PyBreeze-dev 1.0.17__tar.gz → 1.0.19__tar.gz

{pybreeze_dev-1.0.17 → pybreeze_dev-1.0.19}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pybreeze_dev
-Version: 1.0.17
+Version: 1.0.19
 Summary: IDE for multi automation
 Author-email: JE-Chen <jechenmailman@gmail.com>
 Project-URL: Homepage, https://github.com/Integration-Automation/PyBreeze
@@ -24,7 +24,7 @@ Requires-Dist: je_web_runner
 Requires-Dist: je_load_density
 Requires-Dist: je_api_testka
 Requires-Dist: je-mail-thunder
-Requires-Dist: automation-file
+Requires-Dist: automation-file[all]
 Requires-Dist: PySide6==6.11.2
 Requires-Dist: test_pioneer
 Requires-Dist: paramiko
@@ -64,6 +64,7 @@ Dynamic: license-file
 - [Dependencies](#dependencies)
 - [Testing & CI](#testing--ci)
 - [Target Audience](#target-audience)
+- [Security](#security)
 - [License](#license)
 
 ---
@@ -107,6 +108,8 @@ Each module gets the same menu shape: **Run** (single script, batch directory, w
 
 - **Automation keyword sets** — the `AT_*` / GUI / Web / Load keyword sets are registered for `.json`, and TestPioneer's schema for `.yml` and `.yaml`, on top of JEditor's language support. JEditor does not colour them yet: it highlights those files with its own rules for the suffix, which leave registered keywords out
 - **Code editor** — built on [JEditor](https://github.com/Integration-Automation/JEDITOR): tabs, project tree, format checker, debugger, terminal and a git client pane
+- **Navigation panel** — a dock at the left lists what the menus hold as one tree (Automation, Tools, Settings): type in its box to find a tool or a command by name, then press Enter or double-click to open it. **Dock ▸ Navigation** shows and hides it, and a panel closed on purpose stays closed at the next start
+- **Fits a small screen** — a tool tab never asks for more than 60 font heights of width: a row of buttons too long for the tab wraps onto the next line instead of pushing the window wider than the display
 - **Script execution** — single or batch, each run in a window of its own with a Stop button (Run ▸ Stop All Program stops them all), which asks whether to stop the run when it is closed while the run goes on; action files are passed by path, and a script from the tab in front that is too long for a Windows command line (~32 KB) goes through a temporary file
 - **Report generation** — HTML / JSON / XML after a run, with optional email delivery
 - **Integrated JupyterLab** — launches as a tab, in the same interpreter a run would use, installing JupyterLab there if it is missing, and upgrading it and its server first when either is a release with a known vulnerability (JupyterLab before 4.5.10 or 4.6.0–4.6.1, jupyter_server before 2.20.0); the tab stays on the lab, and a link to anywhere else opens in your browser
@@ -126,7 +129,7 @@ Paste a `curl` command from your browser's dev tools and pick a target. The pars
 |---|---|
 | ![cURL import to pytest](images/tool_curl_import.png) | ![cURL import to APITestka action](images/tool_curl_import_action.png) |
 
-Targets: Python `requests`, a ready-to-run **pytest** test, **APITestka** (Python or a `[["AT_test_api_method", {...}]]` action list that `execute_files` runs directly), and a **LoadDensity** Locust load test. Copy the output, open it straight into an editor tab, or save it with the right extension. One click also hands the parsed URL to the URL parser/builder or the headers to the header analyzer.
+Targets: Python `requests`, a ready-to-run **pytest** test, **APITestka** (Python or a `[["AT_test_api_method", {...}]]` action list that `execute_files` runs directly), a **LoadDensity** Locust load test, and a **WebRunner** action list that visits the address in a browser. A target that cannot send everything a request holds says so under the output ("Not sent by this target: headers · the body"): a LoadDensity run drives a method and a URL, and a browser visit keeps the URL, the cookies and a time limit. Copy the output, open it straight into an editor tab, or save it with the right extension. One click also hands the parsed URL to the URL parser/builder or the headers to the header analyzer.
 
