com/alexcrichton/tar-rs) from 0.4.44 to 0.4.45. - [Commits](https://github.com/alexcrichton/tar-rs/compare/0.4.44...0.4.45) --- updated-dependencies: - dependency-name: tar dependency-version: 0.4.45 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>	2026-03-20 18:13:13 +00:00
Gregory Schier	b4a1c418bb	Run oxfmt across repo, add format script and docs Add .oxfmtignore to skip generated bindings and wasm-pack output. Add npm format script, update DEVELOPMENT.md for Vite+ toolchain, and format all non-generated files with oxfmt. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-13 10:15:49 -07:00
Gregory Schier	45262edfbd	Migrate to Vite+ unified toolchain (#428 )	2026-03-13 09:27:56 -07:00
Gregory Schier	aed7bd12ea	Add react compiler	2026-03-13 06:49:14 -07:00
Gregory Schier	b5928af1d7	Bump react	2026-03-13 06:47:42 -07:00
Gregory Schier	6cc47bea38	Fixes for wasm	2026-03-13 06:46:27 -07:00
Gregory Schier	b83d9e6765	Vite 8 upgrade	2026-03-13 06:33:20 -07:00
Gregory Schier	c8ba35e268	Gracefully handle plugin init failures (#424 ) Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-11 16:55:46 -07:00
Gregory Schier	8a330ad1ec	Auto-detect WSL and resolve Windows data directory for CLI When running the CLI in WSL, dirs::data_dir() returns the Linux path instead of the Windows host path where the Yaak desktop app stores data. This detects WSL via /proc/version, resolves %APPDATA% through cmd.exe, and converts it to a WSL mount path using wslpath. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-10 17:23:00 -07:00
Gregory Schier	b563319bed	Fix biome lint: update schema to 2.3.13, exclude npm dir, fix lint errors Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-05 16:19:05 -08:00
Gregory Schier	3d577dd7d9	Update release skills for CLI	2026-03-05 16:06:40 -08:00
Gregory Schier	591c68c59c	Revert macOS CI runners back to macos-latest Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-05 15:59:10 -08:00
Gregory Schier	a0cb7f813f	Replace format-graphql with pretty_graphql for comment-preserving GraphQL formatting Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-05 15:53:13 -08:00
Gregory Schier	cfab62707e	Exclude yaak-cli from app release tests and remove stale lint comments Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-05 15:36:09 -08:00
Gregory Schier	267508e533	Support comments in JSON body (#419 ) Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-05 15:05:09 -08:00
Gregory Schier	242f55b609	Fix macOS Tahoe stoplight positioning and build on macOS 26 On macOS Tahoe (26+), the default title bar is 32px with 14px buttons, so the old formula (button_height + PAD_Y = 14 + 18 = 32) produced no change. Add TITLEBAR_EXTRA_HEIGHT to push the title bar taller than the Tahoe default. Use OnceLock to capture the original default height so repeated calls don't accumulate extra pixels. Also update CI runners to macos-26 for Tahoe SDK builds and adjust frontend padding for larger stoplights. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-05 14:56:19 -08:00
dependabot[bot]	67a3dd15ac	Bump @hono/node-server from 1.19.9 to 1.19.10 (#417 ) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-03-05 13:24:21 -08:00
dependabot[bot]	543325613b	Bump hono from 4.11.10 to 4.12.4 (#416 ) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-03-05 13:24:04 -08:00
Gregory Schier	88f5f0e045	Add redirect drop metadata and warning UI (#418 )	2026-03-05 06:14:11 -08:00
Gregory Schier	615f3134d2	Fix plugin settings layout	2026-03-04 09:21:15 -08:00
Gregory Schier	0c7051d59c	Better external OAuth callback format	2026-03-04 09:10:49 -08:00
Gregory Schier	30f006401a	CLI plugin host: handle send/render HTTP requests (#415 ) Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-03 16:41:53 -08:00
Gregory Schier	3c12074db6	Mention CLI in main dropdown	2026-03-03 06:50:25 -08:00
Gregory Schier	851f12f149	app: detect CLI availability and add command palette copy action	2026-03-02 14:55:04 -08:00
Gregory Schier	cc0d31fdbb	cli: use update.yaak.app /cli/check for version checks	2026-03-02 14:52:23 -08:00
Gregory Schier	bab4fe899b	Upgrade Yaak CLI	2026-03-02 08:01:02 -08:00
Gregory Schier	0b250ff5b5	Fix lint	2026-03-02 07:52:08 -08:00
Gregory Schier	fbf0473b20	Fix plugin dev rebuild signaling and reload toast timing	2026-03-02 07:02:28 -08:00
Gregory Schier	876b7ef454	Add top-level generate and publish CLI aliases	2026-03-02 06:28:04 -08:00
Gregory Schier	96e8572758	Add CLI update check and API client kind identity	2026-03-02 06:21:00 -08:00
Gregory Schier	f302dc39a2	Move local plugin install command into plugins_ext	2026-03-01 16:42:13 -08:00
Gregory Schier	2ca51125a4	Improve plugin source modeling and runtime dedup (#414 )	2026-03-01 16:30:43 -08:00
Gregory Schier	2d99e26f19	plugin-events: route model/find requests through shared handler (#409 )	2026-02-28 14:16:32 -08:00
Gregory Schier	da1e04d99e	Fix Copy as gRPCurl with template-tag payloads (#413 )	2026-02-28 07:39:44 -08:00
dependabot[bot]	d875eaa5bf	Bump minimatch from 3.1.2 to 3.1.5 (#411 ) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-02-28 07:29:04 -08:00
Gregory Schier	5fa2469cd6	Some cleanup	2026-02-28 07:24:30 -08:00
Gregory Schier	49053cb423	Fix [object Object] request descriptions after OpenAPI import (#412 )	2026-02-27 15:36:46 -08:00
Gregory Schier	37d0cabb22	fix: preserve drive letter in Windows plugin paths (#410 ) Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>	2026-02-26 16:23:24 -08:00
Gregory Schier	435ee54140	docs: clarify app vs cli tag naming	2026-02-26 09:40:58 -08:00
dependabot[bot]	407f2c9921	Bump rollup from 4.55.1 to 4.59.0 (#406 ) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-02-26 09:31:25 -08:00
Gregory Schier	3a6630a14d	tests(cli): prevent request send test teardown hang (#408 )	2026-02-26 08:58:13 -08:00