Kotae: The 12.7 MB Postman Alternative That Skips Electron and the Cloud
A 12.7 MB installer and no Chromium bundle is enough for a full API client; the pattern of Go owning network I/O and the system webview rendering is directly reusable. The signature-diff SQLite save and the honest no-sandbox trust toggle are the two decisions most worth copying.
Kotae replaces Postman's collaboration stack with a single machine: no account, no cloud, no backend. The Go-powered desktop shell (via the MyGo framework) drives a system WebView (WebView2 on Windows) running a standard Vite/TypeScript frontend, so the executable is 12.7 MB and the installer 4.8 MB. Go owns every network primitive, bypassing CORS, unlocking arbitrary headers and Set-Cookie visibility, and sharing a cookie jar with WebSocket handshakes. Business logic lives entirely in a 2,800-line store.ts; Go exposes only platform capabilities.
Storage moved from a whole-file JSON workspace to SQLite, with a save() routine that fingerprints each row and only issues INSERT/UPDATE/DELETE statements for changed rows, all in a single transaction. Scripts run via AsyncFunction directly in the page, no sandbox: imported scripts from Postman Collection or HAR are marked 'untrusted' and only execute after an explicit trust toggle. A design system is enforced by a lint script that fails on bare hex colors, raw font-size values, unregistered animations, and undefined CSS variables. Two WebView2 performance issues are documented, including a cold GPU cache that caused a 74ms first-frame stutter, fixed by pre-warming widget rendering after startup.
Testing runs 105 end-to-end cases against the real binary, real windows, real Go HTTP, with no Playwright/Cypress. The test harness uses an Automation plugin built only under //go:build e2e, drives a Unix socket, and each run uses a fresh app name and temp userData to stay isolated. Explicit non-goals: no collection runner, no load testing, no cloud sync, no OpenAPI generation.
The two WebView2 performance fixes apply to any webview-based desktop app: cold GPU shader compilation can dominate first render, and backdrop-filter is often not worth its cost in software rendering.
The decision to skip a sandbox for scripts is refreshingly honest. Rather than building a fake isolation layer, the tool marks imported scripts as untrusted and forces a conscious click. This is a workable model for a single-user local tool, though it wouldn't fit a multitenant service.
Keeping business logic in a 2,800-line TypeScript file while Go stays a thin platform layer pays off: UI, request sending, and storage changes never touched the same file. That boundary is worth copying.
The diff-based SQLite save() is a clean way to avoid write amplification; the critical detail is excluding timestamps from the signature, otherwise every edit rewrites the whole database.