 ### HAR Import — a whole session becomes a test suite
 
@@ -148,12 +151,73 @@ The status code is looked up in the HTTP reference, headers are parsed, a JSON b
 
 Reports names sent more than once, `Set-Cookie` entries missing `Secure` / `HttpOnly` / `SameSite` and those a browser drops outright (a `__Secure-` / `__Host-` name whose rules are broken, `SameSite=None` without `Secure`), wildcard CORS (and the wildcard-plus-credentials combination browsers reject outright), an HSTS `max-age` too short to survive a restart, CSP `unsafe-inline` / `unsafe-eval`, product banners, headers current browsers ignore (`X-XSS-Protection` other than `0`, `Expect-CT`, `Public-Key-Pins`, `P3P`, the old prefixed CSP names), and — for responses — the security headers that are absent, counting a CSP `frame-ancestors` directive as `X-Frame-Options`, as the OWASP HTTP Headers Cheat Sheet does. Headers carrying credentials are reported **by name only**; their values never enter the report.
 
+**Export findings as SARIF** saves the analysis as a SARIF 2.1.0 file that GitHub Code Scanning and other security tooling read: each finding with its rule, level, line, what to do about it and a link. The same export runs without the IDE, for CI:
+
+```bash
+python -m pybreeze.utils.header_tools.header_sarif response-headers.txt -o headers.sarif
+```
+
+`-` reads the headers from standard input, leaving out `-o` writes to standard output, and `--fail-on-warning` exits with 1 when a finding is a warning. The report names rules and lines and quotes no header value.
+
 ### Text Diff
 
 ![Text Diff](images/tool_diff.png)
 
 Compare two payloads — an expected vs. actual API response, say — and get a unified diff, its added and removed lines in the theme's colours, plus a one-line added/removed summary.
 
+### Report Viewer
+
+**Tools → Report Viewer Tab** opens what a run produced, whatever ran it, into one view.
+
+- **Reads** the automation packages' own reports (APITestka, AutoControl, WebRunner, LoadDensity: the `<name>_success.json` / `<name>_failure.json` pair or the `.xml` pair; open either and the other is read with it), **JUnit XML** (pytest's `--junitxml`, and most other runners), and reports exported from PyBreeze. What a file is, is told from what it holds.
+- **Shows** each run as a tree with how every result ended and how long it took; the selected result's details and error, its output, what it left behind, and the package's own record of it, untouched.
+- **Filters** all open runs together: by ending (passed, failed, error, skipped), by time taken, by package, and by text in a name or an error. A line under the tree counts what is shown.
+- **Exports** a run as an execution report (JSON), as **JUnit XML** for a CI service's test summary, or as one self-contained **HTML page** for people, which can be opened here again.
+- The **MCP Client**'s Calls page opens its session here with **Open in Report Viewer**.
+
+A report is a file from somewhere: it is read as data (XML that declares a document type is refused), everything in it is shown as text, and the paths it names are listed, not opened.
+
+### MCP Client
+
+**Tools → MCP Client Tab** connects to [Model Context Protocol](https://modelcontextprotocol.io) servers and shows what each offers: **tools** to call, **resources** to read, **prompts** to fill in.
+
+- **Servers** are set up once and kept for you (`~/.pybreeze/mcp_servers.json`, readable by you alone): a name, the command that starts the server (one argument a line, never a shell line), its environment variables, and how long a request may take. The file uses the `mcpServers` layout other clients write, so a list made elsewhere can be dropped in.
