[{"data":1,"prerenderedAt":701},["ShallowReactive",2],{"navigation_docs":3,"-guide-privacy-and-security":172,"-guide-privacy-and-security-surround":696},[4,30,100,134],{"title":5,"icon":6,"path":7,"stem":8,"children":9,"page":29},"Getting started","i-lucide-rocket","\u002Fgetting-started","1.getting-started",[10,14,18,21,25],{"title":11,"path":12,"stem":13},"Introduction","\u002Fgetting-started\u002Fintroduction","1.getting-started\u002F1.introduction",{"title":15,"path":16,"stem":17},"Installation","\u002Fgetting-started\u002Finstallation","1.getting-started\u002F2.installation",{"title":5,"path":19,"stem":20},"\u002Fgetting-started\u002Fquick-start","1.getting-started\u002F3.quick-start",{"title":22,"path":23,"stem":24},"Build from source","\u002Fgetting-started\u002Fbuild-from-source","1.getting-started\u002F4.build-from-source",{"title":26,"path":27,"stem":28},"Troubleshooting","\u002Fgetting-started\u002Ftroubleshooting","1.getting-started\u002F5.troubleshooting",false,{"title":31,"icon":32,"path":33,"stem":34,"children":35,"page":29},"Guide","i-lucide-book-open","\u002Fguide","2.guide",[36,40,44,48,52,56,60,64,68,72,76,80,84,88,92,96],{"title":37,"path":38,"stem":39},"Interface","\u002Fguide\u002Finterface","2.guide\u002F01.interface",{"title":41,"path":42,"stem":43},"Workspace","\u002Fguide\u002Fworkspace","2.guide\u002F02.workspace",{"title":45,"path":46,"stem":47},"Collections","\u002Fguide\u002Fcollections","2.guide\u002F03.collections",{"title":49,"path":50,"stem":51},"HTTP requests","\u002Fguide\u002Fhttp-requests","2.guide\u002F04.http-requests",{"title":53,"path":54,"stem":55},"Variables","\u002Fguide\u002Fvariables","2.guide\u002F05.variables",{"title":57,"path":58,"stem":59},"Authorization","\u002Fguide\u002Fauthorization","2.guide\u002F06.authorization",{"title":61,"path":62,"stem":63},"Scripts and tests","\u002Fguide\u002Fscripts-and-tests","2.guide\u002F07.scripts-and-tests",{"title":65,"path":66,"stem":67},"Collection runner","\u002Fguide\u002Fcollection-runner","2.guide\u002F08.collection-runner",{"title":69,"path":70,"stem":71},"Import and export","\u002Fguide\u002Fimport-export","2.guide\u002F09.import-export",{"title":73,"path":74,"stem":75},"Code snippets","\u002Fguide\u002Fcode-snippets","2.guide\u002F10.code-snippets",{"title":77,"path":78,"stem":79},"gRPC","\u002Fguide\u002Fgrpc","2.guide\u002F11.grpc",{"title":81,"path":82,"stem":83},"WebSocket","\u002Fguide\u002Fwebsocket","2.guide\u002F12.websocket",{"title":85,"path":86,"stem":87},"Cookies, proxy and certificates","\u002Fguide\u002Fcookies-proxy-certificates","2.guide\u002F13.cookies-proxy-certificates",{"title":89,"path":90,"stem":91},"Settings","\u002Fguide\u002Fsettings","2.guide\u002F14.settings",{"title":93,"path":94,"stem":95},"Keyboard shortcuts","\u002Fguide\u002Fkeyboard-shortcuts","2.guide\u002F15.keyboard-shortcuts",{"title":97,"path":98,"stem":99},"Privacy and security","\u002Fguide\u002Fprivacy-and-security","2.guide\u002F16.privacy-and-security",{"title":101,"icon":102,"path":103,"stem":104,"children":105,"page":29},"Reference","i-lucide-square-terminal","\u002Freference","3.reference",[106,110,114,118,122,126,130],{"title":107,"path":108,"stem":109},"Command line","\u002Freference\u002Fcli","3.reference\u002F1.cli",{"title":111,"path":112,"stem":113},"Automation tools","\u002Freference\u002Fautomation-tools","3.reference\u002F2.automation-tools",{"title":115,"path":116,"stem":117},"Scripting API","\u002Freference\u002Fscripting-api","3.reference\u002F3.scripting-api",{"title":119,"path":120,"stem":121},"Dynamic variables","\u002Freference\u002Fdynamic-variables","3.reference\u002F4.dynamic-variables",{"title":123,"path":124,"stem":125},"UI control channel","\u002Freference\u002Fui-control-channel","3.reference\u002F5.ui-control-channel",{"title":127,"path":128,"stem":129},"Workspace format","\u002Freference\u002Fworkspace-format","3.reference\u002F6.workspace-format",{"title":131,"path":132,"stem":133},"Feature