Reqit

An API client for VS Code. Everything is stored as plain JSON files in a .runner/ folder inside the opened workspace, so teams share and review collections through git like any other code.

• No accounts, no external servers, no telemetry.
• HTTP requests are sent from the extension host (Node, undici), so CORS never applies.
• One file per request, deterministic JSON: clean diffs and few merge conflicts.

Features

Collections and requests (v0.1)

• runner view in the Activity Bar: collections, folders and requests, with HTTP method icons.
• Commands and context menus: New Collection / Folder / Request, Rename, Duplicate, Delete (to trash), Refresh, Edit Settings (JSON).
• Request editor webview, one panel per request, restored after a window reload (unsaved drafts included).
  • Method, URL, tabs for Params, Headers, Body, Auth, Vars, Tests and Notes.
  • URL query string and Params table stay in sync both ways.
  • Ctrl/Cmd+Enter sends, Ctrl/Cmd+S saves; the tab title shows ● while there are unsaved changes.
  • Changing the request name renames the file on save.
• Body types: none, JSON (editor with line numbers and the same colouring as the response), x-www-form-urlencoded, multipart/form-data (text and file fields), raw (custom Content-Type), GraphQL.
• Auth: inherit auth from parent, none, bearer, basic, API key (header or query). With Inherit auth from parent, the Auth tab shows which folder or collection the auth comes from, its type and values (literal secrets masked, {{variables}} shown), and an Edit auth in … link that opens a form to change that folder's or collection's auth in place (saved to its folder.json / collection.json; Open JSON opens the file).
• Response viewer: status, time, size, headers, body with pretty-print (JSON with colouring, XML, HTML), raw view, copy, save to file. Binary responses can be saved.
• Response body shows line numbers; pretty JSON objects and arrays can be folded (gutter arrows, Collapse all / Expand all).
• Drag the handle between the request and response panes to resize the request pane (arrow keys when focused; double-click or Enter resets).
• Clear errors for DNS failures, timeouts, TLS problems, refused/reset connections and cancellation. Requests can be cancelled.

Environments, variables and secrets (v0.2)

• Create, edit and delete environments. Pick the active one from the status bar (stored in workspace state, never committed).
• {{variable}} substitution in URL, params, headers, body and auth. Resolution order: request > folder > collection > environment > global. Variables can reference other variables.
• Unresolved variables are highlighted red; hover a field to see resolved values (secrets masked).
• Variables marked secret keep their value only in .runner/.secrets.local.json (gitignored). The committed environment file keeps the key with an empty value.
• File watcher on .runner/**: after git pull, a branch switch or a manual edit, the tree refreshes and open editors reload. If an editor has unsaved changes you get Reload / Keep mine / Compare.
• Response history per request is still saved in .runner/.history/ (gitignored), capped by runner.historyLimit; the editor no longer shows it.

Collaboration through git (v0.3)

• Notes tab: add notes, reply, resolve/reopen, delete your own notes. Notes are written to the request file immediately. Author comes from git config user.name/email (or a one-time prompt, remembered).
• Tree items show the number of unresolved notes for requests, folders and collections.
• The view title shows the current branch and the number of changed files under .runner/.
• Commit & Push Collection stages only .runner/ (git skips the gitignored secrets/history), asks for a message (default chore(runner): update <request names>), commits only those paths, and pushes (sets upstream on first push).
• Pull runs git pull and, when .runner/ files end up in conflict, offers to open them.
• Uncommitted files get a git decoration (M, U, ...) in the tree; folders with changes get a dot.
• The request editor shows who last changed the file (git log -1).

