snapshot of https://github.com/mountain-loop/yaak.git (main, 2026-09-23; blobs > 131072B omitted)

crates/common/yaak-database/Cargo.toml

@@ -0,0 +1,28 @@
+[package]
+name = "yaak-database"
+version = "0.1.0"
+edition = "2024"
+publish = false
+
+[dependencies]
+chrono = { version = "0.4.38", features = ["serde"] }
+include_dir = "0.7"
+log = { workspace = true }
+nanoid = "0.4.0"
+rusqlite = { version = "0.38", features = ["bundled", "chrono"] }
+sea-query-rusqlite = { version = "0.8.0", features = ["with-chrono"] }
+sea-query = { version = "1.0", features = ["with-chrono", "attr"] }
+serde = { workspace = true, features = ["derive"] }
+serde_json = { workspace = true }
+thiserror = { workspace = true }
+ts-rs = { workspace = true }
+
+[target.'cfg(not(target_arch = "wasm32"))'.dependencies]
+r2d2 = "0.8.10"
+r2d2_sqlite = { version = "0.32" }
+
+# nanoid pulls getrandom, which needs to be told how to reach the browser's
+# CSPRNG on wasm32-unknown-unknown. Native targets are unaffected.
+[target.'cfg(target_arch = "wasm32")'.dependencies]
+getrandom = { version = "0.2", features = ["js"] }
+uuid = { version = "1", features = ["js"] }

crates/common/yaak-database/src/connection_or_tx.rs

@@ -0,0 +1,24 @@
+use crate::pool::SqliteConn;
+use rusqlite::{Connection, Statement, ToSql, Transaction};
+
+pub enum ConnectionOrTx<'a> {
+    Connection(SqliteConn),
+    Transaction(&'a Transaction<'a>),
+}
+
+impl<'a> ConnectionOrTx<'a> {
+    pub fn resolve(&self) -> &Connection {
+        match self {
+            ConnectionOrTx::Connection(c) => c,
+            ConnectionOrTx::Transaction(c) => c,
+        }
+    }
+
+    pub fn prepare(&self, sql: &str) -> rusqlite::Result<Statement<'_>> {
+        self.resolve().prepare(sql)
+    }
+
+    pub fn execute(&self, sql: &str, params: &[&dyn ToSql]) -> rusqlite::Result<usize> {
+        self.resolve().execute(sql, params)
+    }
+}

crates/common/yaak-database/src/db_context.rs

@@ -0,0 +1,194 @@
+use crate::connection_or_tx::ConnectionOrTx;
+use crate::error::Error::ModelNotFound;
+use crate::error::Result;
+use crate::traits::UpsertModelInfo;
+use crate::update_source::UpdateSource;
+use sea_query::ExprTrait;
+use sea_query::{
+    Asterisk, Expr, Func, IntoColumnRef, IntoIden, OnConflict, Query, SimpleExpr,
+    SqliteQueryBuilder,
+};
+use sea_query_rusqlite::RusqliteBinder;
+use std::fmt::Debug;
+
+pub struct DbContext<'a> {
+    conn: ConnectionOrTx<'a>,
+}
+
+impl<'a> DbContext<'a> {
+    pub fn new(conn: ConnectionOrTx<'a>) -> Self {
+        Self { conn }
+    }
+
+    pub fn conn(&self) -> &ConnectionOrTx<'a> {
+        &self.conn
+    }
+
+    pub fn find_one<M>(
+        &self,
+        col: impl IntoColumnRef + IntoIden + Clone,
+        value: impl Into<SimpleExpr> + Debug,
+    ) -> Result<M>
+    where
+        M: UpsertModelInfo,
+    {
+        let value_debug = format!("{:?}", value);
+        let value_expr = value.into();
+        let (sql, params) = Query::select()
+            .from(M::table_name())
+            .column(Asterisk)
+            .cond_where(Expr::col(col.clone()).eq(value_expr))
+            .build_rusqlite(SqliteQueryBuilder);
+        let mut stmt = self.conn.prepare(sql.as_str()).expect("Failed to prepare query");
+        match stmt.query_row(&*params.as_params(), M::from_row) {
+            Ok(result) => Ok(result),
+            Err(rusqlite::Error::QueryReturnedNoRows) => Err(ModelNotFound(format!(
+                r#"table "{}" {} == {}"#,
+                M::table_name().into_iden().to_string(),
+                col.into_iden().to_string(),
+                value_debug
+            ))),
+            Err(e) => Err(crate::error::Error::SqlError(e)),
+        }
+    }
+
+    pub fn find_optional<M>(
+        &self,
+        col: impl IntoColumnRef,
+        value: impl Into<SimpleExpr>,
+    ) -> Option<M>
+    where
+        M: UpsertModelInfo,
+    {
+        let (sql, params) = Query::select()
+            .from(M::table_name())
+            .column(Asterisk)
+            .cond_where(Expr::col(col).eq(value))
+            .build_rusqlite(SqliteQueryBuilder);
+        let mut stmt = self.conn.prepare(sql.as_str()).expect("Failed to prepare query");
+        stmt.query_row(&*params.as_params(), M::from_row).ok()
+    }
+
+    pub fn find_all<M>(&self) -> Result<Vec<M>>
+    where
+        M: UpsertModelInfo,
+    {
+        let (order_by_col, order_by_dir) = M::order_by();
+        let (sql, params) = Query::select()
+            .from(M::table_name())
+            .column(Asterisk)
+            .order_by(order_by_col, order_by_dir)
+            .build_rusqlite(SqliteQueryBuilder);
+        let mut stmt = self.conn.resolve().prepare(sql.as_str())?;
+        let items = stmt.query_map(&*params.as_params(), M::from_row)?;
+        Ok(items.map(|v| v.unwrap()).collect())
+    }
+
+    pub fn find_many<M>(
+        &self,
+        col: impl IntoColumnRef,
+        value: impl Into<SimpleExpr>,
+        limit: Option<u64>,
+    ) -> Result<Vec<M>>
+    where
+        M: UpsertModelInfo,
+    {
+        let (order_by_col, order_by_dir) = M::order_by();
+        let (sql, params) = if let Some(limit) = limit {
+            Query::select()
+                .from(M::table_name())
+                .column(Asterisk)
+                .cond_where(Expr::col(col).eq(value))
+                .limit(limit)
+                .order_by(order_by_col, order_by_dir)
+                .build_rusqlite(SqliteQueryBuilder)
+        } else {
+            Query::select()
+                .from(M::table_name())
+                .column(Asterisk)
+                .cond_where(Expr::col(col).eq(value))
+                .order_by(order_by_col, order_by_dir)
+                .build_rusqlite(SqliteQueryBuilder)
+        };
+
+        let mut stmt = self.conn.resolve().prepare(sql.as_str())?;
+        let items = stmt.query_map(&*params.as_params(), M::from_row)?;
+        Ok(items.map(|v| v.unwrap()).collect())
+    }
+
+    /// Upsert a model. Returns `(model, created)` where `created` is true if a new row was inserted.
+    pub fn upsert<M>(&self, model: &M, source: &UpdateSource) -> Result<(M, bool)>
+    where
+        M: UpsertModelInfo + Clone,
+    {
+        let id_iden = M::id_column().into_iden();
+        let id_val = model.get_id();
+        let other_values = model.clone().insert_values(source)?;
+
+        let mut column_vec = vec![id_iden.clone()];
+        let mut value_vec =
+            vec![if id_val.is_empty() { M::generate_id().into() } else { id_val.into() }];
+
+        for (col, val) in other_values {
+            value_vec.push(val.into());
+            column_vec.push(col.into_iden());
+        }
+
+        let on_conflict =
+            OnConflict::column(id_iden).update_columns(M::update_columns()).to_owned();
+
+        let (sql, params) = Query::insert()
+            .into_table(M::table_name())
+            .columns(column_vec)
+            .values_panic(value_vec)
+            .on_conflict(on_conflict)
+            .returning(Query::returning().exprs(vec![
+                Expr::col(Asterisk),
+                Expr::expr(Func::cust("last_insert_rowid")),
+                Expr::col("rowid"),
+            ]))
+            .build_rusqlite(SqliteQueryBuilder);
+
+        let mut stmt = self.conn.resolve().prepare(sql.as_str())?;
+        let (m, created): (M, bool) = stmt.query_row(&*params.as_params(), |row| {
+            M::from_row(row).and_then(|m| {
+                let rowid: i64 = row.get("rowid")?;
+                let last_rowid: i64 = row.get("last_insert_rowid()")?;
+                Ok((m, rowid == last_rowid))
+            })
+        })?;
+
+        Ok((m, created))
+    }
+
+    /// Bulk-delete all rows matching a column value with a single statement.
+    /// Returns the number of rows deleted.
+    pub fn delete_many<M>(
+        &self,
+        col: impl IntoColumnRef,
+        value: impl Into<SimpleExpr>,
+    ) -> Result<usize>
+    where
+        M: UpsertModelInfo,
+    {
+        let (sql, params) = Query::delete()
+            .from_table(M::table_name())
+            .cond_where(Expr::col(col).eq(value))
+            .build_rusqlite(SqliteQueryBuilder);
+        let count = self.conn.execute(sql.as_str(), &*params.as_params())?;
+        Ok(count)
+    }
+
+    /// Delete a model by its ID. Returns the number of rows deleted.
+    pub fn delete<M>(&self, m: &M) -> Result<usize>
+    where
+        M: UpsertModelInfo,
+    {
+        let (sql, params) = Query::delete()
+            .from_table(M::table_name())
+            .cond_where(Expr::col(M::id_column().into_iden()).eq(m.get_id()))
+            .build_rusqlite(SqliteQueryBuilder);
+        let count = self.conn.execute(sql.as_str(), &*params.as_params())?;
+        Ok(count)
+    }
+}

crates/common/yaak-database/src/error.rs

@@ -0,0 +1,37 @@
+use serde::{Serialize, Serializer};
+use thiserror::Error;
+
+#[derive(Error, Debug)]
+pub enum Error {
+    #[error("SQL error: {0}")]
+    SqlError(#[from] rusqlite::Error),
+
+    #[error("SQL Pool error: {0}")]
+    SqlPoolError(#[from] crate::pool::PoolError),
+
+    #[error("Database error: {0}")]
+    Database(String),
+
+    #[error("IO error: {0}")]
+    Io(#[from] std::io::Error),
+
+    #[error("JSON error: {0}")]
+    JsonError(#[from] serde_json::Error),
+
+    #[error("Model not found: {0}")]
+    ModelNotFound(String),
+
+    #[error("DB Migration Failed: {0}")]
+    MigrationError(String),
+}
+
+impl Serialize for Error {
+    fn serialize<S>(&self, serializer: S) -> std::result::Result<S::Ok, S::Error>
+    where
+        S: Serializer,
+    {
+        serializer.serialize_str(self.to_string().as_ref())
+    }
+}
+
+pub type Result<T> = std::result::Result<T, Error>;

crates/common/yaak-database/src/lib.rs

@@ -0,0 +1,26 @@
+pub mod connection_or_tx;
+pub mod db_context;
+pub mod error;
+pub mod migrate;
+pub mod pool;
+pub mod traits;
+pub mod update_source;
+pub mod util;
+
+// Re-export key types for convenience
+pub use connection_or_tx::ConnectionOrTx;
+pub use db_context::DbContext;
+pub use error::{Error, Result};
+pub use migrate::run_migrations;
+pub use pool::{PoolError, SqliteConn, SqlitePool};
+pub use traits::{UpsertModelInfo, upsert_date};
+pub use update_source::{ModelChangeEvent, UpdateSource};
+pub use util::{generate_id, generate_id_of_length, generate_prefixed_id};
+
+// Re-export types that consumers will need
+#[cfg(not(target_arch = "wasm32"))]
+pub use r2d2;
+#[cfg(not(target_arch = "wasm32"))]
+pub use r2d2_sqlite;
+pub use rusqlite;
+pub use sea_query;

crates/common/yaak-database/src/migrate.rs

@@ -0,0 +1,79 @@
+use crate::error::Result;
+use crate::pool::SqlitePool;
+use include_dir::Dir;
+use log::{debug, info};
+use rusqlite::{OptionalExtension, params};
+
+const TRACKING_TABLE: &str = "_sqlx_migrations";
+
+/// Run SQL migrations from an embedded directory.
+///
+/// Migrations are sorted by filename (use timestamp prefixes like `00000001_init.sql`).
+/// Applied migrations are tracked in `_sqlx_migrations`.
+pub fn run_migrations(pool: &SqlitePool, dir: &Dir<'_>) -> Result<()> {
+    info!("Running migrations");
+
+    // Create tracking table
+    pool.get()?.execute(
+        &format!(
+            "CREATE TABLE IF NOT EXISTS {TRACKING_TABLE} (
+                version     TEXT PRIMARY KEY,
+                description TEXT NOT NULL,
+                applied_at  DATETIME DEFAULT CURRENT_TIMESTAMP NOT NULL
+            )"
+        ),
+        [],
+    )?;
+
+    // Read and sort all .sql files
+    let mut entries: Vec<_> = dir
+        .entries()
+        .iter()
+        .filter(|e| e.path().extension().map(|ext| ext == "sql").unwrap_or(false))
+        .collect();
+
+    entries.sort_by_key(|e| e.path());
+
+    let mut ran_migrations = 0;
+    for entry in &entries {
+        let filename = entry.path().file_name().unwrap().to_str().unwrap();
+        let version = filename.split('_').next().unwrap();
+
+        // Check if already applied
+        let already_applied: Option<i64> = pool
+            .get()?
+            .query_row(
+                &format!("SELECT 1 FROM {TRACKING_TABLE} WHERE version = ?"),
+                [version],
+                |r| r.get(0),
+            )
+            .optional()?;
+
+        if already_applied.is_some() {
+            debug!("Skipping already applied migration: {}", filename);
+            continue;
+        }
+
+        let sql = entry.as_file().unwrap().contents_utf8().expect("Failed to read migration file");
+
+        info!("Applying migration: {}", filename);
+        let conn = pool.get()?;
+        conn.execute_batch(sql)?;
+
+        // Record migration
+        conn.execute(
+            &format!("INSERT INTO {TRACKING_TABLE} (version, description) VALUES (?, ?)"),
+            params![version, filename],
+        )?;
+
+        ran_migrations += 1;
+    }
+
+    if ran_migrations == 0 {
+        info!("No migrations to run");
+    } else {
+        info!("Ran {} migration(s)", ran_migrations);
+    }
+
+    Ok(())
+}

crates/common/yaak-database/src/pool.rs

@@ -0,0 +1,81 @@
+//! Where connections come from.
+//!
+//! Every query in the model layer asks a pool for a connection, uses it, and
+//! hands it back. That is the whole contract, and it is the one place the
+//! desktop and the browser genuinely differ: the desktop has threads and wants
+//! an r2d2 pool; a browser tab has one thread, no way to spawn another, and one
+//! connection is exactly enough. Everything above this module is identical on
+//! both.
+//!
+//! On native targets `SqlitePool` *is* `r2d2::Pool` — a type alias, so nothing
+//! that already builds pools changes. On wasm it is one connection that every
+//! `get()` hands out a shared handle to.
+//!
+//! A `SqliteConn` only ever derefs immutably. The code above this layer opens
+//! transactions with [`rusqlite::Transaction::new_unchecked`], which takes
+//! `&Connection`; the `&mut` that `Connection::transaction` demands is a
+//! compile-time guard against nesting a transaction on one connection, and it
+//! is what would have forced the wasm pool to lend its connection exclusively.
+//! The model layer nests connections freely — a helper that already holds one
+//! calls another that asks for its own — so an exclusive lend would panic on
+//! the second ask. Sharing the handle instead makes nested *reads* work the way
+//! they do on the desktop; nested *write transactions* fail on both, only
+//! differently (here SQLite refuses the inner `BEGIN`; natively the inner
+//! call waits for the one writer connection, which the outer call holds, and
+//! times out).
+
+#[cfg(not(target_arch = "wasm32"))]
+mod imp {
+    use r2d2_sqlite::SqliteConnectionManager;
+
+    pub type SqlitePool = r2d2::Pool<SqliteConnectionManager>;
+    pub type SqliteConn = r2d2::PooledConnection<SqliteConnectionManager>;
+    pub type PoolError = r2d2::Error;
+}
+
+#[cfg(target_arch = "wasm32")]
+mod imp {
+    use rusqlite::Connection;
+    use std::ops::Deref;
+    use std::rc::Rc;
+
+    /// One connection, shared by everyone who asks.
+    ///
+    /// `Rc` rather than `Arc` because a `Connection` is `!Sync`, so wrapping
+    /// it in an `Arc` would buy no `Send`/`Sync` anyway — and there is one
+    /// thread here to be honest about.
+    #[derive(Clone, Debug)]
+    pub struct SqlitePool {
+        conn: Rc<Connection>,
+    }
+
+    impl SqlitePool {
+        pub fn single(conn: Connection) -> Self {
+            Self { conn: Rc::new(conn) }
+        }
+
+        /// Another handle to the connection. Cannot fail; the `Result` keeps
+        /// the signature identical to r2d2's so callers are written once.
+        pub fn get(&self) -> Result<SqliteConn, PoolError> {
+            Ok(SqliteConn(self.conn.clone()))
+        }
+    }
+
+    /// The error a `get()` would return if it could. It can't, so this has no
+    /// variants; it exists so `Error::SqlPoolError` has the same shape on both
+    /// targets.
+    #[derive(Debug, thiserror::Error)]
+    pub enum PoolError {}
+
+    #[derive(Debug)]
+    pub struct SqliteConn(Rc<Connection>);
+
+    impl Deref for SqliteConn {
+        type Target = Connection;
+        fn deref(&self) -> &Connection {
+            &self.0
+        }
+    }
+}
+
+pub use imp::*;

crates/common/yaak-database/src/traits.rs

@@ -0,0 +1,36 @@
+use crate::error::Result;
+use crate::update_source::UpdateSource;
+use chrono::{NaiveDateTime, Utc};
+use rusqlite::Row;
+use sea_query::{IntoColumnRef, IntoIden, IntoTableRef, Order, SimpleExpr};
+
+pub trait UpsertModelInfo {
+    fn table_name() -> impl IntoTableRef + IntoIden;
+    fn id_column() -> impl IntoIden + Eq + Clone;
+    fn generate_id() -> String;
+    fn order_by() -> (impl IntoColumnRef, Order);
+    fn get_id(&self) -> String;
+    fn insert_values(
+        self,
+        source: &UpdateSource,
+    ) -> Result<Vec<(impl IntoIden + Eq, impl Into<SimpleExpr>)>>;
+    fn update_columns() -> Vec<impl IntoIden>;
+    fn from_row(row: &Row) -> rusqlite::Result<Self>
+    where
+        Self: Sized;
+}
+
+/// Generate timestamps for upsert operations.
+/// Sync and import operations preserve existing timestamps; other sources use current time.
+pub fn upsert_date(update_source: &UpdateSource, dt: NaiveDateTime) -> SimpleExpr {
+    match update_source {
+        UpdateSource::Sync | UpdateSource::Import => {
+            if dt.and_utc().timestamp() == 0 {
+                Utc::now().naive_utc().into()
+            } else {
+                dt.into()
+            }
+        }
+        _ => Utc::now().naive_utc().into(),
+    }
+}

crates/common/yaak-database/src/update_source.rs

@@ -0,0 +1,31 @@
+use serde::{Deserialize, Serialize};
+use ts_rs::TS;
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case", tag = "type")]
+pub enum UpdateSource {
+    Background,
+    Import,
+    Plugin,
+    Sync,
+    Window { label: String },
+}
+
+impl UpdateSource {
+    pub fn from_window_label(label: impl Into<String>) -> Self {
+        Self::Window { label: label.into() }
+    }
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, TS)]
+#[serde(rename_all = "snake_case", tag = "type")]
+pub enum ModelChangeEvent {
+    Upsert {
+        created: bool,
+    },
+    /// A delete for a workspace implies deletion of every model in that
+    /// workspace — children are bulk-deleted without their own change rows or
+    /// events, and consumers must prune the subtree themselves (the frontend
+    /// model store does this centrally).
+    Delete,
+}

crates/common/yaak-database/src/util.rs

@@ -0,0 +1,20 @@
+use nanoid::nanoid;
+
+pub fn generate_prefixed_id(prefix: &str) -> String {
+    format!("{prefix}_{}", generate_id())
+}
+
+pub fn generate_id() -> String {
+    generate_id_of_length(10)
+}
+
+pub fn generate_id_of_length(n: usize) -> String {
+    let alphabet: [char; 57] = [
+        '2', '3', '4', '5', '6', '7', '8', '9', 'a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j',
+        'k', 'm', 'n', 'o', 'p', 'q', 'r', 's', 't', 'u', 'v', 'w', 'x', 'y', 'z', 'A', 'B', 'C',
+        'D', 'E', 'F', 'G', 'H', 'J', 'K', 'L', 'M', 'N', 'P', 'Q', 'R', 'S', 'T', 'U', 'V', 'W',
+        'X', 'Y', 'Z',
+    ];
+
+    nanoid!(n, &alphabet)
+}

crates/common/yaak-rpc-schema/Cargo.toml

@@ -0,0 +1,18 @@
+[package]
+name = "yaak-rpc-schema"
+version = "0.0.0"
+edition = "2024"
+authors = ["Gregory Schier"]
+publish = false
+
+[dependencies]
+serde = { workspace = true, features = ["derive"] }
+ts-rs = { workspace = true }
+yaak-git = { workspace = true }
+yaak-grpc = { workspace = true }
+yaak-models = { workspace = true }
+yaak-plugins = { workspace = true }
+yaak-sse = { workspace = true }
+yaak-sync = { workspace = true }
+yaak-templates = { workspace = true }
+yaak-ws = { workspace = true }

crates/common/yaak-rpc-schema/README.md

@@ -0,0 +1,44 @@
+# yaak-rpc-schema
+
+The wire schema for the app's RPC surface: every command name, its request
+payload, and its response type, declared once.
+
+Every host that serves the Yaak UI — the desktop app today, the browser bridge
+and anything after it — imports these types and implements the commands against
+them. That is what keeps a request's shape from drifting between hosts, and it
+is why the TypeScript bindings (`bindings/gen_rpc.ts`, exposed to the frontend
+as `@yaakapp-internal/rpc-schema`) are generated from one place.
+
+Nothing here depends on Tauri or on any host. Request structs are plain data,
+and so are the few response types declared here rather than in an engine crate.
+Command *bodies* live with the host that runs them.
+
+## Adding a command
+
+1. Add its request struct and an entry in `with_commands!` in `src/lib.rs`.
+2. Write the adapter in each host — the desktop's live in
+   `crates-tauri/yaak-app-client/src/rpc_ext.rs`. A host that does not support
+   the command still has to say so; a missing adapter fails to compile.
+3. Regenerate the bindings: `cargo test -p yaak-rpc-schema` writes
+   `bindings/gen_rpc.ts`, which is committed.
+
+## How hosts consume the list
+
+`with_commands!` takes the name of a `macro_rules!` macro and calls it with the
+full `name(Req) -> Res` list. Each host writes a small macro that receives that
+list and builds its router:
+
+```rust
+macro_rules! register_commands {
+    ( $( $name:ident ( $req:ty ) -> $res:ty ),* $(,)? ) => {
+        pub fn build_router() -> RpcRouter<MyCtx> {
+            let mut router = RpcRouter::new();
+            $( router.register(stringify!($name), rpc_handler_async!($name)); )*
+            router
+        }
+    };
+}
+yaak_rpc_schema::with_commands!(register_commands);
+```
+
+The schema decides *what* commands exist; the host decides *how* each one runs.

crates/common/yaak-rpc-schema/bindings/gen_api.ts

@@ -0,0 +1,8 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { PluginVersion } from "./gen_search";
+
+export type PluginNameVersion = { name: string, version: string, };
+
+export type PluginSearchResponse = { plugins: Array<PluginVersion>, };
+
+export type PluginUpdatesResponse = { plugins: Array<PluginNameVersion>, };

crates/common/yaak-rpc-schema/bindings/gen_events.ts

@@ -0,0 +1,389 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { Folder, GrpcRequest, HttpRequest, WebsocketRequest, Workspace } from "./gen_models";
+
+export type CallFolderActionArgs = { folder: Folder, };
+
+export type CallFolderActionRequest = { index: number, pluginRefId: string, args: CallFolderActionArgs, };
+
+export type CallGrpcRequestActionArgs = { grpcRequest: GrpcRequest, protoFiles: Array<string>, };
+
+export type CallGrpcRequestActionRequest = { index: number, pluginRefId: string, args: CallGrpcRequestActionArgs, };
+
+export type CallHttpRequestActionArgs = { httpRequest: HttpRequest, };
+
+export type CallHttpRequestActionRequest = { index: number, pluginRefId: string, args: CallHttpRequestActionArgs, };
+
+export type CallWebsocketRequestActionArgs = { websocketRequest: WebsocketRequest, };
+
+export type CallWebsocketRequestActionRequest = { index: number, pluginRefId: string, args: CallWebsocketRequestActionArgs, };
+
+export type CallWorkspaceActionArgs = { workspace: Workspace, };
+
+export type CallWorkspaceActionRequest = { index: number, pluginRefId: string, args: CallWorkspaceActionArgs, };
+
+export type Color = "primary" | "secondary" | "info" | "success" | "notice" | "warning" | "danger";
+
+export type CompletionOptionType = "constant" | "variable";
+
+export type EditorLanguage = "text" | "javascript" | "json" | "html" | "xml" | "graphql" | "markdown" | "c" | "clojure" | "csharp" | "go" | "http" | "java" | "kotlin" | "objective_c" | "ocaml" | "php" | "powershell" | "python" | "r" | "ruby" | "shell" | "swift";
+
+export type FileFilter = { name: string, 
+/**
+ * File extensions to require
+ */
+extensions: Array<string>, };
+
+export type FilterResponse = { content: string, error?: string, };
+
+export type FolderAction = { label: string, icon?: Icon, };
+
+export type FormInput = { "type": "text" } & FormInputText | { "type": "editor" } & FormInputEditor | { "type": "select" } & FormInputSelect | { "type": "checkbox" } & FormInputCheckbox | { "type": "file" } & FormInputFile | { "type": "http_request" } & FormInputHttpRequest | { "type": "accordion" } & FormInputAccordion | { "type": "h_stack" } & FormInputHStack | { "type": "banner" } & FormInputBanner | { "type": "markdown" } & FormInputMarkdown | { "type": "key_value" } & FormInputKeyValue;
+
+export type FormInputAccordion = { label: string, inputs?: Array<FormInput>, hidden?: boolean, };
+
+export type FormInputBanner = { inputs?: Array<FormInput>, hidden?: boolean, color?: Color, };
+
+export type FormInputCheckbox = { 
+/**
+ * The name of the input. The value will be stored at this object attribute in the resulting data
+ */
+name: string, 
+/**
+ * Whether this input is visible for the given configuration. Use this to
+ * make branching forms.
+ */
+hidden?: boolean, 
+/**
+ * Whether the user must fill in the argument
+ */
+optional?: boolean, 
+/**
+ * The label of the input
+ */
+label?: string, 
+/**
+ * Visually hide the label of the input
+ */
+hideLabel?: boolean, 
+/**
+ * The default value
+ */
+defaultValue?: string, disabled?: boolean, 
+/**
+ * Longer description of the input, likely shown in a tooltip
+ */
+description?: string, };
+
+export type FormInputEditor = { 
+/**
+ * Placeholder for the text input
+ */
+placeholder?: string | null, 
+/**
+ * Don't show the editor gutter (line numbers, folds, etc.)
+ */
+hideGutter?: boolean, 
+/**
+ * Language for syntax highlighting
+ */
+language?: EditorLanguage, readOnly?: boolean, 
+/**
+ * Fixed number of visible rows
+ */
+rows?: number, completionOptions?: Array<GenericCompletionOption>, 
+/**
+ * The name of the input. The value will be stored at this object attribute in the resulting data
+ */
+name: string, 
+/**
+ * Whether this input is visible for the given configuration. Use this to
+ * make branching forms.
+ */
+hidden?: boolean, 
+/**
+ * Whether the user must fill in the argument
+ */
+optional?: boolean, 
+/**
+ * The label of the input
+ */
+label?: string, 
+/**
+ * Visually hide the label of the input
+ */
+hideLabel?: boolean, 
+/**
+ * The default value
+ */
+defaultValue?: string, disabled?: boolean, 
+/**
+ * Longer description of the input, likely shown in a tooltip
+ */
+description?: string, };
+
+export type FormInputFile = { 
+/**
+ * The title of the file selection window
+ */
+title: string, 
+/**
+ * Allow selecting multiple files
+ */
+multiple?: boolean, directory?: boolean, defaultPath?: string, filters?: Array<FileFilter>, 
+/**
+ * The name of the input. The value will be stored at this object attribute in the resulting data
+ */
+name: string, 
+/**
+ * Whether this input is visible for the given configuration. Use this to
+ * make branching forms.
+ */
+hidden?: boolean, 
+/**
+ * Whether the user must fill in the argument
+ */
+optional?: boolean, 
+/**
+ * The label of the input
+ */
+label?: string, 
+/**
+ * Visually hide the label of the input
+ */
+hideLabel?: boolean, 
+/**
+ * The default value
+ */
+defaultValue?: string, disabled?: boolean, 
+/**
+ * Longer description of the input, likely shown in a tooltip
+ */
+description?: string, };
+
+export type FormInputHStack = { inputs?: Array<FormInput>, hidden?: boolean, };
+
+export type FormInputHttpRequest = { 
+/**
+ * The name of the input. The value will be stored at this object attribute in the resulting data
+ */
+name: string, 
+/**
+ * Whether this input is visible for the given configuration. Use this to
+ * make branching forms.
+ */
+hidden?: boolean, 
+/**
+ * Whether the user must fill in the argument
+ */
+optional?: boolean, 
+/**
+ * The label of the input
+ */
+label?: string, 
+/**
+ * Visually hide the label of the input
+ */
+hideLabel?: boolean, 
+/**
+ * The default value
+ */
+defaultValue?: string, disabled?: boolean, 
+/**
+ * Longer description of the input, likely shown in a tooltip
+ */
+description?: string, };
+
+export type FormInputKeyValue = { 
+/**
+ * The name of the input. The value will be stored at this object attribute in the resulting data
+ */
+name: string, 
+/**
+ * Whether this input is visible for the given configuration. Use this to
+ * make branching forms.
+ */
+hidden?: boolean, 
+/**
+ * Whether the user must fill in the argument
+ */
+optional?: boolean, 
+/**
+ * The label of the input
+ */
+label?: string, 
+/**
+ * Visually hide the label of the input
+ */
+hideLabel?: boolean, 
+/**
+ * The default value
+ */
+defaultValue?: string, disabled?: boolean, 
+/**
+ * Longer description of the input, likely shown in a tooltip
+ */
+description?: string, };
+
+export type FormInputMarkdown = { content: string, hidden?: boolean, };
+
+export type FormInputSelect = { 
+/**
+ * The options that will be available in the select input
+ */
+options: Array<FormInputSelectOption>, 
+/**
+ * The name of the input. The value will be stored at this object attribute in the resulting data
+ */
+name: string, 
+/**
+ * Whether this input is visible for the given configuration. Use this to
+ * make branching forms.
+ */
+hidden?: boolean, 
+/**
+ * Whether the user must fill in the argument
+ */
+optional?: boolean, 
+/**
+ * The label of the input
+ */
+label?: string, 
+/**
+ * Visually hide the label of the input
+ */
+hideLabel?: boolean, 
+/**
+ * The default value
+ */
+defaultValue?: string, disabled?: boolean, 
+/**
+ * Longer description of the input, likely shown in a tooltip
+ */
+description?: string, };
+
+export type FormInputSelectOption = { label: string, value: string, };
+
+export type FormInputText = { 
+/**
+ * Placeholder for the text input
+ */
+placeholder?: string | null, 
+/**
+ * Placeholder for the text input
+ */
+password?: boolean, 
+/**
+ * Whether to allow newlines in the input, like a <textarea/>
+ */
+multiLine?: boolean, completionOptions?: Array<GenericCompletionOption>, 
+/**
+ * The name of the input. The value will be stored at this object attribute in the resulting data
+ */
+name: string, 
+/**
+ * Whether this input is visible for the given configuration. Use this to
+ * make branching forms.
+ */
+hidden?: boolean, 
+/**
+ * Whether the user must fill in the argument
+ */
+optional?: boolean, 
+/**
+ * The label of the input
+ */
+label?: string, 
+/**
+ * Visually hide the label of the input
+ */
+hideLabel?: boolean, 
+/**
+ * The default value
+ */
+defaultValue?: string, disabled?: boolean, 
+/**
+ * Longer description of the input, likely shown in a tooltip
+ */
+description?: string, };
+
+export type GenericCompletionOption = { label: string, detail?: string, info?: string, type?: CompletionOptionType, boost?: number, };
+
+export type GetFolderActionsResponse = { actions: Array<FolderAction>, pluginRefId: string, };
+
+export type GetGrpcRequestActionsResponse = { actions: Array<GrpcRequestAction>, pluginRefId: string, };
+
+export type GetHttpAuthenticationConfigResponse = { args: Array<FormInput>, pluginRefId: string, actions?: Array<HttpAuthenticationAction>, };
+
+export type GetHttpAuthenticationSummaryResponse = { name: string, label: string, shortLabel: string, };
+
+export type GetHttpRequestActionsResponse = { actions: Array<HttpRequestAction>, pluginRefId: string, };
+
+export type GetTemplateFunctionConfigResponse = { function: TemplateFunction, pluginRefId: string, };
+
+export type GetTemplateFunctionSummaryResponse = { functions: Array<TemplateFunction>, pluginRefId: string, };
+
+export type GetThemesResponse = { themes: Array<Theme>, };
+
+export type GetWebsocketRequestActionsResponse = { actions: Array<WebsocketRequestAction>, pluginRefId: string, };
+
+export type GetWorkspaceActionsResponse = { actions: Array<WorkspaceAction>, pluginRefId: string, };
+
+export type GrpcRequestAction = { label: string, icon?: Icon, };
+
+export type HttpAuthenticationAction = { label: string, icon?: Icon, };
+
+export type HttpRequestAction = { label: string, icon?: Icon, };
+
+export type Icon = "alert_triangle" | "check" | "check_circle" | "chevron_down" | "copy" | "info" | "pin" | "search" | "trash" | "_unknown";
+
+export type JsonPrimitive = string | number | boolean | null;
+
+export type RenderPurpose = "send" | "preview";
+
+export type TemplateFunction = { name: string, previewType?: TemplateFunctionPreviewType, description?: string, 
+/**
+ * Also support alternative names. This is useful for not breaking existing
+ * tags when changing the `name` property
+ */
+aliases?: Array<string>, args: Array<TemplateFunctionArg>, 
+/**
+ * A list of arg names to show in the inline preview. If not provided, none will be shown (for privacy reasons).
+ */
+previewArgs?: Array<string>, };
+
+/**
+ * Similar to FormInput, but contains
+ */
+export type TemplateFunctionArg = FormInput;
+
+export type TemplateFunctionPreviewType = "live" | "click" | "none";
+
+export type Theme = { 
+/**
+ * How the theme is identified. This should never be changed
+ */
+id: string, 
+/**
+ * The friendly name of the theme to be displayed to the user
+ */
+label: string, 
+/**
+ * Whether the theme will be used for dark or light appearance
+ */
+dark: boolean, 
+/**
+ * The default top-level colors for the theme
+ */
+base: ThemeComponentColors, 
+/**
+ * Optionally override theme for individual UI components for more control
+ */
+components?: ThemeComponents, };
+
+export type ThemeComponentColors = { surface?: string, surfaceHighlight?: string, surfaceActive?: string, text?: string, textSubtle?: string, textSubtlest?: string, border?: string, borderSubtle?: string, borderFocus?: string, shadow?: string, backdrop?: string, selection?: string, primary?: string, secondary?: string, info?: string, success?: string, notice?: string, warning?: string, danger?: string, };
+
+export type ThemeComponents = { dialog?: ThemeComponentColors, menu?: ThemeComponentColors, toast?: ThemeComponentColors, sidebar?: ThemeComponentColors, responsePane?: ThemeComponentColors, appHeader?: ThemeComponentColors, button?: ThemeComponentColors, banner?: ThemeComponentColors, templateTag?: ThemeComponentColors, urlBar?: ThemeComponentColors, editor?: ThemeComponentColors, input?: ThemeComponentColors, };
+
+export type WebsocketRequestAction = { label: string, icon?: Icon, };
+
+export type WorkspaceAction = { label: string, icon?: Icon, };

crates/common/yaak-rpc-schema/bindings/gen_git.ts

@@ -0,0 +1,35 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { SyncModel } from "./gen_models";
+
+export type BranchDeleteResult = { "type": "success", message: string, } | { "type": "not_fully_merged" };
+
+export type CloneResult = { "type": "success" } | { "type": "cancelled" } | { "type": "needs_credentials", url: string, error: string | null, };
+
+export type GitAuthor = { name: string | null, email: string | null, };
+
+export type GitBranchInfo = { path: string, headRef: string | null, headRefShorthand: string | null, origins: Array<string>, localBranches: Array<string>, remoteBranches: Array<string>, ahead: number, behind: number, };
+
+export type GitCommit = { oid: string, author: GitAuthor, when: string, message: string | null, };
+
+export type GitFileDiff = { original: string, modified: string, };
+
+export type GitRemote = { name: string, url: string | null, };
+
+export type GitStatus = "untracked" | "conflict" | "current" | "modified" | "removed" | "renamed" | "type_change";
+
+export type GitStatusEntry = { relaPath: string, status: GitStatus, staged: boolean, prev: SyncModel | null, next: SyncModel | null, };
+
+export type GitStatusSummary = { path: string, 
+/**
+ * The status directory relative to the repo root ("" when it IS the root).
+ * Useful for displaying entry paths relative to the sync directory
+ */
+relaDir: string, headRef: string | null, headRefShorthand: string | null, entries: Array<GitStatusEntry>, origins: Array<string>, localBranches: Array<string>, remoteBranches: Array<string>, ahead: number, behind: number, };
+
+export type GitWorktreeStatus = { entries: Array<GitWorktreeStatusEntry>, };
+
+export type GitWorktreeStatusEntry = { relaPath: string, modelId: string | null, status: GitStatus, staged: boolean, };
+
+export type PullResult = { "type": "success", message: string, } | { "type": "up_to_date" } | { "type": "needs_credentials", url: string, error: string | null, } | { "type": "diverged", remote: string, branch: string, } | { "type": "uncommitted_changes" };
+
+export type PushResult = { "type": "success", message: string, } | { "type": "up_to_date" } | { "type": "needs_credentials", url: string, error: string | null, };

crates/common/yaak-rpc-schema/bindings/gen_grpc.ts

@@ -0,0 +1,5 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+
+export type MethodDefinition = { name: string, schema: string, clientStreaming: boolean, serverStreaming: boolean, };
+
+export type ServiceDefinition = { name: string, methods: Array<MethodDefinition>, };