status","\u002Freference\u002Ffeature-status","3.reference\u002F7.feature-status",{"title":135,"icon":136,"path":137,"stem":138,"children":139,"page":29},"Contributing","i-lucide-git-pull-request","\u002Fcontributing","4.contributing",[140,144,148,152,156,160,164,168],{"title":141,"path":142,"stem":143},"Contributing overview","\u002Fcontributing\u002Foverview","4.contributing\u002F1.overview",{"title":145,"path":146,"stem":147},"Development","\u002Fcontributing\u002Fdevelopment","4.contributing\u002F2.development",{"title":149,"path":150,"stem":151},"Architecture","\u002Fcontributing\u002Farchitecture","4.contributing\u002F3.architecture",{"title":153,"path":154,"stem":155},"Known gaps","\u002Fcontributing\u002Fgaps","4.contributing\u002F4.gaps",{"title":157,"path":158,"stem":159},"Adding a feature","\u002Fcontributing\u002Fadding-a-feature","4.contributing\u002F5.adding-a-feature",{"title":161,"path":162,"stem":163},"Assets and clean-room","\u002Fcontributing\u002Fassets-and-clean-room","4.contributing\u002F6.assets-and-clean-room",{"title":165,"path":166,"stem":167},"Releasing","\u002Fcontributing\u002Freleasing","4.contributing\u002F7.releasing",{"title":169,"path":170,"stem":171},"Writing the documentation","\u002Fcontributing\u002Fdocumentation","4.contributing\u002F8.documentation",{"id":173,"title":97,"body":174,"description":689,"extension":690,"links":691,"meta":692,"navigation":693,"path":98,"seo":694,"stem":99,"__hash__":695},"docs\u002F2.guide\u002F16.privacy-and-security.md",{"type":175,"value":176,"toc":673},"minimark",[177,181,186,266,277,287,292,307,312,316,319,356,368,377,381,394,403,407,410,519,522,536,540,562,566,576,622,627,634,648,657,661,664],[178,179,180],"p",{},"Postguy works offline. Your workspace is a folder of files on your machine. The app makes no network request that you did not start.",[182,183,185],"h2",{"id":184},"network-rules","Network rules",[187,188,189,202],"table",{},[190,191,192],"thead",{},[193,194,195,199],"tr",{},[196,197,198],"th",{},"Rule",[196,200,201],{},"Detail",[203,204,205,214,222,230,243,258],"tbody",{},[193,206,207,211],{},[208,209,210],"td",{},"No telemetry",[208,212,213],{},"The app sends no usage data and no crash reports.",[193,215,216,219],{},[208,217,218],{},"No update check",[208,220,221],{},"It never contacts a server to look for a new version.",[193,223,224,227],{},[208,225,226],{},"No account or sync",[208,228,229],{},"There is no sign-in and no cloud storage.",[193,231,232,235],{},[208,233,234],{},"Requests only on your action",[208,236,237,238,242],{},"The only traffic is what you start: sending a request, a gRPC call, a WebSocket connection, an OAuth 2.0 token request, or a script's ",[239,240,241],"code",{},"pm.sendRequest",".",[193,244,245,248],{},[208,246,247],{},"Browser links",[208,249,250,253,254,257],{},[239,251,252],{},"Documentation"," and ",[239,255,256],{},"GitHub"," in the Help menu open a page in your browser, only when you choose them.",[193,259,260,263],{},[208,261,262],{},"No implicit fetches",[208,264,265],{},"The Import box refuses a pasted URL instead of downloading it (see below).",[178,267,268,269,276],{},"These are project rules in ",[270,271,275],"a",{"href":272,"rel":273},"https:\u002F\u002Fgithub.com\u002Fzuramai\u002Fpostguy\u002Fblob\u002Fmain\u002FAGENTS.md",[274],"nofollow","AGENTS.md"," (section 5.2):",[278,279,280,284],"ul",{},[281,282,283],"li",{},"Never add telemetry, crash upload, an update check or cloud sync.",[281,285,286],{},"Never log secret variable values, client-certificate passphrases or the control-channel token.",[288,289,291],"h3",{"id":290},"import-never-fetches","Import never fetches",[178,293,294,295,298,299,302,303,306],{},"Paste a URL (text starting with ",[239,296,297],{},"http:\u002F\u002F"," or ",[239,300,301],{},"https:\u002F\u002F",") into the Import box. Postguy answers ",[239,304,305],{},"URL imports are not fetched automatically; download the file and drop it here",". Nothing is requested.",[178,308,309,310,242],{},"Download the file