+- **A call is asked about first**: the tool, the server and the arguments as they will be sent, with No as the default. Tick *Do not ask again* to trust one tool of one server. What a server says of its own tool ("changes nothing") is shown, not relied on.
+- **A server that comes with a project** (`.mcp.json` in the project folder) is listed, never started by itself: connecting to it shows its command and asks.
+- **Cancel** gives up a call on its way; a server that does not answer within its time limit is given up on; one that goes away is said so, with the last line of its own log. **Connect** again to start over.
+- **Calls** lists the session: when, which tool, how it ended, how long it took. **Export Session...** saves it as an execution report (JSON).
+
+Put keys and tokens in the server's environment variables, not in its command: their values are shown as dots, and are taken out of the log, of error messages and of exported sessions wherever they turn up. Servers are started as local programs (the protocol's standard-input-and-output transport).
+
+### Keywords for action scripts
+
+A WebRunner, AutoControl or LoadDensity script is a JSON list of actions, `["keyword"]` or `["keyword", arguments]`. Open one (`.json`) in the editor and it is completed and checked against the keywords of the framework **as it is installed**:
+
+- **Completion** — the framework's keywords where an action's name goes, a keyword's parameters where an argument's name goes.
+- **Diagnostics** — a keyword that version does not have (with the nearest one suggested), a parameter the keyword does not take, a required one left out, a list of values of the wrong length, an action of the wrong shape, and text that is not JSON. In the IDE's language.
+- **Hover** and **go to definition** — a keyword's signature and documentation, and the line of the package that defines it.
+
+Nothing about a keyword is kept in PyBreeze. Each framework is asked, in a process of its own, by the interpreter that runs your scripts (the one chosen in the IDE, a `.venv` in the project, else the IDE's own), so upgrading a framework changes what is offered. A framework that is missing or fails to import costs its own keywords and nothing else.
+
+**Tools → Automation Keywords Tab** shows the same keywords: each framework's version, what the editor offers for it, every keyword with its parameters and documentation, a filter, and **Copy as Action**. When a framework gives none, it says why.
+
+The editor gets all this from a language server, which any editor that speaks the Language Server Protocol can start too:
+
+```bash
+python -m pybreeze.extend.language_server [--interpreter /path/to/python] [--language Traditional_Chinese]
+```
+
+### JSON Editor
+
+Edit a JSON file as a **Tree** or as **Text** (**Tools → JSON Editor Tab**). Both are views of one document, so they cannot disagree.
+
+- **Tree** — add, delete, move up or down, and rename in place; type over a value, or give it another type (object, array, string, number, boolean, null). A number is kept as it is written: `1.0` stays `1.0`.
+- **Text** — the JSON itself, always there. It is checked as you type and a line under the views says where it stops being JSON; the tree waits until it is JSON again, and nothing typed is thrown away.
+- **Undo / Redo** step through the document whichever view changed it, and a tab with unsaved changes asks before it closes or opens another file.
+- A file is written back the way it was found: its indent (spaces or tabs), on one line if it was, with its final line break. Alignment by hand and blank lines are not kept by an edit in the tree.
+
+It is a JSON editor, not a second code editor: a file is opened into it from its **Open...** button.
+
 ### The everyday utilities
 
