Restish Files

Overview

Restish 2.1.0 focuses on making API setup easier to share, giving generated commands an optional local validation pass, and smoothing several OpenAPI, OAuth, pagination, and output edges. It also includes security hardening for MessagePack decoding and the web playground.

Trusted Project Config

Repositories can now carry shared, secret-free Restish setup in a discovered .restish.json file. Run:

:::bash
restish config trust

Once trusted, project apis and theme settings layer over your global config for that working tree. Trust is stored outside the repository and includes the file's content hash, so Restish asks you to review and trust the project config again if it changes. Normal config-writing commands still write the global config and refuse to mutate project APIs, which keeps shared setup separate from local secrets.

Optional Generated Body Validation

Generated OpenAPI commands now accept --rsh-validate for JSON request bodies. Restish builds the request body from flags and arguments, then validates it against the operation schema before sending. This is intentionally opt-in: by default, Restish still sends what you ask for and lets the server enforce API-specific semantics.

Validation now carries JSON Schema dialect metadata through OpenAPI-generated commands and plugin messages, giving better behavior for OpenAPI 3.1/3.2-style schemas and clearer errors when a dialect is unsupported.

Page-Parameter Pagination

Restish can now paginate APIs that use a numeric query parameter instead of a next link:

:::json
{
  "apis": {
    "example": {
      "base_url": "https://api.example.com",
      "pagination": { "page_param": "page" }
    }
  }
}

This lets Restish increment the page parameter when responses are collections. Configured items_path and next_path handling is also stricter, so typos or mismatched response shapes fail loudly instead of silently truncating pagination.

OAuth Callback Improvements

Authorization-code OAuth callback pages now use the active Restish theme and can be customized with callback_success_html and callback_error_html. Providers that require HTTPS redirect URLs are supported with a local certificate/key via redirect_scheme: "https", redirect_cert, and redirect_key.

Relative OAuth endpoints are resolved more consistently, and callback details are kept local to the browser flow instead of being forwarded to authorization or token endpoints.

OpenAPI Discovery and Command Polish

api connect, api sync, and doctor api now summarize behavior-changing x-cli-* extensions so operators can see when a spec affects generated command names, hidden/ignored operations, aliases, prompts, or config defaults.

Other OpenAPI and generated-command fixes include honoring base_url for document servers, ignoring documentation-only description references, ignoring encodings on bodyless responses, preserving configured header casing, shortening generated fallback names with operation_base, and refreshing stale raw specs before rebuilding generated commands.

Security and Docs

The MessagePack decoder was updated to v3, and playground error rendering now avoids syntax highlighting untrusted error text. The documentation site and GitHub README also got refreshed social preview images and landing-page polish.

Changelog

• [a1c444] feat(auth): theme OAuth callback pages
• [ffec6f] feat(config): add trusted project config discovery
• [0403d1] feat: add optional generated body validation
• [7d35ec] feat: add page parameter pagination
• [ee2899] feat: carry JSON Schema dialect metadata
• [8370bb] feat: report OpenAPI x-cli extension effects
• [f59222] feat: support HTTPS OAuth callbacks
• [28c2a2] fix(cli): color filtered TTY output
• [2db950] fix(config): address project cache review feedback
• [943fc3] fix(config): address project config review nits
• [1e9812] fix(config): allow shared project config without secrets
• [f969a8] fix(config): tighten project config review fixes
• [a394b6] fix(docs): reuse overview social image on home
• [af225f] fix(openapi): honor base_url for document servers
• [8195f2] fix: align operation-base fallback lookups
• [be3754] fix: honor effective page param query
• [f8bf9f] fix: ignore docs-only description refs
• [fedcd2] fix: ignore encodings on bodyless responses
• [e9f03e] fix: keep page-param items_path strictness
• [e480fb] fix: merge main into relative OAuth endpoints
• [96d8d9] fix: preserve configured header casing
• [cf41db] fix: refine schema validation colors
• [546c06] fix: refresh stale raw spec before generated commands
• [fc4816] fix: resolve relative OAuth endpoints
• [26b612] fix: reuse stale raw spec for generated commands
• [be17db] fix: shorten generated fallback names with operation base
• [7c9c3b] fix: show complete schema validation errors
• [7d6c62] fix: skip nested x-cli effects for ignored entries
• [ca6af6] fix: suppress unchanged config edit writes
• [e28ec8] refactor: replace interface{} with any (Go 1.18+ alias)
• [dfe048] security: render playground errors without highlighting
• [6074df] security: update msgpack decoder to v3

Full Changelog: https://github.com/rest-sh/restish/compare/v2.0.0...v2.1.0