TestPion 0.50.0

Nothing is lost, nothing leaks: a workspace export now holds everything a workspace needs and never a secret, every import says what it could not bring over instead of guessing, and nothing you delete or import over is gone for good. (What's new in 0.50)

Behaviour changes: what works differently (read before upgrading)

• Exports never contain secrets (listed as replaced). A token typed into a collection's auth or a secret header, every MCP server header and stdio env value (except names such as Content-Type or NODE_ENV), a password in a connection string and a provider key become {{variables}} in the export (Bearer {{PETSTORE_MCP_AUTHORIZATION}}); an environment variable with a secret name or value that isn't marked secret is exported empty and marked secret. The message after export lists each one (replaced: [{ kind, item, field, variable }] with testpion workspace export --json), and the import lists the values needed. (Privacy: exports)
• Workspace exports include specs, datasets, mocks and protos. The export used to leave out specs/, datasets/, mocks/ and protos/ (and test files of 5 MB or more) without a word, so a re-imported workspace lost its contract checks, data-driven tests and MCP mocks. They are now in the file (text as text, a SQLite dataset as base64) and come back byte for byte; a file over 10 MB (or past 50 MB in all) is left out and named in the message (notes with --json). (Export the whole workspace)
• The export file is <workspace>.testpion.json (.apsworkspace.json files still import), and testpion workspace export no longer needs -o.
• Importing an API definition never overwrites. Importing an OpenAPI or AsyncAPI document whose name the workspace already has (a newer version) used to replace specs/<name> silently. It is now saved beside it as specs/<name>-2… with its contract checks, and the message says Saved as specs/x-2.yaml with Replace instead (the old document goes to Recently deleted). The same document imported again is reused. testpion import prints the same note; --replace-spec replaces at once.
• Deleting an MCP server has Undo instead of a question. In the Collections sidebar it goes at once, with Undo in the message, and comes back in its place with its settings, reconnected if it was connected.
• Imports never map an unsupported auth to inherit. A Postman, Insomnia, Bruno or Hoppscotch auth TestPion doesn't have (Hawk, NTLM, EdgeGrid, ASAP, WSSE, netrc, anything new) used to fall back to inherit, so the request quietly sent its parent's credentials. It now becomes No auth, with a disabled X-Imported-Auth-<Scheme> header as a reminder and a note naming the request. JWT auth (HS256/384/512) maps to TestPion's JWT auth; an OAuth 2 grant TestPion doesn't run (implicit, device) is imported as authorization code, with a note. (Import fidelity)
• Imported Bruno scripts use tp.*. bru.setVar → tp.collectionVariables.set, bru.getEnvVar → tp.environment.get …; req, res and test still run as in Bruno, and the import reports the scripts converted like a Postman import. A bru.* call TestPion lacks gets a // TODO(import) line and a note. A Bruno export writes the scripts back with bru.*.
• Every import note is shown. What did not map one to one is listed after every import: in the Import dialog and Workspace menu ▸ Import… (Check after import (N notes), the first notes and and N more), in testpion import (up to 20, --json lists them all) and in the MCP tool import_definition (notes).

Nothing lost

• Recently deleted keeps more: MCP servers and API definitions replaced by an import stay for 30 days beside collections, environments and datasets, with Restore (an MCP server back in its place in the list, an API definition at its path). The new Recently deleted icon beside the Filter box of the Collections sidebar lists collections, datasets, API definitions and MCP servers; testpion trash list|restore covers every kind.
• Sidebar rows no longer repeat or disappear when two collections share request ids. Imports, moves between collections and examples updates give fresh ids to requests whose id is already taken, and a second copy of an example collection left by an older version (such as two "Live streams (SSE)") is merged back into one, the copy kept in Recently deleted. Dragging a row shows one small chip and never leaves a ghost of the row behind.
• Workspace import checks every path the same way on every OS (no .., absolute or drive paths, backslashes, or folders other than specs/, datasets/, mocks/ and protos/) and names what it skipped.

Nothing leaked

• One secret detector now serves exports, testpion git check and the masks of logs and AI context: secret names plus value shapes with a confidence (JWT, Bearer/Basic, sk-, ghp_/github_pat_, glpat-, xox?-, AKIA/ASIA, AIza, SG., Twilio SK, npm_, pypi-, private keys, connection strings with a password). git check also flags an MCP server's headers and env together, and a variable holding a provider key or a password URL whatever its name.
• Bruno .env goes to the secret store. The collection's .env (only .env, never .env.example) is read: {{process.env.X}} becomes {{X}} in a Bruno .env environment (and each imported environment), the values go to the secret store, and missing ones are listed as values needed.

Imports that bring more over

• Insomnia v5 scripts and template tags. Request scripts of Insomnia 5 YAML files (scripts.preRequest / afterResponse) and folder scripts are imported; a plain JavaScript script stays runnable instead of being commented out. Template tags are no longer left as literal text: {% uuid %}, {% now %}, {% timestamp %} and {% faker %} become dynamic variables, {% base64 %} and {% hash %} a pre-request line, {% response %} of another request is chained (that request's post-response script sets a variable the request uses), {% prompt %} a variable to set; any other tag stays as text with a note naming the request. {{ _['a-b'] }} works, and folder headers are added to the requests inside, with a note.
• GraphQL SDL import. A GraphQL schema file (.graphql) imports as a GraphQL request for {{graphqlUrl}} with a ready operation for the first Query field; the schema is kept in specs/graphql/ (it used to fail with Unrecognised import format).
• What each importer maps, and what becomes a note, is on the new Import fidelity page.

Downloads

See the download page for which file to choose and the installation guides.

The installers aren't code-signed yet: Windows SmartScreen and macOS Gatekeeper ask you to confirm the first launch.