 Each is a tab or a dock, each has the same copy / open-in-editor / save-to-file row along the bottom.
@@ -248,7 +312,7 @@ Loaded plugins appear under their own **Plugins** menu with an About entry and o
 - **English** (default)
 - **Traditional Chinese** (繁體中文)
 
-Menus, dialogs, the reasons a tool refuses its input and the run window's own notices (`[Error] …`, `[Run] …`) all follow the chosen language. Both dictionaries carry the same 768 keys, and a test enforces that parity so a new string can never land in one language only. The Language menu also lists JEditor's Japanese and Simplified Chinese: picked, JEditor's own menus change and PyBreeze's strings stay in English. Further languages can be added via translation plugins.
+Menus, dialogs, the reasons a tool refuses its input and the run window's own notices (`[Error] …`, `[Run] …`) all follow the chosen language. Both dictionaries carry the same 995 keys, and a test enforces that parity so a new string can never land in one language only. English and Traditional Chinese are the languages PyBreeze maintains. The Language menu also lists JEditor's Japanese (日本語) and Simplified Chinese (简体中文), which PyBreeze passes on without translating: picked, JEditor's own menus change and PyBreeze's strings stay in English. Further languages can be added via translation plugins.
 
 ---
 
@@ -377,6 +441,8 @@ Once launched:
 4. **Generate** an HTML / JSON / XML report
 5. **Send** it by email through the MailThunder integration
 
+New here? The [tutorials](https://pybreeze.readthedocs.io/en/latest/Eng/tutorials/index.html) are thirteen short pages, each with an example that runs and what to expect from it: the first launch, a first API, browser, desktop and load run, tests from cURL and HAR, header findings as SARIF in CI, the JSON editor, keywords for action scripts, the MCP client, reports in CI, plugins, and troubleshooting. They test a small site on your own machine, so none of them needs an account.
+
 ### Log file
 
 PyBreeze writes its log to `~/.pybreeze/logs/PyBreeze.log`: UTF-8, appended to by every run, each line carrying the process ID. Only warnings and errors also appear in the editor's Code Result panel. Two environment variables change this:
@@ -482,7 +548,7 @@ python -m pytest test/test_utils/ -v --tb=short
 
 - **Unit tests** — `test/test_utils/`, covering the pure-logic layer (curl and HAR parsing, header analysis, SSRF validation, JWT, hashing, timestamps, diffing) plus headless Qt widget tests via `QT_QPA_PLATFORM=offscreen`, with Hypothesis property tests over the parsers. The SSH terminal and the SFTP file tree also log in to an SSH server the tests start on the loopback address, which serves a temporary folder over SFTP
 - **Startup tests** — `test/unit_test/start_automation/` launches the IDE in debug mode and verifies it comes up and exits cleanly
-- **CI** — GitHub Actions on Windows across Python 3.10 – 3.14, on every push and PR plus a nightly run; a push to `dev` that passes also publishes `pybreeze_dev` when the package changed
+- **CI** — GitHub Actions: the whole suite on Windows across Python 3.10 – 3.14, and a short set of platform smoke tests on Linux and macOS, on every push and PR plus a nightly run; a push to `dev` that passes the suite also publishes `pybreeze_dev` when the package changed
 - **Static analysis** — SonarCloud, Codacy and Bandit
 
 ---
@@ -496,6 +562,10 @@ python -m pytest test/test_utils/ -v --tb=short
 
 ---
 
+## Security
+
+Report vulnerabilities privately. The policy, supported versions, and operator notes are in [SECURITY.md](SECURITY.md).
+
 ## License
 
 MIT — see [LICENSE](LICENSE). Copyright (c) 2022 JE-Chen

{pybreeze_dev-1.0.17 → pybreeze_dev-1.0.19}/README.md

@@ -31,6 +31,7 @@
 - [Dependencies](#dependencies)
 - [Testing & CI](#testing--ci)
 - [Target Audience](#target-audience)
+- [Security](#security)
 - [License](#license)
 
 ---
@@ -74,6 +75,8 @@ Each module gets the same menu shape: **Run** (single script, batch directory, w
 
 - **Automation keyword sets** — the `AT_*` / GUI / Web / Load keyword sets are registered for `.json`, and TestPioneer's schema for `.yml` and `.yaml`, on top of JEditor's language support. JEditor does not colour them yet: it highlights those files with its own rules for the suffix, which leave registered keywords out
 - **Code editor** — built on [JEditor](https://github.com/Integration-Automation/JEDITOR): tabs, project tree, format checker, debugger, terminal and a git client pane
+- **Navigation panel** — a dock at the left lists what the menus hold as one tree (Automation, Tools, Settings): type in its box to find a tool or a command by name, then press Enter or double-click to open it. **Dock ▸ Navigation** shows and hides it, and a panel closed on purpose stays closed at the next start
+- **Fits a small screen** — a tool tab never asks for more than 60 font heights of width: a row of buttons too long for the tab wraps onto the next line instead of pushing the window wider than the display
 - **Script execution** — single or batch, each run in a window of its own with a Stop button (Run ▸ Stop All Program stops them all), which asks whether to stop the run when it is closed while the run goes on; action files are passed by path, and a script from the tab in front that is too long for a Windows command line (~32 KB) goes through a temporary file
 - **Report generation** — HTML / JSON / XML after a run, with optional email delivery
 - **Integrated JupyterLab** — launches as a tab, in the same interpreter a run would use, installing JupyterLab there if it is missing, and upgrading it and its server first when either is a release with a known vulnerability (JupyterLab before 4.5.10 or 4.6.0–4.6.1, jupyter_server before 2.20.0); the tab stays on the lab, and a link to anywhere else opens in your browser
@@ -93,7 +96,7 @@ Paste a `curl` command from your browser's dev tools and pick a target. The pars
 |---|---|
 | ![cURL import to pytest](images/tool_curl_import.png) | ![cURL import to APITestka action](images/tool_curl_import_action.png) |
 
