Release version 0.23.0; add native raw WebSocket and Socket.IO workspaces with saved connection definitions, multi-tab session management, reconnect controls, message composers, and bounded transcripts. Integrate realtime workflows with collections, import/export, MCP authoring, settings, and shared design-system components. Refresh documentation, website workflows, screenshots, tests, and release metadata.

Author: tansdf

.gitignore

@@ -4,6 +4,8 @@ node_modules/
 .pnpm-store/
 .svelte-kit/
 .vite/
+playwright-report/
+test-results/
 
 # Build output
 build/*

AGENTS.md

@@ -12,7 +12,7 @@ PostNot is a local-first desktop API client built with:
 - TypeScript
 - SQLite
 
-The app already supports request execution, resolved request preview before send, full response body reads, history, collections with nested folders and drag-and-drop request/folder moves, sidebar collection search, playbooks for sequential saved-request execution, environments, secret environment storage, import/export flows including OpenAPI 3 import, broader cURL flag coverage, redacted-by-default single-request cURL/JSON export with optional non-secret environment variable inclusion, OAuth2 bearer auth helpers with client-credentials token fetch, notifications, settings, signed in-app update checks with download progress, inherited collection/folder/saved-request pre-request and test scripts (worker-backed frontend JavaScript execution around the native send), async script helper requests through `pn.http.send(...)`, script-driven active-environment variable writes, and a local authoring-only MCP server with Agent Activity.
+The app already supports request execution, resolved request preview before send, full response body reads, history, collections with nested folders and drag-and-drop request/folder moves, sidebar collection search, raw WebSocket and Socket.IO connection workspaces with session-only transcripts, playbooks for sequential saved-request execution, environments, secret environment storage, mixed PostNot collection portability, import/export flows including OpenAPI 3 import, broader cURL flag coverage, redacted-by-default single-request cURL/JSON export with optional non-secret environment variable inclusion, OAuth2 bearer auth helpers with client-credentials token fetch, notifications, settings, signed in-app update checks with download progress, inherited collection/folder/saved-request pre-request and test scripts (worker-backed frontend JavaScript execution around the native send), async script helper requests through `pn.http.send(...)`, script-driven active-environment variable writes, and a local authoring-only MCP server with Agent Activity.
 
 ## Canonical Working Directory
 
@@ -33,9 +33,12 @@ When onboarding into a fresh task, read these first:
 - [docs/tech-design.md](docs/tech-design.md): architecture, runtime behavior, persistence, command boundaries, and design trade-offs
 - [docs/design-system.md](docs/design-system.md): application design language, reusable UI patterns, accessibility contract, and feature design checklist
 - [src/routes/+page.svelte](src/routes/+page.svelte): main request runner UI
+- [src/routes/websockets/+page.svelte](src/routes/websockets/+page.svelte): WebSocket and Socket.IO connection workspace
 - [src/routes/settings/+page.svelte](src/routes/settings/+page.svelte): persisted settings UI and updater surface
 - [src-tauri/src/lib.rs](src-tauri/src/lib.rs): Tauri startup and command registration
 - [src-tauri/src/services/http_client.rs](src-tauri/src/services/http_client.rs): native request execution
+- [src-tauri/src/services/realtime_service.rs](src-tauri/src/services/realtime_service.rs): app-wide raw WebSocket session manager
+- [src-tauri/src/services/realtime_socketio_service.rs](src-tauri/src/services/realtime_socketio_service.rs): Socket.IO transport adapter
 - [src-tauri/src/services/settings_service.rs](src-tauri/src/services/settings_service.rs): persisted settings
 - [src-tauri/src/services/history_service.rs](src-tauri/src/services/history_service.rs): request history
 - [src-tauri/src/services/environments_service.rs](src-tauri/src/services/environments_service.rs): environments, secret redaction, variable resolution
@@ -50,6 +53,10 @@ Implemented now:
 
 - Tauri desktop shell
 - native HTTP execution in Rust
+- native raw WebSocket and Socket.IO 3.x/4.x execution with application-wide session ownership
+- persistent disconnected WebSockets tab workspace, bounded session-only transcripts, file-backed large payloads, and opt-in reconnect
+- saved HTTP, WebSocket, and Socket.IO definitions in shared collection trees with protocol-aware routing
+- lossless mixed PostNot collection import/export and explicit realtime omissions from Postman export
 - persisted settings
 - persisted history with detail inspection
 - restoring stored requests from history into new request tabs
@@ -86,6 +93,12 @@ Frontend:
 npm run check
 ```
 
+Browser-mode application UX:
+
+```bash
+npm run test:app-e2e
+```
+
 Marketing site:
 
 ```bash
@@ -99,8 +112,11 @@ Rust:
 ```bash
 source "$HOME/.cargo/env"
 cargo check --manifest-path src-tauri/Cargo.toml
+cargo test --manifest-path src-tauri/Cargo.toml
 ```
 
