Skip to content

v2.1.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 29 May 05:37
· 89 commits to main since this release
v2.1.0
This tag was signed with the committer’s verified signature.
danielgtaylor Daniel G. Taylor
GPG key ID: 86BDECE71D7D2FA1
Verified
Learn about vigilant mode.
6f145c1
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Overview

Restish 2.1.0 focuses on making API setup easier to share, giving generated commands an optional local validation pass, and smoothing several OpenAPI, OAuth, pagination, and output edges. It also includes security hardening for MessagePack decoding and the web playground.

Trusted Project Config

Repositories can now carry shared, secret-free Restish setup in a discovered .restish.json file. Run:

restish config trust

Once trusted, project apis and theme settings layer over your global config for that working tree. Trust is stored outside the repository and includes the file's content hash, so Restish asks you to review and trust the project config again if it changes. Normal config-writing commands still write the global config and refuse to mutate project APIs, which keeps shared setup separate from local secrets.

Optional Generated Body Validation

Generated OpenAPI commands now accept --rsh-validate for JSON request bodies. Restish builds the request body from flags and arguments, then validates it against the operation schema before sending. This is intentionally opt-in: by default, Restish still sends what you ask for and lets the server enforce API-specific semantics.

Validation now carries JSON Schema dialect metadata through OpenAPI-generated commands and plugin messages, giving better behavior for OpenAPI 3.1/3.2-style schemas and clearer errors when a dialect is unsupported.

Page-Parameter Pagination

Restish can now paginate APIs that use a numeric query parameter instead of a next link:

{
  "apis": {
    "example": {
      "base_url": "https://api.example.com",
      "pagination": { "page_param": "page" }
    }
  }
}

This lets Restish increment the page parameter when responses are collections. Configured items_path and next_path handling is also stricter, so typos or mismatched response shapes fail loudly instead of silently truncating pagination.

OAuth Callback Improvements

Authorization-code OAuth callback pages now use the active Restish theme and can be customized with callback_success_html and callback_error_html. Providers that require HTTPS redirect URLs are supported with a local certificate/key via redirect_scheme: "https", redirect_cert, and redirect_key.

Relative OAuth endpoints are resolved more consistently, and callback details are kept local to the browser flow instead of being forwarded to authorization or token endpoints.

OpenAPI Discovery and Command Polish

api connect, api sync, and doctor api now summarize behavior-changing x-cli-* extensions so operators can see when a spec affects generated command names, hidden/ignored operations, aliases, prompts, or config defaults.

Other OpenAPI and generated-command fixes include honoring base_url for document servers, ignoring documentation-only description references, ignoring encodings on bodyless responses, preserving configured header casing, shortening generated fallback names with operation_base, and refreshing stale raw specs before rebuilding generated commands.

Security and Docs

The MessagePack decoder was updated to v3, and playground error rendering now avoids syntax highlighting untrusted error text. The documentation site and GitHub README also got refreshed social preview images and landing-page polish.

Changelog

  • a1c4443 feat(auth): theme OAuth callback pages
  • ffec6f6 feat(config): add trusted project config discovery
  • 0403d17 feat: add optional generated body validation
  • 7d35ecb feat: add page parameter pagination
  • ee28992 feat: carry JSON Schema dialect metadata
  • 8370bb1 feat: report OpenAPI x-cli extension effects
  • f59222e feat: support HTTPS OAuth callbacks
  • 28c2a20 fix(cli): color filtered TTY output
  • 2db9500 fix(config): address project cache review feedback
  • 943fc3b fix(config): address project config review nits
  • 1e98120 fix(config): allow shared project config without secrets
  • f969a82 fix(config): tighten project config review fixes
  • a394b6c fix(docs): reuse overview social image on home
  • af225fb fix(openapi): honor base_url for document servers
  • 8195f29 fix: align operation-base fallback lookups
  • be3754b fix: honor effective page param query
  • f8bf9f0 fix: ignore docs-only description refs
  • fedcd2e fix: ignore encodings on bodyless responses
  • e9f03e5 fix: keep page-param items_path strictness
  • e480fbf fix: merge main into relative OAuth endpoints
  • 96d8d97 fix: preserve configured header casing
  • cf41dbe fix: refine schema validation colors
  • 546c06b fix: refresh stale raw spec before generated commands
  • fc48164 fix: resolve relative OAuth endpoints
  • 26b6125 fix: reuse stale raw spec for generated commands
  • be17db7 fix: shorten generated fallback names with operation base
  • 7c9c3b5 fix: show complete schema validation errors
  • 7d6c627 fix: skip nested x-cli effects for ignored entries
  • ca6af63 fix: suppress unchanged config edit writes
  • e28ec87 refactor: replace interface{} with any (Go 1.18+ alias)
  • dfe0481 security: render playground errors without highlighting
  • 6074dfc security: update msgpack decoder to v3

Full Changelog: v2.0.0...v2.1.0

Assets 32
Loading