Fetchpier 0.9.6

[0.9.6] - 2026-11-04

The command-line interface becomes reliable in continuous integration, and the
desktop app gains the engine changes that make that possible. Several of these
change behavior on purpose; they are marked Behavior change.

Fixed

• Values set by a script now reach the next request of a run. A token a login
  request stores with fp.environment.set is used by the authenticated call that
  follows; fp.environment.remove is carried the same way. It was dropped, so the
  call failed with a 401.
• Secrets no longer leak through scripts. What a script logs, a test's name,
  a failed assertion's message and a script error now show a secret as
  {secret:<name>} in the terminal, every report, the run history and the
  desktop's script console — including a value a script itself writes under a
  secret variable's name.
• Binary request bodies are sent by the command line. A request whose body
  is an attached file used to go out with an empty body. A missing file, or a
  reference in the request file that is not valid, now fails that request as
  "not run" instead of sending it empty. (Behavior change)
• Compressed responses are decoded (gzip, deflate, br) on both the
  desktop and the command line, so assertions and the viewer read the real
  body. A body that cannot be decoded is kept as received, with a warning, and
  fp.response.json() fails with that cause. The activity log records a decoded
  compressed text response as text.
• Runs that did nothing no longer pass. A target folder with no request
  stops the run with exit code 19 (Behavior change).
• Values the command line could not honour are refused. --timeout and
  --delay accept whole numbers from 0 to 2147483647; anything else is a
  usage error (exit 3) instead of being ignored. (Behavior change)
• Unreadable configuration stops the run. An unparseable
  .fetchpier/settings.json, or an unparseable config.json for the selected
  environment, exits with code 4 naming the file, instead of running with
  defaults (which dropped the TLS settings) or reporting the environment as
  missing. fp env list warns about unreadable environments. An environment
  file that parses but lacks a name or id (or whose variables is not an
  object) counts as unreadable too: it used to crash every fp run and
  fp env list in the workspace with an internal error, even when another
  environment was selected. (Behavior change)
• The terminal shows the environment by its folder name instead of its internal
  identifier, -v / -vv / -vvv now add detail, and script output (fp.log)
  is shown in runs of several files.
• An expired timeout is reported as timed out after <limit> on both surfaces,
  not as a cancellation.
• No internal diagnostic lines ([execute] …, [parser] …) reach the output;
  they are warnings, also in the JSON report with a stable code.
• The default User-Agent no longer advertises version 0.1.0.
• The "Did you mean …?" hint for a missing path is correct when the current
  directory or the workspace is reached through a symbolic link (as macOS's
  temporary folders are); it used to suggest a path climbing to the root.

Added

• Proxy support for the command line: HTTPS_PROXY / HTTP_PROXY /
  NO_PROXY, --proxy <url> and --no-proxy. The header names the proxy and
  the exclusion list; at -v each request says whether it went through the
  proxy or directly. An unusable proxy URL stops the run (exit 3).
• --persist-env saves script variable changes to the local values exactly
  as the desktop does. Without it a run writes nothing to the workspace.
• Redaction of credentials and cookies in the command line's terminal output
  and reports: the API-key auth credential (query or header) and Cookie /
  Set-Cookie values, in addition to Authorization. --show-secrets reveals
  them. The run history (--save-history) is unchanged.
• A warning when a variable a request uses comes from a {{$env.NAME}} that is
  not defined anywhere, so it was sent empty.
• Advisories that used to be log lines are now shown: a cookie jar or TLS
  material that could not be used, an HTTP/2 downgrade, a replaced multipart
  Content-Type, a script write that could not be saved — in the command line's
  warnings and, on the desktop, in a dismissible notice above the response.
• The JSON report gains optional fields: environmentName, and per response
  compressedBytes, decompressedBytes and decodingStatus; per request
  notRun and via. Its version stays 1.0. Scripts gain
  fp.response.decodingStatus.
• The response viewer shows both the received and the decoded size of a
  compressed response, and flags a body that could not be decoded.

Changed

• Default per-request timeout of 30 seconds on the command line (the
  desktop's default). --timeout 0 is the only way to disable it. (Behavior change)
• Accept-Encoding: gzip, deflate, br is sent by default on both surfaces
  when a request does not set it. (Behavior change)
• Default User-Agent: Fetchpier/<app version> from the desktop and
  Fetchpier-CLI/<CLI version> from the command line, applied at send time and
  never written into request files; both defaults show in the headers editor as
  read-only rows. A value already saved in a file is still sent as written.
  (Behavior change)
• A request that got no response reads no response: <reason> when a send was
  attempted and not run: <reason> when it was not; the JUnit test case is
  renamed from request not sent accordingly. (Behavior change)
• A value a script sets wins over --env-var from that point on.
• The CLI reference documents TLS configuration, missing-variable behavior, the
  limits of secret masking, that the history keeps cookie values, and that the
  CLI may align an environment's display name with its folder.

[0.9.5] - 2026-11-04

Command-line interface fixes and publication readiness for @fetchpier/cli.

Fixed

• fp run with no path now runs every request under the workspace's
  requests/ folder from any directory — a subfolder of the workspace, or
  from outside it with --workspace or FETCHPIER_WORKSPACE. It used to work
  only from the workspace root and otherwise failed with "Path not found".
• The command fp init suggests at the end (fp run --workspace <name>, or
  fp run when initializing the current folder) now works as printed; the
  previous suggestion failed when copied from the same directory.
• --bail now also stops after a request that got no response (unreachable
  host, refused connection, timeout, TLS failure), not only after a failed
  test or script error — the same rule the exit code already applied.
• The npm package is always built from the sources being packed or published,
  instead of shipping whatever the last local build left in place.

Added

• When a path given to fp run does not exist in the current directory but
  does inside the workspace, the error suggests the path to type instead.
• The npm package ships the license notices of the third-party code bundled
  into it.

Changed

• The CLI reference (the package README) was rewritten to match the tool: the
  real Node.js minimum (22.19), which commands need a workspace, every flag and
  exit code, the environment variables it reads, using secrets in CI, and CI
  examples that work as written. The CLI examples in the project README were
  corrected to match.