yourself, then drop it onto the window or choose it as a file. See ",[270,311,69],{"href":70},[182,313,315],{"id":314},"secrets","Secrets",[178,317,318],{},"You can mark a variable secret in an environment, in globals, or in a collection or folder.",[278,320,321,336,339,350],{},[281,322,323,324,327,328,331,332,335],{},"Secret values go in ",[239,325,326],{},".postguy\u002Fsecrets.json"," in the ",[270,329,330],{"href":42},"workspace",". On Unix the file is owner-only (",[239,333,334],{},"0600","). Secrets are never written into collection or environment files.",[281,337,338],{},"OAuth 2.0 tokens follow the same rule.",[281,340,341,342,345,346,349],{},"Postguy masks secret values wherever it echoes them: the history snapshot, the Console, script test and failure messages, and ",[270,343,344],{"href":74},"code snippets",". A masked value shows as ",[239,347,348],{},"•",", one per character, up to 16.",[281,351,352,353,242],{},"Collection exports blank secret values. Environment and globals exports leave them out unless you choose to include them. The workspace zip leaves out ",[239,354,355],{},".postguy\u002F",[357,358,359,360,364,365,367],"warning",{},"The secrets file is ",[361,362,363],"strong",{},"not encrypted at rest",". Anyone who can read your workspace folder can read the secret values. That includes your backups and any sync tool you point at it. Keep ",[239,366,355],{}," out of version control and out of shared folders. Use of the operating system keychain is an undecided future item.",[178,369,370,371,374,375,242],{},"The cookie jar is stored on disk in ",[239,372,373],{},".postguy\u002Fcookies.json",". See ",[270,376,85],{"href":86},[182,378,380],{"id":379},"tls-verification","TLS verification",[178,382,383,386,387,390,391],{},[239,384,385],{},"SSL certificate verification"," in ",[239,388,389],{},"Settings › General"," is on by default. A request can also override it. When you turn it off, the setting reads ",[239,392,393],{},"Verification is off: responses are encrypted but unauthenticated.",[178,395,396,397,400,401,242],{},"Turn it off only for a server you control, such as a local test server with a self-signed certificate. A custom CA bundle in ",[239,398,399],{},"Settings › Certificates"," is safer. See ",[270,402,89],{"href":90},[182,404,406],{"id":405},"scripts","Scripts",[178,408,409],{},"Pre-request and test scripts run in an embedded JavaScript engine (QuickJS). Postguy treats them as untrusted input, so the sandbox is strict.",[187,411,412,422],{},[190,413,414],{},[193,415,416,419],{},[196,417,418],{},"Area",[196,420,421],{},"Limit",[203,423,424,444,452,463,471,479,487,495,503],{},[193,425,426,429],{},[208,427,428],{},"Filesystem",[208,430,431,432,435,436,439,440,443],{},"None. ",[239,433,434],{},"fs"," is a read-only view of the collection's ",[270,437,438],{"href":46},"assets",". Writes and ",[239,441,442],{},".."," escapes throw.",[193,445,446,449],{},[208,447,448],{},"Process",[208,450,451],{},"No access from scripts.",[193,453,454,457],{},[208,455,456],{},"Network",[208,458,459,460,462],{},"Only ",[239,461,241],{},", which goes through the app's own request engine. At most 10 calls per script run.",[193,464,465,468],{},[208,466,467],{},"Wall-clock time",[208,469,470],{},"5,000 ms",[193,472,473,476],{},[208,474,475],{},"Memory",[208,477,478],{},"64 MiB heap, 1 MiB stack",[193,480,481,484],{},[208,482,483],{},"Output",[208,485,486],{},"1,000 console lines, 1,000 test results, 16 KiB per log line",[193,488,489,492],{},[208,490,491],{},"Variable values",[208,493,494],{},"1 MiB each",[193,496,497,500],{},[208,498,499],{},"Timers and jobs",[208,501,502],{},"10,000 pending timers, 100 timer rounds, 1,000,000 promise jobs",[193,504,505,510],{},[208,506,507],{},[239,508,509],{},"require",[208,511,459,512,253,515,518],{},[239,513,514],{},".js",[239,516,517],{},".json"," files from the collection's assets. No npm packages.",[178,520,521],{},"A script that exceeds a limit or throws becomes an error. The error shows its