crates/common/yaak-rpc-schema/bindings/gen_models.ts

@@ -0,0 +1,522 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+
+export type AnyModel =
+  | CookieJar
+  | Environment
+  | Folder
+  | GraphQlIntrospection
+  | GrpcConnection
+  | GrpcEvent
+  | GrpcRequest
+  | HttpRequest
+  | HttpResponse
+  | HttpResponseEvent
+  | ImportSource
+  | KeyValue
+  | Plugin
+  | Settings
+  | SyncState
+  | WebsocketConnection
+  | WebsocketEvent
+  | WebsocketRequest
+  | Workspace
+  | WorkspaceMeta;
+
+export type ClientCertificate = {
+  host: string;
+  port: number | null;
+  crtFile: string | null;
+  keyFile: string | null;
+  pfxFile: string | null;
+  passphrase: string | null;
+  enabled?: boolean;
+};
+
+export type Cookie = {
+  name: string;
+  value: string;
+  domain: CookieDomain;
+  expires: CookieExpires;
+  path: string;
+  secure: boolean;
+  httpOnly: boolean;
+  sameSite: CookieSameSite | null;
+};
+
+export type CookieDomain = { HostOnly: string } | { Suffix: string } | "NotPresent" | "Empty";
+
+export type CookieExpires = { AtUtc: string } | "SessionEnd";
+
+export type CookieJar = {
+  model: "cookie_jar";
+  id: string;
+  createdAt: string;
+  updatedAt: string;
+  workspaceId: string;
+  cookies: Array<Cookie>;
+  name: string;
+};
+
+export type CookieSameSite = "Strict" | "Lax" | "None";
+
+export type DnsOverride = {
+  hostname: string;
+  ipv4: Array<string>;
+  ipv6: Array<string>;
+  enabled?: boolean;
+};
+
+export type EditorKeymap = "default" | "vim" | "vscode" | "emacs";
+
+export type EncryptedKey = { encryptedKey: string };
+
+export type Environment = {
+  model: "environment";
+  id: string;
+  workspaceId: string;
+  createdAt: string;
+  updatedAt: string;
+  name: string;
+  public: boolean;
+  parentModel: string;
+  parentId: string | null;
+  /**
+   * Variables defined in this environment scope.
+   * Child environments override parent variables by name.
+   */
+  variables: Array<EnvironmentVariable>;
+  color: string | null;
+  sortPriority: number;
+};
+
+export type EnvironmentVariable = { enabled?: boolean; name: string; value: string; id?: string };
+
+export type Folder = {
+  model: "folder";
+  id: string;
+  createdAt: string;
+  updatedAt: string;
+  workspaceId: string;
+  folderId: string | null;
+  authentication: Record<string, any>;
+  authenticationType: string | null;
+  description: string;
+  headers: Array<HttpRequestHeader>;
+  name: string;
+  sortPriority: number;
+  settingSendCookies: InheritedBoolSetting;
+  settingStoreCookies: InheritedBoolSetting;
+  settingValidateCertificates: InheritedBoolSetting;
+  settingFollowRedirects: InheritedBoolSetting;
+  settingRequestTimeout: InheritedIntSetting;
+  settingRequestMessageSize: InheritedIntSetting;
+  settingHttpVersion: InheritedHttpVersionSetting;
+};
+
+export type GraphQlIntrospection = {
+  model: "graphql_introspection";
+  id: string;
+  createdAt: string;
+  updatedAt: string;
+  workspaceId: string;
+  requestId: string;
+  content: string | null;
+};
+
+export type GrpcConnection = {
+  model: "grpc_connection";
+  id: string;
+  createdAt: string;
+  updatedAt: string;
+  workspaceId: string;
+  requestId: string;
+  elapsed: number;
+  error: string | null;
+  method: string;
+  service: string;
+  status: number;
+  state: GrpcConnectionState;
+  trailers: { [key in string]?: string };
+  url: string;
+};
+
+export type GrpcConnectionState = "initialized" | "connected" | "closed";
+
+export type GrpcEvent = {
+  model: "grpc_event";
+  id: string;
+  createdAt: string;
+  updatedAt: string;
+  workspaceId: string;
+  requestId: string;
+  connectionId: string;
+  content: string;
+  error: string | null;
+  eventType: GrpcEventType;
+  metadata: { [key in string]?: string };
+  status: number | null;
+};
+
+export type GrpcEventType =
+  | "info"
+  | "error"
+  | "client_message"
+  | "server_message"
+  | "connection_start"
+  | "connection_end";
+
+export type GrpcRequest = {
+  model: "grpc_request";
+  id: string;
+  createdAt: string;
+  updatedAt: string;
+  workspaceId: string;
+  folderId: string | null;
+  authenticationType: string | null;
+  authentication: Record<string, any>;
+  description: string;
+  message: string;
+  metadata: Array<HttpRequestHeader>;
+  method: string | null;
+  name: string;
+  service: string | null;
+  sortPriority: number;
+  /**
+   * Server URL (http for plaintext or https for secure)
+   */
+  url: string;
+  settingValidateCertificates: InheritedBoolSetting;
+  settingRequestMessageSize: InheritedIntSetting;
+};
+
+export type HttpRequest = {
+  model: "http_request";
+  id: string;
+  createdAt: string;
+  updatedAt: string;
+  workspaceId: string;
+  folderId: string | null;
+  authentication: Record<string, any>;
+  authenticationType: string | null;
+  body: Record<string, any>;
+  bodyType: string | null;
+  description: string;
+  headers: Array<HttpRequestHeader>;
+  method: string;
+  name: string;
+  sortPriority: number;
+  url: string;
+  /**
+   * URL parameters used for both path placeholders (`:id`) and query string entries.
+   */
+  urlParameters: Array<HttpUrlParameter>;
+  settingSendCookies: InheritedBoolSetting;
+  settingStoreCookies: InheritedBoolSetting;
+  settingValidateCertificates: InheritedBoolSetting;
+  settingFollowRedirects: InheritedBoolSetting;
+  settingRequestTimeout: InheritedIntSetting;
+  settingHttpVersion: InheritedHttpVersionSetting;
+};
+
+export type HttpRequestHeader = { enabled?: boolean; name: string; value: string; id?: string };
+
+export type HttpResponse = {
+  model: "http_response";
+  id: string;
+  createdAt: string;
+  updatedAt: string;
+  workspaceId: string;
+  requestId: string;
+  contentLength: number | null;
+  contentLengthCompressed: number | null;
+  elapsed: number;
+  elapsedHeaders: number;
+  elapsedDns: number;
+  error: string | null;
+  headers: Array<HttpResponseHeader>;
+  remoteAddr: string | null;
+  requestContentLength: number | null;
+  requestHeaders: Array<HttpResponseHeader>;
+  status: number;
+  statusReason: string | null;
+  state: HttpResponseState;
+  url: string;
+  version: string | null;
+};
+
+export type HttpResponseEvent = {
+  model: "http_response_event";
+  id: string;
+  createdAt: string;
+  updatedAt: string;
+  workspaceId: string;
+  responseId: string;
+  event: HttpResponseEventData;
+};
+
+/**
+ * Serializable representation of HTTP response events for DB storage.
+ * This mirrors `yaak_http::sender::HttpResponseEvent` but with serde support.
+ * The `From` impl is in yaak-http to avoid circular dependencies.
+ */
+export type HttpResponseEventData =
+  | {
+      type: "setting";
+      name: string;
+      value: string;
+      source_model?: string;
+      source_id?: string;
+      source_name?: string;
+    }
+  | { type: "info"; message: string }
+  | {
+      type: "redirect";
+      url: string;
+      status: number;
+      behavior: string;
+      dropped_body: boolean;
+      dropped_headers: Array<string>;
+    }
+  | {
+      type: "send_url";
+      method: string;
+      scheme: string;
+      username: string;
+      password: string;
+      host: string;
+      port: number;
+      path: string;
+      query: string;
+      fragment: string;
+    }
+  | { type: "receive_url"; version: string; status: string }
+  | { type: "header_up"; name: string; value: string }
+  | { type: "header_down"; name: string; value: string }
+  | { type: "chunk_sent"; bytes: number }
+  | { type: "chunk_received"; bytes: number }
+  | {
+      type: "dns_resolved";
+      hostname: string;
+      addresses: Array<string>;
+      duration: bigint;
+      overridden: boolean;
+    };
+
+export type HttpResponseHeader = { name: string; value: string };
+
+export type HttpResponseState = "initialized" | "connected" | "closed";
+
+export type HttpUrlParameter = {
+  enabled?: boolean;
+  /**
+   * Colon-prefixed parameters are treated as path parameters if they match, like `/users/:id`
+   * Other entries are appended as query parameters
+   */
+  name: string;
+  value: string;
+  id?: string;
+};
+
+export type HttpVersion = "auto" | "http1" | "http2";
+
+export type ImportSource = {
+  model: "import_source";
+  id: string;
+  createdAt: string;
+  updatedAt: string;
+  workspaceId: string;
+  importer: string;
+  origin: string;
+  originLabel: string;
+  lastImportedAt: string;
+};
+
+export type InheritedBoolSetting = { enabled?: boolean; value: boolean };
+
+export type InheritedHttpVersionSetting = { enabled?: boolean; value: HttpVersion };
+
+export type InheritedIntSetting = { enabled?: boolean; value: number };
+
+export type KeyValue = {
+  model: "key_value";
+  id: string;
+  createdAt: string;
+  updatedAt: string;
+  key: string;
+  namespace: string;
+  value: string;
+};
+
+export type Plugin = {
+  model: "plugin";
+  id: string;
+  createdAt: string;
+  updatedAt: string;
+  checkedAt: string | null;
+  directory: string;
+  enabled: boolean;
+  url: string | null;
+  source: PluginSource;
+};
+
+export type PluginSource = "bundled" | "filesystem" | "registry";
+
+export type ProxySetting =
+  | {
+      type: "enabled";
+      http: string;
+      https: string;
+      auth: ProxySettingAuth | null;
+      bypass: string;
+      disabled: boolean;
+    }
+  | { type: "disabled" };
+
+export type ProxySettingAuth = { user: string; password: string };
+
+export type Settings = {
+  model: "settings";
+  id: string;
+  createdAt: string;
+  updatedAt: string;
+  appearance: string;
+  clientCertificates: Array<ClientCertificate>;
+  coloredMethods: boolean;
+  editorFont: string | null;
+  editorFontSize: number;
+  editorKeymap: EditorKeymap;
+  editorSoftWrap: boolean;
+  hideWindowControls: boolean;
+  useNativeTitlebar: boolean;
+  interfaceFont: string | null;
+  interfaceFontSize: number;
+  interfaceScale: number;
+  openWorkspaceNewWindow: boolean | null;
+  proxy: ProxySetting | null;
+  themeDark: string;
+  themeLight: string;
+  updateChannel: string;
+  hideLicenseBadge: boolean;
+  promptFeedback: boolean;
+  autoupdate: boolean;
+  autoDownloadUpdates: boolean;
+  checkNotifications: boolean;
+  hotkeys: { [key in string]?: Array<string> };
+};
+
+export type SyncModel =
+  | ({ type: "workspace" } & Workspace)
+  | ({ type: "environment" } & Environment)
+  | ({ type: "folder" } & Folder)
+  | ({ type: "http_request" } & HttpRequest)
+  | ({ type: "grpc_request" } & GrpcRequest)
+  | ({ type: "websocket_request" } & WebsocketRequest);
+
+export type SyncState = {
+  model: "sync_state";
+  id: string;
+  workspaceId: string;
+  createdAt: string;
+  updatedAt: string;
+  flushedAt: string;
+  modelId: string;
+  checksum: string;
+  relPath: string;
+  syncDir: string;
+};
+
+export type WebsocketConnection = {
+  model: "websocket_connection";
+  id: string;
+  createdAt: string;
+  updatedAt: string;
+  workspaceId: string;
+  requestId: string;
+  elapsed: number;
+  error: string | null;
+  headers: Array<HttpResponseHeader>;
+  state: WebsocketConnectionState;
+  status: number;
+  url: string;
+};
+
+export type WebsocketConnectionState = "initialized" | "connected" | "closing" | "closed";
+
+export type WebsocketEvent = {
+  model: "websocket_event";
+  id: string;
+  createdAt: string;
+  updatedAt: string;
+  workspaceId: string;
+  requestId: string;
+  connectionId: string;
+  isServer: boolean;
+  message: Array<number>;
+  messageType: WebsocketEventType;
+};
+
+export type WebsocketEventType =
+  | "binary"
+  | "close"
+  | "error"
+  | "frame"
+  | "open"
+  | "ping"
+  | "pong"
+  | "text";
+
+export type WebsocketRequest = {
+  model: "websocket_request";
+  id: string;
+  createdAt: string;
+  updatedAt: string;
+  workspaceId: string;
+  folderId: string | null;
+  authentication: Record<string, any>;
+  authenticationType: string | null;
+  description: string;
+  headers: Array<HttpRequestHeader>;
+  message: string;
+  name: string;
+  sortPriority: number;
+  url: string;
+  /**
+   * URL parameters used for both path placeholders (`:id`) and query string entries.
+   */
+  urlParameters: Array<HttpUrlParameter>;
+  settingSendCookies: InheritedBoolSetting;
+  settingStoreCookies: InheritedBoolSetting;
+  settingValidateCertificates: InheritedBoolSetting;
+  settingRequestMessageSize: InheritedIntSetting;
+};
+
+export type Workspace = {
+  model: "workspace";
+  id: string;
+  createdAt: string;
+  updatedAt: string;
+  authentication: Record<string, any>;
+  authenticationType: string | null;
+  description: string;
+  headers: Array<HttpRequestHeader>;
+  name: string;
+  encryptionKeyChallenge: string | null;
+  settingValidateCertificates: boolean;
+  settingFollowRedirects: boolean;
+  settingRequestTimeout: number;
+  settingRequestMessageSize: number;
+  settingDnsOverrides: Array<DnsOverride>;
+  settingSendCookies: boolean;
+  settingStoreCookies: boolean;
+  settingHttpVersion: HttpVersion;
+};
+
+export type WorkspaceMeta = {
+  model: "workspace_meta";
+  id: string;
+  workspaceId: string;
+  createdAt: string;
+  updatedAt: string;
+  encryptionKey: EncryptedKey | null;
+  settingSyncDir: string | null;
+};

crates/common/yaak-rpc-schema/bindings/gen_search.ts

@@ -0,0 +1,5 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+
+export type PluginMetadata = { version: string, name: string, displayName: string, description: string | null, homepageUrl: string | null, repositoryUrl: string | null, };
+
+export type PluginVersion = { id: string, version: string, url: string, description: string | null, name: string, displayName: string, homepageUrl: string | null, repositoryUrl: string | null, checksum: string, readme: string | null, yanked: boolean, };

crates/common/yaak-rpc-schema/bindings/gen_sync.ts

@@ -0,0 +1,6 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { SyncModel, SyncState } from "./gen_models";
+
+export type FsCandidate = { "type": "FsCandidate", model: SyncModel, relPath: string, checksum: string, };
+
+export type SyncOp = { "type": "fsCreate", model: SyncModel, } | { "type": "fsUpdate", model: SyncModel, state: SyncState, } | { "type": "fsDelete", state: SyncState, fs: FsCandidate | null, } | { "type": "dbCreate", fs: FsCandidate, } | { "type": "dbUpdate", state: SyncState, fs: FsCandidate, } | { "type": "dbDelete", model: SyncModel, state: SyncState, } | { "type": "ignorePrivate", model: SyncModel, };

crates/common/yaak-rpc-schema/bindings/gen_util.ts

@@ -0,0 +1,107 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type {
+  Environment,
+  Folder,
+  GrpcRequest,
+  HttpRequest,
+  WebsocketRequest,
+  Workspace,
+} from "./gen_models";
+
+export type BatchUpsertResult = {
+  workspaces: Array<Workspace>;
+  environments: Array<Environment>;
+  folders: Array<Folder>;
+  httpRequests: Array<HttpRequest>;
+  grpcRequests: Array<GrpcRequest>;
+  websocketRequests: Array<WebsocketRequest>;
+};
+
+export type ImportConflictResolution = "keep_mine" | "take_source";
+
+/**
+ * Where a staged import will be committed.
+ *
+ * The destination workspace and optional folder IDs are captured in the plan so the preview describes
+ * the exact destination that confirmation will use.
+ */
+export type ImportDestination =
+  | { type: "new_workspace" }
+  | { type: "existing_workspace"; workspaceId: string; folderId?: string };
+
+/**
+ * Where an import's contents came from, used to link the committed workspace back to it.
+ */
+export type ImportOrigin = {
+  /**
+   * The absolute file path or URL the contents were read from.
+   */
+  origin: string;
+  label: string;
+};
+
+export type ImportPlan = {
+  importer: string;
+  destination: ImportDestination;
+  resources: BatchUpsertResult;
+  warnings: Array<ImportPlanWarning>;
+  /**
+   * Stable source key for every model in `resources`, keyed by its planned ID.
+   */
+  sourceKeys: { [key in string]?: string };
+  /**
+   * One entry per plannable resource; commit applies only the selected ones.
+   */
+  items: Array<ImportPlanItem>;
+  origin?: ImportOrigin;
+};
+
+export type ImportPlanAction =
+  | "create"
+  | "update"
+  | "delete"
+  | "unchanged"
+  | "keep_local"
+  | "conflict"
+  | "ignored";
+
+export type ImportPlanItem = {
+  action: ImportPlanAction;
+  model: ImportResourceType;
+  modelId: string;
+  name: string;
+  /**
+   * Planned parent folder ID for incoming resources; current parent for deletions.
+   */
+  parentId?: string;
+  selected: boolean;
+  resolution?: ImportConflictResolution;
+  reason?: ImportPlanReason;
+  /**
+   * Fields where the source and the local copy disagree, so the preview can say why
+   */
+  changedFields: Array<string>;
+};
+
+/**
+ * Extra context for an action that would otherwise be indistinguishable from its plain form.
+ */
+export type ImportPlanReason = "moved_into_ignored_folder";
+
+export type ImportPlanWarning = { title: string; detail: string; level: ImportPlanWarningLevel };
+
+/**
+ * Whether a plan's note is something to know or something to think twice about.
+ */
+export type ImportPlanWarningLevel = "info" | "warning";
+
+/**
+ * The model types an import plan can contain.
+ */
+export type ImportResourceType =
+  | "environment"
+  | "folder"
+  | "grpc_request"
+  | "http_request"
+  | "websocket_request"
+  | "workspace";

crates/common/yaak-rpc-schema/bindings/parser.ts

@@ -0,0 +1,9 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+
+export type FnArg = { name: string, value: Val, };
+
+export type Token = { "type": "raw", text: string, } | { "type": "tag", val: Val, } | { "type": "eof" };
+
+export type Tokens = { tokens: Array<Token>, };
+
+export type Val = { "type": "str", text: string, } | { "type": "var", name: string, } | { "type": "bool", value: boolean, } | { "type": "fn", name: string, args: Array<FnArg>, } | { "type": "null" };

crates/common/yaak-rpc-schema/bindings/sse.ts

@@ -0,0 +1,3 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+
+export type ServerSentEvent = { eventType: string, data: string, id: string | null, retry: bigint | null, };

crates/common/yaak-rpc-schema/index.ts

@@ -0,0 +1,4 @@
+// The RPC wire schema, generated by ts-rs from the Rust declarations in
+// src/lib.rs. `RpcSchema` maps every command name to its (request, response)
+// pair; the app's `rpc()` helper derives its command union from it.
+export * from "./bindings/gen_rpc";

crates/common/yaak-rpc-schema/package.json

@@ -0,0 +1,6 @@
+{
+  "name": "@yaakapp-internal/rpc-schema",
+  "version": "1.0.0",
+  "private": true,
+  "main": "index.ts"
+}

crates/common/yaak-rpc/Cargo.toml

@@ -0,0 +1,12 @@
+[package]
+name = "yaak-rpc"
+version = "0.0.0"
+edition = "2024"
+authors = ["Gregory Schier"]
+publish = false
+
+[dependencies]
+log = { workspace = true }
+serde = { workspace = true, features = ["derive"] }
+serde_json = { workspace = true }
+ts-rs = { workspace = true }

crates/common/yaak-rpc/src/lib.rs

@@ -0,0 +1,259 @@
+use serde::{Deserialize, Serialize};
+use std::collections::HashMap;
+use std::future::Future;
+use std::pin::Pin;
+use std::sync::mpsc;
+
+/// A boxed future, so handlers of different concrete types can share a map.
+pub type BoxFuture<T> = Pin<Box<dyn Future<Output = T> + Send + 'static>>;
+
+/// Type-erased handler function: takes context + JSON payload, returns JSON or error.
+///
+/// Handlers are async and take the context by value: the future outlives the
+/// `dispatch` call frame, so it cannot borrow, and contexts are cheap clones
+/// (handles and `Arc`s). Synchronous handlers wrap into this via `rpc_handler!`
+/// with no visible change.
+type HandlerFn<Ctx> = Box<
+    dyn Fn(Ctx, serde_json::Value) -> BoxFuture<Result<serde_json::Value, RpcError>> + Send + Sync,
+>;
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct RpcError {
+    pub message: String,
+}
+
+impl std::fmt::Display for RpcError {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(f, "{}", self.message)
+    }
+}
+
+impl std::error::Error for RpcError {}
+
+impl From<serde_json::Error> for RpcError {
+    fn from(e: serde_json::Error) -> Self {
+        Self { message: e.to_string() }
+    }
+}
+
+/// Incoming message from a client (Tauri invoke, WebSocket, etc.).
+#[derive(Debug, Deserialize)]
+pub struct RpcRequest {
+    pub id: String,
+    pub cmd: String,
+    #[serde(default)]
+    pub payload: serde_json::Value,
+}
+
+/// Outgoing response to a client.
+#[derive(Debug, Serialize)]
+#[serde(tag = "type")]
+pub enum RpcResponse {
+    Success {
+        id: String,
+        payload: serde_json::Value,
+    },
+    Error {
+        id: String,
+        error: String,
+    },
+}
+
+/// Transport-agnostic command router.
+///
+/// Register typed handler functions, then dispatch incoming JSON messages.
+/// Each transport adapter (Tauri, WebSocket, etc.) calls `dispatch()`.
+pub struct RpcRouter<Ctx> {
+    handlers: HashMap<&'static str, HandlerFn<Ctx>>,
+}
+
+impl<Ctx: Clone> RpcRouter<Ctx> {
+    pub fn new() -> Self {
+        Self { handlers: HashMap::new() }
+    }
+
+    /// Register a handler for a command name.
+    /// Use the `rpc_handler!` (sync) or `rpc_handler_async!` macro to wrap a typed function.
+    pub fn register(&mut self, cmd: &'static str, handler: HandlerFn<Ctx>) {
+        self.handlers.insert(cmd, handler);
+    }
+
+    /// Dispatch a command by name with a JSON payload.
+    pub async fn dispatch(
+        &self,
+        cmd: &str,
+        payload: serde_json::Value,
+        ctx: &Ctx,
+    ) -> Result<serde_json::Value, RpcError> {
+        match self.handlers.get(cmd) {
+            Some(handler) => handler(ctx.clone(), payload).await,
+            None => Err(RpcError { message: format!("unknown command: {cmd}") }),
+        }
+    }
+
+    /// Handle a full `RpcRequest`, returning an `RpcResponse`.
+    pub async fn handle(&self, req: RpcRequest, ctx: &Ctx) -> RpcResponse {
+        match self.dispatch(&req.cmd, req.payload, ctx).await {
+            Ok(payload) => RpcResponse::Success { id: req.id, payload },
+            Err(e) => RpcResponse::Error { id: req.id, error: e.message },
+        }
+    }
+
+    pub fn commands(&self) -> Vec<&'static str> {
+        self.handlers.keys().copied().collect()
+    }
+}
+
+/// A named event carrying a JSON payload, emitted from backend to frontend.
+#[derive(Debug, Clone, Serialize)]
+pub struct RpcEvent {
+    pub event: &'static str,
+    pub payload: serde_json::Value,
+}
+
+/// Channel-based event emitter. The backend calls `emit()`, the transport
+/// adapter (Tauri, WebSocket, etc.) drains the receiver and delivers events.
+#[derive(Clone)]
+pub struct RpcEventEmitter {
+    tx: mpsc::Sender<RpcEvent>,
+}
+
+impl RpcEventEmitter {
+    pub fn new() -> (Self, mpsc::Receiver<RpcEvent>) {
+        let (tx, rx) = mpsc::channel();
+        (Self { tx }, rx)
+    }
+
+    /// Emit a typed event. Serializes the payload to JSON.
+    pub fn emit<T: Serialize>(&self, event: &'static str, payload: &T) {
+        if let Ok(value) = serde_json::to_value(payload) {
+            let _ = self.tx.send(RpcEvent { event, payload: value });
+        }
+    }
+}
+
+/// Define RPC commands and events with a single source of truth.
+///
+/// Generates:
+/// - `build_router()` — creates an `RpcRouter` with all handlers registered
+/// - `RpcSchema` — a struct with ts-rs derives for TypeScript type generation
+/// - `RpcEventSchema` — (if events declared) a struct mapping event names to payload types
+///
+/// The wire name for each command/event is derived from `stringify!($ident)`.
+///
+/// # Example
+/// ```ignore
+/// define_rpc! {
+///     ProxyCtx;
+///     commands {
+///         proxy_start(ProxyStartRequest) -> ProxyStartResponse,
+///         proxy_stop(ProxyStopRequest) -> bool,
+///     }
+///     events {
+///         model_write(ModelPayload),
+///     }
+/// }
+/// ```
+#[macro_export]
+macro_rules! define_rpc {
+    // With both commands and events
+    (
+        $ctx:ty;
+        commands {
+            $( $handler:ident ( $req:ty ) -> $res:ty ),* $(,)?
+        }
+        events {
+            $( $evt_ident:ident ( $evt_payload:ty ) ),* $(,)?
+        }
+    ) => {
+        pub fn build_router() -> $crate::RpcRouter<$ctx> {
+            let mut router = $crate::RpcRouter::new();
+            $( router.register(stringify!($handler), $crate::rpc_handler!($handler)); )*
+            router
+        }
+
+        #[derive(ts_rs::TS)]
+        #[ts(export, export_to = "gen_rpc.ts")]
+        pub struct RpcSchema {
+            $( pub $handler: ($req, $res), )*
+        }
+
+        #[derive(ts_rs::TS)]
+        #[ts(export, export_to = "gen_rpc.ts")]
+        pub struct RpcEventSchema {
+            $( pub $evt_ident: $evt_payload, )*
+        }
+    };
+
+    // Commands only (no events)
+    (
+        $ctx:ty;
+        commands {
+            $( $handler:ident ( $req:ty ) -> $res:ty ),* $(,)?
+        }
+    ) => {
+        pub fn build_router() -> $crate::RpcRouter<$ctx> {
+            let mut router = $crate::RpcRouter::new();
+            $( router.register(stringify!($handler), $crate::rpc_handler!($handler)); )*
+            router
+        }
+
+        #[derive(ts_rs::TS)]
+        #[ts(export, export_to = "gen_rpc.ts")]
+        pub struct RpcSchema {
+            $( pub $handler: ($req, $res), )*
+        }
+    };
+}
+
+/// Wrap a typed synchronous handler function into a type-erased `HandlerFn`.
+///
+/// The function must have the signature:
+/// `fn(ctx: &Ctx, req: Req) -> Result<Res, RpcError>`
+/// where `Req: DeserializeOwned` and `Res: Serialize`.
+///
+/// # Example
+/// ```ignore
+/// fn proxy_start(ctx: &MyCtx, req: StartReq) -> Result<StartRes, RpcError> { ... }
+///
+/// router.register("proxy_start", rpc_handler!(proxy_start));
+/// ```
+#[macro_export]
+macro_rules! rpc_handler {
+    ($f:expr) => {
+        Box::new(|ctx, payload| {
+            Box::pin(async move {
+                let req = serde_json::from_value(payload).map_err($crate::RpcError::from)?;
+                let res = $f(&ctx, req)?;
+                serde_json::to_value(res).map_err($crate::RpcError::from)
+            })
+        })
+    };
+}
+
+/// Wrap a typed async handler function into a type-erased `HandlerFn`.
+///
+/// The function must have the signature:
+/// `async fn(ctx: Ctx, req: Req) -> Result<Res, E>`
+/// where `Req: DeserializeOwned`, `Res: Serialize`, and `E: ToString`, so
+/// handlers can keep returning their own error types.
+///
+/// # Example
+/// ```ignore
+/// async fn cmd_metadata(ctx: ClientCtx, req: MetadataReq) -> Result<AppMetaData, Error> { ... }
+///
+/// router.register("cmd_metadata", rpc_handler_async!(cmd_metadata));
+/// ```
+#[macro_export]
+macro_rules! rpc_handler_async {
+    ($f:expr) => {
+        Box::new(|ctx, payload| {
+            Box::pin(async move {
+                let req = serde_json::from_value(payload).map_err($crate::RpcError::from)?;
+                let res =
+                    $f(ctx, req).await.map_err(|e| $crate::RpcError { message: e.to_string() })?;
+                serde_json::to_value(res).map_err($crate::RpcError::from)
+            })
+        })
+    };
+}

crates/yaak-api/Cargo.toml

@@ -0,0 +1,12 @@
+[package]
+name = "yaak-api"
+version = "0.1.0"
+edition = "2024"
+publish = false
+
+[dependencies]
+log = { workspace = true }
+reqwest = { workspace = true, features = ["gzip"] }
+sysproxy = "0.3"
+thiserror = { workspace = true }
+yaak-common = { workspace = true }

crates/yaak-api/src/error.rs

@@ -0,0 +1,9 @@
+use thiserror::Error;
+
+#[derive(Error, Debug)]
+pub enum Error {
+    #[error(transparent)]
+    ReqwestError(#[from] reqwest::Error),
+}
+
+pub type Result<T> = std::result::Result<T, Error>;

crates/yaak-api/src/lib.rs

@@ -0,0 +1,80 @@
+mod error;
+
+pub use error::{Error, Result};
+
+use log::{debug, warn};
+use reqwest::Client;
+use reqwest::header::{HeaderMap, HeaderValue};
+use std::time::Duration;
+use yaak_common::platform::{get_ua_arch, get_ua_platform};
+
+#[derive(Debug, Clone, Copy, Eq, PartialEq)]
+pub enum ApiClientKind {
+    App,
+    Cli,
+}
+
+/// Build a reqwest Client configured for Yaak's own API calls.
+///
+/// Includes a custom User-Agent, JSON accept header, 20s timeout, gzip,
+/// and automatic OS-level proxy detection via sysproxy.
+pub fn yaak_api_client(kind: ApiClientKind, version: &str) -> Result<Client> {
+    let platform = get_ua_platform();
+    let arch = get_ua_arch();
+    let product = match kind {
+        ApiClientKind::App => "Yaak",
+        ApiClientKind::Cli => "YaakCli",
+    };
+    let ua = format!("{product}/{version} ({platform}; {arch})");
+
+    let mut default_headers = HeaderMap::new();
+    default_headers.insert("Accept", HeaderValue::from_str("application/json").unwrap());
+
+    let mut builder = reqwest::ClientBuilder::new()
+        .timeout(Duration::from_secs(20))
+        .default_headers(default_headers)
+        .gzip(true)
+        .user_agent(ua);
+
+    if let Some(sys) = get_enabled_system_proxy() {
+        let proxy_url = format!("http://{}:{}", sys.host, sys.port);
+        match reqwest::Proxy::all(&proxy_url) {
+            Ok(p) => {
+                let p = if !sys.bypass.is_empty() {
+                    p.no_proxy(reqwest::NoProxy::from_string(&sys.bypass))
+                } else {
+                    p
+                };
+                builder = builder.proxy(p);
+            }
+            Err(e) => {
+                warn!("Failed to configure system proxy: {e}");
+            }
+        }
+    }
+
+    Ok(builder.build()?)
+}
+
+/// Returns the system proxy URL if one is enabled, e.g. `http://host:port`.
+pub fn get_system_proxy_url() -> Option<String> {
+    let sys = get_enabled_system_proxy()?;
+    Some(format!("http://{}:{}", sys.host, sys.port))
+}
+
+fn get_enabled_system_proxy() -> Option<sysproxy::Sysproxy> {
+    match sysproxy::Sysproxy::get_system_proxy() {
+        Ok(sys) if sys.enable => {
+            debug!("Detected system proxy: http://{}:{}", sys.host, sys.port);
+            Some(sys)
+        }
+        Ok(_) => {
+            debug!("System proxy detected but not enabled");
+            None
+        }
+        Err(e) => {
+            debug!("Could not detect system proxy: {e}");
+            None
+        }
+    }
+}

crates/yaak-commands/Cargo.toml

@@ -0,0 +1,21 @@
+[package]
+name = "yaak-commands"
+version = "0.0.0"
+edition = "2024"
+authors = ["Gregory Schier"]
+publish = false
+
+[dependencies]
+serde_json = { workspace = true }
+thiserror = { workspace = true }
+yaak = { workspace = true }
+yaak-core = { workspace = true }
+yaak-crypto = { workspace = true }
+yaak-models = { workspace = true }
+yaak-plugins = { workspace = true }
+yaak-rpc-schema = { workspace = true }
+yaak-templates = { workspace = true }
+
+[dev-dependencies]
+tempfile = "3"
+tokio = { workspace = true, features = ["macros", "rt-multi-thread"] }

crates/yaak-commands/src/actions.rs

@@ -0,0 +1,157 @@
+//! The actions plugins contribute to the UI, and the calls that run them.
+//!
+//! Listing is a plain question for the plugin runtime. Calling is not: the
+//! frontend sends back the model it was showing, and a plugin must act on what
+//! that model *actually is* — re-read from the database, with inheritance
+//! resolved — not on a snapshot the UI has been holding. That re-reading is the
+//! work these handlers do.
+
+use crate::error::{Error, Result};
+use crate::host::PluginHost;
+use crate::resolve::{resolve_grpc_request, resolve_http_request};
+use yaak_models::models::HttpRequest;
+use yaak_plugins::events::{
+    CallFolderActionArgs, CallFolderActionRequest, CallGrpcRequestActionArgs,
+    CallGrpcRequestActionRequest, CallHttpRequestActionArgs, CallHttpRequestActionRequest,
+    CallWebsocketRequestActionArgs, CallWebsocketRequestActionRequest, CallWorkspaceActionArgs,
+    CallWorkspaceActionRequest, GetFolderActionsResponse, GetGrpcRequestActionsResponse,
+    GetHttpRequestActionsResponse, GetWebsocketRequestActionsResponse, GetWorkspaceActionsResponse,
+};
+use yaak_rpc_schema::*;
+
+// -- Listing --
+
+pub async fn cmd_http_request_actions<H: PluginHost>(
+    host: H,
+    _req: CmdHttpRequestActionsReq,
+) -> Result<Vec<GetHttpRequestActionsResponse>> {
+    host.http_request_actions().await
+}
+
+pub async fn cmd_websocket_request_actions<H: PluginHost>(
+    host: H,
+    _req: CmdWebsocketRequestActionsReq,
+) -> Result<Vec<GetWebsocketRequestActionsResponse>> {
+    host.websocket_request_actions().await
+}
+
+pub async fn cmd_grpc_request_actions<H: PluginHost>(
+    host: H,
+    _req: CmdGrpcRequestActionsReq,
+) -> Result<Vec<GetGrpcRequestActionsResponse>> {
+    host.grpc_request_actions().await
+}
+
+pub async fn cmd_workspace_actions<H: PluginHost>(
+    host: H,
+    _req: CmdWorkspaceActionsReq,
+) -> Result<Vec<GetWorkspaceActionsResponse>> {
+    host.workspace_actions().await
+}
+
+pub async fn cmd_folder_actions<H: PluginHost>(
+    host: H,
+    _req: CmdFolderActionsReq,
+) -> Result<Vec<GetFolderActionsResponse>> {
+    host.folder_actions().await
+}
+
+// -- Calling --
+
+pub async fn cmd_call_http_request_action<H: PluginHost>(
+    host: H,
+    req: CmdCallHttpRequestActionReq,
+) -> Result<()> {
+    let inner = req.req;
+    let http_request = resolve_http_request(&host.db(), &inner.args.http_request)?.0;
+    host.call_http_request_action(CallHttpRequestActionRequest {
+        args: CallHttpRequestActionArgs { http_request },
+        ..inner
+    })
+    .await
+}
+
+pub async fn cmd_call_grpc_request_action<H: PluginHost>(
+    host: H,
+    req: CmdCallGrpcRequestActionReq,
+) -> Result<()> {
+    let inner = req.req;
+    let grpc_request = resolve_grpc_request(&host.db(), &inner.args.grpc_request)?.0;
+    host.call_grpc_request_action(CallGrpcRequestActionRequest {
+        args: CallGrpcRequestActionArgs { grpc_request, ..inner.args },
+        ..inner
+    })
+    .await
+}
+
+pub async fn cmd_call_websocket_request_action<H: PluginHost>(
+    host: H,
+    req: CmdCallWebsocketRequestActionReq,
+) -> Result<()> {
+    let inner = req.req;
+    let websocket_request = host.db().get_websocket_request(&inner.args.websocket_request.id)?;
+    host.call_websocket_request_action(CallWebsocketRequestActionRequest {
+        args: CallWebsocketRequestActionArgs { websocket_request },
+        ..inner
+    })
+    .await
+}
+
+pub async fn cmd_call_workspace_action<H: PluginHost>(
+    host: H,
+    req: CmdCallWorkspaceActionReq,
+) -> Result<()> {
+    let inner = req.req;
+    let workspace = host.db().get_workspace(&inner.args.workspace.id)?;
+    host.call_workspace_action(CallWorkspaceActionRequest {
+        args: CallWorkspaceActionArgs { workspace },
+        ..inner
+    })
+    .await
+}
+
+pub async fn cmd_call_folder_action<H: PluginHost>(
+    host: H,
+    req: CmdCallFolderActionReq,
+) -> Result<()> {
+    let inner = req.req;
+    let folder = host.db().get_folder(&inner.args.folder.id)?;
+    host.call_folder_action(CallFolderActionRequest {
+        args: CallFolderActionArgs { folder },
+        ..inner
+    })
+    .await
+}
+
+// -- Other things the plugin runtime does --
+
+/// Turn a `curl` command line into an unsaved request, by handing it to the
+/// same importer plugins that read files.
+pub async fn cmd_curl_to_request<H: PluginHost>(
+    host: H,
+    req: CmdCurlToRequestReq,
+) -> Result<HttpRequest> {
+    let imported = host.import_data(&req.command).await?;
+
+    let request = imported
+        .resources
+        .http_requests
+        .first()
+        .ok_or_else(|| Error::Generic("No curl command found".to_string()))?;
+
+    // Belongs to the workspace the user is importing into, and is not saved
+    // until they say so — hence the blank id.
+    let mut request = request.clone();
+    request.workspace_id = req.workspace_id;
+    request.id = String::new();
+    Ok(request)
+}
+
+/// Restart every plugin, returning whatever failed to come back up.
+pub async fn cmd_reload_plugins<H: PluginHost>(
+    host: H,
+    _req: CmdReloadPluginsReq,
+) -> Result<Vec<(String, String)>> {
+    let plugins = host.db().list_plugins()?;
+    Ok(host.reload_plugins(plugins).await)
+}

crates/yaak-commands/src/auth.rs

@@ -0,0 +1,62 @@
+//! Authentication config forms and their actions.
+//!
+//! Both commands here do the same preparation: the frontend sends the model
+//! whose auth is being edited plus the values currently in the form, and those
+//! values may contain templates. They have to be rendered against the model's
+//! own environment chain before a plugin sees them, or an auth plugin receives
+//! `${[ api_key ]}` where it expected a key.
+
+use crate::error::Result;
+use crate::host::PluginHost;
+use crate::render::render_form_values;
+use yaak_plugins::events::{
+    GetHttpAuthenticationConfigResponse, GetHttpAuthenticationSummaryResponse, RenderPurpose,
+};
+use yaak_rpc_schema::*;
+use yaak_templates::RenderOptions;
+
+pub async fn cmd_get_http_authentication_summaries<H: PluginHost>(
+    host: H,
+    _req: CmdGetHttpAuthenticationSummariesReq,
+) -> Result<Vec<GetHttpAuthenticationSummaryResponse>> {
+    host.http_authentication_summaries().await
+}
+
+pub async fn cmd_get_http_authentication_config<H: PluginHost>(
+    host: H,
+    req: CmdGetHttpAuthenticationConfigReq,
+) -> Result<GetHttpAuthenticationConfigResponse> {
+    // A config form is being displayed, so a template that cannot resolve
+    // should show as blank rather than refuse to open the form.
+    let values = render_form_values(
+        &host,
+        &req.model,
+        req.environment_id.as_deref(),
+        req.values,
+        RenderPurpose::Preview,
+        &RenderOptions::return_empty(),
+    )
+    .await?;
+
+    host.http_authentication_config(&req.auth_name, values, req.model.id()).await
+}
+
+pub async fn cmd_call_http_authentication_action<H: PluginHost>(
+    host: H,
+    req: CmdCallHttpAuthenticationActionReq,
+) -> Result<()> {
+    // An action actually uses these values, so an unresolvable template is an
+    // error rather than an empty string that would silently authenticate wrong.
+    let values = render_form_values(
+        &host,
+        &req.model,
+        req.environment_id.as_deref(),
+        req.values,
+        RenderPurpose::Send,
+        &RenderOptions::throw(),
+    )
+    .await?;
+
+    host.call_http_authentication_action(&req.auth_name, req.action_index, values, req.model.id())
+        .await
+}

crates/yaak-commands/src/data.rs

@@ -0,0 +1,30 @@
+//! Export and formatting.
+
+use crate::error::Result;
+use crate::host::Host;
+use yaak_models::example::create_example_workspace;
+use yaak_models::export::{self, ExportDataParams};
+use yaak_models::util::BatchUpsertResult;
+use yaak_rpc_schema::*;
+use yaak_templates::format_json::format_json;
+
+pub async fn cmd_export_data<H: Host>(host: H, req: CmdExportDataReq) -> Result<String> {
+    let version = host.app_version();
+    Ok(export::export_data(ExportDataParams {
+        query_manager: host.query_manager(),
+        yaak_version: &version,
+        workspace_ids: req.workspace_ids.iter().map(|s| s.as_str()).collect(),
+        include_private_environments: req.include_private_environments,
+    })?)
+}
+
+pub async fn cmd_create_example_workspace<H: Host>(
+    host: H,
+    _req: CmdCreateExampleWorkspaceReq,
+) -> Result<BatchUpsertResult> {
+    Ok(create_example_workspace(host.query_manager(), &host.update_source())?)
+}
+
+pub async fn cmd_format_json<H: Host>(_host: H, req: CmdFormatJsonReq) -> Result<String> {
+    Ok(format_json(&req.text, "  "))
+}