Postman interoperability and tests (v0.4)

• runner: Import from Postman: Postman Collection v2.1 and Postman Environment files. Folders, requests, headers, params, path variables, body modes, auth and variables are mapped. Simple pm.test / pm.expect / pm.response.to.have.* assertions become declarative assertions, pm.environment.set(..., jsonData.x) becomes an extract rule. An import report lists everything that was not converted.
• Export to Postman (collection context menu): Postman Collection v2.1; assertions and extract rules are exported as equivalent test scripts.
• Assertions (tests in the request JSON; there is no Tests tab in the editor): run after every send and in the collection runner: status equals, status in range (200-299 or 2xx), response time below, header exists/equals, body contains, JSON path equals/exists/type.
• Extract rules: copy a JSON path from the response into the active environment (e.g. token = $.data.token) for request chaining.
• Run a collection or folder: requests run sequentially in a results panel with pass/fail summary and timing; export the report as JSON.

Folder layout

.runner/
  config.json                    # { schemaVersion, globals: [...] }  global variables
  collections/
    <collection-slug>/
      collection.json            # name, description, headers, auth, variables, order
      <request-slug>.json        # one file per request
      <folder-slug>/
        folder.json              # name, description, auth, variables, order
        <request-slug>.json
  environments/
    <env-slug>.json              # shared, committed, non-secret values
  .secrets.local.json            # gitignored: secret values per environment id
  .history/                      # gitignored: response history per request id

On first activation runner creates .runner/ and appends .runner/.secrets.local.json and .runner/.history/ to the workspace .gitignore (created if missing, lines never duplicated).

Every file has "schemaVersion": 1. JSON is written with 2-space indentation, \n line endings, a trailing newline and stable key order (schemaVersion, id, name, type first, then alphabetical), so the same content always produces the same bytes.

Request file

{
  "schemaVersion": 1,
  "id": "6f1c...",
  "name": "Get User",
  "auth": { "type": "inherit" },
  "body": { "type": "none", "content": "" },
  "description": "",
  "extract": [{ "id": "...", "enabled": true, "path": "$.data.token", "variable": "token" }],
  "headers": [{ "enabled": true, "key": "Accept", "value": "application/json" }],
  "method": "GET",
  "notes": [],
  "params": [{ "enabled": true, "key": "expand", "value": "owner" }],
  "tests": [{ "id": "...", "type": "statusEquals", "enabled": true, "expected": "200" }],
  "url": "{{baseUrl}}/users/{{userId}}?expand=owner",
  "variables": []
}

Settings

Development

npm install
npm run build        # bundles dist/extension.js and dist/webview.js
npm run watch        # rebuild on change
npm run typecheck    # strict TypeScript for host and webview
npm run lint         # ESLint
npm test             # vitest unit tests

Press F5 in VS Code (.vscode/launch.json) to start an Extension Development Host.

Architecture

Assumptions and limitations

• Multi-root workspaces: runner uses the first workspace folder.
• auth.type has an extra value inherit (default for new requests) so collection/folder auth can apply; collections default to none.
• Folders have an optional folder.json (name, description, auth, variables, order). Collection headers apply to every request; folders have no headers.
• Display/run order is stored in order arrays in collection.json / folder.json; unlisted entries sort by name.
• Collection, folder and global variables, collection headers and collection/folder auth are edited as JSON ("Edit Settings (JSON)", .runner/config.json). Only environments have a table editor, because secrets need special handling.
• Secrets are stored in .runner/.secrets.local.json, not VS Code SecretStorage, so they are visible and easy to back up locally.
• Extract rules write into the active environment. New variables created by extraction are marked secret, so tokens stay local. Without an active environment the value is not stored and the result says so.
• Query values are kept verbatim in the editor; at send time characters that are not URL-safe are percent-encoded while existing %XX escapes are kept. A param without a value is written as key (not key=).
• Multi-line fields (body, GraphQL) list their variables under the editor instead of highlighting inline.
• Postman: pre-request scripts, folder/collection scripts, OAuth/Digest/AWS auth and file body mode are not imported (listed in the import report). JSON schema assertions are not implemented (optional in the spec).
• Notes can only be deleted by their author (matched by email, or name when the note has no email); deleting a note also deletes its replies.