+The Socket.IO integration test starts the pinned Node fixture in `src-tauri/tests/fixtures/socketio-server.mjs`, so install the repository's npm dependencies before running the full Rust suite.
+
 Backend quality gate (required before publishing a release):
 
 ```bash
@@ -142,6 +158,9 @@ This approach is mainly for native Windows verification such as drag-and-drop, w
 - Secret environment values are stored in the OS credential store, not SQLite.
 - History persists requests that use secret environment variables, but stores unresolved `{{variable}}` text instead of resolved secret values.
 - Single-request exports redact credential-looking values by default, including bearer tokens, OAuth2 access tokens, client secrets, API keys, cookies, and basic-auth passwords; the export dialog can include active non-secret environment variables while keeping secrets redacted.
+- Realtime connection definitions and open tabs are managed on `/websockets`; navigation preserves live native sessions, while app restart restores drafts disconnected and clears transcripts.
+- Realtime transcripts are bounded, process-scoped, and never written to SQLite history. Payloads over 256 KiB use temporary opaque handles that are cleared on release or startup.
+- Realtime v1 does not run collection/folder/request scripts or Playbook steps and does not support durable history, legacy Socket.IO 2.x, custom CA/mTLS/proxy settings, `permessage-deflate`, server-requested ACK replies, or mixed binary placeholder arrays.
 - Collections are managed on `/collections`.
 - Playbooks are managed on `/playbooks`.
 - Environments are managed on `/environments`.

CHANGELOG.md

@@ -6,6 +6,31 @@ The project currently uses pre-1.0 semantic versioning. Minor versions mark mean
 
 ## [Unreleased]
 
+## [0.23.0] - 2026-07-30
+
+### Added
+
+- Added native raw WebSocket and Socket.IO 3.x/4.x connections with reusable workspaces, multiple connection tabs, opt-in reconnection, text/JSON/binary payloads, acknowledgements, and bounded session transcripts.
+- Added saved WebSocket and Socket.IO definitions to collection trees, including protocol-aware routing, mixed PostNot collection import/export, and safe MCP authoring support.
+- Added realtime runtime settings for connection timeouts, concurrent sessions, payload limits, and transcript retention.
+
+### Changed
+
+- Kept live realtime sessions active across app navigation while restoring persisted drafts disconnected after an app restart.
+- Reused the Requests workspace's authentication, JSON, query/header, collection-save, and tab-strip patterns throughout the WebSockets workspace.
+- Expanded the design system and browser coverage for consistent panel spacing, responsive layouts, keyboard navigation, styled controls, and accessible realtime interactions.
+
+### Fixed
+
+- Corrected Socket.IO transport defaults, native transcript-limit handling, connection-state messaging, and realtime settings copy.
+- Aligned realtime connection controls, headers, query parameters, authentication, reconnect controls, and message editors with the existing application layout and component standards.
+- Silenced vendored Socket.IO build warnings without weakening project-wide Rust diagnostics.
+
+### Security
+
+- Realtime transcripts remain process-scoped and are never persisted to request history; large payloads use temporary opaque handles that are released on cleanup or startup.
+- Environment variables resolve only when connecting or sending, preserving stored templates and the existing secret-storage boundary.
+
 ## [0.22.0] - 2026-07-22
 
 ### Added

SECURITY.md

@@ -7,8 +7,8 @@ PostNot is pre-1.0. Security fixes are applied on a best-effort basis to the cur
 | Version | Supported |
 | --- | --- |
 | `master` | Yes |
-| `0.21.x` | Yes |
-| `< 0.21` | No |
+| Latest release | Yes |
+| Older releases | No |
 
 ## Reporting a Vulnerability
 
@@ -48,7 +48,7 @@ Reports in these areas are especially important for PostNot:
 
 PostNot request scripts are local automation code. They are intended for scripts you wrote or scripts from API workspaces you trust.
 
-As of `0.19.0`, pre-request and test scripts run in a short-lived worker-backed JavaScript sandbox with explicit bridges for `pn.http.send(...)` helper requests, OAuth2 token-refresh patterns, and active-environment variable writes. Please report any way for scripts to escape that boundary, access app/page globals unexpectedly, bypass helper-request history behavior, or read/write secrets outside the documented `pn.variables` APIs.
+Pre-request and test scripts run in a short-lived worker-backed JavaScript sandbox with explicit bridges for `pn.http.send(...)` helper requests, OAuth2 token-refresh patterns, and active-environment variable writes. Please report any way for scripts to escape that boundary, access app/page globals unexpectedly, bypass helper-request history behavior, or read/write secrets outside the documented `pn.variables` APIs.
 
 Imported Postman collection scripts are preserved for portability, but complex or untrusted imported scripts should be reviewed before running.