crates/yaak-commands/src/encryption.rs

@@ -0,0 +1,41 @@
+//! Workspace encryption keys and the `secure()` template function.
+
+use crate::error::Result;
+use crate::host::{Host, PluginHost};
+use yaak_plugins::native_template_functions::decrypt_secure_template_function;
+use yaak_rpc_schema::*;
+
+pub async fn cmd_enable_encryption<H: Host>(host: H, req: CmdEnableEncryptionReq) -> Result<()> {
+    host.encryption_manager().ensure_workspace_key(&req.workspace_id)?;
+    host.encryption_manager().reveal_workspace_key(&req.workspace_id)?;
+    Ok(())
+}
+
+pub async fn cmd_reveal_workspace_key<H: Host>(
+    host: H,
+    req: CmdRevealWorkspaceKeyReq,
+) -> Result<String> {
+    Ok(host.encryption_manager().reveal_workspace_key(&req.workspace_id)?)
+}
+
+pub async fn cmd_set_workspace_key<H: Host>(host: H, req: CmdSetWorkspaceKeyReq) -> Result<()> {
+    host.encryption_manager().set_human_key(&req.workspace_id, &req.key)?;
+    Ok(())
+}
+
+pub async fn cmd_disable_encryption<H: Host>(host: H, req: CmdDisableEncryptionReq) -> Result<()> {
+    host.encryption_manager().disable_encryption(&req.workspace_id)?;
+    Ok(())
+}
+
+pub async fn cmd_decrypt_template<H: Host>(host: H, req: CmdDecryptTemplateReq) -> Result<String> {
+    let plugin_context = host.plugin_context();
+    Ok(decrypt_secure_template_function(host.encryption_manager(), &plugin_context, &req.template)?)
+}
+
+pub async fn cmd_secure_template<H: PluginHost>(
+    host: H,
+    req: CmdSecureTemplateReq,
+) -> Result<String> {
+    host.encrypt_secure_template(&req.template).await
+}

crates/yaak-commands/src/error.rs

@@ -0,0 +1,30 @@
+use thiserror::Error;
+
+#[derive(Debug, Error)]
+pub enum Error {
+    #[error(transparent)]
+    Yaak(#[from] yaak::Error),
+
+    #[error(transparent)]
+    Model(#[from] yaak_models::error::Error),
+
+    #[error(transparent)]
+    Plugin(#[from] yaak_plugins::error::Error),
+
+    #[error(transparent)]
+    Crypto(#[from] yaak_crypto::error::Error),
+
+    #[error(transparent)]
+    Template(#[from] yaak_templates::error::Error),
+
+    #[error("JSON error: {0}")]
+    Json(#[from] serde_json::Error),
+
+    #[error("I/O error: {0}")]
+    Io(#[from] std::io::Error),
+
+    #[error("{0}")]
+    Generic(String),
+}
+
+pub type Result<T> = std::result::Result<T, Error>;

crates/yaak-commands/src/host.rs

@@ -0,0 +1,229 @@
+//! What a command needs from whatever is running it.
+//!
+//! A command handler is invoked on behalf of one client (a desktop window today)
+//! and needs a handful of things from its surroundings: the shared engine
+//! managers, who the client is, what the client is looking at, and a little
+//! about the app. `Host` is that handful and nothing more. The desktop
+//! implements it over a `WebviewWindow`; a server would implement it over a
+//! connection. Handlers are generic over it, so the same handler body runs
+//! under either without knowing which.
+//!
+//! The surface grows only when a handler being moved here needs something new,
+//! and stays as narrow as those handlers allow. What is deliberately *not* here
+//! is anything only a desktop can do — open a native window, run the updater,
+//! show a native dialog — those handlers stay with the desktop.
+
+use std::collections::HashMap;
+use std::future::Future;
+use yaak_core::WorkspaceContext;
+use yaak_crypto::manager::EncryptionManager;
+use yaak_models::blob_manager::{BlobContext, BlobManager};
+use yaak_models::client_db::ClientDb;
+use yaak_models::models::Plugin;
+use yaak_models::query_manager::QueryManager;
+use yaak_models::util::UpdateSource;
+use yaak_plugins::events::{
+    CallFolderActionRequest, CallGrpcRequestActionRequest, CallHttpRequestActionRequest,
+    CallWebsocketRequestActionRequest, CallWorkspaceActionRequest, GetFolderActionsResponse,
+    GetGrpcRequestActionsResponse, GetHttpAuthenticationConfigResponse,
+    GetHttpAuthenticationSummaryResponse, GetHttpRequestActionsResponse,
+    GetTemplateFunctionConfigResponse, GetTemplateFunctionSummaryResponse, GetThemesResponse,
+    GetWebsocketRequestActionsResponse, GetWorkspaceActionsResponse, ImportResponse, JsonPrimitive,
+    PluginContext, RenderPurpose,
+};
+use yaak_plugins::plugin_meta::PluginMetadata;
+use yaak_templates::TemplateCallback;
+
+/// Only `Clone` is required here. `Send`/`Sync`/`'static` are deliberately
+/// *not*: a browser host is single-threaded and its connection pool is an
+/// `Rc<Connection>` — `rusqlite::Connection` is not `Sync` to begin with — so a
+/// thread-safety bound on the trait would lock that host out of implementing it
+/// at all. The router needs those bounds and states them itself, which is where
+/// they belong: they are a property of a particular transport, not of a command.
+pub trait Host: Clone {
+    /// Stable identity of the client this call is for. On the desktop this is
+    /// the window label. It rides on every model write so the client that made
+    /// a change can tell its own echo from everyone else's.
+    fn client_id(&self) -> &str;
+
+    /// What the client is currently looking at: workspace, environment, cookie
+    /// jar, request. Read at call time, since the client can navigate between
+    /// calls (and during one).
+    fn session(&self) -> WorkspaceContext;
+
+    /// The app version, as reported to the Yaak API and stamped on exports.
+    fn app_version(&self) -> String;
+
+    fn query_manager(&self) -> &QueryManager;
+    fn blob_manager(&self) -> &BlobManager;
+    fn encryption_manager(&self) -> &EncryptionManager;
+
+    // -- Conveniences derived from the above; hosts do not override these --
+
+    fn update_source(&self) -> UpdateSource {
+        UpdateSource::from_window_label(self.client_id())
+    }
+
+    fn plugin_context(&self) -> PluginContext {
+        PluginContext::new(Some(self.client_id().to_string()), self.session().workspace_id)
+    }
+
+    fn db(&self) -> ClientDb<'_> {
+        self.query_manager().connect()
+    }
+
+    fn blobs(&self) -> BlobContext<'_> {
+        self.blob_manager().connect()
+    }
+}
+
+/// A host that can also reach plugins.
+///
+/// Separate from [`Host`] so that a command which only touches the database
+/// never demands a plugin runtime it does not call: a host with no plugins
+/// still serves those, and only handlers bounded on `PluginHost` are closed to
+/// it.
+///
+/// These are *operations*, not a handle. Handing back a `&PluginManager` would
+/// have been shorter, but that type is specifically "spawn a Node sidecar and
+/// talk to it over a socket", and a browser host runs plugins in a Worker it
+/// reaches by message — it can answer any of the questions below and can never
+/// produce that type. Naming the questions instead of the answerer is what lets
+/// both hosts exist.
+///
+/// Same rule as [`Host`]: this grows only when a migrated handler needs
+/// something new, and stays as narrow as those handlers allow. Today it is the
+/// four things batch 1 asks for.
+///
+/// The types crossing this boundary still come from `yaak-plugins` — fine on
+/// the desktop, and once its plain data types are split out from its runtime
+/// that becomes an import-path change here rather than an interface one.
+pub trait PluginHost: Host {
+    /// What the running plugin runtime knows about the plugin installed in
+    /// `directory`, or `None` if it has not loaded one from there. Callers fall
+    /// back to reading the plugin's manifest off disk.
+    fn loaded_plugin_metadata(
+        &self,
+        directory: &str,
+    ) -> impl Future<Output = Option<PluginMetadata>>;
+
+    /// Failures from plugin initialization, drained — reporting them clears
+    /// them, so a caller that drops these has lost them.
+    fn take_plugin_init_errors(&self) -> impl Future<Output = Vec<(String, String)>>;
+
+    /// The plugin rows as the runtime sees them: the database says what is
+    /// installed, the runtime knows which are bundled and what version actually
+    /// loaded. A host without a runtime can return them untouched.
+    fn resolve_plugins(&self, plugins: Vec<Plugin>) -> impl Future<Output = Vec<Plugin>>;
+
+    /// The template functions this host can run, as a callback the renderer
+    /// drives. This is the *only* thing the plugin runtime uniquely provides to
+    /// a render — the variables come from the environment chain, which is an
+    /// ordinary database read — so handing back the callback keeps the rest of
+    /// rendering shared instead of pushing whole commands behind this trait.
+    /// Async so hosts that finish booting their plugin runtime in the
+    /// background can wait for it here.
+    fn template_callback(
+        &self,
+        purpose: RenderPurpose,
+    ) -> impl Future<Output = crate::Result<impl TemplateCallback>>;
+
+    /// Every template function the installed plugins expose, for the
+    /// autocomplete menu.
+    fn template_function_summaries(
+        &self,
+    ) -> impl Future<Output = crate::Result<Vec<GetTemplateFunctionSummaryResponse>>>;
+
+    /// The form a template function wants to show for the given values.
+    /// `values` arrive already rendered.
+    fn template_function_config(
+        &self,
+        function_name: &str,
+        values: HashMap<String, JsonPrimitive>,
+        model_id: &str,
+    ) -> impl Future<Output = crate::Result<GetTemplateFunctionConfigResponse>>;
+
+    /// Themes contributed by plugins.
+    fn themes(&self) -> impl Future<Output = crate::Result<Vec<GetThemesResponse>>>;
+
+    // -- Actions plugins contribute to the UI --
+
+    fn http_request_actions(
+        &self,
+    ) -> impl Future<Output = crate::Result<Vec<GetHttpRequestActionsResponse>>>;
+    fn websocket_request_actions(
+        &self,
+    ) -> impl Future<Output = crate::Result<Vec<GetWebsocketRequestActionsResponse>>>;
+    fn grpc_request_actions(
+        &self,
+    ) -> impl Future<Output = crate::Result<Vec<GetGrpcRequestActionsResponse>>>;
+    fn workspace_actions(
+        &self,
+    ) -> impl Future<Output = crate::Result<Vec<GetWorkspaceActionsResponse>>>;
+    fn folder_actions(&self) -> impl Future<Output = crate::Result<Vec<GetFolderActionsResponse>>>;
+
+    /// Running an action. The request in each of these has already been
+    /// re-read and had its inheritance resolved by the handler; a host must
+    /// pass it through untouched.
+    fn call_http_request_action(
+        &self,
+        req: CallHttpRequestActionRequest,
+    ) -> impl Future<Output = crate::Result<()>>;
+    fn call_grpc_request_action(
+        &self,
+        req: CallGrpcRequestActionRequest,
+    ) -> impl Future<Output = crate::Result<()>>;
+    fn call_websocket_request_action(
+        &self,
+        req: CallWebsocketRequestActionRequest,
+    ) -> impl Future<Output = crate::Result<()>>;
+    fn call_workspace_action(
+        &self,
+        req: CallWorkspaceActionRequest,
+    ) -> impl Future<Output = crate::Result<()>>;
+    fn call_folder_action(
+        &self,
+        req: CallFolderActionRequest,
+    ) -> impl Future<Output = crate::Result<()>>;
+
+    // -- Authentication --
+
+    fn http_authentication_summaries(
+        &self,
+    ) -> impl Future<Output = crate::Result<Vec<GetHttpAuthenticationSummaryResponse>>>;
+
+    /// The form an auth plugin wants to show. `values` arrive already rendered.
+    fn http_authentication_config(
+        &self,
+        auth_name: &str,
+        values: HashMap<String, JsonPrimitive>,
+        model_id: &str,
+    ) -> impl Future<Output = crate::Result<GetHttpAuthenticationConfigResponse>>;
+
+    fn call_http_authentication_action(
+        &self,
+        auth_name: &str,
+        action_index: i32,
+        values: HashMap<String, JsonPrimitive>,
+        model_id: &str,
+    ) -> impl Future<Output = crate::Result<()>>;
+
+    // -- The importers, and the runtime itself --
+
+    /// Hand arbitrary text to the importer plugins and take what they make of
+    /// it. Used for files, URLs and pasted `curl` commands alike.
+    fn import_data(&self, content: &str) -> impl Future<Output = crate::Result<ImportResponse>>;
+
+    /// Restart every plugin, returning `(plugin, error)` for those that failed.
+    fn reload_plugins(&self, plugins: Vec<Plugin>) -> impl Future<Output = Vec<(String, String)>>;
+
+    /// Re-encrypt the `secure(...)` values in a template.
+    ///
+    /// Whole operation rather than its pieces because the encryption is only
+    /// half of it: the value is also run through the plugin template functions,
+    /// so this needs the plugin runtime and not just a key.
+    fn encrypt_secure_template(
+        &self,
+        template: &str,
+    ) -> impl Future<Output = crate::Result<String>>;
+}

crates/yaak-commands/src/lib.rs

@@ -0,0 +1,28 @@
+//! Command handlers for the RPC surface, written against [`Host`] instead of
+//! any particular host.
+//!
+//! `yaak_rpc_schema` declares what each command is called and what it takes
+//! and returns; this crate is where the bodies live. Every handler has the
+//! shape the router wants — `async fn(host, Req) -> Result<Res>` — so a host
+//! registers one with a one-line adapter (or none at all), and never
+//! redeclares a command.
+//!
+//! Not every command is here yet. Handlers move in as they are freed of
+//! host-specific types; the ones that stay behind are the ones only a desktop
+//! can serve (native windows, the updater, dialogs) or that still lean on it.
+
+pub mod actions;
+pub mod auth;
+pub mod data;
+pub mod encryption;
+pub mod error;
+pub mod host;
+pub mod models;
+pub mod plugins;
+pub mod render;
+pub mod resolve;
+pub mod responses;
+pub mod templates;
+
+pub use error::{Error, Result};
+pub use host::{Host, PluginHost};

crates/yaak-commands/src/models.rs

@@ -0,0 +1,187 @@
+//! Reads and writes of models, keyed by the client's identity so the frontend
+//! can suppress its own echoes.
+
+use crate::error::Result;
+use crate::host::{Host, PluginHost};
+use yaak_models::models::{
+    AnyModel, GraphQlIntrospection, GrpcEvent, HttpRequestHeader, Settings, WebsocketEvent,
+    WorkspaceMeta,
+};
+use yaak_models::queries::workspaces::default_headers;
+use yaak_rpc_schema::*;
+
+pub async fn models_upsert<H: Host>(host: H, req: ModelsUpsertReq) -> Result<String> {
+    let blobs = host.blob_manager();
+    let source = host.update_source();
+    Ok(host
+        .query_manager()
+        .with_tx(|tx| yaak_models::models_ops::upsert_model(tx, blobs, req.model, &source))?)
+}
+
+/// Deletes cascade — a workspace can hold thousands of requests — and run in a
+/// transaction, which holds a raw connection for the duration.
+///
+/// Whether that wants a blocking thread is the *host's* question, not the
+/// delete's: a desktop with a multi-threaded runtime should keep this off the
+/// runtime (see its adapter), while a single-threaded host has nothing to move
+/// it to and runs it here. So this is the plain version, and a host that wants
+/// to relocate it calls [`models_delete_blocking`] itself.
+pub async fn models_delete<H: Host>(host: H, req: ModelsDeleteReq) -> Result<String> {
+    models_delete_blocking(&host, req)
+}
+
+/// The body of [`models_delete`], callable from a blocking context.
+pub fn models_delete_blocking<H: Host>(host: &H, req: ModelsDeleteReq) -> Result<String> {
+    let source = host.update_source();
+    Ok(host.query_manager().with_tx(|tx| {
+        yaak_models::models_ops::delete_model(tx, host.blob_manager(), req.model, &source)
+    })?)
+}
+
+/// Duplicates recurse, so this runs in a transaction too.
+pub async fn models_duplicate<H: Host>(host: H, req: ModelsDuplicateReq) -> Result<String> {
+    let source = host.update_source();
+    Ok(host.query_manager().with_tx(|tx| {
+        yaak_models::models_ops::duplicate_model(tx, &req.model_type, &req.model_id, &source)
+    })?)
+}
+
+pub async fn models_websocket_events<H: Host>(
+    host: H,
+    req: ModelsWebsocketEventsReq,
+) -> Result<Vec<WebsocketEvent>> {
+    Ok(host.db().list_websocket_events(&req.connection_id)?)
+}
+
+pub async fn models_grpc_events<H: Host>(
+    host: H,
+    req: ModelsGrpcEventsReq,
+) -> Result<Vec<GrpcEvent>> {
+    Ok(host.db().list_grpc_events(&req.connection_id)?)
+}
+
+pub async fn models_get_settings<H: Host>(host: H, _req: ModelsGetSettingsReq) -> Result<Settings> {
+    Ok(host.db().get_settings())
+}
+
+pub async fn models_get_graphql_introspection<H: Host>(
+    host: H,
+    req: ModelsGetGraphqlIntrospectionReq,
+) -> Result<Option<GraphQlIntrospection>> {
+    Ok(host.db().get_graphql_introspection(&req.request_id))
+}
+
+pub async fn models_upsert_graphql_introspection<H: Host>(
+    host: H,
+    req: ModelsUpsertGraphqlIntrospectionReq,
+) -> Result<GraphQlIntrospection> {
+    let source = host.update_source();
+    Ok(host.query_manager().with_tx(|tx| {
+        tx.upsert_graphql_introspection(&req.workspace_id, &req.request_id, req.content, &source)
+    })?)
+}
+
+/// Everything the frontend's model store needs to boot, as one JSON string.
+///
+/// A string rather than a `Vec<AnyModel>` because the desktop has to escape
+/// this payload before it crosses into the webview (see its adapter), and the
+/// frontend `JSON.parse`s either form the same way.
+pub async fn models_workspace_models<H: PluginHost>(
+    host: H,
+    req: ModelsWorkspaceModelsReq,
+) -> Result<String> {
+    let mut l: Vec<AnyModel> = Vec::new();
+
+    // Add the global models
+    {
+        let db = host.db();
+        l.push(db.get_settings().into());
+        l.append(&mut db.list_workspaces()?.into_iter().map(Into::into).collect());
+        l.append(&mut db.list_key_values()?.into_iter().map(Into::into).collect());
+    }
+
+    let plugins = {
+        let db = host.db();
+        db.list_plugins()?
+    };
+
+    let plugins = host.resolve_plugins(plugins).await;
+    l.append(&mut plugins.into_iter().map(Into::into).collect());
+
+    // Add the workspace children
+    if let Some(wid) = req.workspace_id.as_deref() {
+        // Opening a workspace is where the rows it is assumed to have get created
+        host.query_manager().with_tx(|tx| {
+            tx.ensure_base_environment(wid)?;
+            tx.ensure_default_cookie_jar(wid)?;
+            tx.ensure_workspace_meta(wid)?;
+            Ok::<(), yaak_models::error::Error>(())
+        })?;
+        let db = host.db();
+        l.append(&mut db.list_cookie_jars(wid)?.into_iter().map(Into::into).collect());
+        l.append(&mut db.list_environments(wid)?.into_iter().map(Into::into).collect());
+        l.append(&mut db.list_folders(wid)?.into_iter().map(Into::into).collect());
+        l.append(&mut db.list_grpc_connections(wid)?.into_iter().map(Into::into).collect());
+        l.append(&mut db.list_grpc_requests(wid)?.into_iter().map(Into::into).collect());
+        l.append(&mut db.list_http_requests(wid)?.into_iter().map(Into::into).collect());
+        l.append(&mut db.list_http_responses(wid, None)?.into_iter().map(Into::into).collect());
+        l.append(&mut db.list_websocket_connections(wid)?.into_iter().map(Into::into).collect());
+        l.append(&mut db.list_websocket_requests(wid)?.into_iter().map(Into::into).collect());
+        l.append(&mut db.list_workspace_metas(wid)?.into_iter().map(Into::into).collect());
+    }
+
+    Ok(serde_json::to_string(&l)?)
+}
+
+pub async fn cmd_get_workspace_meta<H: Host>(
+    host: H,
+    req: CmdGetWorkspaceMetaReq,
+) -> Result<WorkspaceMeta> {
+    let workspace = host.db().get_workspace(&req.workspace_id)?;
+    Ok(host.query_manager().with_tx(|tx| tx.ensure_workspace_meta(&workspace.id))?)
+}
+
+pub async fn cmd_delete_all_grpc_connections<H: Host>(
+    host: H,
+    req: CmdDeleteAllGrpcConnectionsReq,
+) -> Result<()> {
+    Ok(host.query_manager().with_tx(|tx| {
+        tx.delete_all_grpc_connections_for_request(&req.request_id, &host.update_source())
+    })?)
+}
+
+pub async fn cmd_delete_all_http_responses<H: Host>(
+    host: H,
+    req: CmdDeleteAllHttpResponsesReq,
+) -> Result<()> {
+    host.query_manager().with_tx(|tx| {
+        tx.delete_all_http_responses_for_request(&req.request_id, &host.update_source())
+    })?;
+    Ok(())
+}
+
+pub async fn cmd_ws_delete_connections<H: Host>(
+    host: H,
+    req: CmdWsDeleteConnectionsReq,
+) -> Result<()> {
+    Ok(host.query_manager().with_tx(|tx| {
+        tx.delete_all_websocket_connections_for_request(&req.request_id, &host.update_source())
+    })?)
+}
+
+pub async fn cmd_delete_send_history<H: Host>(host: H, req: CmdDeleteSendHistoryReq) -> Result<()> {
+    Ok(host.query_manager().with_tx(|tx| {
+        let source = &host.update_source();
+        tx.delete_all_http_responses_for_workspace(&req.workspace_id, source)?;
+        tx.delete_all_grpc_connections_for_workspace(&req.workspace_id, source)?;
+        tx.delete_all_websocket_connections_for_workspace(&req.workspace_id, source)?;
+        Ok::<(), yaak_models::error::Error>(())
+    })?)
+}
+
+pub async fn cmd_default_headers<H: Host>(
+    _host: H,
+    _req: CmdDefaultHeadersReq,
+) -> Result<Vec<HttpRequestHeader>> {
+    Ok(default_headers())
+}

crates/yaak-commands/src/plugins.rs

@@ -0,0 +1,48 @@
+//! Plugin queries: what the runtime has loaded, and what failed to load.
+
+use crate::error::Result;
+use crate::host::PluginHost;
+use std::path::PathBuf;
+use yaak_plugins::plugin_meta::{PluginMetadata, get_plugin_meta};
+use yaak_rpc_schema::*;
+
+pub async fn cmd_plugin_info<H: PluginHost>(
+    host: H,
+    req: CmdPluginInfoReq,
+) -> Result<PluginMetadata> {
+    let plugin = host.db().get_plugin(&req.id)?;
+    if let Some(metadata) = host.loaded_plugin_metadata(&plugin.directory).await {
+        return Ok(metadata);
+    }
+
+    if let Ok(metadata) = get_plugin_meta(&PathBuf::from(&plugin.directory)) {
+        return Ok(metadata);
+    }
+
+    Ok(fallback_plugin_metadata(&plugin.directory))
+}
+
+fn fallback_plugin_metadata(directory: &str) -> PluginMetadata {
+    let display_name = PathBuf::from(directory)
+        .file_name()
+        .and_then(|name| name.to_str())
+        .filter(|name| !name.is_empty())
+        .unwrap_or(directory)
+        .to_string();
+
+    PluginMetadata {
+        version: "Unavailable".to_string(),
+        name: directory.to_string(),
+        display_name,
+        description: Some(format!("Plugin metadata could not be loaded from {directory}")),
+        homepage_url: None,
+        repository_url: None,
+    }
+}
+
+pub async fn cmd_plugin_init_errors<H: PluginHost>(
+    host: H,
+    _req: CmdPluginInitErrorsReq,
+) -> Result<Vec<(String, String)>> {
+    Ok(host.take_plugin_init_errors().await)
+}

crates/yaak-commands/src/render.rs

@@ -0,0 +1,74 @@
+//! Rendering a template against an environment chain.
+//!
+//! The variables come from the chain, the functions come from the host's
+//! template callback. `render_template` and `render_json_value` know nothing
+//! about which host they run under — that is the whole point of taking the
+//! callback as a parameter. `render_form_values` sits one level up: resolving
+//! the chain a model sits in is an ordinary database read, so it takes the
+//! host and does that read before rendering.
+
+use crate::error::{Error, Result};
+use crate::host::PluginHost;
+use serde_json::Value;
+use std::collections::HashMap;
+use yaak_models::models::{AnyModel, Environment};
+use yaak_models::render::make_vars_hashmap;
+use yaak_plugins::events::{JsonPrimitive, RenderPurpose};
+use yaak_templates::{RenderOptions, TemplateCallback, parse_and_render, render_json_value_raw};
+
+pub async fn render_template<T: TemplateCallback>(
+    template: &str,
+    environment_chain: Vec<Environment>,
+    cb: &T,
+    opt: &RenderOptions,
+) -> yaak_templates::error::Result<String> {
+    let vars = &make_vars_hashmap(environment_chain);
+    parse_and_render(template, vars, cb, opt).await
+}
+
+pub async fn render_json_value<T: TemplateCallback>(
+    value: Value,
+    environment_chain: Vec<Environment>,
+    cb: &T,
+    opt: &RenderOptions,
+) -> yaak_templates::error::Result<Value> {
+    let vars = &make_vars_hashmap(environment_chain);
+    render_json_value_raw(value, vars, cb, opt).await
+}
+
+/// Render a config form's values against the environment chain the model sits in.
+///
+/// The chain depends on where the model lives — a request inherits through its
+/// folder, a workspace has only its own — so the model is what decides which
+/// variables are in scope.
+pub(crate) async fn render_form_values<H: PluginHost>(
+    host: &H,
+    model: &AnyModel,
+    environment_id: Option<&str>,
+    values: HashMap<String, JsonPrimitive>,
+    purpose: RenderPurpose,
+    options: &RenderOptions,
+) -> Result<HashMap<String, JsonPrimitive>> {
+    let (workspace_id, folder_id) = match model {
+        AnyModel::HttpRequest(r) => (r.workspace_id.clone(), r.folder_id.clone()),
+        AnyModel::GrpcRequest(r) => (r.workspace_id.clone(), r.folder_id.clone()),
+        AnyModel::WebsocketRequest(r) => (r.workspace_id.clone(), r.folder_id.clone()),
+        AnyModel::Folder(f) => (f.workspace_id.clone(), f.folder_id.clone()),
+        AnyModel::Workspace(w) => (w.id.clone(), None),
+        other => {
+            return Err(Error::Generic(format!(
+                "Cannot resolve environments for a {}",
+                other.model()
+            )));
+        }
+    };
+
+    let environment_chain =
+        host.db().resolve_environments(&workspace_id, folder_id.as_deref(), environment_id)?;
+
+    let cb = host.template_callback(purpose).await?;
+    let rendered =
+        render_json_value(serde_json::to_value(&values)?, environment_chain, &cb, options).await?;
+
+    Ok(serde_json::from_value(rendered)?)
+}

crates/yaak-commands/src/resolve.rs

@@ -0,0 +1,56 @@
+//! Filling in what a request inherits from its folders and workspace.
+//!
+//! A request stored in the database records only what is set *on it*;
+//! authentication and headers can come from any ancestor. Anything that acts on
+//! a request as the user sees it — sending it, handing it to a plugin — has to
+//! resolve that chain first, which is why this is shared rather than living
+//! next to any one caller.
+
+use crate::error::Result;
+use yaak_models::client_db::ClientDb;
+use yaak_models::models::{GrpcRequest, HttpRequest, WebsocketRequest};
+
+/// The request with inherited auth and headers filled in, plus the id of the
+/// model the authentication was inherited *from* — plugins key their token
+/// caches on it, so it must be the ancestor's id and not the request's.
+pub fn resolve_http_request(db: &ClientDb, request: &HttpRequest) -> Result<(HttpRequest, String)> {
+    let mut new_request = request.clone();
+
+    let (authentication_type, authentication, authentication_context_id) =
+        db.resolve_auth_for_http_request(request)?;
+    new_request.authentication_type = authentication_type;
+    new_request.authentication = authentication;
+
+    new_request.headers = db.resolve_headers_for_http_request(request)?;
+
+    Ok((new_request, authentication_context_id))
+}
+
+pub fn resolve_grpc_request(db: &ClientDb, request: &GrpcRequest) -> Result<(GrpcRequest, String)> {
+    let mut new_request = request.clone();
+
+    let (authentication_type, authentication, authentication_context_id) =
+        db.resolve_auth_for_grpc_request(request)?;
+    new_request.authentication_type = authentication_type;
+    new_request.authentication = authentication;
+
+    new_request.metadata = db.resolve_metadata_for_grpc_request(request)?;
+
+    Ok((new_request, authentication_context_id))
+}
+
+pub fn resolve_websocket_request(
+    db: &ClientDb,
+    request: &WebsocketRequest,
+) -> Result<(WebsocketRequest, String)> {
+    let mut new_request = request.clone();
+
+    let (authentication_type, authentication, authentication_context_id) =
+        db.resolve_auth_for_websocket_request(request)?;
+    new_request.authentication_type = authentication_type;
+    new_request.authentication = authentication;
+
+    new_request.headers = db.resolve_headers_for_websocket_request(request)?;
+
+    Ok((new_request, authentication_context_id))
+}

crates/yaak-commands/src/responses.rs

@@ -0,0 +1,86 @@
+//! Reading back what a send left behind: response events, request bodies, and
+//! where a response body lives.
+
+use crate::error::{Error, Result};
+use crate::host::Host;
+use std::fs;
+use std::path::PathBuf;
+use yaak_models::client_db::ClientDb;
+use yaak_models::models::HttpResponseEvent;
+use yaak_rpc_schema::*;
+
+/// Where a response's body is, and what it is meant to be read as.
+pub struct ResponseBodyLocation {
+    /// None when the response has no stored body.
+    pub path: Option<PathBuf>,
+    /// The response's declared `Content-Type`, empty when it has none.
+    pub content_type: String,
+}
+
+/// Find a response's body from its id alone.
+///
+/// The frontend hands back an id and never a path, so the only bodies reachable
+/// here are ones the engine wrote and the database still knows about. A
+/// response that was never saved has no entry, and its body came back from the
+/// send that made it.
+pub fn locate_response_body(db: &ClientDb, response_id: &str) -> Result<ResponseBodyLocation> {
+    let response = db.get_http_response(response_id)?;
+
+    Ok(ResponseBodyLocation {
+        path: response.body_path.map(PathBuf::from),
+        content_type: response
+            .headers
+            .iter()
+            .find(|h| h.name.eq_ignore_ascii_case("content-type"))
+            .map(|h| h.value.clone())
+            .unwrap_or_default(),
+    })
+}
+
+pub async fn cmd_get_http_response_events<H: Host>(
+    host: H,
+    req: CmdGetHttpResponseEventsReq,
+) -> Result<Vec<HttpResponseEvent>> {
+    let events: Vec<HttpResponseEvent> = host.db().list_http_response_events(&req.response_id)?;
+    Ok(events)
+}
+
+/// The body's path on this machine, for the desktop host to read or hand to the
+/// webview's asset protocol.
+///
+/// The frontend holds response ids; only `packages/platform`'s Tauri host sees
+/// the path, and only because it is about to open the file itself. Hosts
+/// without a filesystem serve the same bytes over HTTP instead.
+pub async fn cmd_http_response_body_path<H: Host>(
+    host: H,
+    req: CmdHttpResponseBodyPathReq,
+) -> Result<Option<String>> {
+    let location = locate_response_body(&host.db(), &req.response_id)?;
+    Ok(location.path.map(|p| p.to_string_lossy().to_string()))
+}
+
+pub async fn cmd_http_request_body<H: Host>(
+    host: H,
+    req: CmdHttpRequestBodyReq,
+) -> Result<Option<Vec<u8>>> {
+    let body_id = format!("{}.request", req.response_id);
+    let chunks = host.blobs().get_chunks(&body_id)?;
+
+    if chunks.is_empty() {
+        return Ok(None);
+    }
+
+    // Concatenate all chunks
+    let body: Vec<u8> = chunks.into_iter().flat_map(|c| c.data).collect();
+    Ok(Some(body))
+}
+
+pub async fn cmd_save_response<H: Host>(host: H, req: CmdSaveResponseReq) -> Result<()> {
+    let response = host.db().get_http_response(&req.response_id)?;
+
+    let body_path =
+        response.body_path.ok_or(Error::Generic("Response does not have a body".to_string()))?;
+    fs::copy(body_path, &req.filepath).map_err(|e| Error::Generic(e.to_string()))?;
+
+    Ok(())
+}

crates/yaak-commands/src/templates.rs

@@ -0,0 +1,79 @@
+//! Templates, the functions plugins put in them, and themes.
+//!
+//! Everything here needs the plugin runtime, but only for the one thing it
+//! uniquely provides: running a template function. Resolving the environment
+//! chain and deciding what a render should do about errors are ordinary work
+//! and stay here, where every host gets them the same.
+
+use crate::error::Result;
+use crate::host::PluginHost;
+use crate::render::{render_form_values, render_template};
+use yaak_plugins::events::{
+    GetTemplateFunctionConfigResponse, GetTemplateFunctionSummaryResponse, GetThemesResponse,
+    RenderPurpose,
+};
+use yaak_rpc_schema::*;
+use yaak_templates::{RenderErrorBehavior, RenderOptions, transform_args};
+
+pub async fn cmd_render_template<H: PluginHost>(
+    host: H,
+    req: CmdRenderTemplateReq,
+) -> Result<String> {
+    let environment_chain =
+        host.db().resolve_environments(&req.workspace_id, None, req.environment_id.as_deref())?;
+    let cb = host.template_callback(req.purpose.unwrap_or(RenderPurpose::Preview)).await?;
+    let options = RenderOptions {
+        // A preview that throws would show the user an error where they expect
+        // to see the value so far, so callers rendering *into the UI* ask for
+        // empties instead.
+        error_behavior: match req.ignore_error {
+            Some(true) => RenderErrorBehavior::ReturnEmpty,
+            _ => RenderErrorBehavior::Throw,
+        },
+    };
+    Ok(render_template(&req.template, environment_chain, &cb, &options).await?)
+}
+
+/// Render only the *arguments* of a template's function calls, leaving the
+/// calls themselves intact. This is what turns a parsed template back into
+/// something displayable without evaluating it.
+pub async fn cmd_template_tokens_to_string<H: PluginHost>(
+    host: H,
+    req: CmdTemplateTokensToStringReq,
+) -> Result<String> {
+    let cb = host.template_callback(RenderPurpose::Preview).await?;
+    Ok(transform_args(req.tokens, &cb)?.to_string())
+}
+
+pub async fn cmd_template_function_summaries<H: PluginHost>(
+    host: H,
+    _req: CmdTemplateFunctionSummariesReq,
+) -> Result<Vec<GetTemplateFunctionSummaryResponse>> {
+    host.template_function_summaries().await
+}
+
+pub async fn cmd_template_function_config<H: PluginHost>(
+    host: H,
+    req: CmdTemplateFunctionConfigReq,
+) -> Result<GetTemplateFunctionConfigResponse> {
+    // A config form is being displayed, so a template that cannot resolve
+    // should show as blank rather than refuse to open the form.
+    let values = render_form_values(
+        &host,
+        &req.model,
+        req.environment_id.as_deref(),
+        req.values,
+        RenderPurpose::Preview,
+        &RenderOptions::return_empty(),
+    )
+    .await?;
+
+    host.template_function_config(&req.function_name, values, req.model.id()).await
+}
+
+pub async fn cmd_get_themes<H: PluginHost>(
+    host: H,
+    _req: CmdGetThemesReq,
+) -> Result<Vec<GetThemesResponse>> {
+    host.themes().await
+}

