Baixar Vayu 0.19.0 per a Windows

0.19.0 - 2026-08-19
The agents and transport release. Two epics land side by side. MCP stops being the read-mostly half of Vayu: an agent can now run a whole collection in design mode or under load, start and drive mock servers and webhook inboxes, create and switch environments, read and clear the cookie jar, write a saved request's auth and every Settings field, curate its examples, and keep run history - roughly thirty new tools over routes the engine already had. Underneath, the engine gains one transport policy that every outbound path inherits, carrying manual proxies, pasted CA anchors, per-request verifySSL and a per-host client-certificate registry, so an internal or mTLS-protected API is callable at all. The OpenAPI work 0.18.0 started gets its follow-through - a bound spec is described rather than transferred, a document-level change is applyable, and orphaned documents are reclaimed - and the dialog primitive learns to fit on a screen. The bulk of the change is new TypeScript in the app's MCP server and new C++ in the engine's transport layer.
Added
- One transport policy, and a manual proxy on every outbound path. The engine had proxy readers and no writer: proxy_url sat in two config structs that nothing ever assigned, SSE had no proxy option at all, and the only proxying Vayu did was libcurl's implicit environment pickup, which a desktop launch never sees. TransportPolicy is resolved from settings at the point of use and applied by one function for all three drivers, so a transport option cannot land on two paths and miss the third - which is exactly how SSE never got a proxy. Design sends, pm.sendRequest, load runs, collection runs, SSE streams, the OAuth token fetch, /import/fetch and the monitor scrape all inherit it, and the load and collection paths read it once per run because libcurl only reuses a pooled connection when its proxy config matches. Modes are environment (today's behaviour, named), manual and off, where off genuinely disables the env pickup; manual always writes the bypass list, empty or not, since libcurl consults the ambient no_proxy whenever CURLOPT_NOPROXY is unset. A refused CONNECT becomes ErrorCode::ProxyError rather than a plain receive error, read off CURLINFO_HTTP_CONNECTCODE - the only place a 407 survives.
- Custom CA certificates, and verifySSL end to end. A new customCaCertificates setting takes pasted PEM anchors, validates them, materializes a bundle beside the database and hands its path to the one applier, so the anchors reach every path the policy does. They extend the platform's rather than replacing them: on an OpenSSL build CURLOPT_CAINFO is the whole trust store, so the file is the system anchors plus the pasted ones, while Schannel and Apple SecTrust keep their OS store and the engine sets NATIVE_CA beside the bundle. A backend that refuses the option is named in the log rather than failing every later request with nothing saying why. verifySSL becomes a real column on requests carried through both serializers, POST /compose, the replay path and a Settings toggle that paints a warning while verification is off - never elided at its default, because a dropped false verifies the certificate the user opted out for. curl -k and wget's --no-check-certificate now import as that setting instead of being skipped, and the curl generator emits -k back.
- Client certificates (mTLS) as a per-host registry. Nothing in the engine ever set CURLOPT_SSLCERT, so an mTLS endpoint was uncallable. A certificate is a property of where you are calling rather than of one request - the transfer that needs it is as often a token fetch, a redirect or a script's pm.sendRequest - so this is a registry keyed by host and port, applied by the engine, and no request names a certificate. The private key never enters the database (paths are stored, and both are checked at write time, since an unreadable one otherwise surfaces at handshake as an SSL error that reads like "the API is broken"), one entry per host+port pair, and a match is exact with port-specific beating catch-all and no wildcards. Settings > Network & connectivity gains the card; a cert-authenticated exchange carries the matched entry through both design funnels and shows a chip on the response status bar.
