Baixar Vayu 0.18.1 per a Windows

0.18.1 - 2026-08-17
A follow-up on the contract stack v0.18.0 shipped. That release bound a collection to the spec it came from and built coverage, schema validation and sync on that identity; this one makes those engage on the paths people actually take. A binding written at import carried no version, so both features were inert on nearly every binding that exists. Running a tag sub-collection - what an OpenAPI import files every request under - resolved no binding at all. A response declared as a $ref, the shape GitHub's public spec uses almost everywhere, yielded no schema while coverage counted the same status as declared. And a duplicated operationId let a sync rewrite a request into an operation it never was. Beside those: two engine execution fixes, a refusal of bound data that would forge a header line, and a full per-entry audit of the engine settings tree. No new surface.
Changed
- The engine settings tree got a per-entry audit. The previous pass fixed the shelves; this one audits every entry against the words a user arrives with. Sixteen rows move and a new Limits category holds the six ceilings a rejection message names - the scenario and spec caps, maxStepsPerIteration, and maxResponseBodyBytes, which fails an oversized load-run read in flight and so is not retention. Core was a dumping ground of twelve entries under a description covering four of them, and keeps those four. The oauth2Refresh* family joins Services, beside the issuers the category description already named; the per-run storage budgets join Data & retention; phaseHistograms moves to Observability, being a measurement toggle rather than a retention budget. Five entries gain the advanced flag by a rule citable in review: if a description has to say "only if" or "only for", the entry has declared itself advanced. The moves are seed metadata only - your values are kept and an existing install migrates on next start - and a new guard asserts every moved entry is still findable under the words it is searched with, since the category label is the one search field that does not travel with an entry.
Fixed
- An imported spec's binding carries a version, and bindings written without one are repaired. Import stored {"specId": "..."} and nothing else, while contract coverage and response-schema validation each require the binding's specHash to match the stored document's before they engage. An empty hash never matches, so every run of an imported collection took the mismatch branch and reported no contract at all - while telling the user their document had moved under the binding, which it had not. The hash is now the engine's half on every write path: a client sends the specId, the only half it can know without a round trip whose answer is stale by the time it writes it, and one rule fills in the rest for both collection write verbs, for /import/apply, and for a startup pass that repairs the rows written before the rule existed. That pass stamps the document's fetched_at rather than now, because stamping months-old rows with the current time would say you synced today. A hashless binding also stops masquerading as a document that moved: it gets its own reason, never_stamped, whose remedy is re-binding - a sync of an unchanged document short-circuits on byte equality without touching the binding, so "sync the collection" was advice that could not have worked.
- Running a tag sub-collection of a spec-bound tree measures coverage and validates again. An OpenAPI import binds the root collection and files every request under tag sub-collections, so the most natural workflow - right-click the pets folder, Run collection - resolved no binding, measured no coverage and validated nothing, silently. The run path read the openapi column of only the collection the run named, while design-mode validation of the same request walked the ancestry to the nearest bound collection; both now resolve through one function over the chain request composition already walks for inherited auth, and the design path's inline copy of that walk is gone rather than kept in step by hand. A scoped run is measured against the whole document while enumerating one subtree, which is what running one tag folder means, so the manifest marks a binding inherited from an ancestor and the coverage block says so - "4 / 618 operations" now reads as the scope of the run rather than as an API nobody is calling.
- Response schemas are extracted through a response-level $ref. A response written as {"$ref": "#/components/responses/X"} carries no content, so the extractor stepped over it and emitted no schema. Validation then reported no_schema_for_status - "the spec declares no response for this status" - about a status the document declares plainly, while coverage, which reads the status keys and never needed the ref, counted that same status as declared: two features contradicting each other about one document on one run. Both the OpenAPI 3 and Swagger 2.0 extractors now resolve the entry before reading it, one hop, the resolved response flowing through the existing media-type logic unchanged. Existing bindings keep the index they were stored with until the document is stored again, and a byte-identical "Check for changes" stops at unchanged, so the remedy for an already-imported collection is a re-bind.
- A duplicated operationId is no longer taken as an identity. A document declaring one id on two operations is invalid OpenAPI and common in generated specs, and Vayu turned it into local corruption: the import stamped the id on both requests and the sync diff followed it unconditionally, so the request bound to the second declaration resolved to the first's draft, read as a rename, and a default-ticked apply rewrote its method, url and operation to one it never was. Import now claims one identity per operation - a repeated id stays with its first declaration, later ones are identified by method and path, and each drop is counted as a duplicate_operation_id skip the preview names. The diff no longer follows an id that means two things: an id more than one request claims (the stamp left behind by an import before this fix) is skipped, and an id whose entry contradicts the request's own method and path loses to an exact match on those. An id with no exact match to lose to is still followed, which is the ordinary rename.
- A load run's deferred scripts see the run's real variables. The deferred tests script, and a scenario load run's per-step script, ran against a freshly constructed empty environment with no globals and no collection scope, so pm.environment.get('x') read undefined under load for a variable that resolves on every Send with the same environment selected. A test comparing a response against a variable therefore failed on every sampled replay, and the report described the target as broken when only the harness was. The replay now binds the run's environment, the globals and the collection chain through one function, so it cannot re-derive which scope is writable; writes are read-your-own-writes within the pass and are never persisted, since a reservoir sample is not an iteration.
- A buffered send's test results survive into History. POST /execute returned testResults, console logs and the two script errors in its body and stored none of them, because the trace's scripts node was written only when a streaming record was present. Restoring that run from History showed the Tests pane's empty state, so a send whose assertions all passed was indistinguishable from one that never ran any. The node is a property of the execution rather than of the transport, so the buffered handler now builds it once and hands the same object to the response body and to the trace.
Security
- A bound data cell can no longer forge a header line. Header names and values bound as verbatim plain text, so a JSON or JSONL cell holding ok\r\nX-Admin: true did not sit in the header - it ended the header line and made the remainder a header of its own. Those formats keep native strings, so no CSV grammar had stripped the newline on the way in, and the engine's wire gate filtered all-whitespace values only. Headers now bind under their own context and a value carrying CR or LF is refused, naming the column and the row. It is a refusal rather than an encoding because a header has no escape for a line break: every candidate encoding either changes the value or leaves the line ended. The same rule reaches the credentials auth writes into a header line, which are as forgeable and are what a credentials file most often binds - a bearer token and both halves of a header api key are header text, while basic auth's pair and a query api key are encoded before they reach the wire and bind unchanged.