crates/yaak-commands/tests/test_host.rs

@@ -0,0 +1,580 @@
+//! A host that is nothing but the trait: a temp database, a fixed client id,
+//! a fixed session. It exists to prove that the handlers really do run without
+//! a desktop around them, and that the client's identity reaches the writes.
+//!
+//! Neither host here has a plugin runtime — no `PluginManager`, no sidecar.
+//! `TestHost` implements `Host` alone, so a handler that reaches for plugins
+//! would not compile against it. `SingleThreadedHost` goes further and answers
+//! `PluginHost` too, without one, which is only possible because that trait
+//! names operations rather than handing back a manager.
+
+use std::cell::RefCell;
+use std::collections::HashMap;
+use std::rc::Rc;
+use std::sync::{Arc, Mutex};
+use tempfile::TempDir;
+use yaak_commands::auth::cmd_get_http_authentication_config;
+use yaak_commands::models::{
+    cmd_default_headers, cmd_get_workspace_meta, models_delete, models_upsert,
+    models_workspace_models,
+};
+use yaak_commands::templates::{cmd_render_template, cmd_template_function_config};
+use yaak_commands::{Host, PluginHost};
+use yaak_core::WorkspaceContext;
+use yaak_crypto::manager::EncryptionManager;
+use yaak_models::blob_manager::BlobManager;
+use yaak_models::models::{AnyModel, Environment, EnvironmentVariable, Plugin, Workspace};
+use yaak_models::query_manager::QueryManager;
+use yaak_models::util::{ModelPayload, UpdateSource};
+use yaak_plugins::events::{
+    CallFolderActionRequest, CallGrpcRequestActionRequest, CallHttpRequestActionRequest,
+    CallWebsocketRequestActionRequest, CallWorkspaceActionRequest, GetFolderActionsResponse,
+    GetGrpcRequestActionsResponse, GetHttpAuthenticationConfigResponse,
+    GetHttpAuthenticationSummaryResponse, GetHttpRequestActionsResponse,
+    GetTemplateFunctionConfigResponse, GetTemplateFunctionSummaryResponse, GetThemesResponse,
+    GetWebsocketRequestActionsResponse, GetWorkspaceActionsResponse, ImportResponse, JsonPrimitive,
+    RenderPurpose,
+};
+use yaak_plugins::plugin_meta::PluginMetadata;
+use yaak_rpc_schema::{
+    CmdDefaultHeadersReq, CmdGetWorkspaceMetaReq, CmdRenderTemplateReq, ModelsDeleteReq,
+    ModelsUpsertReq, ModelsWorkspaceModelsReq,
+};
+use yaak_templates::TemplateCallback;
+
+#[derive(Clone)]
+struct TestHost {
+    inner: Arc<Inner>,
+}
+
+struct Inner {
+    _dir: TempDir,
+    query_manager: QueryManager,
+    blob_manager: BlobManager,
+    encryption_manager: EncryptionManager,
+    /// Every model write the database reported, so a test can check who it
+    /// says made them.
+    writes: Mutex<Vec<ModelPayload>>,
+    rx: Mutex<std::sync::mpsc::Receiver<ModelPayload>>,
+}
+
+impl TestHost {
+    fn new() -> Self {
+        let dir = TempDir::new().expect("temp dir");
+        let (query_manager, blob_manager, rx) = yaak_models::init_standalone(
+            dir.path().join("db.sqlite"),
+            dir.path().join("blobs.sqlite"),
+        )
+        .expect("init db");
+        let encryption_manager = EncryptionManager::new(query_manager.clone(), "app.yaak.test");
+        Self {
+            inner: Arc::new(Inner {
+                _dir: dir,
+                query_manager,
+                blob_manager,
+                encryption_manager,
+                writes: Mutex::new(Vec::new()),
+                rx: Mutex::new(rx),
+            }),
+        }
+    }
+
+    fn drain_writes(&self) -> Vec<ModelPayload> {
+        let rx = self.inner.rx.lock().unwrap();
+        let mut writes = self.inner.writes.lock().unwrap();
+        while let Ok(payload) = rx.try_recv() {
+            writes.push(payload);
+        }
+        writes.drain(..).collect()
+    }
+}
+
+impl Host for TestHost {
+    fn client_id(&self) -> &str {
+        "test-client"
+    }
+
+    fn session(&self) -> WorkspaceContext {
+        WorkspaceContext::new().with_workspace("wk_test")
+    }
+
+    fn app_version(&self) -> String {
+        "0.0.0-test".to_string()
+    }
+
+    fn query_manager(&self) -> &QueryManager {
+        &self.inner.query_manager
+    }
+
+    fn blob_manager(&self) -> &BlobManager {
+        &self.inner.blob_manager
+    }
+
+    fn encryption_manager(&self) -> &EncryptionManager {
+        &self.inner.encryption_manager
+    }
+}
+
+#[tokio::test(flavor = "multi_thread")]
+async fn writes_carry_the_client_id() {
+    let host = TestHost::new();
+    host.drain_writes(); // the rows startup creates
+
+    let workspace = Workspace { name: "From a test".to_string(), ..Default::default() };
+    let id = models_upsert(host.clone(), ModelsUpsertReq { model: AnyModel::Workspace(workspace) })
+        .await
+        .expect("upsert");
+    assert!(id.starts_with("wk_"), "unexpected id {id}");
+
+    let writes = host.drain_writes();
+    assert_eq!(writes.len(), 1);
+    assert!(
+        matches!(&writes[0].update_source, UpdateSource::Window { label } if label == "test-client"),
+        "the write should be attributed to the calling client, got {:?}",
+        writes[0].update_source,
+    );
+
+    let meta =
+        cmd_get_workspace_meta(host.clone(), CmdGetWorkspaceMetaReq { workspace_id: id.clone() })
+            .await
+            .expect("workspace meta");
+    assert_eq!(meta.workspace_id, id);
+
+    // Deletes cascade inside a transaction; make sure that path works with no
+    // host doing anything special around it.
+    let workspace = host.db().get_workspace(&id).expect("get workspace");
+    let deleted =
+        models_delete(host.clone(), ModelsDeleteReq { model: AnyModel::Workspace(workspace) })
+            .await
+            .expect("delete");
+    assert_eq!(deleted, id);
+    assert!(host.db().get_workspace(&id).is_err(), "workspace should be gone");
+}
+
+#[tokio::test]
+async fn host_free_handlers_need_no_state() {
+    let host = TestHost::new();
+    let headers = cmd_default_headers(host, CmdDefaultHeadersReq {}).await.expect("headers");
+    assert!(!headers.is_empty());
+}
+
+/// A host that is deliberately **not** `Send` or `Sync`: it keeps its state in
+/// an `Rc`, the way a single-threaded browser host has to, since
+/// `rusqlite::Connection` is not `Sync` to begin with. It also has no plugin
+/// runtime of any kind — no `PluginManager`, no sidecar, nothing to spawn.
+///
+/// Nothing here asserts much at runtime; the test is largely that it compiles.
+/// A `Host` demanding thread-safety, or a `PluginHost` handing back a
+/// `&PluginManager`, would shut such a host out of the traits entirely and this
+/// file would stop building.
+#[derive(Clone)]
+struct SingleThreadedHost {
+    inner: Rc<Inner>,
+    /// The values the last auth-config call arrived with, so a test can check
+    /// they were rendered before the host ever saw them.
+    auth_values: Rc<RefCell<Option<HashMap<String, JsonPrimitive>>>>,
+    /// Same, for the last template-function-config call.
+    fn_values: Rc<RefCell<Option<HashMap<String, JsonPrimitive>>>>,
+}
+
+impl Host for SingleThreadedHost {
+    fn client_id(&self) -> &str {
+        "tab-1"
+    }
+
+    fn session(&self) -> WorkspaceContext {
+        WorkspaceContext::new()
+    }
+
+    fn app_version(&self) -> String {
+        "0.0.0-web".to_string()
+    }
+
+    fn query_manager(&self) -> &QueryManager {
+        &self.inner.query_manager
+    }
+
+    fn blob_manager(&self) -> &BlobManager {
+        &self.inner.blob_manager
+    }
+
+    fn encryption_manager(&self) -> &EncryptionManager {
+        &self.inner.encryption_manager
+    }
+}
+
+/// A template callback with no plugins behind it: variables still resolve,
+/// function calls have nothing to run them. A browser host would put a Worker
+/// round-trip where this returns an error.
+struct NoTemplateFunctions;
+
+impl TemplateCallback for NoTemplateFunctions {
+    async fn run(
+        &self,
+        fn_name: &str,
+        _args: HashMap<String, serde_json::Value>,
+    ) -> yaak_templates::error::Result<String> {
+        Err(yaak_templates::error::Error::RenderError(format!(
+            "no plugin runtime to run {fn_name}()"
+        )))
+    }
+
+    fn transform_arg(
+        &self,
+        _fn_name: &str,
+        _arg_name: &str,
+        arg_value: &str,
+    ) -> yaak_templates::error::Result<String> {
+        Ok(arg_value.to_string())
+    }
+}
+
+/// Answering plugin questions with no plugin runtime behind them. A browser
+/// host would put a `postMessage` round-trip to its Worker where these return
+/// constants; the shape of the trait is what makes either possible.
+impl PluginHost for SingleThreadedHost {
+    async fn loaded_plugin_metadata(&self, _directory: &str) -> Option<PluginMetadata> {
+        None
+    }
+
+    async fn take_plugin_init_errors(&self) -> Vec<(String, String)> {
+        Vec::new()
+    }
+
+    async fn resolve_plugins(&self, plugins: Vec<Plugin>) -> Vec<Plugin> {
+        // No runtime to enrich them with; the database rows are still the truth
+        // about what is installed.
+        plugins
+    }
+
+    async fn encrypt_secure_template(&self, _template: &str) -> yaak_commands::Result<String> {
+        Err(yaak_commands::Error::Generic("no plugin runtime on this host".into()))
+    }
+
+    async fn template_callback(
+        &self,
+        _purpose: RenderPurpose,
+    ) -> yaak_commands::Result<impl TemplateCallback> {
+        Ok(NoTemplateFunctions)
+    }
+
+    async fn template_function_summaries(
+        &self,
+    ) -> yaak_commands::Result<Vec<GetTemplateFunctionSummaryResponse>> {
+        Ok(Vec::new())
+    }
+
+    async fn template_function_config(
+        &self,
+        function_name: &str,
+        values: HashMap<String, JsonPrimitive>,
+        _model_id: &str,
+    ) -> yaak_commands::Result<GetTemplateFunctionConfigResponse> {
+        *self.fn_values.borrow_mut() = Some(values);
+        Err(yaak_commands::Error::Generic(format!("no plugin provides {function_name}()")))
+    }
+
+    async fn themes(&self) -> yaak_commands::Result<Vec<GetThemesResponse>> {
+        Ok(Vec::new())
+    }
+
+    // No plugins, so nothing contributes actions and nothing can run one.
+
+    async fn http_request_actions(
+        &self,
+    ) -> yaak_commands::Result<Vec<GetHttpRequestActionsResponse>> {
+        Ok(Vec::new())
+    }
+
+    async fn websocket_request_actions(
+        &self,
+    ) -> yaak_commands::Result<Vec<GetWebsocketRequestActionsResponse>> {
+        Ok(Vec::new())
+    }
+
+    async fn grpc_request_actions(
+        &self,
+    ) -> yaak_commands::Result<Vec<GetGrpcRequestActionsResponse>> {
+        Ok(Vec::new())
+    }
+
+    async fn workspace_actions(&self) -> yaak_commands::Result<Vec<GetWorkspaceActionsResponse>> {
+        Ok(Vec::new())
+    }
+
+    async fn folder_actions(&self) -> yaak_commands::Result<Vec<GetFolderActionsResponse>> {
+        Ok(Vec::new())
+    }
+
+    async fn call_http_request_action(
+        &self,
+        _req: CallHttpRequestActionRequest,
+    ) -> yaak_commands::Result<()> {
+        Err(no_plugins())
+    }
+
+    async fn call_grpc_request_action(
+        &self,
+        _req: CallGrpcRequestActionRequest,
+    ) -> yaak_commands::Result<()> {
+        Err(no_plugins())
+    }
+
+    async fn call_websocket_request_action(
+        &self,
+        _req: CallWebsocketRequestActionRequest,
+    ) -> yaak_commands::Result<()> {
+        Err(no_plugins())
+    }
+
+    async fn call_workspace_action(
+        &self,
+        _req: CallWorkspaceActionRequest,
+    ) -> yaak_commands::Result<()> {
+        Err(no_plugins())
+    }
+
+    async fn call_folder_action(&self, _req: CallFolderActionRequest) -> yaak_commands::Result<()> {
+        Err(no_plugins())
+    }
+
+    async fn http_authentication_summaries(
+        &self,
+    ) -> yaak_commands::Result<Vec<GetHttpAuthenticationSummaryResponse>> {
+        Ok(Vec::new())
+    }
+
+    async fn http_authentication_config(
+        &self,
+        _auth_name: &str,
+        values: HashMap<String, JsonPrimitive>,
+        _model_id: &str,
+    ) -> yaak_commands::Result<GetHttpAuthenticationConfigResponse> {
+        *self.auth_values.borrow_mut() = Some(values);
+        Err(no_plugins())
+    }
+
+    async fn call_http_authentication_action(
+        &self,
+        _auth_name: &str,
+        _action_index: i32,
+        _values: HashMap<String, JsonPrimitive>,
+        _model_id: &str,
+    ) -> yaak_commands::Result<()> {
+        Err(no_plugins())
+    }
+
+    async fn import_data(&self, _content: &str) -> yaak_commands::Result<ImportResponse> {
+        Err(no_plugins())
+    }
+
+    async fn reload_plugins(&self, _plugins: Vec<Plugin>) -> Vec<(String, String)> {
+        Vec::new()
+    }
+}
+
+fn no_plugins() -> yaak_commands::Error {
+    yaak_commands::Error::Generic("no plugin runtime on this host".into())
+}
+
+#[tokio::test]
+async fn a_single_threaded_host_can_implement_the_trait() {
+    let TestHost { inner } = TestHost::new();
+    let host = SingleThreadedHost {
+        inner: Rc::new(Arc::into_inner(inner).expect("sole owner")),
+        auth_values: Rc::new(RefCell::new(None)),
+        fn_values: Rc::new(RefCell::new(None)),
+    };
+
+    let workspace = Workspace { name: "From one thread".to_string(), ..Default::default() };
+    let id = models_upsert(host.clone(), ModelsUpsertReq { model: AnyModel::Workspace(workspace) })
+        .await
+        .expect("upsert");
+
+    // A `PluginHost` command, on a host with no plugin runtime at all. This is
+    // the one that could not be written when the trait handed back a
+    // `&PluginManager`.
+    let json = models_workspace_models(
+        host.clone(),
+        ModelsWorkspaceModelsReq { workspace_id: Some(id.clone()) },
+    )
+    .await
+    .expect("workspace models");
+    assert!(json.contains(&id), "the workspace should be in its own bootstrap payload");
+
+    // Rendering, on a host whose template callback has no plugins behind it.
+    // Resolving the environment chain is a database read and the render is
+    // shared code; only the callback came from the host. Rendering a real
+    // variable is what proves the chain was resolved rather than skipped.
+    let environment = host
+        .query_manager()
+        .with_tx(|tx| {
+            tx.upsert_environment(
+                &Environment {
+                    workspace_id: id.clone(),
+                    name: "Test env".to_string(),
+                    variables: vec![EnvironmentVariable {
+                        enabled: true,
+                        name: "greeting".to_string(),
+                        value: "hello".to_string(),
+                        id: None,
+                    }],
+                    ..Default::default()
+                },
+                &host.update_source(),
+            )
+        })
+        .expect("seed environment");
+
+    let rendered = cmd_render_template(
+        host.clone(),
+        CmdRenderTemplateReq {
+            template: "${[ greeting ]} world".to_string(),
+            workspace_id: id.clone(),
+            environment_id: Some(environment.id.clone()),
+            purpose: None,
+            ignore_error: None,
+        },
+    )
+    .await
+    .expect("render");
+    assert_eq!(rendered, "hello world", "the environment chain should have been resolved");
+
+    // The delete path too, since it is the one that used to reach for a
+    // blocking thread this host does not have.
+    let workspace = host.db().get_workspace(&id).expect("get workspace");
+    let deleted = models_delete(host, ModelsDeleteReq { model: AnyModel::Workspace(workspace) })
+        .await
+        .expect("delete");
+    assert_eq!(deleted, id);
+}
+
+/// Auth form values may contain templates, and a plugin must never see one
+/// unrendered. The rendering happens in the shared handler, so this checks the
+/// host received a resolved value rather than `${[ ... ]}`.
+#[tokio::test]
+async fn auth_values_are_rendered_before_the_host_sees_them() {
+    let TestHost { inner } = TestHost::new();
+    let host = SingleThreadedHost {
+        inner: Rc::new(Arc::into_inner(inner).expect("sole owner")),
+        auth_values: Rc::new(RefCell::new(None)),
+        fn_values: Rc::new(RefCell::new(None)),
+    };
+
+    let workspace = host
+        .query_manager()
+        .with_tx(|tx| {
+            tx.upsert_workspace(
+                &Workspace { name: "Auth".to_string(), ..Default::default() },
+                &host.update_source(),
+            )
+        })
+        .expect("workspace");
+    host.query_manager()
+        .with_tx(|tx| {
+            tx.upsert_environment(
+                &Environment {
+                    workspace_id: workspace.id.clone(),
+                    name: "Env".to_string(),
+                    variables: vec![EnvironmentVariable {
+                        enabled: true,
+                        name: "token".to_string(),
+                        value: "s3cret".to_string(),
+                        id: None,
+                    }],
+                    ..Default::default()
+                },
+                &host.update_source(),
+            )
+        })
+        .expect("environment");
+    let environment = host.db().list_environments(&workspace.id).expect("list").remove(0);
+
+    let mut values = HashMap::new();
+    values.insert("password".to_string(), JsonPrimitive::String("${[ token ]}".to_string()));
+
+    // The host refuses the call itself — it has no plugins — but only after the
+    // handler has rendered and handed over the values, which is what matters.
+    let _ = cmd_get_http_authentication_config(
+        host.clone(),
+        yaak_rpc_schema::CmdGetHttpAuthenticationConfigReq {
+            auth_name: "basic".to_string(),
+            values,
+            model: AnyModel::Workspace(workspace),
+            environment_id: Some(environment.id),
+        },
+    )
+    .await;
+
+    let seen = host.auth_values.borrow().clone().expect("the host should have been called");
+    assert!(
+        matches!(seen.get("password"), Some(JsonPrimitive::String(v)) if v == "s3cret"),
+        "the template should have been rendered before reaching the host, got {:?}",
+        seen.get("password"),
+    );
+}
+
+/// Same contract as auth: template function argument values may contain
+/// templates (the 1Password token argument defaults to `${[1PASSWORD_TOKEN]}`),
+/// and the shared handler renders them before the host is called.
+#[tokio::test]
+async fn template_function_values_are_rendered_before_the_host_sees_them() {
+    let TestHost { inner } = TestHost::new();
+    let host = SingleThreadedHost {
+        inner: Rc::new(Arc::into_inner(inner).expect("sole owner")),
+        auth_values: Rc::new(RefCell::new(None)),
+        fn_values: Rc::new(RefCell::new(None)),
+    };
+
+    let workspace = host
+        .query_manager()
+        .with_tx(|tx| {
+            tx.upsert_workspace(
+                &Workspace { name: "Functions".to_string(), ..Default::default() },
+                &host.update_source(),
+            )
+        })
+        .expect("workspace");
+    host.query_manager()
+        .with_tx(|tx| {
+            tx.upsert_environment(
+                &Environment {
+                    workspace_id: workspace.id.clone(),
+                    name: "Env".to_string(),
+                    variables: vec![EnvironmentVariable {
+                        enabled: true,
+                        name: "1PASSWORD_TOKEN".to_string(),
+                        value: "ops_abc123".to_string(),
+                        id: None,
+                    }],
+                    ..Default::default()
+                },
+                &host.update_source(),
+            )
+        })
+        .expect("environment");
+    let environment = host.db().list_environments(&workspace.id).expect("list").remove(0);
+
+    let mut values = HashMap::new();
+    values.insert("token".to_string(), JsonPrimitive::String("${[1PASSWORD_TOKEN]}".to_string()));
+
+    // The host refuses the call itself — it has no plugins — but only after the
+    // handler has rendered and handed over the values, which is what matters.
+    let _ = cmd_template_function_config(
+        host.clone(),
+        yaak_rpc_schema::CmdTemplateFunctionConfigReq {
+            function_name: "1password.item".to_string(),
+            values,
+            model: AnyModel::Workspace(workspace),
+            environment_id: Some(environment.id),
+        },
+    )
+    .await;
+
+    let seen = host.fn_values.borrow().clone().expect("the host should have been called");
+    assert!(
+        matches!(seen.get("token"), Some(JsonPrimitive::String(v)) if v == "ops_abc123"),
+        "the template should have been rendered before reaching the host, got {:?}",
+        seen.get("token"),
+    );
+}

crates/yaak-common/Cargo.toml

@@ -0,0 +1,9 @@
+[package]
+name = "yaak-common"
+version = "0.1.0"
+edition = "2024"
+publish = false
+
+[dependencies]
+serde_json = { workspace = true }
+tokio = { workspace = true, features = ["process"] }

crates/yaak-common/src/command.rs

@@ -0,0 +1,42 @@
+use std::ffi::{OsStr, OsString};
+use std::io::{self, ErrorKind};
+use std::process::Stdio;
+
+#[cfg(target_os = "windows")]
+const CREATE_NO_WINDOW: u32 = 0x0800_0000;
+
+/// Creates a new `tokio::process::Command` that won't spawn a console window on Windows.
+pub fn new_xplatform_command<S: AsRef<OsStr>>(program: S) -> tokio::process::Command {
+    #[allow(unused_mut)]
+    let mut cmd = tokio::process::Command::new(program);
+    #[cfg(target_os = "windows")]
+    {
+        use std::os::windows::process::CommandExt;
+        cmd.creation_flags(CREATE_NO_WINDOW);
+    }
+    cmd
+}
+
+/// Creates a command only if the binary exists and can be invoked with the given probe argument.
+pub async fn new_checked_command<S: AsRef<OsStr>>(
+    program: S,
+    probe_arg: &str,
+) -> io::Result<tokio::process::Command> {
+    let program: OsString = program.as_ref().to_os_string();
+
+    let mut probe = new_xplatform_command(&program);
+    probe.arg(probe_arg).stdin(Stdio::null()).stdout(Stdio::null()).stderr(Stdio::null());
+
+    let status = probe.status().await?;
+    if !status.success() {
+        return Err(io::Error::new(
+            ErrorKind::NotFound,
+            format!(
+                "'{}' is not available on PATH or failed to execute",
+                program.to_string_lossy()
+            ),
+        ));
+    }
+
+    Ok(new_xplatform_command(&program))
+}

crates/yaak-common/src/lib.rs

@@ -0,0 +1,3 @@
+pub mod command;
+pub mod platform;
+pub mod serde;

crates/yaak-common/src/platform.rs

@@ -0,0 +1,55 @@
+use crate::platform::OperatingSystem::{Linux, MacOS, Unknown, Windows};
+
+pub enum OperatingSystem {
+    Windows,
+    MacOS,
+    Linux,
+    Unknown,
+}
+
+pub fn get_os() -> OperatingSystem {
+    if cfg!(target_os = "windows") {
+        Windows
+    } else if cfg!(target_os = "macos") {
+        MacOS
+    } else if cfg!(target_os = "linux") {
+        Linux
+    } else {
+        Unknown
+    }
+}
+
+pub fn get_os_str() -> &'static str {
+    match get_os() {
+        Windows => "windows",
+        MacOS => "macos",
+        Linux => "linux",
+        Unknown => "unknown",
+    }
+}
+
+pub fn get_ua_platform() -> &'static str {
+    if cfg!(target_os = "windows") {
+        "Win"
+    } else if cfg!(target_os = "macos") {
+        "Mac"
+    } else if cfg!(target_os = "linux") {
+        "Linux"
+    } else {
+        "Unknown"
+    }
+}
+
+pub fn get_ua_arch() -> &'static str {
+    if cfg!(target_arch = "x86_64") {
+        "x86_64"
+    } else if cfg!(target_arch = "x86") {
+        "i386"
+    } else if cfg!(target_arch = "arm") {
+        "ARM"
+    } else if cfg!(target_arch = "aarch64") {
+        "ARM64"
+    } else {
+        "Unknown"
+    }
+}

crates/yaak-common/src/serde.rs

@@ -0,0 +1,30 @@
+use serde_json::Value;
+use std::collections::BTreeMap;
+
+pub fn get_bool(v: &Value, key: &str, fallback: bool) -> bool {
+    match v.get(key) {
+        None => fallback,
+        Some(v) => v.as_bool().unwrap_or(fallback),
+    }
+}
+
+pub fn get_str<'a>(v: &'a Value, key: &str) -> &'a str {
+    match v.get(key) {
+        None => "",
+        Some(v) => v.as_str().unwrap_or_default(),
+    }
+}
+
+pub fn get_str_map<'a>(v: &'a BTreeMap<String, Value>, key: &str) -> &'a str {
+    match v.get(key) {
+        None => "",
+        Some(v) => v.as_str().unwrap_or_default(),
+    }
+}
+
+pub fn get_bool_map(v: &BTreeMap<String, Value>, key: &str, fallback: bool) -> bool {
+    match v.get(key) {
+        None => fallback,
+        Some(v) => v.as_bool().unwrap_or(fallback),
+    }
+}

crates/yaak-core/Cargo.toml

@@ -0,0 +1,9 @@
+[package]
+name = "yaak-core"
+version = "0.0.0"
+edition = "2024"
+authors = ["Gregory Schier"]
+publish = false
+
+[dependencies]
+thiserror = { workspace = true }

crates/yaak-core/src/context.rs

@@ -0,0 +1,37 @@
+/// Context for a workspace operation.
+///
+/// In Tauri, this is extracted from the WebviewWindow URL.
+/// In CLI, this is constructed from command arguments or config.
+#[derive(Debug, Clone, Default)]
+pub struct WorkspaceContext {
+    pub workspace_id: Option<String>,
+    pub environment_id: Option<String>,
+    pub cookie_jar_id: Option<String>,
+    pub request_id: Option<String>,
+}
+
+impl WorkspaceContext {
+    pub fn new() -> Self {
+        Self::default()
+    }
+
+    pub fn with_workspace(mut self, workspace_id: impl Into<String>) -> Self {
+        self.workspace_id = Some(workspace_id.into());
+        self
+    }
+
+    pub fn with_environment(mut self, environment_id: impl Into<String>) -> Self {
+        self.environment_id = Some(environment_id.into());
+        self
+    }
+
+    pub fn with_cookie_jar(mut self, cookie_jar_id: impl Into<String>) -> Self {
+        self.cookie_jar_id = Some(cookie_jar_id.into());
+        self
+    }
+
+    pub fn with_request(mut self, request_id: impl Into<String>) -> Self {
+        self.request_id = Some(request_id.into());
+        self
+    }
+}

crates/yaak-core/src/error.rs

@@ -0,0 +1,15 @@
+use thiserror::Error;
+
+pub type Result<T> = std::result::Result<T, Error>;
+
+#[derive(Error, Debug)]
+pub enum Error {
+    #[error("Missing required context: {0}")]
+    MissingContext(String),
+
+    #[error("Configuration error: {0}")]
+    Config(String),
+
+    #[error("IO error: {0}")]
+    Io(#[from] std::io::Error),
+}

crates/yaak-core/src/lib.rs

@@ -0,0 +1,10 @@
+//! Core abstractions for Yaak that work without Tauri.
+//!
+//! This crate provides foundational types and traits that allow Yaak's
+//! business logic to run in both Tauri (desktop app) and CLI contexts.
+
+mod context;
+mod error;
+
+pub use context::WorkspaceContext;
+pub use error::{Error, Result};

crates/yaak-crypto/Cargo.toml

@@ -0,0 +1,15 @@
+[package]
+name = "yaak-crypto"
+version = "0.1.0"
+edition = "2021"
+publish = false
+
+[dependencies]
+base32 = "0.5.1" # For encoding human-readable key
+base64 = "0.22.1" # For encoding in the database
+chacha20poly1305 = "0.11.0"
+keyring = { workspace = true, features = ["apple-native", "windows-native", "sync-secret-service"] }
+log = { workspace = true }
+serde = { workspace = true, features = ["derive"] }
+thiserror = { workspace = true }
+yaak-models = { workspace = true }

crates/yaak-crypto/index.ts

@@ -0,0 +1,17 @@
+import { platform } from "@yaakapp-internal/platform";
+
+export function enableEncryption(workspaceId: string) {
+  return platform.rpc<void>("cmd_enable_encryption", { workspaceId });
+}
+
+export function revealWorkspaceKey(workspaceId: string) {
+  return platform.rpc<string>("cmd_reveal_workspace_key", { workspaceId });
+}
+
+export function setWorkspaceKey(args: { workspaceId: string; key: string }) {
+  return platform.rpc<void>("cmd_set_workspace_key", args);
+}
+
+export function disableEncryption(workspaceId: string) {
+  return platform.rpc<void>("cmd_disable_encryption", { workspaceId });
+}

crates/yaak-crypto/package.json

@@ -0,0 +1,6 @@
+{
+  "name": "@yaakapp-internal/crypto",
+  "version": "1.0.0",
+  "private": true,
+  "main": "index.ts"
+}

crates/yaak-crypto/src/encryption.rs

@@ -0,0 +1,119 @@
+use crate::error::Error::{DecryptionError, EncryptionError, InvalidEncryptedData};
+use crate::error::Result;
+use chacha20poly1305::aead::array::typenum::Unsigned;
+use chacha20poly1305::aead::{Aead, AeadCore, Generate, Key, KeyInit};
+use chacha20poly1305::{XChaCha20Poly1305, XNonce};
+
+const ENCRYPTION_TAG: &str = "yA4k3nC";
+const ENCRYPTION_VERSION: u8 = 1;
+
+pub(crate) fn encrypt_data(data: &[u8], key: &Key<XChaCha20Poly1305>) -> Result<Vec<u8>> {
+    let nonce = XNonce::generate();
+    let cipher = XChaCha20Poly1305::new(&key);
+    let ciphered_data = cipher.encrypt(&nonce, data).map_err(|_| EncryptionError)?;
+
+    let mut data: Vec<u8> = Vec::new();
+    data.extend_from_slice(ENCRYPTION_TAG.as_bytes()); // Tag
+    data.push(ENCRYPTION_VERSION); // Version
+    data.extend_from_slice(&nonce.as_slice()); // Nonce
+    data.extend_from_slice(&ciphered_data); // Ciphertext
+
+    Ok(data)
+}
+
+pub(crate) fn decrypt_data(cipher_data: &[u8], key: &Key<XChaCha20Poly1305>) -> Result<Vec<u8>> {
+    // Yaak Tag + ID + Version + Nonce + ... ciphertext ...
+    let (tag, rest) =
+        cipher_data.split_at_checked(ENCRYPTION_TAG.len()).ok_or(InvalidEncryptedData)?;
+    if tag != ENCRYPTION_TAG.as_bytes() {
+        return Err(InvalidEncryptedData);
+    }
+
+    let (version, rest) = rest.split_at_checked(1).ok_or(InvalidEncryptedData)?;
+    if version[0] != ENCRYPTION_VERSION {
+        return Err(InvalidEncryptedData);
+    }
+
+    let nonce_bytes = <XChaCha20Poly1305 as AeadCore>::NonceSize::USIZE;
+    let (nonce, ciphered_data) = rest.split_at_checked(nonce_bytes).ok_or(InvalidEncryptedData)?;
+
+    let nonce: &XNonce = nonce.try_into().map_err(|_| InvalidEncryptedData)?;
+    let cipher = XChaCha20Poly1305::new(&key);
+    cipher.decrypt(nonce, ciphered_data).map_err(|_e| DecryptionError)
+}
+
+#[cfg(test)]
+mod test {
+    use crate::encryption::{decrypt_data, encrypt_data};
+    use crate::error::Error::InvalidEncryptedData;
+    use crate::error::Result;
+    use chacha20poly1305::aead::{Generate, Key};
+    use chacha20poly1305::XChaCha20Poly1305;
+
+    #[test]
+    fn test_encrypt_decrypt() -> Result<()> {
+        let key = Key::<XChaCha20Poly1305>::generate();
+        let encrypted = encrypt_data("hello world".as_bytes(), &key)?;
+        let decrypted = decrypt_data(encrypted.as_slice(), &key)?;
+        assert_eq!(String::from_utf8(decrypted).unwrap(), "hello world");
+        Ok(())
+    }
+
+    #[test]
+    fn test_decrypt_empty() -> Result<()> {
+        let key = Key::<XChaCha20Poly1305>::generate();
+        let encrypted = encrypt_data(&[], &key)?;
+        assert_eq!(encrypted.len(), 48);
+        let decrypted = decrypt_data(encrypted.as_slice(), &key)?;
+        assert_eq!(String::from_utf8(decrypted).unwrap(), "");
+        Ok(())
+    }
+
+    #[test]
+    fn test_decrypt_bad_version() -> Result<()> {
+        let key = Key::<XChaCha20Poly1305>::generate();
+        let mut encrypted = encrypt_data("hello world".as_bytes(), &key)?;
+        encrypted[7] = 0;
+        let decrypted = decrypt_data(encrypted.as_slice(), &key);
+        assert!(matches!(decrypted, Err(InvalidEncryptedData)));
+        Ok(())
+    }
+
+    #[test]
+    fn test_decrypt_bad_tag() -> Result<()> {
+        let key = Key::<XChaCha20Poly1305>::generate();
+        let mut encrypted = encrypt_data("hello world".as_bytes(), &key)?;
+        encrypted[0] = 2;
+        let decrypted = decrypt_data(encrypted.as_slice(), &key);
+        assert!(matches!(decrypted, Err(InvalidEncryptedData)));
+        Ok(())
+    }
+
+    #[test]
+    fn test_decrypt_unencrypted_data() -> Result<()> {
+        let key = Key::<XChaCha20Poly1305>::generate();
+        let decrypted = decrypt_data("123".as_bytes(), &key);
+        assert!(matches!(decrypted, Err(InvalidEncryptedData)));
+        Ok(())
+    }
+}
+
+#[cfg(test)]
+mod compatibility {
+    use super::*;
+
+    /// Produced by chacha20poly1305 0.10.1. Decrypting it here proves a crate
+    /// upgrade hasn't changed the on-disk format, which users already have
+    /// rows of in their databases.
+    const V1_FROM_0_10: &str = "7941346b336e43017c7cb13467eecaa963b11734be636f9cc4152de348584fb27e95d1a70973e557cd335cf29e12d0d305d63ca0aa168f1b17003b1690a9d49140f0";
+
+    #[test]
+    fn decrypts_data_written_by_the_previous_release() {
+        let bytes: Vec<u8> = (0..V1_FROM_0_10.len())
+            .step_by(2)
+            .map(|i| u8::from_str_radix(&V1_FROM_0_10[i..i + 2], 16).unwrap())
+            .collect();
+        let key = Key::<XChaCha20Poly1305>::from([7u8; 32]);
+        assert_eq!(decrypt_data(&bytes, &key).unwrap(), b"yaak golden vector");
+    }
+}

crates/yaak-crypto/src/error.rs

@@ -0,0 +1,50 @@
+use serde::{Serialize, Serializer};
+use std::io;
+use thiserror::Error;
+
+#[derive(Error, Debug)]
+pub enum Error {
+    #[error(transparent)]
+    DbError(#[from] yaak_models::error::Error),
+
+    #[error("Keyring error: {0}")]
+    KeyringError(#[from] keyring::Error),
+
+    #[error("Missing workspace encryption key")]
+    MissingWorkspaceKey,
+
+    #[error("Incorrect workspace key")]
+    IncorrectWorkspaceKey,
+
+    #[error("Failed to decrypt workspace key: {0}")]
+    WorkspaceKeyDecryptionError(String),
+
+    #[error("Crypto IO error: {0}")]
+    IoError(#[from] io::Error),
+
+    #[error("Failed to encrypt data")]
+    EncryptionError,
+
+    #[error("Failed to decrypt data")]
+    DecryptionError,
+
+    #[error("Invalid encrypted data")]
+    InvalidEncryptedData,
+
+    #[error("Invalid key provided")]
+    InvalidHumanKey,
+
+    #[error("Encryption error: {0}")]
+    GenericError(String),
+}
+
+impl Serialize for Error {
+    fn serialize<S>(&self, serializer: S) -> std::result::Result<S::Ok, S::Error>
+    where
+        S: Serializer,
+    {
+        serializer.serialize_str(self.to_string().as_ref())
+    }
+}
+
+pub type Result<T> = std::result::Result<T, Error>;

crates/yaak-crypto/src/lib.rs

@@ -0,0 +1,7 @@
+extern crate core;
+
+pub mod encryption;
+pub mod error;
+pub mod manager;
+mod master_key;
+mod workspace_key;

crates/yaak-crypto/src/manager.rs

@@ -0,0 +1,189 @@
+use crate::error::Error::{
+    GenericError, IncorrectWorkspaceKey, MissingWorkspaceKey, WorkspaceKeyDecryptionError,
+};
+use crate::error::{Error, Result};
+use crate::master_key::MasterKey;
+use crate::workspace_key::WorkspaceKey;
+use base64::prelude::BASE64_STANDARD;
+use base64::Engine;
+use log::{info, warn};
+use std::collections::HashMap;
+use std::sync::{Arc, Mutex};
+use yaak_models::models::{EncryptedKey, Workspace, WorkspaceMeta};
+use yaak_models::query_manager::QueryManager;
+use yaak_models::util::{generate_id_of_length, UpdateSource};
+
+const KEY_USER: &str = "encryption-key";
+
+#[derive(Debug, Clone)]
+pub struct EncryptionManager {
+    cached_master_key: Arc<Mutex<Option<MasterKey>>>,
+    cached_workspace_keys: Arc<Mutex<HashMap<String, WorkspaceKey>>>,
+    query_manager: QueryManager,
+    app_id: String,
+}
+
+impl EncryptionManager {
+    pub fn new(query_manager: QueryManager, app_id: impl Into<String>) -> Self {
+        Self {
+            cached_master_key: Default::default(),
+            cached_workspace_keys: Default::default(),
+            query_manager,
+            app_id: app_id.into(),
+        }
+    }
+
+    pub fn encrypt(&self, workspace_id: &str, data: &[u8]) -> Result<Vec<u8>> {
+        let workspace_secret = self.get_workspace_key(workspace_id)?;
+        workspace_secret.encrypt(data)
+    }
+
+    pub fn decrypt(&self, workspace_id: &str, data: &[u8]) -> Result<Vec<u8>> {
+        let workspace_secret = self.get_workspace_key(workspace_id)?;
+        workspace_secret.decrypt(data)
+    }
+
+    pub fn reveal_workspace_key(&self, workspace_id: &str) -> Result<String> {
+        let key = self.get_workspace_key(workspace_id)?;
+        key.to_human()
+    }
+
+    pub fn set_human_key(&self, workspace_id: &str, human_key: &str) -> Result<WorkspaceMeta> {
+        let wkey = WorkspaceKey::from_human(human_key)?;
+
+        let workspace = self.query_manager.connect().get_workspace(workspace_id)?;
+        let encryption_key_challenge = match workspace.encryption_key_challenge {
+            None => return self.set_workspace_key(workspace_id, &wkey),
+            Some(c) => c,
+        };
+
+        let encryption_key_challenge = match BASE64_STANDARD.decode(encryption_key_challenge) {
+            Ok(c) => c,
+            Err(_) => return Err(GenericError("Failed to decode workspace challenge".to_string())),
+        };
+
+        if let Err(_) = wkey.decrypt(encryption_key_challenge.as_slice()) {
+            return Err(IncorrectWorkspaceKey);
+        };
+
+        self.set_workspace_key(workspace_id, &wkey)
+    }
+
+    pub(crate) fn set_workspace_key(
+        &self,
+        workspace_id: &str,
+        wkey: &WorkspaceKey,
+    ) -> Result<WorkspaceMeta> {
+        info!("Created workspace key for {workspace_id}");
+
+        let encrypted_key = BASE64_STANDARD.encode(self.get_master_key()?.encrypt(wkey.raw_key())?);
+        let encrypted_key = EncryptedKey { encrypted_key };
+        let encryption_key_challenge = wkey.encrypt(generate_id_of_length(50).as_bytes())?;
+        let encryption_key_challenge = Some(BASE64_STANDARD.encode(encryption_key_challenge));
+
+        let workspace_meta = self.query_manager.with_tx::<WorkspaceMeta, Error>(|tx| {
+            let workspace = tx.get_workspace(workspace_id)?;
+            let workspace_meta = tx.ensure_workspace_meta(workspace_id)?;
+            tx.upsert_workspace(
+                &Workspace { encryption_key_challenge, ..workspace },
+                &UpdateSource::Background,
+            )?;
+
+            Ok(tx.upsert_workspace_meta(
+                &WorkspaceMeta { encryption_key: Some(encrypted_key.clone()), ..workspace_meta },
+                &UpdateSource::Background,
+            )?)
+        })?;
+
+        let mut cache = self.cached_workspace_keys.lock().unwrap();
+        cache.insert(workspace_id.to_string(), wkey.clone());
+
+        Ok(workspace_meta)
+    }
+
+    pub fn ensure_workspace_key(&self, workspace_id: &str) -> Result<WorkspaceMeta> {
+        let workspace_meta =
+            self.query_manager.with_tx(|tx| tx.ensure_workspace_meta(workspace_id))?;
+
+        // Already exists
+        if let Some(_) = workspace_meta.encryption_key {
+            warn!("Tried to create workspace key when one already exists for {workspace_id}");
+            return Ok(workspace_meta);
+        }
+
+        let wkey = WorkspaceKey::create()?;
+        self.set_workspace_key(workspace_id, &wkey)
+    }
+
+    pub fn disable_encryption(&self, workspace_id: &str) -> Result<()> {
+        info!("Disabling encryption for {workspace_id}");
+
+        self.query_manager.with_tx::<(), Error>(|tx| {
+            let workspace = tx.get_workspace(workspace_id)?;
+            let workspace_meta = tx.ensure_workspace_meta(workspace_id)?;
+
+            // Clear encryption challenge on workspace
+            tx.upsert_workspace(
+                &Workspace { encryption_key_challenge: None, ..workspace },
+                &UpdateSource::Background,
+            )?;
+
+            // Clear encryption key on workspace meta
+            tx.upsert_workspace_meta(
+                &WorkspaceMeta { encryption_key: None, ..workspace_meta },
+                &UpdateSource::Background,
+            )?;
+
+            Ok(())
+        })?;
+
+        // Remove from cache
+        let mut cache = self.cached_workspace_keys.lock().unwrap();
+        cache.remove(workspace_id);
+
+        Ok(())
+    }
+
+    fn get_workspace_key(&self, workspace_id: &str) -> Result<WorkspaceKey> {
+        {
+            let cache = self.cached_workspace_keys.lock().unwrap();
+            if let Some(k) = cache.get(workspace_id) {
+                return Ok(k.clone());
+            }
+        };
+
+        let key = match self
+            .query_manager
+            .connect()
+            .get_workspace_meta(workspace_id)
+            .and_then(|m| m.encryption_key)
+        {
+            None => return Err(MissingWorkspaceKey),
+            Some(k) => k,
+        };
+
+        let mkey = self.get_master_key()?;
+        let decoded_key = BASE64_STANDARD
+            .decode(key.encrypted_key)
+            .map_err(|e| WorkspaceKeyDecryptionError(e.to_string()))?;
+        let raw_key = mkey
+            .decrypt(decoded_key.as_slice())
+            .map_err(|e| WorkspaceKeyDecryptionError(e.to_string()))?;
+        let wkey = WorkspaceKey::from_raw_key(raw_key.as_slice());
+
+        Ok(wkey)
+    }
+
+    fn get_master_key(&self) -> Result<MasterKey> {
+        // NOTE: This locks the key for the entire function which seems wrong, but this prevents
+        // concurrent access from prompting the user for a keychain password multiple times.
+        let mut master_secret = self.cached_master_key.lock().unwrap();
+        if let Some(k) = master_secret.as_ref() {
+            return Ok(k.to_owned());
+        }
+
+        let mkey = MasterKey::get_or_create(&self.app_id, KEY_USER)?;
+        *master_secret = Some(mkey.clone());
+        Ok(mkey)
+    }
+}