-Targets: Python `requests`, a ready-to-run **pytest** test, **APITestka** (Python or a `[["AT_test_api_method", {...}]]` action list that `execute_files` runs directly), and a **LoadDensity** Locust load test. Copy the output, open it straight into an editor tab, or save it with the right extension. One click also hands the parsed URL to the URL parser/builder or the headers to the header analyzer.
+Targets: Python `requests`, a ready-to-run **pytest** test, **APITestka** (Python or a `[["AT_test_api_method", {...}]]` action list that `execute_files` runs directly), a **LoadDensity** Locust load test, and a **WebRunner** action list that visits the address in a browser. A target that cannot send everything a request holds says so under the output ("Not sent by this target: headers · the body"): a LoadDensity run drives a method and a URL, and a browser visit keeps the URL, the cookies and a time limit. Copy the output, open it straight into an editor tab, or save it with the right extension. One click also hands the parsed URL to the URL parser/builder or the headers to the header analyzer.
 
 ### HAR Import — a whole session becomes a test suite
 
@@ -115,12 +118,73 @@ The status code is looked up in the HTTP reference, headers are parsed, a JSON b
 
 Reports names sent more than once, `Set-Cookie` entries missing `Secure` / `HttpOnly` / `SameSite` and those a browser drops outright (a `__Secure-` / `__Host-` name whose rules are broken, `SameSite=None` without `Secure`), wildcard CORS (and the wildcard-plus-credentials combination browsers reject outright), an HSTS `max-age` too short to survive a restart, CSP `unsafe-inline` / `unsafe-eval`, product banners, headers current browsers ignore (`X-XSS-Protection` other than `0`, `Expect-CT`, `Public-Key-Pins`, `P3P`, the old prefixed CSP names), and — for responses — the security headers that are absent, counting a CSP `frame-ancestors` directive as `X-Frame-Options`, as the OWASP HTTP Headers Cheat Sheet does. Headers carrying credentials are reported **by name only**; their values never enter the report.
 
+**Export findings as SARIF** saves the analysis as a SARIF 2.1.0 file that GitHub Code Scanning and other security tooling read: each finding with its rule, level, line, what to do about it and a link. The same export runs without the IDE, for CI:
+
+```bash
+python -m pybreeze.utils.header_tools.header_sarif response-headers.txt -o headers.sarif
+```
+
+`-` reads the headers from standard input, leaving out `-o` writes to standard output, and `--fail-on-warning` exits with 1 when a finding is a warning. The report names rules and lines and quotes no header value.
+
 ### Text Diff
 
 ![Text Diff](images/tool_diff.png)
 
 Compare two payloads — an expected vs. actual API response, say — and get a unified diff, its added and removed lines in the theme's colours, plus a one-line added/removed summary.
 
