Restish Files

Overview

Restish 2.1.1 is a focused patch release for authenticated OpenAPI discovery, Linux OAuth browser launching, and legacy client-certificate migration. It makes api sync, api connect, generated command discovery, and doctor api --check-network use the same request pipeline as normal Restish HTTP calls, while tightening credential redaction in spec metadata, cache files, traces, and errors.

Authenticated Spec Discovery

Spec discovery now runs through Restish's shared request path instead of a bare HTTP transport. Discovery requests can now apply the configured TLS transport, profile headers and query params, auth callbacks, request middleware, Restish user agent, and one-shot 401 refresh behavior.

Auth is scoped to same-origin discovery targets derived from the API base URL, explicit spec_url, and remote spec_files, so cross-origin discovered specs can still be fetched when allowed without receiving the API's credentials.

doctor api --check-network now uses the same normalized and authenticated request path for its HEAD reachability check, making doctor output match real authenticated API behavior more closely.

Safer Discovery Metadata and Diagnostics

Discovery cache metadata now tracks both the requested spec URL and the final source URL, so explicit spec_url values remain cacheable even when the server redirects to a versioned spec URL.

Credential-looking query parameters are removed from persisted discovery/cache metadata and from diagnostic output, including verbose traces, OpenAPI external-ref errors, malformed URL errors, and failed doctor reachability checks. External OpenAPI reference fetching also uses the shared discovery fetcher so auth and transport behavior stay consistent.

The release also guards custom spec fetchers that return no response, and keeps absolute $ref fragments visible in diagnostics while still redacting userinfo and credential query params.

Linux OAuth and Legacy Certificate Migration

OAuth browser launching on Linux now calls xdg-open <url> without the unsupported -- separator, fixing flows where Restish appeared to open a browser but then waited forever for a callback.

Legacy v1 config migration now preserves file-based client certificate settings by mapping tls.cert and tls.key into the v2 default profile's client_cert_path and client_key_path.

Contributor Workflow Notes

The repository agent guidance now emphasizes keeping PR review loops scoped to the current change and doing a post-review simplification pass when diffs grow, without dropping meaningful edge-case coverage.

Changelog

• [346bad] Merge pull request [#356] from natalie-o-perret/fix/discovery-auth-xdg-open-linux
• [5f74cd] fix(migrate): map legacy tls.cert/tls.key to client_cert_path/client_key_path
• [9fa304] fix: also pass apiName to doctor reachability check
• [0bdb44] fix: guard nil spec fetch responses
• [914ffc] fix: send auth credentials during spec discovery; fix xdg-open on Linux
• [d958d6] fix: use request pipeline for spec discovery
• [6936dd] test(cli): assert auth header is sent during api sync spec discovery

New Contributors

• @natalie-o-perret made their first contribution in https://github.com/rest-sh/restish/pull/356

Full Changelog: https://github.com/rest-sh/restish/compare/v2.1.0...v2.1.1