crates/yaak-crypto/src/master_key.rs

@@ -0,0 +1,78 @@
+use crate::encryption::{decrypt_data, encrypt_data};
+use crate::error::Error::GenericError;
+use crate::error::Result;
+use base32::Alphabet;
+use chacha20poly1305::aead::{Generate, Key};
+use chacha20poly1305::XChaCha20Poly1305;
+use keyring::{Entry, Error};
+use log::info;
+
+const HUMAN_PREFIX: &str = "YKM_";
+
+#[derive(Debug, Clone)]
+pub(crate) struct MasterKey {
+    key: Key<XChaCha20Poly1305>,
+}
+
+impl MasterKey {
+    pub(crate) fn get_or_create(app_id: &str, user: &str) -> Result<Self> {
+        let id = format!("{app_id}.EncryptionKey");
+        let entry = Entry::new(&id, user)?;
+
+        let key = match entry.get_password() {
+            Ok(encoded) => {
+                let without_prefix = encoded.strip_prefix(HUMAN_PREFIX).unwrap_or(&encoded);
+                let key_bytes = base32::decode(Alphabet::Crockford {}, &without_prefix)
+                    .ok_or(GenericError("Failed to decode master key".to_string()))?;
+                Key::<XChaCha20Poly1305>::try_from(key_bytes.as_slice())
+                    .map_err(|_| GenericError("Master key is the wrong length".to_string()))?
+            }
+            Err(Error::NoEntry) => {
+                info!("Creating new master key");
+                let key = Key::<XChaCha20Poly1305>::generate();
+                let encoded = base32::encode(Alphabet::Crockford {}, key.as_slice());
+                let with_prefix = format!("{HUMAN_PREFIX}{encoded}");
+                entry.set_password(&with_prefix)?;
+                key
+            }
+            Err(e) => return Err(GenericError(e.to_string())),
+        };
+
+        Ok(Self { key })
+    }
+
+    pub(crate) fn encrypt(&self, data: &[u8]) -> Result<Vec<u8>> {
+        encrypt_data(data, &self.key)
+    }
+
+    pub(crate) fn decrypt(&self, data: &[u8]) -> Result<Vec<u8>> {
+        decrypt_data(data, &self.key)
+    }
+
+    #[cfg(test)]
+    pub(crate) fn test_key() -> Self {
+        let key = Key::<XChaCha20Poly1305>::from(*b"00000000000000000000000000000000");
+        Self { key }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::error::Result;
+    use crate::master_key::MasterKey;
+
+    #[test]
+    fn test_master_key() -> Result<()> {
+        // Test out the master key
+        let mkey = MasterKey::test_key();
+        let encrypted = mkey.encrypt("hello".as_bytes())?;
+        let decrypted = mkey.decrypt(encrypted.as_slice()).unwrap();
+        assert_eq!(decrypted, "hello".as_bytes().to_vec());
+
+        let mkey = MasterKey::test_key();
+        let decrypted = mkey.decrypt(encrypted.as_slice()).unwrap();
+        assert_eq!(decrypted, "hello".as_bytes().to_vec());
+
+        Ok(())
+    }
+}

crates/yaak-crypto/src/workspace_key.rs

@@ -0,0 +1,116 @@
+use crate::encryption::{decrypt_data, encrypt_data};
+use crate::error::Error::InvalidHumanKey;
+use crate::error::Result;
+use base32::Alphabet;
+use chacha20poly1305::aead::{Generate, Key};
+use chacha20poly1305::{KeySizeUser, XChaCha20Poly1305};
+
+#[derive(Debug, Clone)]
+pub struct WorkspaceKey {
+    key: Key<XChaCha20Poly1305>,
+}
+
+const HUMAN_PREFIX: &str = "YK";
+
+impl WorkspaceKey {
+    pub(crate) fn to_human(&self) -> Result<String> {
+        let encoded = base32::encode(Alphabet::Crockford {}, self.key.as_slice());
+        let with_prefix = format!("{HUMAN_PREFIX}{encoded}");
+        let with_separators = with_prefix
+            .chars()
+            .collect::<Vec<_>>()
+            .chunks(6)
+            .map(|chunk| chunk.iter().collect::<String>())
+            .collect::<Vec<_>>()
+            .join("-");
+        Ok(with_separators)
+    }
+
+    #[allow(dead_code)]
+    pub(crate) fn from_human(human_key: &str) -> Result<Self> {
+        let without_prefix = human_key.strip_prefix(HUMAN_PREFIX).unwrap_or(human_key);
+        let without_separators = without_prefix.replace("-", "");
+        let key =
+            base32::decode(Alphabet::Crockford {}, &without_separators).ok_or(InvalidHumanKey)?;
+        if key.len() != XChaCha20Poly1305::key_size() {
+            return Err(InvalidHumanKey);
+        }
+        Ok(Self::from_raw_key(key.as_slice()))
+    }
+
+    pub(crate) fn from_raw_key(key: &[u8]) -> Self {
+        Self {
+            key: Key::<XChaCha20Poly1305>::try_from(key).expect("workspace key must be 32 bytes"),
+        }
+    }
+
+    pub(crate) fn raw_key(&self) -> &[u8] {
+        self.key.as_slice()
+    }
+
+    pub(crate) fn create() -> Result<Self> {
+        let key = Key::<XChaCha20Poly1305>::generate();
+        Ok(Self::from_raw_key(key.as_slice()))
+    }
+
+    pub(crate) fn encrypt(&self, data: &[u8]) -> Result<Vec<u8>> {
+        encrypt_data(data, &self.key)
+    }
+
+    pub(crate) fn decrypt(&self, data: &[u8]) -> Result<Vec<u8>> {
+        decrypt_data(data, &self.key)
+    }
+
+    #[cfg(test)]
+    pub(crate) fn test_key() -> Self {
+        Self::from_raw_key("f1a2d4b3c8e799af1456be3478a4c3f2".as_bytes())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::error::Error::InvalidHumanKey;
+    use crate::error::Result;
+    use crate::workspace_key::WorkspaceKey;
+
+    #[test]
+    fn test_persisted_key() -> Result<()> {
+        let key = WorkspaceKey::test_key();
+        let encrypted = key.encrypt("hello".as_bytes())?;
+        assert_eq!(key.decrypt(encrypted.as_slice())?, "hello".as_bytes());
+
+        Ok(())
+    }
+
+    #[test]
+    fn test_human_format() -> Result<()> {
+        let key = WorkspaceKey::test_key();
+
+        let encrypted = key.encrypt("hello".as_bytes())?;
+        assert_eq!(key.decrypt(encrypted.as_slice())?, "hello".as_bytes());
+
+        let human = key.to_human()?;
+        assert_eq!(human, "YKCRRP-2CK46H-H36RSR-CMVKJE-B1CRRK-8D9PC9-JK6D1Q-71GK8R-SKCRS0");
+        assert_eq!(
+            WorkspaceKey::from_human(&human)?.decrypt(encrypted.as_slice())?,
+            "hello".as_bytes()
+        );
+
+        Ok(())
+    }
+
+    #[test]
+    fn test_from_human_invalid() -> Result<()> {
+        assert!(matches!(
+            WorkspaceKey::from_human(
+                "YKCRRP-2CK46H-H36RSR-CMVKJE-B1CRRK-8D9PC9-JK6D1Q-71GK8R-SKCRS0-H3X38D",
+            ),
+            Err(InvalidHumanKey)
+        ));
+
+        assert!(matches!(WorkspaceKey::from_human("bad-key",), Err(InvalidHumanKey)));
+        assert!(matches!(WorkspaceKey::from_human("",), Err(InvalidHumanKey)));
+
+        Ok(())
+    }
+}

crates/yaak-git/Cargo.toml

@@ -0,0 +1,24 @@
+[package]
+name = "yaak-git"
+version = "0.1.0"
+edition = "2024"
+publish = false
+
+[dependencies]
+chrono = { workspace = true, features = ["serde"] }
+git2 = { version = "0.20.4", features = ["vendored-libgit2", "vendored-openssl"] }
+log = { workspace = true }
+serde = { workspace = true, features = ["derive"] }
+serde_json = { workspace = true }
+serde_yaml = "0.9.34"
+thiserror = { workspace = true }
+tokio = { workspace = true, features = ["io-util"] }
+ts-rs = { workspace = true, features = ["chrono-impl", "serde-json-impl"] }
+url = "2"
+yaak-common = { workspace = true }
+yaak-models = { workspace = true }
+yaak-sync = { workspace = true }
+
+[dev-dependencies]
+tempfile = "3"
+tokio = { workspace = true, features = ["macros", "rt"] }

crates/yaak-git/bindings/gen_git.ts

@@ -0,0 +1,35 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { SyncModel } from "./gen_models";
+
+export type BranchDeleteResult = { "type": "success", message: string, } | { "type": "not_fully_merged" };
+
+export type CloneResult = { "type": "success" } | { "type": "cancelled" } | { "type": "needs_credentials", url: string, error: string | null, };
+
+export type GitAuthor = { name: string | null, email: string | null, };
+
+export type GitBranchInfo = { path: string, headRef: string | null, headRefShorthand: string | null, origins: Array<string>, localBranches: Array<string>, remoteBranches: Array<string>, ahead: number, behind: number, };
+
+export type GitCommit = { oid: string, author: GitAuthor, when: string, message: string | null, };
+
+export type GitFileDiff = { original: string, modified: string, };
+
+export type GitRemote = { name: string, url: string | null, };
+
+export type GitStatus = "untracked" | "conflict" | "current" | "modified" | "removed" | "renamed" | "type_change";
+
+export type GitStatusEntry = { relaPath: string, status: GitStatus, staged: boolean, prev: SyncModel | null, next: SyncModel | null, };
+
+export type GitStatusSummary = { path: string, 
+/**
+ * The status directory relative to the repo root ("" when it IS the root).
+ * Useful for displaying entry paths relative to the sync directory
+ */
+relaDir: string, headRef: string | null, headRefShorthand: string | null, entries: Array<GitStatusEntry>, origins: Array<string>, localBranches: Array<string>, remoteBranches: Array<string>, ahead: number, behind: number, };
+
+export type GitWorktreeStatus = { entries: Array<GitWorktreeStatusEntry>, };
+
+export type GitWorktreeStatusEntry = { relaPath: string, modelId: string | null, status: GitStatus, staged: boolean, };
+
+export type PullResult = { "type": "success", message: string, } | { "type": "up_to_date" } | { "type": "needs_credentials", url: string, error: string | null, } | { "type": "diverged", remote: string, branch: string, } | { "type": "uncommitted_changes" };
+
+export type PushResult = { "type": "success", message: string, } | { "type": "up_to_date" } | { "type": "needs_credentials", url: string, error: string | null, };

crates/yaak-git/bindings/gen_models.ts

@@ -0,0 +1,179 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+
+export type DnsOverride = {
+  hostname: string;
+  ipv4: Array<string>;
+  ipv6: Array<string>;
+  enabled?: boolean;
+};
+
+export type Environment = {
+  model: "environment";
+  id: string;
+  workspaceId: string;
+  createdAt: string;
+  updatedAt: string;
+  name: string;
+  public: boolean;
+  parentModel: string;
+  parentId: string | null;
+  /**
+   * Variables defined in this environment scope.
+   * Child environments override parent variables by name.
+   */
+  variables: Array<EnvironmentVariable>;
+  color: string | null;
+  sortPriority: number;
+};
+
+export type EnvironmentVariable = { enabled?: boolean; name: string; value: string; id?: string };
+
+export type Folder = {
+  model: "folder";
+  id: string;
+  createdAt: string;
+  updatedAt: string;
+  workspaceId: string;
+  folderId: string | null;
+  authentication: Record<string, any>;
+  authenticationType: string | null;
+  description: string;
+  headers: Array<HttpRequestHeader>;
+  name: string;
+  sortPriority: number;
+  settingSendCookies: InheritedBoolSetting;
+  settingStoreCookies: InheritedBoolSetting;
+  settingValidateCertificates: InheritedBoolSetting;
+  settingFollowRedirects: InheritedBoolSetting;
+  settingRequestTimeout: InheritedIntSetting;
+  settingRequestMessageSize: InheritedIntSetting;
+  settingHttpVersion: InheritedHttpVersionSetting;
+};
+
+export type GrpcRequest = {
+  model: "grpc_request";
+  id: string;
+  createdAt: string;
+  updatedAt: string;
+  workspaceId: string;
+  folderId: string | null;
+  authenticationType: string | null;
+  authentication: Record<string, any>;
+  description: string;
+  message: string;
+  metadata: Array<HttpRequestHeader>;
+  method: string | null;
+  name: string;
+  service: string | null;
+  sortPriority: number;
+  /**
+   * Server URL (http for plaintext or https for secure)
+   */
+  url: string;
+  settingValidateCertificates: InheritedBoolSetting;
+  settingRequestMessageSize: InheritedIntSetting;
+};
+
+export type HttpRequest = {
+  model: "http_request";
+  id: string;
+  createdAt: string;
+  updatedAt: string;
+  workspaceId: string;
+  folderId: string | null;
+  authentication: Record<string, any>;
+  authenticationType: string | null;
+  body: Record<string, any>;
+  bodyType: string | null;
+  description: string;
+  headers: Array<HttpRequestHeader>;
+  method: string;
+  name: string;
+  sortPriority: number;
+  url: string;
+  /**
+   * URL parameters used for both path placeholders (`:id`) and query string entries.
+   */
+  urlParameters: Array<HttpUrlParameter>;
+  settingSendCookies: InheritedBoolSetting;
+  settingStoreCookies: InheritedBoolSetting;
+  settingValidateCertificates: InheritedBoolSetting;
+  settingFollowRedirects: InheritedBoolSetting;
+  settingRequestTimeout: InheritedIntSetting;
+  settingHttpVersion: InheritedHttpVersionSetting;
+};
+
+export type HttpRequestHeader = { enabled?: boolean; name: string; value: string; id?: string };
+
+export type HttpUrlParameter = {
+  enabled?: boolean;
+  /**
+   * Colon-prefixed parameters are treated as path parameters if they match, like `/users/:id`
+   * Other entries are appended as query parameters
+   */
+  name: string;
+  value: string;
+  id?: string;
+};
+
+export type HttpVersion = "auto" | "http1" | "http2";
+
+export type InheritedBoolSetting = { enabled?: boolean; value: boolean };
+
+export type InheritedHttpVersionSetting = { enabled?: boolean; value: HttpVersion };
+
+export type InheritedIntSetting = { enabled?: boolean; value: number };
+
+export type SyncModel =
+  | ({ type: "workspace" } & Workspace)
+  | ({ type: "environment" } & Environment)
+  | ({ type: "folder" } & Folder)
+  | ({ type: "http_request" } & HttpRequest)
+  | ({ type: "grpc_request" } & GrpcRequest)
+  | ({ type: "websocket_request" } & WebsocketRequest);
+
+export type WebsocketRequest = {
+  model: "websocket_request";
+  id: string;
+  createdAt: string;
+  updatedAt: string;
+  workspaceId: string;
+  folderId: string | null;
+  authentication: Record<string, any>;
+  authenticationType: string | null;
+  description: string;
+  headers: Array<HttpRequestHeader>;
+  message: string;
+  name: string;
+  sortPriority: number;
+  url: string;
+  /**
+   * URL parameters used for both path placeholders (`:id`) and query string entries.
+   */
+  urlParameters: Array<HttpUrlParameter>;
+  settingSendCookies: InheritedBoolSetting;
+  settingStoreCookies: InheritedBoolSetting;
+  settingValidateCertificates: InheritedBoolSetting;
+  settingRequestMessageSize: InheritedIntSetting;
+};
+
+export type Workspace = {
+  model: "workspace";
+  id: string;
+  createdAt: string;
+  updatedAt: string;
+  authentication: Record<string, any>;
+  authenticationType: string | null;
+  description: string;
+  headers: Array<HttpRequestHeader>;
+  name: string;
+  encryptionKeyChallenge: string | null;
+  settingValidateCertificates: boolean;
+  settingFollowRedirects: boolean;
+  settingRequestTimeout: number;
+  settingRequestMessageSize: number;
+  settingDnsOverrides: Array<DnsOverride>;
+  settingSendCookies: boolean;
+  settingStoreCookies: boolean;
+  settingHttpVersion: HttpVersion;
+};

crates/yaak-git/index.ts

@@ -0,0 +1,424 @@
+import { useQuery } from "@tanstack/react-query";
+import { platform } from "@yaakapp-internal/platform";
+import { createFastMutation } from "@yaakapp/yaak-client/hooks/useFastMutation";
+import { queryClient } from "@yaakapp/yaak-client/lib/queryClient";
+import { useMemo } from "react";
+import {
+  BranchDeleteResult,
+  CloneResult,
+  GitBranchInfo,
+  GitCommit,
+  GitFileDiff,
+  GitRemote,
+  GitStatusSummary,
+  GitWorktreeStatus,
+  PullResult,
+  PushResult,
+} from "./bindings/gen_git";
+import { showToast } from "@yaakapp/yaak-client/lib/toast";
+
+export * from "./bindings/gen_git";
+export * from "./bindings/gen_models";
+
+export interface GitCredentials {
+  username: string;
+  password: string;
+}
+
+export type DivergedStrategy = "force_reset" | "merge" | "cancel";
+
+export type UncommittedChangesStrategy = "reset" | "cancel";
+
+interface GitWatchResult {
+  unlistenEvent: string;
+}
+
+export interface GitCallbacks {
+  addRemote: () => Promise<GitRemote | null>;
+  promptCredentials: (
+    result: Extract<PushResult, { type: "needs_credentials" }>,
+  ) => Promise<GitCredentials | null>;
+  promptDiverged: (result: Extract<PullResult, { type: "diverged" }>) => Promise<DivergedStrategy>;
+  promptUncommittedChanges: () => Promise<UncommittedChangesStrategy>;
+  forceSync: () => Promise<void>;
+}
+
+const onSuccess = () => queryClient.invalidateQueries({ queryKey: ["git"] });
+
+function gitWorktreeStatusQueryKey(dir?: string, refreshKey?: string) {
+  return refreshKey == null
+    ? (["git", "worktree_status", dir] as const)
+    : (["git", "worktree_status", dir, refreshKey] as const);
+}
+
+export function invalidateGitWorktreeStatus(dir?: string) {
+  return queryClient.invalidateQueries({ queryKey: gitWorktreeStatusQueryKey(dir) });
+}
+
+export function useGitWorktreeStatus(dir: string, refreshKey?: string) {
+  return useQuery<GitWorktreeStatus, string>({
+    queryKey: gitWorktreeStatusQueryKey(dir, refreshKey),
+    queryFn: () => platform.rpc("cmd_git_worktree_status", { dir }),
+    placeholderData: (prev) => prev,
+  });
+}
+
+export function watchGitWorktreeStatus(dir: string, callback: (status: GitWorktreeStatus) => void) {
+  const handle = platform.rpcStream<GitWatchResult, GitWorktreeStatus>(
+    "cmd_git_watch_worktree_status",
+    { dir },
+    callback,
+  );
+
+  void handle
+    .then(({ result }) => {
+      addGitWatchKey(result.unlistenEvent);
+    })
+    .catch(console.debug);
+
+  return () =>
+    handle
+      .then(async ({ result, unlisten }) => {
+        unlistenGitWatcher(result.unlistenEvent);
+        unlisten();
+      })
+      .catch(console.error);
+}
+
+function useGitFetchAll(dir: string, refreshKey?: string) {
+  return useQuery<void, string>({
+    queryKey: ["git", "fetch_all", dir, refreshKey],
+    queryFn: () => platform.rpc("cmd_git_fetch_all", { dir }),
+    refetchInterval: 10 * 60_000,
+  });
+}
+
+function useGitBranchInfoQuery(dir: string, refreshKey?: string, fetchAllUpdatedAt?: number) {
+  return useQuery<GitBranchInfo, string>({
+    refetchOnMount: true,
+    queryKey: ["git", "branch_info", dir, refreshKey, fetchAllUpdatedAt],
+    queryFn: () => platform.rpc("cmd_git_branch_info", { dir }),
+    placeholderData: (prev) => prev,
+  });
+}
+
+export function useGitBranchInfo(dir: string, refreshKey?: string) {
+  const fetchAll = useGitFetchAll(dir, refreshKey);
+  return useGitBranchInfoQuery(dir, refreshKey, fetchAll.dataUpdatedAt);
+}
+
+export function useGitLog(dir: string, refreshKey?: string, relaPath?: string) {
+  return useQuery<GitCommit[], string>({
+    queryKey: ["git", "log", dir, refreshKey, relaPath],
+    queryFn: () =>
+      relaPath == null
+        ? platform.rpc("cmd_git_log", { dir })
+        : platform.rpc("cmd_git_log_for_file", { dir, relaPath }),
+    placeholderData: (prev) => prev,
+  });
+}
+
+export function useGitFileDiffForCommit(
+  dir: string,
+  relaPath: string,
+  commitOid: string | null | undefined,
+) {
+  return useQuery<GitFileDiff, string>({
+    enabled: commitOid != null,
+    queryKey: ["git", "file_diff_for_commit", dir, relaPath, commitOid],
+    queryFn: () => {
+      if (commitOid == null) throw new Error("Missing commit oid");
+      return platform.rpc("cmd_git_file_diff_for_commit", { dir, relaPath, commitOid });
+    },
+  });
+}
+
+export function useGit(dir: string, callbacks: GitCallbacks, refreshKey?: string) {
+  const mutations = useGitMutations(dir, callbacks);
+  const fetchAll = useGitFetchAll(dir, refreshKey);
+
+  return [
+    {
+      remotes: useQuery<GitRemote[], string>({
+        queryKey: ["git", "remotes", dir, refreshKey],
+        queryFn: () => getRemotes(dir),
+        placeholderData: (prev) => prev,
+      }),
+      log: useGitLog(dir, refreshKey),
+      status: useQuery<GitStatusSummary, string>({
+        refetchOnMount: true,
+        queryKey: ["git", "status", dir, refreshKey, fetchAll.dataUpdatedAt],
+        queryFn: () => platform.rpc("cmd_git_status", { dir }),
+        placeholderData: (prev) => prev,
+      }),
+    },
+    mutations,
+  ] as const;
+}
+
+export function useGitMutations(dir: string, callbacks: GitCallbacks) {
+  return useMemo(() => gitMutations(dir, callbacks), [dir, callbacks]);
+}
+
+export const gitMutations = (dir: string, callbacks: GitCallbacks) => {
+  const push = async () => {
+    const remotes = await getRemotes(dir);
+    if (remotes.length === 0) {
+      const remote = await callbacks.addRemote();
+      if (remote == null) throw new Error("No remote found");
+    }
+
+    const result = await platform.rpc<PushResult>("cmd_git_push", { dir });
+    if (result.type !== "needs_credentials") return result;
+
+    // Needs credentials, prompt for them
+    const creds = await callbacks.promptCredentials(result);
+    if (creds == null) throw new Error("Canceled");
+
+    await platform.rpc("cmd_git_add_credential", {
+      remoteUrl: result.url,
+      username: creds.username,
+      password: creds.password,
+    });
+
+    // Push again
+    return platform.rpc<PushResult>("cmd_git_push", { dir });
+  };
+
+  const handleError = (err: unknown) => {
+    showToast({
+      id: String(err),
+      message: String(err),
+      color: "danger",
+      timeout: 5000,
+    });
+  };
+
+  return {
+    init: createFastMutation<void, string, void>({
+      mutationKey: ["git", "init"],
+      mutationFn: () => platform.rpc("cmd_git_initialize", { dir }),
+      onSuccess,
+    }),
+    add: createFastMutation<void, string, { relaPaths: string[] }>({
+      mutationKey: ["git", "add", dir],
+      mutationFn: (args) => platform.rpc("cmd_git_add", { dir, ...args }),
+      onSuccess,
+    }),
+    addRemote: createFastMutation<GitRemote, string, GitRemote>({
+      mutationKey: ["git", "add-remote"],
+      mutationFn: (args) => platform.rpc("cmd_git_add_remote", { dir, ...args }),
+      onSuccess,
+    }),
+    rmRemote: createFastMutation<void, string, { name: string }>({
+      mutationKey: ["git", "rm-remote", dir],
+      mutationFn: (args) => platform.rpc("cmd_git_rm_remote", { dir, ...args }),
+      onSuccess,
+    }),
+    createBranch: createFastMutation<void, string, { branch: string; base?: string }>({
+      mutationKey: ["git", "branch", dir],
+      mutationFn: (args) => platform.rpc("cmd_git_branch", { dir, ...args }),
+      onSuccess,
+    }),
+    mergeBranch: createFastMutation<void, string, { branch: string }>({
+      mutationKey: ["git", "merge", dir],
+      mutationFn: (args) => platform.rpc("cmd_git_merge_branch", { dir, ...args }),
+      onSuccess,
+    }),
+    deleteBranch: createFastMutation<
+      BranchDeleteResult,
+      string,
+      { branch: string; force?: boolean }
+    >({
+      mutationKey: ["git", "delete-branch", dir],
+      mutationFn: (args) => platform.rpc("cmd_git_delete_branch", { dir, ...args }),
+      onSuccess,
+    }),
+    deleteRemoteBranch: createFastMutation<void, string, { branch: string }>({
+      mutationKey: ["git", "delete-remote-branch", dir],
+      mutationFn: (args) => platform.rpc("cmd_git_delete_remote_branch", { dir, ...args }),
+      onSuccess,
+    }),
+    renameBranch: createFastMutation<void, string, { oldName: string; newName: string }>({
+      mutationKey: ["git", "rename-branch", dir],
+      mutationFn: (args) => platform.rpc("cmd_git_rename_branch", { dir, ...args }),
+      onSuccess,
+    }),
+    checkout: createFastMutation<string, string, { branch: string; force: boolean }>({
+      mutationKey: ["git", "checkout", dir],
+      mutationFn: (args) => platform.rpc("cmd_git_checkout", { dir, ...args }),
+      onSuccess,
+    }),
+    commit: createFastMutation<void, string, { message: string }>({
+      mutationKey: ["git", "commit", dir],
+      mutationFn: (args) => platform.rpc("cmd_git_commit", { dir, ...args }),
+      onSuccess,
+    }),
+    commitAndPush: createFastMutation<PushResult, string, { message: string }>({
+      mutationKey: ["git", "commit_push", dir],
+      mutationFn: async (args) => {
+        await platform.rpc("cmd_git_commit", { dir, ...args });
+        return push();
+      },
+      onSuccess,
+    }),
+
+    push: createFastMutation<PushResult, string, void>({
+      mutationKey: ["git", "push", dir],
+      mutationFn: push,
+      onSuccess,
+    }),
+    pull: createFastMutation<PullResult, string, void>({
+      mutationKey: ["git", "pull", dir],
+      async mutationFn() {
+        const result = await platform.rpc<PullResult>("cmd_git_pull", { dir });
+
+        if (result.type === "needs_credentials") {
+          const creds = await callbacks.promptCredentials(result);
+          if (creds == null) throw new Error("Canceled");
+
+          await platform.rpc("cmd_git_add_credential", {
+            remoteUrl: result.url,
+            username: creds.username,
+            password: creds.password,
+          });
+
+          // Pull again after credentials
+          return platform.rpc<PullResult>("cmd_git_pull", { dir });
+        }
+
+        if (result.type === "uncommitted_changes") {
+          void callbacks
+            .promptUncommittedChanges()
+            .then(async (strategy) => {
+              if (strategy === "cancel") return;
+
+              await platform.rpc("cmd_git_reset_changes", { dir });
+              return platform.rpc<PullResult>("cmd_git_pull", { dir });
+            })
+            .then(async () => {
+              await onSuccess();
+              await callbacks.forceSync();
+            }, handleError);
+        }
+
+        if (result.type === "diverged") {
+          void callbacks
+            .promptDiverged(result)
+            .then((strategy) => {
+              if (strategy === "cancel") return;
+
+              if (strategy === "force_reset") {
+                return platform.rpc<PullResult>("cmd_git_pull_force_reset", {
+                  dir,
+                  remote: result.remote,
+                  branch: result.branch,
+                });
+              }
+
+              return platform.rpc<PullResult>("cmd_git_pull_merge", {
+                dir,
+                remote: result.remote,
+                branch: result.branch,
+              });
+            })
+            .then(async () => {
+              await onSuccess();
+              await callbacks.forceSync();
+            }, handleError);
+        }
+
+        return result;
+      },
+      onSuccess,
+    }),
+    unstage: createFastMutation<void, string, { relaPaths: string[] }>({
+      mutationKey: ["git", "unstage", dir],
+      mutationFn: (args) => platform.rpc("cmd_git_unstage", { dir, ...args }),
+      onSuccess,
+    }),
+    resetChanges: createFastMutation<void, string, void>({
+      mutationKey: ["git", "reset-changes", dir],
+      mutationFn: () => platform.rpc("cmd_git_reset_changes", { dir }),
+      onSuccess,
+    }),
+    restore: createFastMutation<void, string, { relaPaths: string[] }>({
+      mutationKey: ["git", "restore", dir],
+      mutationFn: (args) => platform.rpc("cmd_git_restore_files", { dir, ...args }),
+      onSuccess,
+    }),
+    restoreFileFromCommit: createFastMutation<
+      void,
+      string,
+      { commitOid: string; relaPath: string }
+    >({
+      mutationKey: ["git", "restore-file-from-commit", dir],
+      mutationFn: (args) => platform.rpc("cmd_git_restore_file_from_commit", { dir, ...args }),
+      onSuccess,
+    }),
+  } as const;
+};
+
+async function getRemotes(dir: string) {
+  return platform.rpc<GitRemote[]>("cmd_git_remotes", { dir });
+}
+
+function unlistenGitWatcher(unlistenEvent: string) {
+  void platform.emit(unlistenEvent).then(() => {
+    removeGitWatchKey(unlistenEvent);
+  });
+}
+
+function getGitWatchKeys() {
+  return sessionStorage.getItem("git-worktree-watchers")?.split(",").filter(Boolean) ?? [];
+}
+
+function setGitWatchKeys(keys: string[]) {
+  sessionStorage.setItem("git-worktree-watchers", keys.join(","));
+}
+
+function addGitWatchKey(key: string) {
+  const keys = getGitWatchKeys();
+  setGitWatchKeys([...keys, key]);
+}
+
+function removeGitWatchKey(key: string) {
+  const keys = getGitWatchKeys();
+  setGitWatchKeys(keys.filter((k) => k !== key));
+}
+
+const gitWatchKeys = getGitWatchKeys();
+if (gitWatchKeys.length > 0) {
+  gitWatchKeys.forEach(unlistenGitWatcher);
+}
+
+/**
+ * Clone a git repository, prompting for credentials if needed.
+ */
+export async function gitClone(
+  url: string,
+  dir: string,
+  promptCredentials: (args: {
+    url: string;
+    error: string | null;
+  }) => Promise<GitCredentials | null>,
+): Promise<CloneResult> {
+  const result = await platform.rpc<CloneResult>("cmd_git_clone", { url, dir });
+  if (result.type !== "needs_credentials") return result;
+
+  // Prompt for credentials
+  const creds = await promptCredentials({
+    url: result.url,
+    error: result.error,
+  });
+  if (creds == null) return { type: "cancelled" };
+
+  // Store credentials and retry
+  await platform.rpc("cmd_git_add_credential", {
+    remoteUrl: result.url,
+    username: creds.username,
+    password: creds.password,
+  });
+
+  return platform.rpc<CloneResult>("cmd_git_clone", { url, dir });
+}

crates/yaak-git/package.json

@@ -0,0 +1,6 @@
+{
+  "name": "@yaakapp-internal/git",
+  "version": "1.0.0",
+  "private": true,
+  "main": "index.ts"
+}

crates/yaak-git/src/add.rs

@@ -0,0 +1,16 @@
+use crate::error::Result;
+use crate::repository::open_repo;
+use git2::IndexAddOption;
+use log::info;
+use std::path::Path;
+
+pub fn git_add(dir: &Path, rela_path: &Path) -> Result<()> {
+    let repo = open_repo(dir)?;
+    let mut index = repo.index()?;
+
+    info!("Staging file {rela_path:?} to {dir:?}");
+    index.add_all(&[rela_path], IndexAddOption::DEFAULT, None)?;
+    index.write()?;
+
+    Ok(())
+}

crates/yaak-git/src/binary.rs

@@ -0,0 +1,17 @@
+use crate::error::Error::GitNotFound;
+use crate::error::Result;
+use std::path::Path;
+use tokio::process::Command;
+use yaak_common::command::new_checked_command;
+
+/// Create a git command that runs in the specified directory
+pub(crate) async fn new_binary_command(dir: &Path) -> Result<Command> {
+    let mut cmd = new_binary_command_global().await?;
+    cmd.arg("-C").arg(dir);
+    Ok(cmd)
+}
+
+/// Create a git command without a specific directory (for global operations)
+pub(crate) async fn new_binary_command_global() -> Result<Command> {
+    new_checked_command("git", "--version").await.map_err(|_| GitNotFound)
+}

crates/yaak-git/src/branch.rs

@@ -0,0 +1,153 @@
+use serde::{Deserialize, Serialize};
+use ts_rs::TS;
+
+use crate::binary::new_binary_command;
+use crate::error::Error::GenericError;
+use crate::error::Result;
+use std::path::Path;
+
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize, TS)]
+#[serde(rename_all = "snake_case", tag = "type")]
+#[ts(export, export_to = "gen_git.ts")]
+pub enum BranchDeleteResult {
+    Success { message: String },
+    NotFullyMerged,
+}
+
+pub async fn git_checkout_branch(dir: &Path, branch_name: &str, force: bool) -> Result<String> {
+    let branch_name = branch_name.trim_start_matches("origin/");
+
+    let mut args = vec!["checkout"];
+    if force {
+        args.push("--force");
+    }
+    args.push(branch_name);
+
+    let out = new_binary_command(dir)
+        .await?
+        .args(&args)
+        .output()
+        .await
+        .map_err(|e| GenericError(format!("failed to run git checkout: {e}")))?;
+
+    let stdout = String::from_utf8_lossy(&out.stdout);
+    let stderr = String::from_utf8_lossy(&out.stderr);
+    let combined = format!("{}{}", stdout, stderr);
+
+    if !out.status.success() {
+        return Err(GenericError(format!("Failed to checkout: {}", combined.trim())));
+    }
+
+    Ok(branch_name.to_string())
+}
+
+pub async fn git_create_branch(dir: &Path, name: &str, base: Option<&str>) -> Result<()> {
+    let mut cmd = new_binary_command(dir).await?;
+    cmd.arg("branch").arg(name);
+    if let Some(base_branch) = base {
+        cmd.arg(base_branch);
+    }
+
+    let out =
+        cmd.output().await.map_err(|e| GenericError(format!("failed to run git branch: {e}")))?;
+
+    let stdout = String::from_utf8_lossy(&out.stdout);
+    let stderr = String::from_utf8_lossy(&out.stderr);
+    let combined = format!("{}{}", stdout, stderr);
+
+    if !out.status.success() {
+        return Err(GenericError(format!("Failed to create branch: {}", combined.trim())));
+    }
+
+    Ok(())
+}
+
+pub async fn git_delete_branch(dir: &Path, name: &str, force: bool) -> Result<BranchDeleteResult> {
+    let mut cmd = new_binary_command(dir).await?;
+
+    let out =
+        if force { cmd.args(["branch", "-D", name]) } else { cmd.args(["branch", "-d", name]) }
+            .output()
+            .await
+            .map_err(|e| GenericError(format!("failed to run git branch -d: {e}")))?;
+
+    let stdout = String::from_utf8_lossy(&out.stdout);
+    let stderr = String::from_utf8_lossy(&out.stderr);
+    let combined = format!("{}{}", stdout, stderr);
+
+    if !out.status.success() && stderr.to_lowercase().contains("not fully merged") {
+        return Ok(BranchDeleteResult::NotFullyMerged);
+    }
+
+    if !out.status.success() {
+        return Err(GenericError(format!("Failed to delete branch: {}", combined.trim())));
+    }
+
+    Ok(BranchDeleteResult::Success { message: combined })
+}
+
+pub async fn git_merge_branch(dir: &Path, name: &str) -> Result<()> {
+    let out = new_binary_command(dir)
+        .await?
+        .args(["merge", name])
+        .output()
+        .await
+        .map_err(|e| GenericError(format!("failed to run git merge: {e}")))?;
+
+    let stdout = String::from_utf8_lossy(&out.stdout);
+    let stderr = String::from_utf8_lossy(&out.stderr);
+    let combined = format!("{}{}", stdout, stderr);
+
+    if !out.status.success() {
+        // Check for merge conflicts
+        if combined.to_lowercase().contains("conflict") {
+            return Err(GenericError(
+                "Merge conflicts detected. Please resolve them manually.".to_string(),
+            ));
+        }
+        return Err(GenericError(format!("Failed to merge: {}", combined.trim())));
+    }
+
+    Ok(())
+}
+
+pub async fn git_delete_remote_branch(dir: &Path, name: &str) -> Result<()> {
+    // Remote branch names come in as "origin/branch-name", extract the branch name
+    let branch_name = name.trim_start_matches("origin/");
+
+    let out = new_binary_command(dir)
+        .await?
+        .args(["push", "origin", "--delete", branch_name])
+        .output()
+        .await
+        .map_err(|e| GenericError(format!("failed to run git push --delete: {e}")))?;
+
+    let stdout = String::from_utf8_lossy(&out.stdout);
+    let stderr = String::from_utf8_lossy(&out.stderr);
+    let combined = format!("{}{}", stdout, stderr);
+
+    if !out.status.success() {
+        return Err(GenericError(format!("Failed to delete remote branch: {}", combined.trim())));
+    }
+
+    Ok(())
+}
+
+pub async fn git_rename_branch(dir: &Path, old_name: &str, new_name: &str) -> Result<()> {
+    let out = new_binary_command(dir)
+        .await?
+        .args(["branch", "-m", old_name, new_name])
+        .output()
+        .await
+        .map_err(|e| GenericError(format!("failed to run git branch -m: {e}")))?;
+
+    let stdout = String::from_utf8_lossy(&out.stdout);
+    let stderr = String::from_utf8_lossy(&out.stderr);
+    let combined = format!("{}{}", stdout, stderr);
+
+    if !out.status.success() {
+        return Err(GenericError(format!("Failed to rename branch: {}", combined.trim())));
+    }
+
+    Ok(())
+}

crates/yaak-git/src/clone.rs

@@ -0,0 +1,53 @@
+use crate::binary::new_binary_command;
+use crate::error::Error::GenericError;
+use crate::error::Result;
+use log::info;
+use serde::{Deserialize, Serialize};
+use std::fs;
+use std::path::Path;
+use ts_rs::TS;
+
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize, TS)]
+#[serde(rename_all = "snake_case", tag = "type")]
+#[ts(export, export_to = "gen_git.ts")]
+pub enum CloneResult {
+    Success,
+    Cancelled,
+    NeedsCredentials { url: String, error: Option<String> },
+}
+
+pub async fn git_clone(url: &str, dir: &Path) -> Result<CloneResult> {
+    let parent = dir.parent().ok_or_else(|| GenericError("Invalid clone directory".to_string()))?;
+    fs::create_dir_all(parent)
+        .map_err(|e| GenericError(format!("Failed to create directory: {e}")))?;
+    let mut cmd = new_binary_command(parent).await?;
+    cmd.args(["clone", url]).arg(dir).env("GIT_TERMINAL_PROMPT", "0");
+
+    let out =
+        cmd.output().await.map_err(|e| GenericError(format!("failed to run git clone: {e}")))?;
+
+    let stdout = String::from_utf8_lossy(&out.stdout);
+    let stderr = String::from_utf8_lossy(&out.stderr);
+    let combined = format!("{}{}", stdout, stderr);
+    let combined_lower = combined.to_lowercase();
+
+    info!("Cloned status={}: {combined}", out.status);
+
+    if !out.status.success() {
+        // Check for credentials error
+        if combined_lower.contains("could not read") {
+            return Ok(CloneResult::NeedsCredentials { url: url.to_string(), error: None });
+        }
+        if combined_lower.contains("unable to access")
+            || combined_lower.contains("authentication failed")
+        {
+            return Ok(CloneResult::NeedsCredentials {
+                url: url.to_string(),
+                error: Some(combined.to_string()),
+            });
+        }
+        return Err(GenericError(format!("Failed to clone: {}", combined.trim())));
+    }
+
+    Ok(CloneResult::Success)
+}

