cli@1.6.0

1.6.0 (2026-10-11)

🚀 Features

• Onboarding fixes for flows run against local apps: (baead616)

  • Secure cookies are now sent to http://localhost, 127.0.0.1, ::1 and *.localhost, as browsers do, so a local dev server's Secure session cookie keeps the session alive. Other http:// hosts still never get them.
  • follow_redirects: false on a request step returns the 30x as is, so the redirect itself can be asserted. Every response now has response.url (the final URL after redirects) and response.redirects, e.g. '!(response.url contains "/login")'. The option survives YAML export; the desktop app doesn't store it yet.
  • {{ now() }} now writes an RFC 3339 timestamp (2026-10-11T15:59:15.978+03:00) instead of Go's internal time format. uuid(), ulid(), now().Unix() and faker.* are documented in the YAML README.
  • flow run reads ./.env and the flow file's directory's .env for {{ #env:NAME }} (the process environment wins), and before running lists every missing #env: name in one error instead of failing at the first step that reads one.

🩹 Fixes

• AI checks: with no judge provider configured, the judge uses OpenAI when OPENAI_API_KEY is the only key set (a configured provider, model, base_url or api_key_env still decides), and the no-key notice names both keys. A failing token check reports the budget that failed, not the first one, and ci summaries print > instead of ≤ when the p95 latency or max tokens is over its limit. (76e47463)

❤️ Thank You

• moosebay