phase, origin and line. It does not crash the app.",[178,523,524,525,386,528,374,530,532,533,242],{},"Scripts run only for HTTP requests. To turn them all off, enable ",[239,526,527],{},"Disable scripts",[239,529,389],{},[270,531,61],{"href":62}," and the ",[270,534,535],{"href":116},"scripting API",[182,537,539],{"id":538},"files-from-strangers","Files from strangers",[278,541,542,545,552,555],{},[281,543,544],{},"Importers and data files cap size, nesting and expansion. On malformed input the app returns an error instead of crashing.",[281,546,547,548,551],{},"File paths in requests resolve against the working directory. Reading outside it needs the ",[239,549,550],{},"Read files outside the working directory"," setting.",[281,553,554],{},"Saves are atomic. A failed save leaves the previous file intact.",[281,556,557,558,561],{},"A corrupt file is renamed with a ",[239,559,560],{},".corrupt-\u003Ctime>"," suffix, and the app starts without it.",[182,563,565],{"id":564},"the-ui-control-channel","The UI control channel",[178,567,568,569,572,573,242],{},"The control channel lets ",[239,570,571],{},"postguy-cli ui"," inspect and drive a running window. It is off unless you start the app with ",[239,574,575],{},"--control FILE",[278,577,578,585,595,605,608],{},[281,579,580,581,584],{},"It listens on ",[239,582,583],{},"127.0.0.1"," only, on a random port.",[281,586,587,588,591,592,594],{},"Each launch makes a fresh random token. It writes ",[239,589,590],{},"{port, token, pid}"," to the file you named, readable by you only (",[239,593,334],{}," on Unix). The token is never logged.",[281,596,597,598,601,602,242],{},"Every request must carry ",[239,599,600],{},"Authorization: Bearer \u003Ctoken>",". Others get ",[239,603,604],{},"401",[281,606,607],{},"Stopping the app removes the file.",[281,609,610,611,614,615,253,618,621],{},"Synthetic ",[239,612,613],{},"click",", ",[239,616,617],{},"key",[239,619,620],{},"type"," are refused.",[178,623,624,625,242],{},"Details are in ",[270,626,123],{"href":124},[182,628,630,631],{"id":629},"headless-cli-and-root","Headless CLI and ",[239,632,633],{},"--root",[178,635,636,639,640,643,644,647],{},[239,637,638],{},"postguy-cli"," runs the same tools with no window and no server. With ",[239,641,642],{},"--root DIR",", it refuses any path outside ",[239,645,646],{},"DIR",". The refusal is the same whether or not the path exists.",[178,649,650,651,653,654,242],{},"Use ",[239,652,633],{}," when you hand the CLI to a script or an agent. See ",[270,655,656],{"href":108},"CLI",[182,658,660],{"id":659},"mcp","MCP",[178,662,663],{},"An MCP server is planned. It does not exist yet. The project rule is that it must be opt-in. Nothing may start it, register it with an agent or open a port by default.",[665,666,667,668,242],"note",{},"Report security problems through the ",[270,669,672],{"href":670,"rel":671},"https:\u002F\u002Fgithub.com\u002Fzuramai\u002Fpostguy",[274],"repository",{"title":674,"searchDepth":675,"depth":675,"links":676},"",2,[677,681,682,683,684,685,686,688],{"id":184,"depth":675,"text":185,"children":678},[679],{"id":290,"depth":680,"text":291},3,{"id":314,"depth":675,"text":315},{"id":379,"depth":675,"text":380},{"id":405,"depth":675,"text":406},{"id":538,"depth":675,"text":539},{"id":564,"depth":675,"text":565},{"id":629,"depth":675,"text":687},"Headless CLI and --root",{"id":659,"depth":675,"text":660},"What Postguy sends over the network, where secrets are stored, what scripts can do, and how the opt-in control channel is protected.","md",null,{},true,{"title":97,"description":689},"SCO4giJ9a692iR4-j9DqkXogiRi216QEhEEeNUcgBiE",[697,699],{"title":93,"path":94,"stem":95,"description":698,"children":-1},"Every shortcut and command, with macOS and Windows\u002FLinux keys, plus the command palette.",{"title":107,"path":108,"stem":109,"description":700,"children":-1},"Every flag of the postguy app and every postguy-cli command: tools, call, run, ui, flags, output and exit codes.",1793179614117]