crates/yaak-git/src/commit.rs

@@ -0,0 +1,106 @@
+use crate::binary::new_binary_command;
+use crate::error::Error::GenericError;
+use crate::repository::open_repo;
+use crate::status::repo_relative_dir;
+use log::info;
+use std::path::Path;
+
+/// Commit the staged changes within `dir` (their current worktree content,
+/// matching what the commit dialog displays). Scoping the commit to the sync
+/// directory means files staged outside of it (e.g. elsewhere in a containing
+/// monorepo) are never swept into a Yaak commit — they stay staged for the
+/// user's own next commit.
+pub async fn git_commit(dir: &Path, message: &str) -> crate::error::Result<()> {
+    // Run git from the repo root: command-line pathspecs resolve relative to
+    // the working directory, and staged paths are repo-root-relative
+    let (workdir, rela_dir) = {
+        let repo = open_repo(dir)?;
+        let workdir = repo
+            .workdir()
+            .ok_or_else(|| GenericError("Repository has no worktree".to_string()))?
+            .to_path_buf();
+        (workdir, repo_relative_dir(&repo, dir))
+    };
+
+    let staged = staged_files(&workdir, rela_dir.as_deref()).await?;
+    if staged.is_empty() {
+        return Err(GenericError("No staged changes to commit".to_string()));
+    }
+
+    let mut cmd = new_binary_command(&workdir).await?;
+    // --literal-pathspecs: the staged paths are exact files, never patterns
+    cmd.arg("--literal-pathspecs");
+    cmd.args(["commit", "--message", message, "--"]);
+    cmd.args(staged);
+
+    let out = cmd.output().await?;
+
+    let stdout = String::from_utf8_lossy(&out.stdout);
+    let stderr = String::from_utf8_lossy(&out.stderr);
+    let combined = stdout + stderr;
+
+    if !out.status.success() {
+        return Err(GenericError(format!("Failed to commit: {}", combined)));
+    }
+
+    info!("Committed to {dir:?}");
+
+    Ok(())
+}
+
+/// Repo-relative paths of staged changes, limited to `rela_dir` when given.
+/// Must be run from the repo root so the pathspec resolves correctly. Uses
+/// -z for NUL separation so paths with special characters come through
+/// unquoted, --no-renames so staged renames list both sides, and
+/// --literal-pathspecs so a scope dir with glob characters isn't a pattern
+async fn staged_files(workdir: &Path, rela_dir: Option<&str>) -> crate::error::Result<Vec<String>> {
+    let mut cmd = new_binary_command(workdir).await?;
+    cmd.arg("--literal-pathspecs");
+    cmd.args(["diff", "--cached", "--name-only", "--no-renames", "-z"]);
+    if let Some(rela_dir) = rela_dir {
+        cmd.args(["--", rela_dir]);
+    }
+    let out = cmd.output().await?;
+
+    if !out.status.success() {
+        let stderr = String::from_utf8_lossy(&out.stderr);
+        return Err(GenericError(format!("Failed to list staged files: {}", stderr)));
+    }
+
+    Ok(String::from_utf8_lossy(&out.stdout)
+        .split('\0')
+        .filter(|p| !p.is_empty())
+        .map(String::from)
+        .collect())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[tokio::test]
+    async fn test_staged_files_scoped() {
+        let tmp = tempfile::tempdir().unwrap();
+        let repo = git2::Repository::init(tmp.path()).unwrap();
+
+        // Scope dir name doubles as a glob pattern; sync1 is its glob decoy
+        let sync_dir = tmp.path().join("sync[1]");
+        std::fs::create_dir(&sync_dir).unwrap();
+        std::fs::write(sync_dir.join("yaak.req_1.yaml"), "inside").unwrap();
+        std::fs::create_dir(tmp.path().join("sync1")).unwrap();
+        std::fs::write(tmp.path().join("sync1").join("decoy.txt"), "decoy").unwrap();
+        std::fs::write(tmp.path().join("outside.txt"), "outside").unwrap();
+
+        let mut index = repo.index().unwrap();
+        index.add_path(Path::new("sync[1]/yaak.req_1.yaml")).unwrap();
+        index.add_path(Path::new("sync1/decoy.txt")).unwrap();
+        index.add_path(Path::new("outside.txt")).unwrap();
+        index.write().unwrap();
+
+        let scoped = staged_files(tmp.path(), Some("sync[1]")).await.unwrap();
+        assert_eq!(scoped, vec!["sync[1]/yaak.req_1.yaml"]);
+
+        let all = staged_files(tmp.path(), None).await.unwrap();
+        assert_eq!(all.len(), 3);
+    }
+}

crates/yaak-git/src/credential.rs

@@ -0,0 +1,44 @@
+use crate::binary::new_binary_command_global;
+use crate::error::Error::GenericError;
+use crate::error::Result;
+use std::process::Stdio;
+use tokio::io::AsyncWriteExt;
+use url::Url;
+
+pub async fn git_add_credential(remote_url: &str, username: &str, password: &str) -> Result<()> {
+    let url = Url::parse(remote_url)
+        .map_err(|e| GenericError(format!("Failed to parse remote url {remote_url}: {e:?}")))?;
+    let protocol = url.scheme();
+    let host = url.host_str().unwrap();
+    let path = Some(url.path());
+
+    let mut child = new_binary_command_global()
+        .await?
+        .args(["credential", "approve"])
+        .stdin(Stdio::piped())
+        .stdout(Stdio::null())
+        .spawn()?;
+
+    {
+        let stdin = child.stdin.as_mut().unwrap();
+        stdin.write_all(format!("protocol={}\n", protocol).as_bytes()).await?;
+        stdin.write_all(format!("host={}\n", host).as_bytes()).await?;
+        if let Some(path) = path {
+            if !path.is_empty() {
+                stdin
+                    .write_all(format!("path={}\n", path.trim_start_matches('/')).as_bytes())
+                    .await?;
+            }
+        }
+        stdin.write_all(format!("username={}\n", username).as_bytes()).await?;
+        stdin.write_all(format!("password={}\n", password).as_bytes()).await?;
+        stdin.write_all(b"\n").await?; // blank line terminator
+    }
+
+    let status = child.wait().await?;
+    if !status.success() {
+        return Err(GenericError("Failed to approve git credential".to_string()));
+    }
+
+    Ok(())
+}

crates/yaak-git/src/error.rs

@@ -0,0 +1,64 @@
+use serde::{Serialize, Serializer};
+use std::io;
+use std::path::PathBuf;
+use std::string::FromUtf8Error;
+use thiserror::Error;
+
+#[derive(Error, Debug)]
+pub enum Error {
+    #[error("Git repo not found {0}")]
+    GitRepoNotFound(PathBuf),
+
+    #[error("Git error: {0}")]
+    GitUnknown(#[from] git2::Error),
+
+    #[error("Yaml error: {0}")]
+    YamlParseError(#[from] serde_yaml::Error),
+
+    #[error(transparent)]
+    ModelError(#[from] yaak_models::error::Error),
+
+    #[error("Sync error: {0}")]
+    SyncError(#[from] yaak_sync::error::Error),
+
+    #[error("I/o error: {0}")]
+    IoError(#[from] io::Error),
+
+    #[error("JSON error: {0}")]
+    JsonParseError(#[from] serde_json::Error),
+
+    #[error("UTF8 error: {0}")]
+    Utf8ConversionError(#[from] FromUtf8Error),
+
+    #[error("Git error: {0}")]
+    GenericError(String),
+
+    #[error("'git' not found. Please ensure it's installed and available in $PATH")]
+    GitNotFound,
+
+    #[error("Credentials required: {0}")]
+    CredentialsRequiredError(String),
+
+    #[error("No default remote found")]
+    NoDefaultRemoteFound,
+
+    #[error("No remotes found for repo")]
+    NoRemotesFound,
+
+    #[error("Merge failed due to conflicts")]
+    MergeConflicts,
+
+    #[error("No active branch")]
+    NoActiveBranch,
+}
+
+impl Serialize for Error {
+    fn serialize<S>(&self, serializer: S) -> std::result::Result<S::Ok, S::Error>
+    where
+        S: Serializer,
+    {
+        serializer.serialize_str(self.to_string().as_ref())
+    }
+}
+
+pub type Result<T> = std::result::Result<T, Error>;

crates/yaak-git/src/fetch.rs

@@ -0,0 +1,22 @@
+use crate::binary::new_binary_command;
+use crate::error::Error::GenericError;
+use crate::error::Result;
+use std::path::Path;
+
+pub async fn git_fetch_all(dir: &Path) -> Result<()> {
+    let out = new_binary_command(dir)
+        .await?
+        .args(["fetch", "--all", "--prune", "--tags"])
+        .output()
+        .await
+        .map_err(|e| GenericError(format!("failed to run git pull: {e}")))?;
+    let stdout = String::from_utf8_lossy(&out.stdout);
+    let stderr = String::from_utf8_lossy(&out.stderr);
+    let combined = stdout + stderr;
+
+    if !out.status.success() {
+        return Err(GenericError(format!("Failed to fetch: {}", combined)));
+    }
+
+    Ok(())
+}

crates/yaak-git/src/init.rs

@@ -0,0 +1,14 @@
+use crate::error::Result;
+use crate::repository::open_repo;
+use log::info;
+use std::path::Path;
+
+pub fn git_init(dir: &Path) -> Result<()> {
+    git2::Repository::init(dir)?;
+    let repo = open_repo(dir)?;
+    // Default to main instead of master, to align with
+    // the official Git and GitHub behavior
+    repo.set_head("refs/heads/main")?;
+    info!("Initialized {dir:?}");
+    Ok(())
+}

crates/yaak-git/src/lib.rs

@@ -0,0 +1,44 @@
+mod add;
+mod binary;
+mod branch;
+mod clone;
+mod commit;
+mod credential;
+pub mod error;
+mod fetch;
+mod init;
+mod log;
+
+mod pull;
+mod push;
+mod remotes;
+mod repository;
+mod reset;
+mod restore;
+mod status;
+mod unstage;
+mod util;
+
+// Re-export all git functions for external use
+pub use add::git_add;
+pub use branch::{
+    BranchDeleteResult, git_checkout_branch, git_create_branch, git_delete_branch,
+    git_delete_remote_branch, git_merge_branch, git_rename_branch,
+};
+pub use clone::{CloneResult, git_clone};
+pub use commit::git_commit;
+pub use credential::git_add_credential;
+pub use fetch::git_fetch_all;
+pub use init::git_init;
+pub use log::{GitCommit, GitFileDiff, git_file_diff_for_commit, git_log, git_log_for_file};
+pub use pull::{PullResult, git_pull, git_pull_force_reset, git_pull_merge};
+pub use push::{PushResult, git_push};
+pub use remotes::{GitRemote, git_add_remote, git_remotes, git_rm_remote};
+pub use repository::{GitRepositoryPaths, git_path_is_ignored, git_repository_paths};
+pub use reset::git_reset_changes;
+pub use restore::{git_restore, git_restore_file_from_commit};
+pub use status::{
+    GitBranchInfo, GitStatusSummary, GitWorktreeStatus, git_branch_info, git_status,
+    git_worktree_status,
+};
+pub use unstage::git_unstage;

crates/yaak-git/src/log.rs

@@ -0,0 +1,145 @@
+use crate::repository::open_repo;
+use chrono::{DateTime, Utc};
+use serde::{Deserialize, Serialize};
+use std::path::Path;
+use ts_rs::TS;
+
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize, TS)]
+#[serde(rename_all = "camelCase")]
+#[ts(export, export_to = "gen_git.ts")]
+pub struct GitCommit {
+    pub oid: String,
+    pub author: GitAuthor,
+    pub when: DateTime<Utc>,
+    pub message: Option<String>,
+}
+
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize, TS)]
+#[serde(rename_all = "camelCase")]
+#[ts(export, export_to = "gen_git.ts")]
+pub struct GitAuthor {
+    pub name: Option<String>,
+    pub email: Option<String>,
+}
+
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize, TS)]
+#[serde(rename_all = "camelCase")]
+#[ts(export, export_to = "gen_git.ts")]
+pub struct GitFileDiff {
+    pub original: String,
+    pub modified: String,
+}
+
+pub fn git_log(dir: &Path) -> crate::error::Result<Vec<GitCommit>> {
+    git_log_inner(dir, None)
+}
+
+pub fn git_log_for_file(dir: &Path, rela_path: &Path) -> crate::error::Result<Vec<GitCommit>> {
+    git_log_inner(dir, Some(rela_path))
+}
+
+fn git_log_inner(dir: &Path, rela_path: Option<&Path>) -> crate::error::Result<Vec<GitCommit>> {
+    let repo = open_repo(dir)?;
+
+    // Return empty if empty repo or no head (new repo)
+    if repo.is_empty()? || repo.head().is_err() {
+        return Ok(vec![]);
+    }
+
+    let mut revwalk = repo.revwalk()?;
+    revwalk.push_head()?;
+    revwalk.set_sorting(git2::Sort::TIME)?;
+
+    // Run git log
+    macro_rules! filter_try {
+        ($e:expr) => {
+            match $e {
+                Ok(t) => t,
+                Err(_) => return None,
+            }
+        };
+    }
+    let log: Vec<GitCommit> = revwalk
+        .filter_map(|oid| {
+            let oid = filter_try!(oid);
+            let commit = filter_try!(repo.find_commit(oid));
+            if let Some(rela_path) = rela_path {
+                let touches_path = filter_try!(commit_touches_path(&repo, &commit, rela_path));
+                if !touches_path {
+                    return None;
+                }
+            }
+
+            let author = commit.author();
+            Some(GitCommit {
+                oid: oid.to_string(),
+                author: GitAuthor {
+                    name: author.name().map(|s| s.to_string()),
+                    email: author.email().map(|s| s.to_string()),
+                },
+                when: convert_git_time_to_date(author.when()),
+                message: commit.message().map(|m| m.to_string()),
+            })
+        })
+        .collect();
+
+    Ok(log)
+}
+
+pub fn git_file_diff_for_commit(
+    dir: &Path,
+    commit_oid: &str,
+    rela_path: &Path,
+) -> crate::error::Result<GitFileDiff> {
+    let repo = open_repo(dir)?;
+    let oid = git2::Oid::from_str(commit_oid)?;
+    let commit = repo.find_commit(oid)?;
+    let new_tree = commit.tree()?;
+    let old_tree = if commit.parent_count() > 0 { Some(commit.parent(0)?.tree()?) } else { None };
+
+    Ok(GitFileDiff {
+        original: blob_text_at_path(&repo, old_tree.as_ref(), rela_path)?,
+        modified: blob_text_at_path(&repo, Some(&new_tree), rela_path)?,
+    })
+}
+
+fn commit_touches_path(
+    repo: &git2::Repository,
+    commit: &git2::Commit,
+    rela_path: &Path,
+) -> crate::error::Result<bool> {
+    let new_tree = commit.tree()?;
+    let old_tree = if commit.parent_count() > 0 { Some(commit.parent(0)?.tree()?) } else { None };
+
+    let mut opts = git2::DiffOptions::new();
+    opts.pathspec(rela_path);
+
+    let diff = repo.diff_tree_to_tree(old_tree.as_ref(), Some(&new_tree), Some(&mut opts))?;
+    Ok(diff.deltas().len() > 0)
+}
+
+fn blob_text_at_path(
+    repo: &git2::Repository,
+    tree: Option<&git2::Tree>,
+    rela_path: &Path,
+) -> crate::error::Result<String> {
+    let Some(tree) = tree else {
+        return Ok(String::new());
+    };
+    let Ok(entry) = tree.get_path(rela_path) else {
+        return Ok(String::new());
+    };
+    let blob = entry.to_object(repo)?.peel_to_blob()?;
+    Ok(String::from_utf8(blob.content().to_vec())?)
+}
+
+#[cfg(test)]
+fn convert_git_time_to_date(_git_time: git2::Time) -> DateTime<Utc> {
+    DateTime::from_timestamp(0, 0).unwrap()
+}
+
+#[cfg(not(test))]
+fn convert_git_time_to_date(git_time: git2::Time) -> DateTime<Utc> {
+    let timestamp = git_time.seconds();
+    DateTime::from_timestamp(timestamp, 0).unwrap()
+}

crates/yaak-git/src/pull.rs

@@ -0,0 +1,208 @@
+use crate::binary::new_binary_command;
+use crate::error::Error::GenericError;
+use crate::error::Result;
+use crate::repository::open_repo;
+use crate::util::{get_current_branch_name, get_default_remote_in_repo};
+use log::info;
+use serde::{Deserialize, Serialize};
+use std::path::Path;
+use ts_rs::TS;
+
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize, TS)]
+#[serde(rename_all = "snake_case", tag = "type")]
+#[ts(export, export_to = "gen_git.ts")]
+pub enum PullResult {
+    Success { message: String },
+    UpToDate,
+    NeedsCredentials { url: String, error: Option<String> },
+    Diverged { remote: String, branch: String },
+    UncommittedChanges,
+}
+
+fn has_uncommitted_changes(dir: &Path) -> Result<bool> {
+    let repo = open_repo(dir)?;
+    // Scoped to the sync directory: uncommitted changes elsewhere in a
+    // containing monorepo shouldn't block pulling. Git itself still refuses
+    // a merge that would clobber uncommitted files outside the sync dir
+    let mut opts = crate::status::scoped_status_options(&repo, dir);
+    opts.include_untracked(false);
+    let statuses = repo.statuses(Some(&mut opts))?;
+    Ok(statuses.iter().any(|e| e.status() != git2::Status::CURRENT))
+}
+
+pub async fn git_pull(dir: &Path) -> Result<PullResult> {
+    if has_uncommitted_changes(dir)? {
+        return Ok(PullResult::UncommittedChanges);
+    }
+
+    // Extract all git2 data before any await points (git2 types are not Send)
+    let (branch_name, remote_name, remote_url) = {
+        let repo = open_repo(dir)?;
+        let branch_name = get_current_branch_name(&repo)?;
+        let remote = get_default_remote_in_repo(&repo)?;
+        let remote_name =
+            remote.name().ok_or(GenericError("Failed to get remote name".to_string()))?.to_string();
+        let remote_url =
+            remote.url().ok_or(GenericError("Failed to get remote url".to_string()))?.to_string();
+        (branch_name, remote_name, remote_url)
+    };
+
+    // Step 1: fetch the specific branch
+    // NOTE: We use fetch + merge instead of `git pull` to avoid conflicts with
+    // global git config (e.g. pull.ff=only) and the background fetch --all.
+    let fetch_out = new_binary_command(dir)
+        .await?
+        .args(["fetch", &remote_name, &branch_name])
+        .env("GIT_TERMINAL_PROMPT", "0")
+        .output()
+        .await
+        .map_err(|e| GenericError(format!("failed to run git fetch: {e}")))?;
+
+    let fetch_stdout = String::from_utf8_lossy(&fetch_out.stdout);
+    let fetch_stderr = String::from_utf8_lossy(&fetch_out.stderr);
+    let fetch_combined = format!("{fetch_stdout}{fetch_stderr}");
+
+    info!("Fetched status={} {fetch_combined}", fetch_out.status);
+
+    if fetch_combined.to_lowercase().contains("could not read") {
+        return Ok(PullResult::NeedsCredentials { url: remote_url.to_string(), error: None });
+    }
+
+    if fetch_combined.to_lowercase().contains("unable to access") {
+        return Ok(PullResult::NeedsCredentials {
+            url: remote_url.to_string(),
+            error: Some(fetch_combined.to_string()),
+        });
+    }
+
+    if !fetch_out.status.success() {
+        return Err(GenericError(format!("Failed to fetch: {fetch_combined}")));
+    }
+
+    // Step 2: merge the fetched branch
+    let ref_name = format!("{}/{}", remote_name, branch_name);
+    let merge_out = new_binary_command(dir)
+        .await?
+        .args(["merge", "--ff-only", &ref_name])
+        .output()
+        .await
+        .map_err(|e| GenericError(format!("failed to run git merge: {e}")))?;
+
+    let merge_stdout = String::from_utf8_lossy(&merge_out.stdout);
+    let merge_stderr = String::from_utf8_lossy(&merge_out.stderr);
+    let merge_combined = format!("{merge_stdout}{merge_stderr}");
+
+    info!("Merged status={} {merge_combined}", merge_out.status);
+
+    if !merge_out.status.success() {
+        let merge_lower = merge_combined.to_lowercase();
+        if merge_lower.contains("cannot fast-forward")
+            || merge_lower.contains("not possible to fast-forward")
+            || merge_lower.contains("diverged")
+        {
+            return Ok(PullResult::Diverged { remote: remote_name, branch: branch_name });
+        }
+        return Err(GenericError(format!("Failed to merge: {merge_combined}")));
+    }
+
+    if merge_combined.to_lowercase().contains("up to date") {
+        return Ok(PullResult::UpToDate);
+    }
+
+    Ok(PullResult::Success { message: format!("Pulled from {}/{}", remote_name, branch_name) })
+}
+
+pub async fn git_pull_force_reset(dir: &Path, remote: &str, branch: &str) -> Result<PullResult> {
+    // Step 1: fetch the remote
+    let fetch_out = new_binary_command(dir)
+        .await?
+        .args(["fetch", remote])
+        .env("GIT_TERMINAL_PROMPT", "0")
+        .output()
+        .await
+        .map_err(|e| GenericError(format!("failed to run git fetch: {e}")))?;
+
+    if !fetch_out.status.success() {
+        let stderr = String::from_utf8_lossy(&fetch_out.stderr);
+        return Err(GenericError(format!("Failed to fetch: {stderr}")));
+    }
+
+    // Step 2: reset --hard to remote/branch
+    let ref_name = format!("{}/{}", remote, branch);
+    let reset_out = new_binary_command(dir)
+        .await?
+        .args(["reset", "--hard", &ref_name])
+        .output()
+        .await
+        .map_err(|e| GenericError(format!("failed to run git reset: {e}")))?;
+
+    if !reset_out.status.success() {
+        let stderr = String::from_utf8_lossy(&reset_out.stderr);
+        return Err(GenericError(format!("Failed to reset: {}", stderr.trim())));
+    }
+
+    Ok(PullResult::Success { message: format!("Reset to {}/{}", remote, branch) })
+}
+
+pub async fn git_pull_merge(dir: &Path, remote: &str, branch: &str) -> Result<PullResult> {
+    let out = new_binary_command(dir)
+        .await?
+        .args(["pull", "--no-rebase", remote, branch])
+        .env("GIT_TERMINAL_PROMPT", "0")
+        .output()
+        .await
+        .map_err(|e| GenericError(format!("failed to run git pull --no-rebase: {e}")))?;
+
+    let stdout = String::from_utf8_lossy(&out.stdout);
+    let stderr = String::from_utf8_lossy(&out.stderr);
+    let combined = format!("{}{}", stdout, stderr);
+
+    info!("Pull merge status={} {combined}", out.status);
+
+    if !out.status.success() {
+        if combined.to_lowercase().contains("conflict") {
+            return Err(GenericError(
+                "Merge conflicts detected. Please resolve them manually.".to_string(),
+            ));
+        }
+        return Err(GenericError(format!("Failed to merge pull: {}", combined.trim())));
+    }
+
+    Ok(PullResult::Success { message: format!("Merged from {}/{}", remote, branch) })
+}
+
+// pub(crate) fn git_pull_old(dir: &Path) -> Result<PullResult> {
+//     let repo = open_repo(dir)?;
+//
+//     let branch = get_current_branch(&repo)?.ok_or(NoActiveBranch)?;
+//     let branch_ref = branch.get();
+//     let branch_ref = bytes_to_string(branch_ref.name_bytes())?;
+//
+//     let remote_name = repo.branch_upstream_remote(&branch_ref)?;
+//     let remote_name = bytes_to_string(&remote_name)?;
+//     debug!("Pulling from {remote_name}");
+//
+//     let mut remote = repo.find_remote(&remote_name)?;
+//
+//     let mut options = FetchOptions::new();
+//     let callbacks = default_callbacks();
+//     options.remote_callbacks(callbacks);
+//
+//     let mut proxy = ProxyOptions::new();
+//     proxy.auto();
+//     options.proxy_options(proxy);
+//
+//     remote.fetch(&[&branch_ref], Some(&mut options), None)?;
+//
+//     let stats = remote.stats();
+//
+//     let fetch_head = repo.find_reference("FETCH_HEAD")?;
+//     let fetch_commit = repo.reference_to_annotated_commit(&fetch_head)?;
+//     do_merge(&repo, &branch, &fetch_commit)?;
+//
+//     Ok(PullResult::Success {
+//         message: "Hello".to_string(),
+//         // received_bytes: stats.received_bytes(),
+//         // received_objects: stats.received_objects(),
+//     })
+// }

crates/yaak-git/src/push.rs

@@ -0,0 +1,89 @@
+use crate::binary::new_binary_command;
+use crate::error::Error::GenericError;
+use crate::error::Result;
+use crate::repository::open_repo;
+use crate::util::{get_current_branch_name, get_default_remote_for_push_in_repo};
+use log::info;
+use serde::{Deserialize, Serialize};
+use std::path::Path;
+use ts_rs::TS;
+
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize, TS)]
+#[serde(rename_all = "snake_case", tag = "type")]
+#[ts(export, export_to = "gen_git.ts")]
+pub enum PushResult {
+    Success { message: String },
+    UpToDate,
+    NeedsCredentials { url: String, error: Option<String> },
+}
+
+pub async fn git_push(dir: &Path) -> Result<PushResult> {
+    // Extract all git2 data before any await points (git2 types are not Send)
+    let (branch_name, remote_name, remote_url) = {
+        let repo = open_repo(dir)?;
+        let branch_name = get_current_branch_name(&repo)?;
+        let remote = get_default_remote_for_push_in_repo(&repo)?;
+        let remote_name =
+            remote.name().ok_or(GenericError("Failed to get remote name".to_string()))?.to_string();
+        let remote_url =
+            remote.url().ok_or(GenericError("Failed to get remote url".to_string()))?.to_string();
+        (branch_name, remote_name, remote_url)
+    };
+
+    let out = new_binary_command(dir)
+        .await?
+        .args(["push", &remote_name, &branch_name])
+        .env("GIT_TERMINAL_PROMPT", "0")
+        .output()
+        .await
+        .map_err(|e| GenericError(format!("failed to run git push: {e}")))?;
+
+    let stdout = String::from_utf8_lossy(&out.stdout);
+    let stderr = String::from_utf8_lossy(&out.stderr);
+    let combined = stdout + stderr;
+    let combined_lower = combined.to_lowercase();
+
+    info!("Pushed to repo status={} {combined}", out.status);
+
+    // Helper to check if this is a credentials error
+    let is_credentials_error = || {
+        combined_lower.contains("could not read")
+            || combined_lower.contains("unable to access")
+            || combined_lower.contains("authentication failed")
+    };
+
+    // Check for explicit rejection indicators first (e.g., protected branch rejections)
+    // These can occur even if some git servers don't properly set exit codes
+    if combined_lower.contains("rejected") || combined_lower.contains("failed to push") {
+        if is_credentials_error() {
+            return Ok(PushResult::NeedsCredentials {
+                url: remote_url.to_string(),
+                error: Some(combined.to_string()),
+            });
+        }
+        return Err(GenericError(format!("Failed to push: {combined}")));
+    }
+
+    // Check exit status for any other failures
+    if !out.status.success() {
+        if combined_lower.contains("could not read") {
+            return Ok(PushResult::NeedsCredentials { url: remote_url.to_string(), error: None });
+        }
+        if combined_lower.contains("unable to access")
+            || combined_lower.contains("authentication failed")
+        {
+            return Ok(PushResult::NeedsCredentials {
+                url: remote_url.to_string(),
+                error: Some(combined.to_string()),
+            });
+        }
+        return Err(GenericError(format!("Failed to push: {combined}")));
+    }
+
+    // Success cases (exit code 0 and no rejection indicators)
+    if combined_lower.contains("up-to-date") {
+        return Ok(PushResult::UpToDate);
+    }
+
+    Ok(PushResult::Success { message: format!("Pushed to {}/{}", remote_name, branch_name) })
+}

crates/yaak-git/src/remotes.rs

@@ -0,0 +1,47 @@
+use crate::error::Result;
+use crate::repository::open_repo;
+use log::warn;
+use serde::{Deserialize, Serialize};
+use std::path::Path;
+use ts_rs::TS;
+
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize, TS)]
+#[ts(export, export_to = "gen_git.ts")]
+pub struct GitRemote {
+    name: String,
+    url: Option<String>,
+}
+
+pub fn git_remotes(dir: &Path) -> Result<Vec<GitRemote>> {
+    let repo = open_repo(dir)?;
+    let mut remotes = Vec::new();
+
+    for remote in repo.remotes()?.into_iter() {
+        let name = match remote {
+            None => continue,
+            Some(name) => name,
+        };
+        let r = match repo.find_remote(name) {
+            Ok(r) => r,
+            Err(e) => {
+                warn!("Failed to get remote {name}: {e:?}");
+                continue;
+            }
+        };
+        remotes.push(GitRemote { name: name.to_string(), url: r.url().map(|u| u.to_string()) });
+    }
+
+    Ok(remotes)
+}
+
+pub fn git_add_remote(dir: &Path, name: &str, url: &str) -> Result<GitRemote> {
+    let repo = open_repo(dir)?;
+    repo.remote(name, url)?;
+    Ok(GitRemote { name: name.to_string(), url: Some(url.to_string()) })
+}
+
+pub fn git_rm_remote(dir: &Path, name: &str) -> Result<()> {
+    let repo = open_repo(dir)?;
+    repo.remote_delete(name)?;
+    Ok(())
+}

crates/yaak-git/src/repository.rs

@@ -0,0 +1,38 @@
+use crate::error::Error::{GitRepoNotFound, GitUnknown};
+use crate::error::{Error, Result};
+use std::path::{Path, PathBuf};
+
+#[derive(Debug, Clone)]
+pub struct GitRepositoryPaths {
+    pub workdir: PathBuf,
+    pub gitdir: PathBuf,
+    pub commondir: PathBuf,
+}
+
+pub(crate) fn open_repo(dir: &Path) -> crate::error::Result<git2::Repository> {
+    match git2::Repository::discover(dir) {
+        Ok(r) => Ok(r),
+        Err(e) if e.code() == git2::ErrorCode::NotFound => Err(GitRepoNotFound(dir.to_path_buf())),
+        Err(e) => Err(GitUnknown(e)),
+    }
+}
+
+pub fn git_repository_paths(dir: &Path) -> Result<GitRepositoryPaths> {
+    let repo = open_repo(dir)?;
+    let workdir = repo
+        .workdir()
+        .ok_or_else(|| Error::GenericError("Git repository does not have a worktree".into()))?
+        .to_path_buf();
+    Ok(GitRepositoryPaths {
+        workdir,
+        gitdir: repo.path().to_path_buf(),
+        // Same as gitdir except for linked worktrees, where shared refs and
+        // packed-refs live in the main repository's git directory
+        commondir: repo.commondir().to_path_buf(),
+    })
+}
+
+pub fn git_path_is_ignored(dir: &Path, rela_path: &Path) -> Result<bool> {
+    let repo = open_repo(dir)?;
+    Ok(repo.status_should_ignore(rela_path)?)
+}

crates/yaak-git/src/reset.rs

@@ -0,0 +1,20 @@
+use crate::binary::new_binary_command;
+use crate::error::Error::GenericError;
+use crate::error::Result;
+use std::path::Path;
+
+pub async fn git_reset_changes(dir: &Path) -> Result<()> {
+    let out = new_binary_command(dir)
+        .await?
+        .args(["reset", "--hard", "HEAD"])
+        .output()
+        .await
+        .map_err(|e| GenericError(format!("failed to run git reset: {e}")))?;
+
+    if !out.status.success() {
+        let stderr = String::from_utf8_lossy(&out.stderr);
+        return Err(GenericError(format!("Failed to reset: {}", stderr.trim())));
+    }
+
+    Ok(())
+}

crates/yaak-git/src/restore.rs

@@ -0,0 +1,76 @@
+use crate::error::Result;
+use crate::repository::open_repo;
+use log::info;
+use std::fs;
+use std::path::{Component, Path};
+
+pub fn git_restore(dir: &Path, rela_path: &Path) -> Result<()> {
+    let repo = open_repo(dir)?;
+    validate_relative_path(rela_path)?;
+
+    let status = repo.status_file(rela_path).ok();
+    let is_untracked = status
+        .is_some_and(|s| s.contains(git2::Status::WT_NEW) || s.contains(git2::Status::INDEX_NEW));
+
+    info!("Restoring file {rela_path:?} in {dir:?}");
+    if is_untracked {
+        let mut index = repo.index()?;
+        let _ = index.remove_path(rela_path);
+        index.write()?;
+
+        let path = repo.workdir().unwrap_or(dir).join(rela_path);
+        if path.is_dir() {
+            fs::remove_dir_all(path)?;
+        } else if path.exists() {
+            fs::remove_file(path)?;
+        }
+        return Ok(());
+    }
+
+    let head = repo.head()?;
+    let commit = head.peel_to_commit()?;
+    repo.reset_default(Some(commit.as_object()), &[rela_path])?;
+
+    let mut checkout = git2::build::CheckoutBuilder::new();
+    checkout.force().path(rela_path);
+    repo.checkout_head(Some(&mut checkout))?;
+
+    Ok(())
+}
+
+pub fn git_restore_file_from_commit(dir: &Path, commit_oid: &str, rela_path: &Path) -> Result<()> {
+    let repo = open_repo(dir)?;
+    validate_relative_path(rela_path)?;
+
+    let oid = git2::Oid::from_str(commit_oid)?;
+    let commit = repo.find_commit(oid)?;
+    let tree = commit.tree()?;
+    let path = repo.workdir().unwrap_or(dir).join(rela_path);
+
+    info!("Restoring file {rela_path:?} from commit {commit_oid} in {dir:?}");
+    if tree.get_path(rela_path).is_err() {
+        if path.is_dir() {
+            fs::remove_dir_all(path)?;
+        } else if path.exists() {
+            fs::remove_file(path)?;
+        }
+        return Ok(());
+    }
+
+    let mut checkout = git2::build::CheckoutBuilder::new();
+    checkout.force().path(rela_path);
+    repo.checkout_tree(commit.as_object(), Some(&mut checkout))?;
+
+    Ok(())
+}
+
+fn validate_relative_path(path: &Path) -> Result<()> {
+    let is_safe = !path.as_os_str().is_empty()
+        && !path.is_absolute()
+        && path.components().all(|c| matches!(c, Component::Normal(_)));
+    if is_safe {
+        Ok(())
+    } else {
+        Err(crate::error::Error::GenericError(format!("Invalid restore path {}", path.display())))
+    }
+}