- Run a collection from MCP, in design mode or under load. run_collection starts the same design-mode runner the Run Collection dialog does - steps one at a time, sharing the environment's cookie jar, honouring pm.execution flow control, running stored scripts, repeating per data row - and start_load_run takes a scenario block to hand the same plan to the load executor. The allowlist gate is all-or-nothing here: every step is composed by id and gated before the run row exists, so one step off the allowlist refuses the whole run with nothing sent, naming the step the engine would have reached first. Modes that cannot drive a sequence (capacity, constant_rps, any non-zero targetRps) are refused with the engine's own reasoning, and every argument describing a single target is refused by name beside a scenario rather than being silently unread.
- Mock servers and webhook inboxes over MCP. The examples-driven mock server and the webhook inbox both shipped without an agent surface, which left their one agent loop - start a listener, trigger the sender, assert on what arrived - unreachable. Twelve tools cover lifecycle, routes, captures and live editing: update_mock_issuer and update_inbox_response merge-patch a running service, so an agent testing retry behaviour flips the failure mode instead of destroying and recreating an issuer, which would invalidate the token URL the request under test points at. Every listener the engine binds is loopback with no host to configure, and inboxStartPayload never emits bind whatever the arguments carry. A started mock that has nothing mappable answers 404s, so the counts the engine already reports become a sentence on the result rather than something to spot in the JSON.
- Environments, globals and the cookie jar over MCP. An agent could merge values into an environment that already existed and nothing else. Seven tools add create, activate and delete, globals read and write, and the cookie jar's read and scoped clear, while update_environment gains a per-variable {value, secret, type, enabled} form and a removeVariables list. Both blobs merge through one implementation because both are replaced wholesale engine-side: a field the call did not state keeps its stored value, so a rotated secret stays masked. A variable with no stored value must carry one, so {secret: true} against a mistyped name is an error rather than a new empty secret; a name in both variables and removeVariables is refused, because "set it and delete it" has no correct order; and a removal that found nothing is a note, not an error, so a retried call cannot fail on its own success.
- Saved-request parity: auth, every Settings field, and example CRUD. create_request and update_request now take the request's auth block and all five Settings fields (followRedirects, maxRedirects, httpVersion, stream, verifySSL), on the merge-patch rule the strings already followed - which for verifySSL is a security rule rather than a convenience, since a defaulted true on an unrelated update would silently re-enable a check the user turned off. The auth input is run_request's own schema re-described rather than a copy, so an agent can write back verbatim what list_requests handed it. Examples get the CRUD the engine has had since 0.16.0, with origin the one field no tool accepts: a created example is always user, because a claimable origin would let an agent hand its own example to the next spec sync to overwrite. create_collection / update_collection reach variables, auth and both collection scripts, and move_item re-parents through POST /reorder - atomic against a concurrent move where a plain update is not - offering first / last only and refusing a collection into its own subtree.
- Run housekeeping over MCP. list_runs fetched the first 100 rows with no parameters; it now takes the engine's filters and paging, with type and status as real enums rather than passthrough strings, because GET /runs ignores one it cannot parse and a typo forwarded raw would answer the unfiltered page and read as "nothing matched anywhere". delete_run and set_run_baseline land the write half that was never shipped, and get_run_samples, get_run_timeseries and get_run_monitor open the captured data, defaulting well under the engine's own page sizes, refusing a limit past the cap rather than clamping it, and saying in words when a page has more behind it.
- Load-run recording knobs, OAuth 2.0 token tools and the scripting types. start_load_run takes successSamplePeriod, slowRequestThresholdMs, saveTimingBreakdown and comment, each named for what the value means rather than for the engine key it maps to, and all four reach a scenario run as well, since forwarding on one path would be a knob that silently does nothing on the other. fetch_oauth2_token, get_oauth2_token_status and clear_oauth2_token cover the token cache under two stated rules: no tool returns access-token bytes - the engine is what applies a token, so the bytes buy an agent nothing it can use through Vayu while turning a credential into something it can carry off the machine - and the authorization_code grant is refused before the engine is called, because acquire_token answers a cache hit before it looks at the grant. vayu://scripting/types re-serves the .d.ts the app's editor loads.