crates/yaak-git/src/status.rs

@@ -0,0 +1,375 @@
+use crate::repository::open_repo;
+use crate::util::{local_branch_names, remote_branch_names};
+use log::warn;
+use serde::{Deserialize, Serialize};
+use std::fs;
+use std::path::Path;
+use ts_rs::TS;
+use yaak_sync::models::SyncModel;
+
+#[derive(Debug, Clone, Serialize, Deserialize, TS, PartialEq)]
+#[serde(rename_all = "camelCase")]
+#[ts(export, export_to = "gen_git.ts")]
+pub struct GitStatusSummary {
+    pub path: String,
+    /// The status directory relative to the repo root ("" when it IS the root).
+    /// Useful for displaying entry paths relative to the sync directory
+    pub rela_dir: String,
+    pub head_ref: Option<String>,
+    pub head_ref_shorthand: Option<String>,
+    pub entries: Vec<GitStatusEntry>,
+    pub origins: Vec<String>,
+    pub local_branches: Vec<String>,
+    pub remote_branches: Vec<String>,
+    pub ahead: u32,
+    pub behind: u32,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, TS, PartialEq)]
+#[serde(rename_all = "camelCase")]
+#[ts(export, export_to = "gen_git.ts")]
+pub struct GitBranchInfo {
+    pub path: String,
+    pub head_ref: Option<String>,
+    pub head_ref_shorthand: Option<String>,
+    pub origins: Vec<String>,
+    pub local_branches: Vec<String>,
+    pub remote_branches: Vec<String>,
+    pub ahead: u32,
+    pub behind: u32,
+}
+
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize, TS)]
+#[serde(rename_all = "camelCase")]
+#[ts(export, export_to = "gen_git.ts")]
+pub struct GitStatusEntry {
+    pub rela_path: String,
+    pub status: GitStatus,
+    pub staged: bool,
+    pub prev: Option<SyncModel>,
+    pub next: Option<SyncModel>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, TS, PartialEq)]
+#[serde(rename_all = "camelCase")]
+#[ts(export, export_to = "gen_git.ts")]
+pub struct GitWorktreeStatus {
+    pub entries: Vec<GitWorktreeStatusEntry>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, TS, PartialEq)]
+#[serde(rename_all = "camelCase")]
+#[ts(export, export_to = "gen_git.ts")]
+pub struct GitWorktreeStatusEntry {
+    pub rela_path: String,
+    pub model_id: Option<String>,
+    pub status: GitStatus,
+    pub staged: bool,
+}
+
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize, TS)]
+#[serde(rename_all = "snake_case")]
+#[ts(export, export_to = "gen_git.ts")]
+pub enum GitStatus {
+    Untracked,
+    Conflict,
+    Current,
+    Modified,
+    Removed,
+    Renamed,
+    TypeChange,
+}
+
+pub fn git_worktree_status(dir: &Path) -> crate::error::Result<GitWorktreeStatus> {
+    let repo = open_repo(dir)?;
+    let mut opts = scoped_status_options(&repo, dir);
+    opts.include_unmodified(false);
+
+    let mut entries = Vec::new();
+    for entry in repo.statuses(Some(&mut opts))?.into_iter() {
+        let Some(rela_path) = entry.path() else {
+            continue;
+        };
+        let Some((status, staged)) = git_status_from_raw(entry.status()) else {
+            continue;
+        };
+
+        entries.push(GitWorktreeStatusEntry {
+            rela_path: rela_path.to_string(),
+            model_id: model_id_from_rela_path(Path::new(rela_path)),
+            status,
+            staged,
+        });
+    }
+
+    Ok(GitWorktreeStatus { entries })
+}
+
+pub fn git_branch_info(dir: &Path) -> crate::error::Result<GitBranchInfo> {
+    let repo = open_repo(dir)?;
+    git_branch_info_for_repo(&repo, dir)
+}
+
+pub fn git_status(dir: &Path) -> crate::error::Result<GitStatusSummary> {
+    let repo = open_repo(dir)?;
+    let branch_info = git_branch_info_for_repo(&repo, dir)?;
+    let head_tree = repo.head().ok().and_then(|head| head.peel_to_tree().ok());
+
+    let mut opts = scoped_status_options(&repo, dir);
+    opts.include_unmodified(true); // Include unchanged
+
+    // TODO: Support renames
+
+    let mut entries: Vec<GitStatusEntry> = Vec::new();
+    for entry in repo.statuses(Some(&mut opts))?.into_iter() {
+        let rela_path = entry.path().unwrap().to_string();
+        let Some((status, staged)) = git_status_from_raw(entry.status()) else {
+            continue;
+        };
+
+        // Get previous content from Git, if it's in there
+        let prev = match head_tree.clone() {
+            None => None,
+            Some(t) => match t.get_path(&Path::new(&rela_path)) {
+                Ok(entry) => {
+                    let obj = entry.to_object(&repo)?;
+                    let content = obj.as_blob().unwrap().content();
+                    let name = Path::new(entry.name().unwrap_or_default());
+                    SyncModel::from_bytes(content.into(), name)?.map(|m| m.0)
+                }
+                Err(_) => None,
+            },
+        };
+
+        let next = {
+            let full_path = repo.workdir().unwrap().join(rela_path.clone());
+            SyncModel::from_file(full_path.as_path())?.map(|m| m.0)
+        };
+
+        entries.push(GitStatusEntry {
+            status,
+            staged,
+            rela_path,
+            prev: prev.clone(),
+            next: next.clone(),
+        })
+    }
+
+    Ok(GitStatusSummary {
+        entries,
+        rela_dir: repo_relative_dir(&repo, dir).unwrap_or_default(),
+        path: branch_info.path,
+        head_ref: branch_info.head_ref,
+        head_ref_shorthand: branch_info.head_ref_shorthand,
+        origins: branch_info.origins,
+        local_branches: branch_info.local_branches,
+        remote_branches: branch_info.remote_branches,
+        ahead: branch_info.ahead,
+        behind: branch_info.behind,
+    })
+}
+
+fn git_branch_info_for_repo(
+    repo: &git2::Repository,
+    dir: &Path,
+) -> crate::error::Result<GitBranchInfo> {
+    let (head_ref, head_ref_shorthand) = git_head_refs(repo);
+    let origins = repo.remotes()?.into_iter().filter_map(|o| Some(o?.to_string())).collect();
+    let local_branches = local_branch_names(repo)?;
+    let remote_branches = remote_branch_names(repo)?;
+
+    // Compute ahead/behind relative to remote tracking branch
+    let (ahead, behind) = (|| -> Option<(usize, usize)> {
+        let head = repo.head().ok()?;
+        let local_oid = head.target()?;
+        let branch_name = head.shorthand()?;
+        let upstream_ref =
+            repo.find_branch(&format!("origin/{branch_name}"), git2::BranchType::Remote).ok()?;
+        let upstream_oid = upstream_ref.get().target()?;
+        repo.graph_ahead_behind(local_oid, upstream_oid).ok()
+    })()
+    .unwrap_or((0, 0));
+
+    Ok(GitBranchInfo {
+        path: dir.to_string_lossy().to_string(),
+        head_ref,
+        head_ref_shorthand,
+        origins,
+        local_branches,
+        remote_branches,
+        ahead: ahead as u32,
+        behind: behind as u32,
+    })
+}
+
+fn git_head_refs(repo: &git2::Repository) -> (Option<String>, Option<String>) {
+    match repo.head() {
+        Ok(head) => {
+            let head_ref = head.name().map(|s| s.to_string());
+            let head_ref_shorthand = head.shorthand().map(|s| s.to_string());
+            (head_ref, head_ref_shorthand)
+        }
+        Err(_) => {
+            // For "unborn" repos, reading from HEAD is the only way to get the branch name
+            // See https://github.com/starship/starship/pull/1336
+            let head_path = repo.path().join("HEAD");
+            let head_ref = fs::read_to_string(&head_path)
+                .ok()
+                .unwrap_or_default()
+                .lines()
+                .next()
+                .map(|s| s.trim_start_matches("ref:").trim().to_string());
+            let head_ref_shorthand =
+                head_ref.clone().map(|r| r.split('/').last().unwrap_or("unknown").to_string());
+            (head_ref, head_ref_shorthand)
+        }
+    }
+}
+
+fn git_status_from_raw(status: git2::Status) -> Option<(GitStatus, bool)> {
+    let index_status = match status {
+        // Note: order matters here, since we're checking a bitmap!
+        s if s.contains(git2::Status::CONFLICTED) => GitStatus::Conflict,
+        s if s.contains(git2::Status::INDEX_NEW) => GitStatus::Untracked,
+        s if s.contains(git2::Status::INDEX_MODIFIED) => GitStatus::Modified,
+        s if s.contains(git2::Status::INDEX_DELETED) => GitStatus::Removed,
+        s if s.contains(git2::Status::INDEX_RENAMED) => GitStatus::Renamed,
+        s if s.contains(git2::Status::INDEX_TYPECHANGE) => GitStatus::TypeChange,
+        s if s.contains(git2::Status::CURRENT) => GitStatus::Current,
+        s => {
+            warn!("Unknown index status {s:?}");
+            return None;
+        }
+    };
+
+    let worktree_status = match status {
+        // Note: order matters here, since we're checking a bitmap!
+        s if s.contains(git2::Status::CONFLICTED) => GitStatus::Conflict,
+        s if s.contains(git2::Status::WT_NEW) => GitStatus::Untracked,
+        s if s.contains(git2::Status::WT_MODIFIED) => GitStatus::Modified,
+        s if s.contains(git2::Status::WT_DELETED) => GitStatus::Removed,
+        s if s.contains(git2::Status::WT_RENAMED) => GitStatus::Renamed,
+        s if s.contains(git2::Status::WT_TYPECHANGE) => GitStatus::TypeChange,
+        s if s.contains(git2::Status::CURRENT) => GitStatus::Current,
+        s => {
+            warn!("Unknown worktree status {s:?}");
+            return None;
+        }
+    };
+
+    let status =
+        if index_status == GitStatus::Current { worktree_status } else { index_status.clone() };
+    let staged = index_status != GitStatus::Current;
+
+    Some((status, staged))
+}
+
+/// Construct StatusOptions for a walk scoped to `dir`. Yaak only cares about
+/// the sync directory, and a full walk is expensive when the containing repo
+/// is large (e.g. a sync dir inside a monorepo); scoping is a no-op when
+/// `dir` is the repo root. Always build status walks through this so a new
+/// call site can't forget the scoping.
+pub(crate) fn scoped_status_options(repo: &git2::Repository, dir: &Path) -> git2::StatusOptions {
+    let mut opts = git2::StatusOptions::new();
+    opts.include_ignored(false).include_untracked(true).recurse_untracked_dirs(true);
+    if let Some(rela) = repo_relative_dir(repo, dir) {
+        opts.pathspec(rela);
+        // Match the path literally (exact or directory prefix) instead of as
+        // a glob — directory names can contain pattern characters like [ or *
+        opts.disable_pathspec_match(true);
+    }
+    opts
+}
+
+/// The path of `dir` relative to the repo root as a forward-slash string
+/// (Git pathspecs use forward slashes even on Windows), or None when `dir`
+/// is the root itself (or outside the repo). Both sides are canonicalized so
+/// symlinked paths compare consistently.
+pub(crate) fn repo_relative_dir(repo: &git2::Repository, dir: &Path) -> Option<String> {
+    let workdir = repo.workdir()?;
+    let workdir = workdir.canonicalize().unwrap_or_else(|_| workdir.to_path_buf());
+    let canonical_dir = dir.canonicalize().unwrap_or_else(|_| dir.to_path_buf());
+    let rela = canonical_dir.strip_prefix(&workdir).ok()?;
+    if rela.as_os_str().is_empty() {
+        return None;
+    }
+    let parts: Vec<String> =
+        rela.components().map(|c| c.as_os_str().to_string_lossy().into_owned()).collect();
+    Some(parts.join("/"))
+}
+
+fn model_id_from_rela_path(path: &Path) -> Option<String> {
+    let ext = path.extension()?.to_str()?;
+    if ext != "yaml" && ext != "yml" && ext != "json" {
+        return None;
+    }
+
+    path.file_stem()?.to_str()?.strip_prefix("yaak.").map(String::from)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_worktree_status_scoped_to_subdir() {
+        let tmp = tempfile::tempdir().unwrap();
+        git2::Repository::init(tmp.path()).unwrap();
+
+        let sync_dir = tmp.path().join("sync");
+        std::fs::create_dir(&sync_dir).unwrap();
+        std::fs::write(sync_dir.join("yaak.req_1.yaml"), "inside").unwrap();
+        std::fs::write(tmp.path().join("outside.txt"), "outside").unwrap();
+
+        // Status on a subdirectory only reports that subdirectory
+        let status = git_worktree_status(&sync_dir).unwrap();
+        let paths: Vec<&str> = status.entries.iter().map(|e| e.rela_path.as_str()).collect();
+        assert_eq!(paths, vec!["sync/yaak.req_1.yaml"]);
+        assert_eq!(status.entries[0].model_id.as_deref(), Some("req_1"));
+
+        // Status on the repo root reports everything
+        let status = git_worktree_status(tmp.path()).unwrap();
+        assert_eq!(status.entries.len(), 2);
+    }
+
+    #[test]
+    fn test_worktree_status_scoped_literal_dir_name() {
+        let tmp = tempfile::tempdir().unwrap();
+        git2::Repository::init(tmp.path()).unwrap();
+
+        // A directory name that is also a valid glob pattern ([1] matches "1")
+        let sync_dir = tmp.path().join("sync[1]");
+        std::fs::create_dir(&sync_dir).unwrap();
+        std::fs::write(sync_dir.join("yaak.req_1.yaml"), "inside").unwrap();
+        std::fs::create_dir(tmp.path().join("sync1")).unwrap();
+        std::fs::write(tmp.path().join("sync1").join("decoy.txt"), "glob match").unwrap();
+
+        let status = git_worktree_status(&sync_dir).unwrap();
+        let paths: Vec<&str> = status.entries.iter().map(|e| e.rela_path.as_str()).collect();
+        assert_eq!(paths, vec!["sync[1]/yaak.req_1.yaml"]);
+    }
+
+    #[test]
+    fn test_status_scoped_to_subdir() {
+        let tmp = tempfile::tempdir().unwrap();
+        git2::Repository::init(tmp.path()).unwrap();
+
+        let sync_dir = tmp.path().join("sync");
+        std::fs::create_dir(&sync_dir).unwrap();
+        std::fs::write(sync_dir.join("yaak.req_1.yaml"), "inside").unwrap();
+        std::fs::write(sync_dir.join("README.md"), "external, but in sync dir").unwrap();
+        std::fs::write(tmp.path().join("outside.txt"), "outside").unwrap();
+
+        // The commit dialog's status only reports the sync directory
+        let status = git_status(&sync_dir).unwrap();
+        assert_eq!(status.rela_dir, "sync");
+        let mut paths: Vec<&str> = status.entries.iter().map(|e| e.rela_path.as_str()).collect();
+        paths.sort();
+        assert_eq!(paths, vec!["sync/README.md", "sync/yaak.req_1.yaml"]);
+
+        // Status on the repo root reports everything
+        let status = git_status(tmp.path()).unwrap();
+        assert_eq!(status.rela_dir, "");
+        assert_eq!(status.entries.len(), 3);
+    }
+}

crates/yaak-git/src/unstage.rs

@@ -0,0 +1,27 @@
+use crate::repository::open_repo;
+use log::info;
+use std::path::Path;
+
+pub fn git_unstage(dir: &Path, rela_path: &Path) -> crate::error::Result<()> {
+    let repo = open_repo(dir)?;
+
+    let head = match repo.head() {
+        Ok(h) => h,
+        Err(e) if e.code() == git2::ErrorCode::UnbornBranch => {
+            info!("Unstaging file in empty branch {rela_path:?} to {dir:?}");
+            // Repo has no commits, so "unstage" means remove from index
+            let mut index = repo.index()?;
+            index.remove_path(rela_path)?;
+            index.write()?;
+            return Ok(());
+        }
+        Err(e) => return Err(e.into()),
+    };
+
+    // If repo has commits, update the index entry back to HEAD
+    info!("Unstaging file {rela_path:?} to {dir:?}");
+    let commit = head.peel_to_commit()?;
+    repo.reset_default(Some(commit.as_object()), &[rela_path])?;
+
+    Ok(())
+}

crates/yaak-git/src/util.rs

@@ -0,0 +1,121 @@
+use crate::error::Error::{GenericError, NoDefaultRemoteFound};
+use crate::error::Result;
+use git2::{Branch, BranchType, Remote, Repository};
+
+const DEFAULT_REMOTE_NAME: &str = "origin";
+
+pub(crate) fn get_current_branch(repo: &Repository) -> Result<Option<Branch<'_>>> {
+    for b in repo.branches(None)? {
+        let branch = b?.0;
+        if branch.is_head() {
+            return Ok(Some(branch));
+        }
+    }
+    Ok(None)
+}
+
+pub(crate) fn get_current_branch_name(repo: &Repository) -> Result<String> {
+    Ok(get_current_branch(&repo)?
+        .ok_or(GenericError("Failed to get current branch".to_string()))?
+        .name()?
+        .ok_or(GenericError("Failed to get current branch name".to_string()))?
+        .to_string())
+}
+
+pub(crate) fn local_branch_names(repo: &Repository) -> Result<Vec<String>> {
+    let mut branches = Vec::new();
+    for branch in repo.branches(Some(BranchType::Local))? {
+        let (branch, _) = branch?;
+        let name = branch.name_bytes()?;
+        let name = bytes_to_string(name)?;
+        branches.push(name);
+    }
+    Ok(branches)
+}
+
+pub(crate) fn remote_branch_names(repo: &Repository) -> Result<Vec<String>> {
+    let mut branches = Vec::new();
+    for branch in repo.branches(Some(BranchType::Remote))? {
+        let (branch, _) = branch?;
+        let name = branch.name_bytes()?;
+        let name = bytes_to_string(name)?;
+        if name.ends_with("/HEAD") {
+            continue;
+        }
+        branches.push(name);
+    }
+    Ok(branches)
+}
+
+pub(crate) fn bytes_to_string(bytes: &[u8]) -> Result<String> {
+    Ok(String::from_utf8(bytes.to_vec())?)
+}
+
+pub(crate) fn get_default_remote_for_push_in_repo(repo: &'_ Repository) -> Result<Remote<'_>> {
+    let name = get_default_remote_name_for_push_in_repo(repo)?;
+    let remote = repo.find_remote(&name)?;
+    Ok(remote)
+}
+
+pub(crate) fn get_default_remote_name_for_push_in_repo(repo: &Repository) -> Result<String> {
+    let config = repo.config()?;
+
+    let branch = get_current_branch(repo)?;
+
+    if let Some(branch) = branch {
+        let remote_name = bytes_to_string(branch.name_bytes()?)?;
+
+        let entry_name = format!("branch.{}.pushRemote", &remote_name);
+
+        if let Ok(entry) = config.get_entry(&entry_name) {
+            return bytes_to_string(entry.value_bytes());
+        }
+
+        if let Ok(entry) = config.get_entry("remote.pushDefault") {
+            return bytes_to_string(entry.value_bytes());
+        }
+
+        let entry_name = format!("branch.{}.remote", &remote_name);
+
+        if let Ok(entry) = config.get_entry(&entry_name) {
+            return bytes_to_string(entry.value_bytes());
+        }
+    }
+
+    get_default_remote_name_in_repo(repo)
+}
+
+pub(crate) fn get_default_remote_in_repo(repo: &'_ Repository) -> Result<Remote<'_>> {
+    let name = get_default_remote_name_in_repo(repo)?;
+    let remote = repo.find_remote(&name)?;
+    Ok(remote)
+}
+
+pub(crate) fn get_default_remote_name_in_repo(repo: &Repository) -> Result<String> {
+    let remotes = repo.remotes()?;
+
+    if remotes.is_empty() {
+        return Err(NoDefaultRemoteFound);
+    }
+
+    // if `origin` exists return that
+    let found_origin = remotes.iter().any(|r| r.is_some_and(|r| r == DEFAULT_REMOTE_NAME));
+    if found_origin {
+        return Ok(DEFAULT_REMOTE_NAME.into());
+    }
+
+    // if only one remote exists, pick that
+    if remotes.len() == 1 {
+        let first_remote = remotes
+            .iter()
+            .next()
+            .flatten()
+            .map(String::from)
+            .ok_or_else(|| GenericError("no remote found".into()))?;
+
+        return Ok(first_remote);
+    }
+
+    // inconclusive
+    Err(NoDefaultRemoteFound)
+}

crates/yaak-grpc/Cargo.toml

@@ -0,0 +1,28 @@
+[package]
+name = "yaak-grpc"
+version = "0.1.0"
+edition = "2024"
+publish = false
+
+[dependencies]
+ts-rs = { workspace = true }
+anyhow = "1.0.97"
+async-recursion = "1.1.1"
+dunce = "1.0.4"
+hyper-rustls = { version = "0.27.7", default-features = false, features = ["http2"] }
+hyper-util = { version = "0.1.13", default-features = false, features = ["client-legacy"] }
+log = { workspace = true }
+md5 = "0.7.0"
+prost = "0.14.4"
+prost-reflect = { version = "0.16.5", default-features = false, features = ["serde", "derive"] }
+prost-types = "0.14.4"
+serde = { workspace = true, features = ["derive"] }
+serde_json = { workspace = true }
+tokio = { workspace = true, features = ["macros", "rt-multi-thread", "fs", "process"] }
+tokio-stream = "0.1.14"
+tonic = { version = "0.14.6", default-features = false, features = ["transport"] }
+tonic-reflection = "0.14.6"
+uuid = { version = "1.7.0", features = ["v4"] }
+yaak-common = { workspace = true }
+yaak-tls = { workspace = true }
+thiserror = "2.0.17"

crates/yaak-grpc/bindings/gen_grpc.ts

@@ -0,0 +1,5 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+
+export type MethodDefinition = { name: string, schema: string, clientStreaming: boolean, serverStreaming: boolean, };
+
+export type ServiceDefinition = { name: string, methods: Array<MethodDefinition>, };

crates/yaak-grpc/src/any.rs

@@ -0,0 +1,61 @@
+use log::error;
+
+pub(crate) fn collect_any_types(json: &str, out: &mut Vec<String>) {
+    let value = match serde_json::from_str(json).map_err(|e| e.to_string()) {
+        Ok(v) => v,
+        Err(e) => {
+            error!("Failed to parse gRPC message JSON: {e:?}");
+            return;
+        }
+    };
+    collect_any_types_value(&value, out);
+}
+
+fn collect_any_types_value(json: &serde_json::Value, out: &mut Vec<String>) {
+    match json {
+        serde_json::Value::Object(map) => {
+            if let Some(t) = map.get("@type").and_then(|v| v.as_str()) {
+                if let Some(full_name) = t.rsplit_once('/').map(|(_, n)| n) {
+                    out.push(full_name.to_string());
+                }
+            }
+
+            for v in map.values() {
+                collect_any_types_value(v, out);
+            }
+        }
+        serde_json::Value::Array(arr) => {
+            for v in arr {
+                collect_any_types_value(v, out);
+            }
+        }
+        _ => {}
+    }
+}
+
+// Write tests for this
+#[cfg(test)]
+mod tests {
+    #[test]
+    fn test_collect_any_types() {
+        let json = r#"{
+            "mounts": [
+              {
+                "mountSource": {
+                  "@type": "type.googleapis.com/mount_source.MountSourceRBDVolume",
+                  "volumeID": "volumes/rbd"
+                }
+              }
+            ],
+            "foo": {
+              "@type": "type.googleapis.com/foo.bar",
+              "foo": "fooo"
+            }
+        }"#;
+
+        let mut out = Vec::new();
+        super::collect_any_types(json, &mut out);
+        out.sort();
+        assert_eq!(out, vec!["foo.bar", "mount_source.MountSourceRBDVolume"]);
+    }
+}

crates/yaak-grpc/src/client.rs

@@ -0,0 +1,188 @@
+use crate::error::Error::GenericError;
+use crate::error::Result;
+use crate::manager::decorate_req;
+use crate::transport::get_transport;
+use async_recursion::async_recursion;
+use hyper_rustls::HttpsConnector;
+use hyper_util::client::legacy::Client;
+use hyper_util::client::legacy::connect::HttpConnector;
+use log::debug;
+use std::collections::BTreeMap;
+use tokio_stream::StreamExt;
+use tonic::Request;
+use tonic::body::Body;
+use tonic::transport::Uri;
+use tonic_reflection::pb::v1::server_reflection_request::MessageRequest;
+use tonic_reflection::pb::v1::server_reflection_response::MessageResponse;
+use tonic_reflection::pb::v1::{
+    ErrorResponse, ExtensionNumberResponse, ListServiceResponse, ServerReflectionRequest,
+    ServiceResponse,
+};
+use tonic_reflection::pb::v1::{ExtensionRequest, FileDescriptorResponse};
+use tonic_reflection::pb::{v1, v1alpha};
+use yaak_tls::ClientCertificateConfig;
+
+pub struct AutoReflectionClient<T = Client<HttpsConnector<HttpConnector>, Body>> {
+    use_v1alpha: bool,
+    client_v1: v1::server_reflection_client::ServerReflectionClient<T>,
+    client_v1alpha: v1alpha::server_reflection_client::ServerReflectionClient<T>,
+}
+
+impl AutoReflectionClient {
+    pub fn new(
+        uri: &Uri,
+        validate_certificates: bool,
+        client_cert: Option<ClientCertificateConfig>,
+        max_message_size: usize,
+    ) -> Result<Self> {
+        let client_v1 = v1::server_reflection_client::ServerReflectionClient::with_origin(
+            get_transport(validate_certificates, client_cert.clone())?,
+            uri.clone(),
+        )
+        .max_decoding_message_size(max_message_size)
+        .max_encoding_message_size(max_message_size);
+        let client_v1alpha =
+            v1alpha::server_reflection_client::ServerReflectionClient::with_origin(
+                get_transport(validate_certificates, client_cert.clone())?,
+                uri.clone(),
+            )
+            .max_decoding_message_size(max_message_size)
+            .max_encoding_message_size(max_message_size);
+        Ok(AutoReflectionClient { use_v1alpha: false, client_v1, client_v1alpha })
+    }
+
+    #[async_recursion]
+    pub async fn send_reflection_request(
+        &mut self,
+        message: MessageRequest,
+        metadata: &BTreeMap<String, String>,
+    ) -> Result<MessageResponse> {
+        let reflection_request = ServerReflectionRequest {
+            host: "".into(), // Doesn't matter
+            message_request: Some(message.clone()),
+        };
+
+        if self.use_v1alpha {
+            let mut request =
+                Request::new(tokio_stream::once(to_v1alpha_request(reflection_request)));
+            decorate_req(metadata, &mut request)?;
+
+            self.client_v1alpha
+                .server_reflection_info(request)
+                .await
+                .map_err(|e| match e.code() {
+                    tonic::Code::Unavailable => {
+                        GenericError("Failed to connect to endpoint".to_string())
+                    }
+                    tonic::Code::Unauthenticated => {
+                        GenericError("Authentication failed".to_string())
+                    }
+                    tonic::Code::DeadlineExceeded => GenericError("Deadline exceeded".to_string()),
+                    _ => GenericError(e.to_string()),
+                })?
+                .into_inner()
+                .next()
+                .await
+                .ok_or(GenericError("Missing reflection message".to_string()))??
+                .message_response
+                .ok_or(GenericError("No reflection response".to_string()))
+                .map(|resp| to_v1_msg_response(resp))
+        } else {
+            let mut request = Request::new(tokio_stream::once(reflection_request));
+            decorate_req(metadata, &mut request)?;
+
+            let resp = self.client_v1.server_reflection_info(request).await;
+            match resp {
+                Ok(r) => Ok(r),
+                Err(e) => match e.code().clone() {
+                    tonic::Code::Unimplemented => {
+                        // If v1 fails, change to v1alpha and try again
+                        debug!("gRPC schema reflection falling back to v1alpha");
+                        self.use_v1alpha = true;
+                        return self.send_reflection_request(message, metadata).await;
+                    }
+                    _ => Err(e),
+                },
+            }
+            .map_err(|e| match e.code() {
+                tonic::Code::Unavailable => {
+                    GenericError("Failed to connect to endpoint".to_string())
+                }
+                tonic::Code::Unauthenticated => GenericError("Authentication failed".to_string()),
+                tonic::Code::DeadlineExceeded => GenericError("Deadline exceeded".to_string()),
+                _ => GenericError(e.to_string()),
+            })?
+            .into_inner()
+            .next()
+            .await
+            .ok_or(GenericError("Missing reflection message".to_string()))??
+            .message_response
+            .ok_or(GenericError("No reflection response".to_string()))
+        }
+    }
+}
+
+fn to_v1_msg_response(
+    response: v1alpha::server_reflection_response::MessageResponse,
+) -> MessageResponse {
+    match response {
+        v1alpha::server_reflection_response::MessageResponse::FileDescriptorResponse(v) => {
+            MessageResponse::FileDescriptorResponse(FileDescriptorResponse {
+                file_descriptor_proto: v.file_descriptor_proto,
+            })
+        }
+        v1alpha::server_reflection_response::MessageResponse::AllExtensionNumbersResponse(v) => {
+            MessageResponse::AllExtensionNumbersResponse(ExtensionNumberResponse {
+                extension_number: v.extension_number,
+                base_type_name: v.base_type_name,
+            })
+        }
+        v1alpha::server_reflection_response::MessageResponse::ListServicesResponse(v) => {
+            MessageResponse::ListServicesResponse(ListServiceResponse {
+                service: v
+                    .service
+                    .iter()
+                    .map(|s| ServiceResponse { name: s.name.clone() })
+                    .collect(),
+            })
+        }
+        v1alpha::server_reflection_response::MessageResponse::ErrorResponse(v) => {
+            MessageResponse::ErrorResponse(ErrorResponse {
+                error_code: v.error_code,
+                error_message: v.error_message,
+            })
+        }
+    }
+}
+
+fn to_v1alpha_request(request: ServerReflectionRequest) -> v1alpha::ServerReflectionRequest {
+    v1alpha::ServerReflectionRequest {
+        host: request.host,
+        message_request: request.message_request.map(|m| to_v1alpha_msg_request(m)),
+    }
+}
+
+fn to_v1alpha_msg_request(
+    message: MessageRequest,
+) -> v1alpha::server_reflection_request::MessageRequest {
+    match message {
+        MessageRequest::FileByFilename(v) => {
+            v1alpha::server_reflection_request::MessageRequest::FileByFilename(v)
+        }
+        MessageRequest::FileContainingSymbol(v) => {
+            v1alpha::server_reflection_request::MessageRequest::FileContainingSymbol(v)
+        }
+        MessageRequest::FileContainingExtension(ExtensionRequest {
+            extension_number,
+            containing_type,
+        }) => v1alpha::server_reflection_request::MessageRequest::FileContainingExtension(
+            v1alpha::ExtensionRequest { extension_number, containing_type },
+        ),
+        MessageRequest::AllExtensionNumbersOfType(v) => {
+            v1alpha::server_reflection_request::MessageRequest::AllExtensionNumbersOfType(v)
+        }
+        MessageRequest::ListServices(v) => {
+            v1alpha::server_reflection_request::MessageRequest::ListServices(v)
+        }
+    }
+}

crates/yaak-grpc/src/codec.rs

@@ -0,0 +1,50 @@
+use prost_reflect::prost::Message;
+use prost_reflect::{DynamicMessage, MethodDescriptor};
+use tonic::Status;
+use tonic::codec::{Codec, DecodeBuf, Decoder, EncodeBuf, Encoder};
+
+#[derive(Clone)]
+pub struct DynamicCodec(MethodDescriptor);
+
+impl DynamicCodec {
+    #[allow(dead_code)]
+    pub fn new(md: MethodDescriptor) -> Self {
+        Self(md)
+    }
+}
+
+impl Codec for DynamicCodec {
+    type Encode = DynamicMessage;
+    type Decode = DynamicMessage;
+    type Encoder = Self;
+    type Decoder = Self;
+
+    fn encoder(&mut self) -> Self::Encoder {
+        self.clone()
+    }
+
+    fn decoder(&mut self) -> Self::Decoder {
+        self.clone()
+    }
+}
+
+impl Encoder for DynamicCodec {
+    type Item = DynamicMessage;
+    type Error = Status;
+
+    fn encode(&mut self, item: Self::Item, dst: &mut EncodeBuf<'_>) -> Result<(), Self::Error> {
+        item.encode(dst).expect("buffer is too small to decode this message");
+        Ok(())
+    }
+}
+
+impl Decoder for DynamicCodec {
+    type Item = DynamicMessage;
+    type Error = Status;
+
+    fn decode(&mut self, src: &mut DecodeBuf<'_>) -> Result<Option<Self::Item>, Self::Error> {
+        let mut msg = DynamicMessage::new(self.0.output());
+        msg.merge(src).map_err(|err| Status::internal(err.to_string()))?;
+        Ok(Some(msg))
+    }
+}

crates/yaak-grpc/src/error.rs

@@ -0,0 +1,51 @@
+use crate::manager::GrpcStreamError;
+use prost::DecodeError;
+use serde::{Serialize, Serializer};
+use serde_json::Error as SerdeJsonError;
+use std::io;
+use thiserror::Error;
+use tonic::Status;
+
+#[derive(Error, Debug)]
+pub enum Error {
+    #[error(transparent)]
+    TlsError(#[from] yaak_tls::error::Error),
+
+    #[error(transparent)]
+    TonicError(#[from] Status),
+
+    #[error("Prost reflect error: {0:?}")]
+    ProstReflectError(#[from] prost_reflect::DescriptorError),
+
+    #[error(transparent)]
+    DeserializerError(#[from] SerdeJsonError),
+
+    #[error(transparent)]
+    GrpcStreamError(#[from] GrpcStreamError),
+
+    #[error(transparent)]
+    GrpcDecodeError(#[from] DecodeError),
+
+    #[error(transparent)]
+    GrpcInvalidMetadataKeyError(#[from] tonic::metadata::errors::InvalidMetadataKey),
+
+    #[error(transparent)]
+    GrpcInvalidMetadataValueError(#[from] tonic::metadata::errors::InvalidMetadataValue),
+
+    #[error(transparent)]
+    IOError(#[from] io::Error),
+
+    #[error("GRPC error: {0}")]
+    GenericError(String),
+}
+
+impl Serialize for Error {
+    fn serialize<S>(&self, serializer: S) -> std::result::Result<S::Ok, S::Error>
+    where
+        S: Serializer,
+    {
+        serializer.serialize_str(self.to_string().as_ref())
+    }
+}
+
+pub type Result<T> = std::result::Result<T, Error>;

crates/yaak-grpc/src/json_schema.rs

@@ -0,0 +1,382 @@
+use prost_reflect::{DescriptorPool, FieldDescriptor, MessageDescriptor};
+use std::collections::{HashMap, HashSet, VecDeque};
+
+pub fn message_to_json_schema(_: &DescriptorPool, root_msg: MessageDescriptor) -> JsonSchemaEntry {
+    JsonSchemaGenerator::generate_json_schema(root_msg)
+}
+
+struct JsonSchemaGenerator {
+    msg_mapping: HashMap<String, JsonSchemaEntry>,
+}
+
+impl JsonSchemaGenerator {
+    pub fn new() -> Self {
+        JsonSchemaGenerator { msg_mapping: HashMap::new() }
+    }
+
+    pub fn generate_json_schema(msg: MessageDescriptor) -> JsonSchemaEntry {
+        let generator = JsonSchemaGenerator::new();
+        generator.scan_root(msg)
+    }
+
+    fn add_message(&mut self, msg: &MessageDescriptor) {
+        let name = msg.full_name().to_string();
+        if self.msg_mapping.contains_key(&name) {
+            return;
+        }
+        self.msg_mapping.insert(name.clone(), JsonSchemaEntry::object());
+    }
+
+    pub fn scan_root(mut self, root_msg: MessageDescriptor) -> JsonSchemaEntry {
+        self.init_structure(root_msg.clone());
+        self.fill_properties(root_msg.clone());
+
+        let mut root = self.msg_mapping.remove(root_msg.full_name()).unwrap();
+
+        if self.msg_mapping.len() > 0 {
+            root.defs = Some(self.msg_mapping);
+        }
+        root
+    }
+
+    fn fill_properties(&mut self, root_msg: MessageDescriptor) {
+        let root_name = root_msg.full_name().to_string();
+
+        let mut visited = HashSet::new();
+        let mut msg_queue = VecDeque::new();
+        msg_queue.push_back(root_msg);
+
+        while !msg_queue.is_empty() {
+            let msg = msg_queue.pop_front().unwrap();
+            let msg_name = msg.full_name();
+            if visited.contains(msg_name) {
+                continue;
+            }
+
+            visited.insert(msg_name.to_string());
+
+            let entry = self.msg_mapping.get_mut(msg_name).unwrap();
+
+            for field in msg.fields() {
+                let field_name = field.name().to_string();
+
+                if matches!(field.cardinality(), prost_reflect::Cardinality::Required) {
+                    entry.add_required(field_name.clone());
+                }
+
+                if let Some(oneof) = field.containing_oneof() {
+                    for oneof_field in oneof.fields() {
+                        if let Some(fm) = is_message_field(&oneof_field) {
+                            msg_queue.push_back(fm);
+                        }
+                        entry.add_property(
+                            oneof_field.name().to_string(),
+                            field_to_type_or_ref(&root_name, oneof_field),
+                        );
+                    }
+                    continue;
+                }
+
+                let (field_type, nest_msg) = {
+                    if let Some(fm) = is_message_field(&field) {
+                        if field.is_list() {
+                            // repeated message type
+                            (
+                                JsonSchemaEntry::array(field_to_type_or_ref(&root_name, field)),
+                                Some(fm),
+                            )
+                        } else if field.is_map() {
+                            let value_field = fm.get_field_by_name("value").unwrap();
+
+                            if let Some(fm) = is_message_field(&value_field) {
+                                (
+                                    JsonSchemaEntry::map(field_to_type_or_ref(
+                                        &root_name,
+                                        value_field,
+                                    )),
+                                    Some(fm),
+                                )
+                            } else {
+                                (
+                                    JsonSchemaEntry::map(field_to_type_or_ref(
+                                        &root_name,
+                                        value_field,
+                                    )),
+                                    None,
+                                )
+                            }
+                        } else {
+                            (field_to_type_or_ref(&root_name, field), Some(fm))
+                        }
+                    } else {
+                        if field.is_list() {
+                            // repeated scalar type
+                            (JsonSchemaEntry::array(field_to_type_or_ref(&root_name, field)), None)
+                        } else {
+                            (field_to_type_or_ref(&root_name, field), None)
+                        }
+                    }
+                };
+
+                if let Some(fm) = nest_msg {
+                    msg_queue.push_back(fm);
+                }
+
+                entry.add_property(field_name, field_type);
+            }
+        }
+    }
+
+    fn init_structure(&mut self, root_msg: MessageDescriptor) {
+        let mut visited = HashSet::new();
+        let mut msg_queue = VecDeque::new();
+        msg_queue.push_back(root_msg.clone());
+
+        // level traversal, to make sure all message type is defined before used
+        while !msg_queue.is_empty() {
+            let msg = msg_queue.pop_front().unwrap();
+            let name = msg.full_name();
+            if visited.contains(name) {
+                continue;
+            }
+            visited.insert(name.to_string());
+            self.add_message(&msg);
+
+            for child in msg.child_messages() {
+                if child.is_map_entry() {
+                    //  for field with map<key, value> type, there will be a child message type *Entry generated
+                    // just skip it
+                    continue;
+                }
+
+                self.add_message(&child);
+                msg_queue.push_back(child);
+            }
+
+            for field in msg.fields() {
+                if let Some(oneof) = field.containing_oneof() {
+                    for oneof_field in oneof.fields() {
+                        if let Some(fm) = is_message_field(&oneof_field) {
+                            self.add_message(&fm);
+                            msg_queue.push_back(fm);
+                        }
+                    }
+                    continue;
+                }
+                if field.is_map() {
+                    // key is always scalar type, so no need to process
+                    // value can be any type, so need to unpack value type
+                    let map_field_msg = is_message_field(&field).unwrap();
+                    let map_value_field = map_field_msg.get_field_by_name("value").unwrap();
+                    if let Some(value_fm) = is_message_field(&map_value_field) {
+                        self.add_message(&value_fm);
+                        msg_queue.push_back(value_fm);
+                    }
+                    continue;
+                }
+                if let Some(fm) = is_message_field(&field) {
+                    self.add_message(&fm);
+                    msg_queue.push_back(fm);
+                }
+            }
+        }
+    }
+}
+
+fn field_to_type_or_ref(root_name: &str, field: FieldDescriptor) -> JsonSchemaEntry {
+    match field.kind() {
+        prost_reflect::Kind::Bool => JsonSchemaEntry::boolean(),
+        prost_reflect::Kind::Double => JsonSchemaEntry::number("double"),
+        prost_reflect::Kind::Float => JsonSchemaEntry::number("float"),
+        prost_reflect::Kind::Int32 => JsonSchemaEntry::number("int32"),
+        prost_reflect::Kind::Int64 => JsonSchemaEntry::string_with_format("int64"),
+        prost_reflect::Kind::Uint32 => JsonSchemaEntry::number("int64"),
+        prost_reflect::Kind::Uint64 => JsonSchemaEntry::string_with_format("uint64"),
+        prost_reflect::Kind::Sint32 => JsonSchemaEntry::number("sint32"),
+        prost_reflect::Kind::Sint64 => JsonSchemaEntry::string_with_format("sint64"),
+        prost_reflect::Kind::Fixed32 => JsonSchemaEntry::number("int64"),
+        prost_reflect::Kind::Fixed64 => JsonSchemaEntry::string_with_format("fixed64"),
+        prost_reflect::Kind::Sfixed32 => JsonSchemaEntry::number("sfixed32"),
+        prost_reflect::Kind::Sfixed64 => JsonSchemaEntry::string_with_format("sfixed64"),
+        prost_reflect::Kind::String => JsonSchemaEntry::string(),
+        prost_reflect::Kind::Bytes => JsonSchemaEntry::string_with_format("byte"),
+        prost_reflect::Kind::Enum(enums) => {
+            let values = enums.values().map(|v| v.name().to_string()).collect::<Vec<_>>();
+            JsonSchemaEntry::enums(values)
+        }
+        prost_reflect::Kind::Message(fm) => {
+            let field_type_full_name = fm.full_name();
+            match field_type_full_name {
+                // [Protocol Buffers Well-Known Types]: https://protobuf.dev/reference/protobuf/google.protobuf/
+                "google.protobuf.FieldMask" => JsonSchemaEntry::string(),
+                "google.protobuf.Timestamp" => JsonSchemaEntry::string_with_format("date-time"),
+                "google.protobuf.Duration" => JsonSchemaEntry::string_with_format("duration"),
+                "google.protobuf.StringValue" => JsonSchemaEntry::string(),
+                "google.protobuf.BytesValue" => JsonSchemaEntry::string_with_format("byte"),
+                "google.protobuf.Int32Value" => JsonSchemaEntry::number("int32"),
+                "google.protobuf.UInt32Value" => JsonSchemaEntry::string_with_format("int64"),
+                "google.protobuf.Int64Value" => JsonSchemaEntry::string_with_format("int64"),
+                "google.protobuf.UInt64Value" => JsonSchemaEntry::string_with_format("uint64"),
+                "google.protobuf.FloatValue" => JsonSchemaEntry::number("float"),
+                "google.protobuf.DoubleValue" => JsonSchemaEntry::number("double"),
+                "google.protobuf.BoolValue" => JsonSchemaEntry::boolean(),
+                "google.protobuf.Empty" => JsonSchemaEntry::default(),
+                "google.protobuf.Struct" => JsonSchemaEntry::object(),
+                "google.protobuf.ListValue" => JsonSchemaEntry::array(JsonSchemaEntry::default()),
+                "google.protobuf.NullValue" => JsonSchemaEntry::null(),
+                name @ _ if name == root_name => JsonSchemaEntry::root_reference(),
+                _ => JsonSchemaEntry::reference(fm.full_name()),
+            }
+        }
+    }
+}
+
+fn is_message_field(field: &FieldDescriptor) -> Option<MessageDescriptor> {
+    match field.kind() {
+        prost_reflect::Kind::Message(m) => Some(m),
+        _ => None,
+    }
+}
+
+#[derive(Default, serde::Serialize)]
+#[serde(default, rename_all = "camelCase")]
+pub struct JsonSchemaEntry {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    title: Option<String>,
+
+    #[serde(rename = "type", skip_serializing_if = "Option::is_none")]
+    type_: Option<JsonType>,
+
+    #[serde(skip_serializing_if = "Option::is_none")]
+    format: Option<String>,
+
+    #[serde(skip_serializing_if = "Option::is_none")]
+    description: Option<String>,
+
+    #[serde(skip_serializing_if = "Option::is_none")]
+    properties: Option<HashMap<String, JsonSchemaEntry>>,
+
+    #[serde(rename = "enum", skip_serializing_if = "Option::is_none")]
+    enum_: Option<Vec<String>>,
+
+    // for map type
+    #[serde(skip_serializing_if = "Option::is_none")]
+    additional_properties: Option<Box<JsonSchemaEntry>>,
+
+    // Set all properties to required
+    #[serde(skip_serializing_if = "Option::is_none")]
+    required: Option<Vec<String>>,
+
+    #[serde(skip_serializing_if = "Option::is_none")]
+    items: Option<Box<JsonSchemaEntry>>,
+
+    #[serde(skip_serializing_if = "Option::is_none", rename = "$defs")]
+    defs: Option<HashMap<String, JsonSchemaEntry>>,
+
+    #[serde(skip_serializing_if = "Option::is_none", rename = "$ref")]
+    ref_: Option<String>,
+}
+
+impl JsonSchemaEntry {
+    pub fn add_property(&mut self, name: String, entry: JsonSchemaEntry) {
+        if self.properties.is_none() {
+            self.properties = Some(HashMap::new());
+        }
+        self.properties.as_mut().unwrap().insert(name, entry);
+    }
+
+    pub fn add_required(&mut self, name: String) {
+        if self.required.is_none() {
+            self.required = Some(Vec::new());
+        }
+        self.required.as_mut().unwrap().push(name);
+    }
+}
+
+impl JsonSchemaEntry {
+    pub fn object() -> Self {
+        JsonSchemaEntry { type_: Some(JsonType::Object), ..Default::default() }
+    }
+    pub fn boolean() -> Self {
+        JsonSchemaEntry { type_: Some(JsonType::Boolean), ..Default::default() }
+    }
+    pub fn number<S: Into<String>>(format: S) -> Self {
+        JsonSchemaEntry {
+            type_: Some(JsonType::Number),
+            format: Some(format.into()),
+            ..Default::default()
+        }
+    }
+    pub fn string() -> Self {
+        JsonSchemaEntry { type_: Some(JsonType::String), ..Default::default() }
+    }
+
+    pub fn string_with_format<S: Into<String>>(format: S) -> Self {
+        JsonSchemaEntry {
+            type_: Some(JsonType::String),
+            format: Some(format.into()),
+            ..Default::default()
+        }
+    }
+    pub fn reference<S: AsRef<str>>(ref_: S) -> Self {
+        JsonSchemaEntry { ref_: Some(format!("#/$defs/{}", ref_.as_ref())), ..Default::default() }
+    }
+    pub fn root_reference() -> Self {
+        JsonSchemaEntry { ref_: Some("#".to_string()), ..Default::default() }
+    }
+    pub fn array(item: JsonSchemaEntry) -> Self {
+        JsonSchemaEntry {
+            type_: Some(JsonType::Array),
+            items: Some(Box::new(item)),
+            ..Default::default()
+        }
+    }
+    pub fn enums(enums: Vec<String>) -> Self {
+        JsonSchemaEntry { type_: Some(JsonType::String), enum_: Some(enums), ..Default::default() }
+    }
+
+    pub fn map(value_type: JsonSchemaEntry) -> Self {
+        JsonSchemaEntry {
+            type_: Some(JsonType::Object),
+            additional_properties: Some(Box::new(value_type)),
+            ..Default::default()
+        }
+    }
+
+    pub fn null() -> Self {
+        JsonSchemaEntry { type_: Some(JsonType::Null), ..Default::default() }
+    }
+}
+
+enum JsonType {
+    String,
+    Number,
+    Object,
+    Array,
+    Boolean,
+    Null,
+    _UNKNOWN,
+}
+
+impl Default for JsonType {
+    fn default() -> Self {
+        JsonType::_UNKNOWN
+    }
+}
+
+impl serde::Serialize for JsonType {
+    fn serialize<S>(&self, serializer: S) -> std::result::Result<S::Ok, S::Error>
+    where
+        S: serde::Serializer,
+    {
+        match self {
+            JsonType::String => serializer.serialize_str("string"),
+            JsonType::Number => serializer.serialize_str("number"),
+            JsonType::Object => serializer.serialize_str("object"),
+            JsonType::Array => serializer.serialize_str("array"),
+            JsonType::Boolean => serializer.serialize_str("boolean"),
+            JsonType::Null => serializer.serialize_str("null"),
+            JsonType::_UNKNOWN => serializer.serialize_str("unknown"),
+        }
+    }
+}

crates/yaak-grpc/src/lib.rs

@@ -0,0 +1,56 @@
+use prost_reflect::{DynamicMessage, MethodDescriptor, SerializeOptions};
+use serde::{Deserialize, Serialize};
+use serde_json::Deserializer;
+
+mod any;
+mod client;
+mod codec;
+pub mod error;
+mod json_schema;
+pub mod manager;
+mod reflection;
+mod transport;
+
+pub use tonic::Code;
+pub use tonic::metadata::*;
+
+pub fn serialize_options() -> SerializeOptions {
+    SerializeOptions::new().skip_default_fields(false)
+}
+
+#[derive(Serialize, Deserialize, Debug, Default, ts_rs::TS)]
+#[serde(default, rename_all = "camelCase")]
+#[ts(export, export_to = "gen_grpc.ts")]
+pub struct ServiceDefinition {
+    pub name: String,
+    pub methods: Vec<MethodDefinition>,
+}
+
+#[derive(Serialize, Deserialize, Debug, Default, ts_rs::TS)]
+#[serde(default, rename_all = "camelCase")]
+#[ts(export, export_to = "gen_grpc.ts")]
+pub struct MethodDefinition {
+    pub name: String,
+    pub schema: String,
+    pub client_streaming: bool,
+    pub server_streaming: bool,
+}
+
+static SERIALIZE_OPTIONS: &'static SerializeOptions =
+    &SerializeOptions::new().skip_default_fields(false).stringify_64_bit_integers(false);
+
+pub(crate) fn serialize_dynamic_message_json(msg: &DynamicMessage) -> Result<String, String> {
+    let mut buf = Vec::new();
+    let mut se = serde_json::Serializer::pretty(&mut buf);
+    msg.serialize_with_options(&mut se, SERIALIZE_OPTIONS).map_err(|e| e.to_string())?;
+    let s = String::from_utf8(buf).expect("serde_json to emit valid utf8");
+    Ok(s)
+}
+
+pub fn deserialize_message(msg: &str, method: MethodDescriptor) -> Result<DynamicMessage, String> {
+    let mut deserializer = Deserializer::from_str(&msg);
+    let req_message = DynamicMessage::deserialize(method.input(), &mut deserializer)
+        .map_err(|e| e.to_string())?;
+    deserializer.end().map_err(|e| e.to_string())?;
+    Ok(req_message)
+}

crates/yaak-grpc/src/manager.rs

@@ -0,0 +1,553 @@
+use crate::codec::DynamicCodec;
+use crate::error::Error::GenericError;
+use crate::error::Result;
+use crate::reflection::{
+    fill_pool_from_files, fill_pool_from_reflection, method_desc_to_path,
+    reflect_types_for_dynamic_message, reflect_types_for_message,
+};
+use crate::transport::get_transport;
+use crate::{MethodDefinition, ServiceDefinition, json_schema};
+use hyper_rustls::HttpsConnector;
+use hyper_util::client::legacy::Client;
+use hyper_util::client::legacy::connect::HttpConnector;
+use log::{info, warn};
+pub use prost_reflect::DynamicMessage;
+use prost_reflect::ReflectMessage;
+use prost_reflect::prost::Message;
+use prost_reflect::{DescriptorPool, MethodDescriptor, ServiceDescriptor};
+use serde_json::Deserializer;
+use std::borrow::Cow;
+use std::collections::BTreeMap;
+use std::error::Error;
+use std::fmt;
+use std::fmt::Display;
+use std::path::PathBuf;
+use std::str::FromStr;
+use std::sync::Arc;
+use tokio::sync::RwLock;
+use tokio_stream::StreamExt;
+use tokio_stream::wrappers::ReceiverStream;
+use tonic::body::Body;
+use tonic::metadata::{MetadataKey, MetadataValue};
+use tonic::transport::Uri;
+use tonic::{IntoRequest, IntoStreamingRequest, Request, Response, Status, Streaming};
+use yaak_tls::ClientCertificateConfig;
+
+#[derive(Clone)]
+pub struct GrpcConnection {
+    pool: Arc<RwLock<DescriptorPool>>,
+    conn: Client<HttpsConnector<HttpConnector>, Body>,
+    pub uri: Uri,
+    use_reflection: bool,
+    max_message_size: usize,
+}
+
+#[derive(Default, Debug)]
+pub struct GrpcStreamError {
+    pub message: String,
+    pub status: Option<Status>,
+}
+
+impl Error for GrpcStreamError {}
+
+impl Display for GrpcStreamError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match &self.status {
+            Some(status) => write!(f, "[{}] {}", status, self.message),
+            None => write!(f, "{}", self.message),
+        }
+    }
+}
+
+impl From<String> for GrpcStreamError {
+    fn from(value: String) -> Self {
+        GrpcStreamError { message: value.to_string(), status: None }
+    }
+}
+
+impl From<Status> for GrpcStreamError {
+    fn from(s: Status) -> Self {
+        GrpcStreamError { message: s.message().to_string(), status: Some(s) }
+    }
+}
+
+impl GrpcConnection {
+    pub async fn method(&self, service: &str, method: &str) -> Result<MethodDescriptor> {
+        let service = self.service(service).await?;
+        let method = service
+            .methods()
+            .find(|m| m.name() == method)
+            .ok_or(GenericError("Failed to find method".to_string()))?;
+        Ok(method)
+    }
+
+    async fn service(&self, service: &str) -> Result<ServiceDescriptor> {
+        let pool = self.pool.read().await;
+        let service = pool
+            .get_service_by_name(service)
+            .ok_or(GenericError("Failed to find service".to_string()))?;
+        Ok(service)
+    }
+
+    pub async fn unary(
+        &self,
+        service: &str,
+        method: &str,
+        message: &str,
+        metadata: &BTreeMap<String, String>,
+        client_cert: Option<ClientCertificateConfig>,
+    ) -> Result<Response<DynamicMessage>> {
+        if self.use_reflection {
+            reflect_types_for_message(
+                self.pool.clone(),
+                &self.uri,
+                message,
+                metadata,
+                client_cert,
+                self.max_message_size,
+            )
+            .await?;
+        }
+        let method = &self.method(&service, &method).await?;
+        let input_message = method.input();
+
+        let mut deserializer = Deserializer::from_str(message);
+        let req_message = DynamicMessage::deserialize(input_message, &mut deserializer)?;
+        deserializer.end()?;
+
+        let mut client = grpc_client(self.conn.clone(), self.uri.clone(), self.max_message_size);
+
+        let mut req = req_message.into_request();
+        decorate_req(metadata, &mut req)?;
+
+        let path = method_desc_to_path(method);
+        let codec = DynamicCodec::new(method.clone());
+        client.ready().await.map_err(|e| GenericError(format!("Failed to connect: {}", e)))?;
+
+        Ok(client.unary(req, path, codec).await?)
+    }
+
+    pub async fn serialize_message(
+        &self,
+        message: &DynamicMessage,
+        metadata: &BTreeMap<String, String>,
+        client_cert: Option<ClientCertificateConfig>,
+    ) -> Result<String> {
+        let message = if self.use_reflection {
+            reflect_types_for_dynamic_message(
+                self.pool.clone(),
+                &self.uri,
+                message,
+                metadata,
+                client_cert,
+                self.max_message_size,
+            )
+            .await?;
+
+            let message_name = message.descriptor().full_name().to_string();
+            let message_desc = {
+                let pool = self.pool.read().await;
+                pool.get_message_by_name(&message_name)
+                    .ok_or(GenericError(format!("Failed to find message {message_name}")))?
+            };
+            let mut message_with_updated_pool = DynamicMessage::new(message_desc);
+            message_with_updated_pool.merge(message.encode_to_vec().as_slice())?;
+            Cow::Owned(message_with_updated_pool)
+        } else {
+            Cow::Borrowed(message)
+        };
+
+        crate::serialize_dynamic_message_json(message.as_ref()).map_err(GenericError)
+    }
+
+    pub async fn streaming<F>(
+        &self,
+        service: &str,
+        method: &str,
+        stream: ReceiverStream<String>,
+        metadata: &BTreeMap<String, String>,
+        client_cert: Option<ClientCertificateConfig>,
+        on_message: F,
+    ) -> Result<Response<Streaming<DynamicMessage>>>
+    where
+        F: Fn(std::result::Result<String, String>) + Send + Sync + Clone + 'static,
+    {
+        let method = &self.method(&service, &method).await?;
+        let mapped_stream = {
+            let input_message = method.input();
+            let pool = self.pool.clone();
+            let uri = self.uri.clone();
+            let md = metadata.clone();
+            let use_reflection = self.use_reflection.clone();
+            let client_cert = client_cert.clone();
+            let max_message_size = self.max_message_size;
+            stream
+                .then(move |json| {
+                    let pool = pool.clone();
+                    let uri = uri.clone();
+                    let input_message = input_message.clone();
+                    let md = md.clone();
+                    let use_reflection = use_reflection.clone();
+                    let client_cert = client_cert.clone();
+                    let on_message = on_message.clone();
+                    let json_clone = json.clone();
+                    async move {
+                        if use_reflection {
+                            if let Err(e) = reflect_types_for_message(
+                                pool,
+                                &uri,
+                                &json,
+                                &md,
+                                client_cert,
+                                max_message_size,
+                            )
+                            .await
+                            {
+                                warn!("Failed to resolve Any types: {e}");
+                            }
+                        }
+                        let mut de = Deserializer::from_str(&json);
+                        match DynamicMessage::deserialize(input_message, &mut de) {
+                            Ok(m) => {
+                                on_message(Ok(json_clone));
+                                Some(m)
+                            }
+                            Err(e) => {
+                                warn!("Failed to deserialize message: {e}");
+                                on_message(Err(e.to_string()));
+                                None
+                            }
+                        }
+                    }
+                })
+                .filter_map(|x| x)
+        };
+
+        let mut client = grpc_client(self.conn.clone(), self.uri.clone(), self.max_message_size);
+        let path = method_desc_to_path(method);
+        let codec = DynamicCodec::new(method.clone());
+
+        let mut req = mapped_stream.into_streaming_request();
+        decorate_req(metadata, &mut req)?;
+
+        client.ready().await.map_err(|e| GenericError(format!("Failed to connect: {}", e)))?;
+        Ok(client.streaming(req, path, codec).await?)
+    }
+
+    pub async fn client_streaming<F>(
+        &self,
+        service: &str,
+        method: &str,
+        stream: ReceiverStream<String>,
+        metadata: &BTreeMap<String, String>,
+        client_cert: Option<ClientCertificateConfig>,
+        on_message: F,
+    ) -> Result<Response<DynamicMessage>>
+    where
+        F: Fn(std::result::Result<String, String>) + Send + Sync + Clone + 'static,
+    {
+        let method = &self.method(&service, &method).await?;
+        let mapped_stream = {
+            let input_message = method.input();
+            let pool = self.pool.clone();
+            let uri = self.uri.clone();
+            let md = metadata.clone();
+            let use_reflection = self.use_reflection.clone();
+            let client_cert = client_cert.clone();
+            let max_message_size = self.max_message_size;
+            stream
+                .then(move |json| {
+                    let pool = pool.clone();
+                    let uri = uri.clone();
+                    let input_message = input_message.clone();
+                    let md = md.clone();
+                    let use_reflection = use_reflection.clone();
+                    let client_cert = client_cert.clone();
+                    let on_message = on_message.clone();
+                    let json_clone = json.clone();
+                    async move {
+                        if use_reflection {
+                            if let Err(e) = reflect_types_for_message(
+                                pool,
+                                &uri,
+                                &json,
+                                &md,
+                                client_cert,
+                                max_message_size,
+                            )
+                            .await
+                            {
+                                warn!("Failed to resolve Any types: {e}");
+                            }
+                        }
+                        let mut de = Deserializer::from_str(&json);
+                        match DynamicMessage::deserialize(input_message, &mut de) {
+                            Ok(m) => {
+                                on_message(Ok(json_clone));
+                                Some(m)
+                            }
+                            Err(e) => {
+                                warn!("Failed to deserialize message: {e}");
+                                on_message(Err(e.to_string()));
+                                None
+                            }
+                        }
+                    }
+                })
+                .filter_map(|x| x)
+        };
+
+        let mut client = grpc_client(self.conn.clone(), self.uri.clone(), self.max_message_size);
+        let path = method_desc_to_path(method);
+        let codec = DynamicCodec::new(method.clone());
+
+        let mut req = mapped_stream.into_streaming_request();
+        decorate_req(metadata, &mut req)?;
+
+        client.ready().await.map_err(|e| GenericError(format!("Failed to connect: {}", e)))?;
+        Ok(client
+            .client_streaming(req, path, codec)
+            .await
+            .map_err(|e| GrpcStreamError { message: e.message().to_string(), status: Some(e) })?)
+    }
+
+    pub async fn server_streaming(
+        &self,
+        service: &str,
+        method: &str,
+        message: &str,
+        metadata: &BTreeMap<String, String>,
+    ) -> Result<Response<Streaming<DynamicMessage>>> {
+        let method = &self.method(&service, &method).await?;
+        let input_message = method.input();
+
+        let mut deserializer = Deserializer::from_str(message);
+        let req_message = DynamicMessage::deserialize(input_message, &mut deserializer)?;
+        deserializer.end()?;
+
+        let mut client = grpc_client(self.conn.clone(), self.uri.clone(), self.max_message_size);
+
+        let mut req = req_message.into_request();
+        decorate_req(metadata, &mut req)?;
+
+        let path = method_desc_to_path(method);
+        let codec = DynamicCodec::new(method.clone());
+        client.ready().await.map_err(|e| GenericError(format!("Failed to connect: {}", e)))?;
+        Ok(client.server_streaming(req, path, codec).await?)
+    }
+}
+
+fn grpc_client(
+    conn: Client<HttpsConnector<HttpConnector>, Body>,
+    uri: Uri,
+    max_message_size: usize,
+) -> tonic::client::Grpc<Client<HttpsConnector<HttpConnector>, Body>> {
+    tonic::client::Grpc::with_origin(conn, uri)
+        .max_decoding_message_size(max_message_size)
+        .max_encoding_message_size(max_message_size)
+}
+
+fn message_size_limit(setting: i32) -> usize {
+    match setting.try_into() {
+        Ok(0) | Err(_) => usize::MAX,
+        Ok(limit) => limit,
+    }
+}
+
+/// Configuration for GrpcHandle to compile proto files
+#[derive(Clone)]
+pub struct GrpcConfig {
+    /// Path to the protoc include directory (vendored/protoc/include)
+    pub protoc_include_dir: PathBuf,
+    /// Path to the yaakprotoc sidecar binary
+    pub protoc_bin_path: PathBuf,
+}
+
+pub struct GrpcHandle {
+    config: GrpcConfig,
+    pools: BTreeMap<String, DescriptorPool>,
+}
+
+impl GrpcHandle {
+    pub fn new(config: GrpcConfig) -> Self {
+        let pools = BTreeMap::new();
+        Self { pools, config }
+    }
+}
+
+impl GrpcHandle {
+    /// Remove cached descriptor pool for the given key, if present.
+    pub fn invalidate_pool(&mut self, id: &str, uri: &str, proto_files: &Vec<PathBuf>) {
+        let key = make_pool_key(id, uri, proto_files);
+        self.pools.remove(&key);
+    }
+
+    pub async fn reflect(
+        &mut self,
+        id: &str,
+        uri: &str,
+        proto_files: &Vec<PathBuf>,
+        metadata: &BTreeMap<String, String>,
+        validate_certificates: bool,
+        client_cert: Option<ClientCertificateConfig>,
+        request_message_size: i32,
+    ) -> Result<bool> {
+        let server_reflection = proto_files.is_empty();
+        let key = make_pool_key(id, uri, proto_files);
+
+        // If we already have a pool for this key, reuse it and avoid re-reflection
+        if self.pools.contains_key(&key) {
+            return Ok(server_reflection);
+        }
+
+        let pool = if server_reflection {
+            let full_uri = uri_from_str(uri)?;
+            fill_pool_from_reflection(
+                &full_uri,
+                metadata,
+                validate_certificates,
+                client_cert,
+                message_size_limit(request_message_size),
+            )
+            .await
+        } else {
+            fill_pool_from_files(&self.config, proto_files).await
+        }?;
+
+        self.pools.insert(key, pool.clone());
+        Ok(server_reflection)
+    }
+
+    pub async fn services(
+        &mut self,
+        id: &str,
+        uri: &str,
+        proto_files: &Vec<PathBuf>,
+        metadata: &BTreeMap<String, String>,
+        validate_certificates: bool,
+        client_cert: Option<ClientCertificateConfig>,
+        request_message_size: i32,
+    ) -> Result<Vec<ServiceDefinition>> {
+        // Ensure we have a pool; reflect only if missing
+        if self.get_pool(id, uri, proto_files).is_none() {
+            info!("Reflecting gRPC services for {} at {}", id, uri);
+            self.reflect(
+                id,
+                uri,
+                proto_files,
+                metadata,
+                validate_certificates,
+                client_cert,
+                request_message_size,
+            )
+            .await?;
+        }
+
+        let pool = self
+            .get_pool(id, uri, proto_files)
+            .ok_or(GenericError("Failed to get pool".to_string()))?;
+        Ok(self.services_from_pool(&pool))
+    }
+
+    fn services_from_pool(&self, pool: &DescriptorPool) -> Vec<ServiceDefinition> {
+        pool.services()
+            .map(|s| {
+                let mut def =
+                    ServiceDefinition { name: s.full_name().to_string(), methods: vec![] };
+                for method in s.methods() {
+                    let input_message = method.input();
+                    def.methods.push(MethodDefinition {
+                        name: method.name().to_string(),
+                        server_streaming: method.is_server_streaming(),
+                        client_streaming: method.is_client_streaming(),
+                        schema: serde_json::to_string_pretty(&json_schema::message_to_json_schema(
+                            &pool,
+                            input_message,
+                        ))
+                        .expect("Failed to serialize JSON schema"),
+                    })
+                }
+                def
+            })
+            .collect::<Vec<_>>()
+    }
+
+    pub async fn connect(
+        &mut self,
+        id: &str,
+        uri: &str,
+        proto_files: &Vec<PathBuf>,
+        metadata: &BTreeMap<String, String>,
+        validate_certificates: bool,
+        client_cert: Option<ClientCertificateConfig>,
+        request_message_size: i32,
+    ) -> Result<GrpcConnection> {
+        let use_reflection = proto_files.is_empty();
+        let max_message_size = message_size_limit(request_message_size);
+        if self.get_pool(id, uri, proto_files).is_none() {
+            self.reflect(
+                id,
+                uri,
+                proto_files,
+                metadata,
+                validate_certificates,
+                client_cert.clone(),
+                request_message_size,
+            )
+            .await?;
+        }
+        let pool = self
+            .get_pool(id, uri, proto_files)
+            .ok_or(GenericError("Failed to get pool".to_string()))?
+            .clone();
+        let uri = uri_from_str(uri)?;
+        let conn = get_transport(validate_certificates, client_cert.clone())?;
+        Ok(GrpcConnection {
+            pool: Arc::new(RwLock::new(pool)),
+            use_reflection,
+            conn,
+            uri,
+            max_message_size,
+        })
+    }
+
+    fn get_pool(&self, id: &str, uri: &str, proto_files: &Vec<PathBuf>) -> Option<&DescriptorPool> {
+        self.pools.get(make_pool_key(id, uri, proto_files).as_str())
+    }
+}
+
+pub(crate) fn decorate_req<T>(
+    metadata: &BTreeMap<String, String>,
+    req: &mut Request<T>,
+) -> Result<()> {
+    for (k, v) in metadata {
+        req.metadata_mut()
+            .insert(MetadataKey::from_str(k.as_str())?, MetadataValue::from_str(v.as_str())?);
+    }
+    Ok(())
+}
+
+fn uri_from_str(uri_str: &str) -> Result<Uri> {
+    match Uri::from_str(uri_str) {
+        Ok(uri) => Ok(uri),
+        Err(err) => {
+            // Uri::from_str basically only returns "invalid format" so we add more context here
+            Err(GenericError(format!("Failed to parse URL, {}", err.to_string())))
+        }
+    }
+}
+
+fn make_pool_key(id: &str, uri: &str, proto_files: &Vec<PathBuf>) -> String {
+    let pool_key = format!(
+        "{}::{}::{}",
+        id,
+        uri,
+        proto_files
+            .iter()
+            .map(|p| p.to_string_lossy().to_string())
+            .collect::<Vec<String>>()
+            .join(":")
+    );
+
+    format!("{:x}", md5::compute(pool_key))
+}

crates/yaak-grpc/src/reflection.rs

@@ -0,0 +1,533 @@
+use crate::any::collect_any_types;
+use crate::client::AutoReflectionClient;
+use crate::error::Error::GenericError;
+use crate::error::Result;
+use crate::manager::GrpcConfig;
+use anyhow::anyhow;
+use async_recursion::async_recursion;
+use log::{debug, info, warn};
+use prost::Message;
+use prost_reflect::{DescriptorPool, DynamicMessage, MethodDescriptor, ReflectMessage, Value};
+use prost_types::{FileDescriptorProto, FileDescriptorSet};
+use std::collections::{BTreeMap, HashSet};
+use std::env::temp_dir;
+use std::ops::Deref;
+use std::path::{Path, PathBuf};
+use std::str::FromStr;
+use std::sync::Arc;
+use tokio::fs;
+use tokio::sync::RwLock;
+use tonic::codegen::http::uri::PathAndQuery;
+use tonic::transport::Uri;
+use tonic_reflection::pb::v1::server_reflection_request::MessageRequest;
+use tonic_reflection::pb::v1::server_reflection_response::MessageResponse;
+use yaak_common::command::new_xplatform_command;
+use yaak_tls::ClientCertificateConfig;
+
+pub async fn fill_pool_from_files(
+    config: &GrpcConfig,
+    paths: &Vec<PathBuf>,
+) -> Result<DescriptorPool> {
+    let mut pool = DescriptorPool::new();
+    let random_file_name = format!("{}.desc", uuid::Uuid::new_v4());
+    let desc_path = temp_dir().join(random_file_name);
+
+    // HACK: Remove UNC prefix for Windows paths
+    let global_import_dir =
+        dunce::simplified(config.protoc_include_dir.as_path()).to_string_lossy().to_string();
+    let desc_path = dunce::simplified(desc_path.as_path());
+
+    let mut args = vec![
+        "--include_imports".to_string(),
+        "--include_source_info".to_string(),
+        "-I".to_string(),
+        global_import_dir,
+        "-o".to_string(),
+        desc_path.to_string_lossy().to_string(),
+    ];
+
+    let mut include_dirs = HashSet::new();
+    let mut include_protos = HashSet::new();
+
+    for p in paths {
+        if !p.exists() {
+            continue;
+        }
+
+        // Dirs are added as includes
+        if p.is_dir() {
+            include_dirs.insert(p.to_string_lossy().to_string());
+            continue;
+        }
+
+        let parent = p.as_path().parent();
+        if let Some(parent_path) = parent {
+            match find_parent_proto_dir(parent_path) {
+                None => {
+                    // Add parent/grandparent as fallback
+                    include_dirs.insert(parent_path.to_string_lossy().to_string());
+                    if let Some(grandparent_path) = parent_path.parent() {
+                        include_dirs.insert(grandparent_path.to_string_lossy().to_string());
+                    }
+                }
+                Some(p) => {
+                    include_dirs.insert(p.to_string_lossy().to_string());
+                }
+            };
+        } else {
+            debug!("ignoring {:?} since it does not exist.", parent)
+        }
+
+        include_protos.insert(p.to_string_lossy().to_string());
+    }
+
+    for d in include_dirs.clone() {
+        args.push("-I".to_string());
+        args.push(d);
+    }
+    for p in include_protos.clone() {
+        args.push(p);
+    }
+
+    info!("Invoking protoc with {}", args.join(" "));
+
+    let mut cmd = new_xplatform_command(&config.protoc_bin_path);
+    cmd.args(&args);
+
+    let out =
+        cmd.output().await.map_err(|e| GenericError(format!("Failed to run protoc: {}", e)))?;
+
+    if !out.status.success() {
+        return Err(GenericError(format!(
+            "protoc failed with status {}: {}",
+            out.status.code().unwrap_or(-1),
+            String::from_utf8_lossy(out.stderr.as_slice())
+        )));
+    }
+
+    let bytes = fs::read(desc_path).await?;
+    let fdp = FileDescriptorSet::decode(bytes.deref())?;
+    pool.add_file_descriptor_set(fdp)?;
+
+    fs::remove_file(desc_path).await?;
+
+    Ok(pool)
+}
+
+pub async fn fill_pool_from_reflection(
+    uri: &Uri,
+    metadata: &BTreeMap<String, String>,
+    validate_certificates: bool,
+    client_cert: Option<ClientCertificateConfig>,
+    max_message_size: usize,
+) -> Result<DescriptorPool> {
+    let mut pool = DescriptorPool::new();
+    let mut client =
+        AutoReflectionClient::new(uri, validate_certificates, client_cert, max_message_size)?;
+
+    for service in list_services(&mut client, metadata).await? {
+        if service == "grpc.reflection.v1alpha.ServerReflection" {
+            continue;
+        }
+        if service == "grpc.reflection.v1.ServerReflection" {
+            continue;
+        }
+        debug!("Fetching descriptors for {}", service);
+        file_descriptor_set_from_service_name(&service, &mut pool, &mut client, metadata).await;
+    }
+
+    Ok(pool)
+}
+
+async fn list_services(
+    client: &mut AutoReflectionClient,
+    metadata: &BTreeMap<String, String>,
+) -> Result<Vec<String>> {
+    let response =
+        client.send_reflection_request(MessageRequest::ListServices("".into()), metadata).await?;
+
+    let list_services_response = match response {
+        MessageResponse::ListServicesResponse(resp) => resp,
+        _ => panic!("Expected a ListServicesResponse variant"),
+    };
+
+    Ok(list_services_response.service.iter().map(|s| s.name.clone()).collect::<Vec<_>>())
+}
+
+async fn file_descriptor_set_from_service_name(
+    service_name: &str,
+    pool: &mut DescriptorPool,
+    client: &mut AutoReflectionClient,
+    metadata: &BTreeMap<String, String>,
+) {
+    let response = match client
+        .send_reflection_request(
+            MessageRequest::FileContainingSymbol(service_name.into()),
+            metadata,
+        )
+        .await
+    {
+        Ok(resp) => resp,
+        Err(e) => {
+            warn!("Error fetching file descriptor for service {}: {:?}", service_name, e);
+            return;
+        }
+    };
+
+    let file_descriptor_response = match response {
+        MessageResponse::FileDescriptorResponse(resp) => resp,
+        _ => panic!("Expected a FileDescriptorResponse variant"),
+    };
+
+    add_file_descriptors_to_pool(
+        file_descriptor_response.file_descriptor_proto,
+        pool,
+        client,
+        metadata,
+    )
+    .await;
+}
+
+pub(crate) async fn reflect_types_for_message(
+    pool: Arc<RwLock<DescriptorPool>>,
+    uri: &Uri,
+    json: &str,
+    metadata: &BTreeMap<String, String>,
+    client_cert: Option<ClientCertificateConfig>,
+    max_message_size: usize,
+) -> Result<()> {
+    // 1. Collect all Any types in the JSON
+    let mut extra_types = Vec::new();
+    collect_any_types(json, &mut extra_types);
+
+    if extra_types.is_empty() {
+        return Ok(()); // nothing to do
+    }
+
+    let mut client = AutoReflectionClient::new(uri, false, client_cert, max_message_size)?;
+    for extra_type in extra_types {
+        {
+            let guard = pool.read().await;
+            if guard.get_message_by_name(&extra_type).is_some() {
+                continue;
+            }
+        }
+        info!("Adding file descriptor for {:?} from reflection", extra_type);
+        let req = MessageRequest::FileContainingSymbol(extra_type.clone().into());
+        let resp = match client.send_reflection_request(req, metadata).await {
+            Ok(r) => r,
+            Err(e) => {
+                return Err(GenericError(format!(
+                    "Error sending reflection request for @type \"{extra_type}\": {e:?}",
+                )));
+            }
+        };
+        let files = match resp {
+            MessageResponse::FileDescriptorResponse(resp) => resp.file_descriptor_proto,
+            _ => panic!("Expected a FileDescriptorResponse variant"),
+        };
+
+        {
+            let mut guard = pool.write().await;
+            add_file_descriptors_to_pool(files, &mut *guard, &mut client, metadata).await;
+        }
+    }
+
+    Ok(())
+}
+
+pub(crate) async fn reflect_types_for_dynamic_message(
+    pool: Arc<RwLock<DescriptorPool>>,
+    uri: &Uri,
+    message: &DynamicMessage,
+    metadata: &BTreeMap<String, String>,
+    client_cert: Option<ClientCertificateConfig>,
+    max_message_size: usize,
+) -> Result<()> {
+    let mut extra_types = HashSet::new();
+    collect_any_types_from_dynamic_message(message, &mut extra_types);
+
+    if extra_types.is_empty() {
+        return Ok(());
+    }
+
+    let mut client = AutoReflectionClient::new(uri, false, client_cert, max_message_size)?;
+    for extra_type in extra_types {
+        {
+            let guard = pool.read().await;
+            if guard.get_message_by_name(&extra_type).is_some() {
+                continue;
+            }
+        }
+        info!("Adding response file descriptor for {:?} from reflection", extra_type);
+        let req = MessageRequest::FileContainingSymbol(extra_type.clone().into());
+        let resp = match client.send_reflection_request(req, metadata).await {
+            Ok(r) => r,
+            Err(e) => {
+                return Err(GenericError(format!(
+                    "Error sending reflection request for response @type \"{extra_type}\": {e:?}",
+                )));
+            }
+        };
+        let files = match resp {
+            MessageResponse::FileDescriptorResponse(resp) => resp.file_descriptor_proto,
+            _ => panic!("Expected a FileDescriptorResponse variant"),
+        };
+
+        {
+            let mut guard = pool.write().await;
+            add_file_descriptors_to_pool(files, &mut *guard, &mut client, metadata).await;
+        }
+    }
+
+    Ok(())
+}
+
+fn collect_any_types_from_dynamic_message(message: &DynamicMessage, out: &mut HashSet<String>) {
+    if message.descriptor().full_name() == "google.protobuf.Any" {
+        if let Some(Value::String(type_url)) = message.get_field_by_name("type_url").as_deref() {
+            if let Some(full_name) = type_url.rsplit_once('/').map(|(_, name)| name) {
+                out.insert(full_name.to_string());
+            }
+        }
+    }
+
+    for (_, value) in message.fields() {
+        collect_any_types_from_value(value, out);
+    }
+}
+
+fn collect_any_types_from_value(value: &Value, out: &mut HashSet<String>) {
+    match value {
+        Value::Message(message) => collect_any_types_from_dynamic_message(message, out),
+        Value::List(values) => {
+            for value in values {
+                collect_any_types_from_value(value, out);
+            }
+        }
+        Value::Map(values) => {
+            for value in values.values() {
+                collect_any_types_from_value(value, out);
+            }
+        }
+        _ => {}
+    }
+}
+
+#[async_recursion]
+pub(crate) async fn add_file_descriptors_to_pool(
+    fds: Vec<Vec<u8>>,
+    pool: &mut DescriptorPool,
+    client: &mut AutoReflectionClient,
+    metadata: &BTreeMap<String, String>,
+) {
+    let mut topo_sort = topology::SimpleTopoSort::new();
+    let mut fd_mapping = std::collections::HashMap::with_capacity(fds.len());
+
+    for fd in fds {
+        let fdp = FileDescriptorProto::decode(fd.deref()).unwrap();
+
+        topo_sort.insert(fdp.name().to_string(), fdp.dependency.clone());
+        fd_mapping.insert(fdp.name().to_string(), fdp);
+    }
+
+    for node in topo_sort {
+        match node {
+            Ok(node) => {
+                if let Some(fdp) = fd_mapping.remove(&node) {
+                    pool.add_file_descriptor_proto(fdp).expect("add file descriptor proto");
+                } else {
+                    file_descriptor_set_by_filename(node.as_str(), pool, client, metadata).await;
+                }
+            }
+            Err(_) => panic!("proto file got cycle!"),
+        }
+    }
+}
+
+async fn file_descriptor_set_by_filename(
+    filename: &str,
+    pool: &mut DescriptorPool,
+    client: &mut AutoReflectionClient,
+    metadata: &BTreeMap<String, String>,
+) {
+    // We already fetched this file
+    if let Some(_) = pool.get_file_by_name(filename) {
+        return;
+    }
+
+    let msg = MessageRequest::FileByFilename(filename.into());
+    let response = client.send_reflection_request(msg, metadata).await;
+    let file_descriptor_response = match response {
+        Ok(MessageResponse::FileDescriptorResponse(resp)) => resp,
+        Ok(_) => {
+            panic!("Expected a FileDescriptorResponse variant")
+        }
+        Err(e) => {
+            warn!("Error fetching file descriptor for {}: {:?}", filename, e);
+            return;
+        }
+    };
+
+    add_file_descriptors_to_pool(
+        file_descriptor_response.file_descriptor_proto,
+        pool,
+        client,
+        metadata,
+    )
+    .await;
+}
+
+pub fn method_desc_to_path(md: &MethodDescriptor) -> PathAndQuery {
+    let full_name = md.full_name();
+    let (namespace, method_name) = full_name
+        .rsplit_once('.')
+        .ok_or_else(|| anyhow!("invalid method path"))
+        .expect("invalid method path");
+    PathAndQuery::from_str(&format!("/{}/{}", namespace, method_name)).expect("invalid method path")
+}
+
+mod topology {
+    use std::collections::{HashMap, HashSet};
+
+    pub struct SimpleTopoSort<T> {
+        out_graph: HashMap<T, HashSet<T>>,
+        in_graph: HashMap<T, HashSet<T>>,
+    }
+
+    impl<T> SimpleTopoSort<T>
+    where
+        T: Eq + std::hash::Hash + Clone,
+    {
+        pub fn new() -> Self {
+            SimpleTopoSort { out_graph: HashMap::new(), in_graph: HashMap::new() }
+        }
+
+        pub fn insert<I: IntoIterator<Item = T>>(&mut self, node: T, deps: I) {
+            self.out_graph.entry(node.clone()).or_insert(HashSet::new());
+            for dep in deps {
+                self.out_graph.entry(node.clone()).or_insert(HashSet::new()).insert(dep.clone());
+                self.in_graph.entry(dep.clone()).or_insert(HashSet::new()).insert(node.clone());
+            }
+        }
+    }
+
+    impl<T> IntoIterator for SimpleTopoSort<T>
+    where
+        T: Eq + std::hash::Hash + Clone,
+    {
+        type Item = <SimpleTopoSortIter<T> as Iterator>::Item;
+        type IntoIter = SimpleTopoSortIter<T>;
+
+        fn into_iter(self) -> Self::IntoIter {
+            SimpleTopoSortIter::new(self)
+        }
+    }
+
+    pub struct SimpleTopoSortIter<T> {
+        data: SimpleTopoSort<T>,
+        zero_indegree: Vec<T>,
+    }
+
+    impl<T> SimpleTopoSortIter<T>
+    where
+        T: Eq + std::hash::Hash + Clone,
+    {
+        pub fn new(data: SimpleTopoSort<T>) -> Self {
+            let mut zero_indegree = Vec::new();
+            for (node, _) in data.in_graph.iter() {
+                if !data.out_graph.contains_key(node) {
+                    zero_indegree.push(node.clone());
+                }
+            }
+            for (node, deps) in data.out_graph.iter() {
+                if deps.is_empty() {
+                    zero_indegree.push(node.clone());
+                }
+            }
+
+            SimpleTopoSortIter { data, zero_indegree }
+        }
+    }
+
+    impl<T> Iterator for SimpleTopoSortIter<T>
+    where
+        T: Eq + std::hash::Hash + Clone,
+    {
+        type Item = Result<T, &'static str>;
+
+        fn next(&mut self) -> Option<Self::Item> {
+            if self.zero_indegree.is_empty() {
+                if self.data.out_graph.is_empty() {
+                    return None;
+                }
+                return Some(Err("Cycle detected"));
+            }
+
+            let node = self.zero_indegree.pop().unwrap();
+            if let Some(parents) = self.data.in_graph.get(&node) {
+                for parent in parents.iter() {
+                    let deps = self.data.out_graph.get_mut(parent).unwrap();
+                    deps.remove(&node);
+                    if deps.is_empty() {
+                        self.zero_indegree.push(parent.clone());
+                    }
+                }
+            }
+            self.data.out_graph.remove(&node);
+
+            Some(Ok(node))
+        }
+    }
+
+    #[test]
+    fn test_sort() {
+        {
+            let mut topo_sort = SimpleTopoSort::new();
+            topo_sort.insert("a", []);
+
+            for node in topo_sort {
+                match node {
+                    Ok(n) => assert_eq!(n, "a"),
+                    Err(e) => panic!("err {}", e),
+                }
+            }
+        }
+
+        {
+            let mut topo_sort = SimpleTopoSort::new();
+            topo_sort.insert("a", ["b"]);
+            topo_sort.insert("b", []);
+
+            let mut iter = topo_sort.into_iter();
+            match iter.next() {
+                Some(Ok(n)) => assert_eq!(n, "b"),
+                _ => panic!("err"),
+            }
+            match iter.next() {
+                Some(Ok(n)) => assert_eq!(n, "a"),
+                _ => panic!("err"),
+            }
+            assert_eq!(iter.next(), None);
+        }
+    }
+}
+
+fn find_parent_proto_dir(start_path: impl AsRef<Path>) -> Option<PathBuf> {
+    let mut dir = start_path.as_ref().canonicalize().ok()?;
+
+    loop {
+        if let Some(name) = dir.file_name().and_then(|n| n.to_str()) {
+            if name == "proto" {
+                return Some(dir);
+            }
+        }
+
+        let parent = dir.parent()?;
+        if parent == dir {
+            return None; // Reached root
+        }
+
+        dir = parent.to_path_buf();
+    }
+}

crates/yaak-grpc/src/transport.rs

@@ -0,0 +1,40 @@
+use crate::error::Result;
+use hyper_rustls::{HttpsConnector, HttpsConnectorBuilder};
+use hyper_util::client::legacy::Client;
+use hyper_util::client::legacy::connect::HttpConnector;
+use hyper_util::rt::TokioExecutor;
+use log::info;
+use tonic::body::Body;
+use yaak_tls::{ClientCertificateConfig, get_tls_config};
+
+// I think ALPN breaks this because we're specifying http2_only
+const WITH_ALPN: bool = false;
+
+pub(crate) fn get_transport(
+    validate_certificates: bool,
+    client_cert: Option<ClientCertificateConfig>,
+) -> Result<Client<HttpsConnector<HttpConnector>, Body>> {
+    let tls_config = get_tls_config(validate_certificates, WITH_ALPN, client_cert.clone())?;
+
+    let mut http = HttpConnector::new();
+    http.enforce_http(false);
+
+    let connector = HttpsConnectorBuilder::new()
+        .with_tls_config(tls_config)
+        .https_or_http()
+        .enable_http2()
+        .build();
+
+    let client = Client::builder(TokioExecutor::new())
+        .pool_max_idle_per_host(0)
+        .http2_only(true)
+        .build(connector);
+
+    info!(
+        "Created gRPC client validate_certs={} client_cert={}",
+        validate_certificates,
+        client_cert.is_some()
+    );
+
+    Ok(client)
+}