+### Report Viewer
+
+**Tools → Report Viewer Tab** opens what a run produced, whatever ran it, into one view.
+
+- **Reads** the automation packages' own reports (APITestka, AutoControl, WebRunner, LoadDensity: the `<name>_success.json` / `<name>_failure.json` pair or the `.xml` pair; open either and the other is read with it), **JUnit XML** (pytest's `--junitxml`, and most other runners), and reports exported from PyBreeze. What a file is, is told from what it holds.
+- **Shows** each run as a tree with how every result ended and how long it took; the selected result's details and error, its output, what it left behind, and the package's own record of it, untouched.
+- **Filters** all open runs together: by ending (passed, failed, error, skipped), by time taken, by package, and by text in a name or an error. A line under the tree counts what is shown.
+- **Exports** a run as an execution report (JSON), as **JUnit XML** for a CI service's test summary, or as one self-contained **HTML page** for people, which can be opened here again.
+- The **MCP Client**'s Calls page opens its session here with **Open in Report Viewer**.
+
+A report is a file from somewhere: it is read as data (XML that declares a document type is refused), everything in it is shown as text, and the paths it names are listed, not opened.
+
+### MCP Client
+
+**Tools → MCP Client Tab** connects to [Model Context Protocol](https://modelcontextprotocol.io) servers and shows what each offers: **tools** to call, **resources** to read, **prompts** to fill in.
+
+- **Servers** are set up once and kept for you (`~/.pybreeze/mcp_servers.json`, readable by you alone): a name, the command that starts the server (one argument a line, never a shell line), its environment variables, and how long a request may take. The file uses the `mcpServers` layout other clients write, so a list made elsewhere can be dropped in.
+- **A call is asked about first**: the tool, the server and the arguments as they will be sent, with No as the default. Tick *Do not ask again* to trust one tool of one server. What a server says of its own tool ("changes nothing") is shown, not relied on.
+- **A server that comes with a project** (`.mcp.json` in the project folder) is listed, never started by itself: connecting to it shows its command and asks.
+- **Cancel** gives up a call on its way; a server that does not answer within its time limit is given up on; one that goes away is said so, with the last line of its own log. **Connect** again to start over.
+- **Calls** lists the session: when, which tool, how it ended, how long it took. **Export Session...** saves it as an execution report (JSON).
+
+Put keys and tokens in the server's environment variables, not in its command: their values are shown as dots, and are taken out of the log, of error messages and of exported sessions wherever they turn up. Servers are started as local programs (the protocol's standard-input-and-output transport).
+
+### Keywords for action scripts
+
+A WebRunner, AutoControl or LoadDensity script is a JSON list of actions, `["keyword"]` or `["keyword", arguments]`. Open one (`.json`) in the editor and it is completed and checked against the keywords of the framework **as it is installed**:
+
+- **Completion** — the framework's keywords where an action's name goes, a keyword's parameters where an argument's name goes.
+- **Diagnostics** — a keyword that version does not have (with the nearest one suggested), a parameter the keyword does not take, a required one left out, a list of values of the wrong length, an action of the wrong shape, and text that is not JSON. In the IDE's language.
+- **Hover** and **go to definition** — a keyword's signature and documentation, and the line of the package that defines it.
+
+Nothing about a keyword is kept in PyBreeze. Each framework is asked, in a process of its own, by the interpreter that runs your scripts (the one chosen in the IDE, a `.venv` in the project, else the IDE's own), so upgrading a framework changes what is offered. A framework that is missing or fails to import costs its own keywords and nothing else.
+
+**Tools → Automation Keywords Tab** shows the same keywords: each framework's version, what the editor offers for it, every keyword with its parameters and documentation, a filter, and **Copy as Action**. When a framework gives none, it says why.
+
+The editor gets all this from a language server, which any editor that speaks the Language Server Protocol can start too:
+
+```bash
+python -m pybreeze.extend.language_server [--interpreter /path/to/python] [--language Traditional_Chinese]
+```
+
+### JSON Editor
+
+Edit a JSON file as a **Tree** or as **Text** (**Tools → JSON Editor Tab**). Both are views of one document, so they cannot disagree.
+
+- **Tree** — add, delete, move up or down, and rename in place; type over a value, or give it another type (object, array, string, number, boolean, null). A number is kept as it is written: `1.0` stays `1.0`.
+- **Text** — the JSON itself, always there. It is checked as you type and a line under the views says where it stops being JSON; the tree waits until it is JSON again, and nothing typed is thrown away.
+- **Undo / Redo** step through the document whichever view changed it, and a tab with unsaved changes asks before it closes or opens another file.
+- A file is written back the way it was found: its indent (spaces or tabs), on one line if it was, with its final line break. Alignment by hand and blank lines are not kept by an edit in the tree.
+
+It is a JSON editor, not a second code editor: a file is opened into it from its **Open...** button.
+
 ### The everyday utilities
 
 Each is a tab or a dock, each has the same copy / open-in-editor / save-to-file row along the bottom.
@@ -215,7 +279,7 @@ Loaded plugins appear under their own **Plugins** menu with an About entry and o
 - **English** (default)
 - **Traditional Chinese** (繁體中文)
 
-Menus, dialogs, the reasons a tool refuses its input and the run window's own notices (`[Error] …`, `[Run] …`) all follow the chosen language. Both dictionaries carry the same 768 keys, and a test enforces that parity so a new string can never land in one language only. The Language menu also lists JEditor's Japanese and Simplified Chinese: picked, JEditor's own menus change and PyBreeze's strings stay in English. Further languages can be added via translation plugins.
+Menus, dialogs, the reasons a tool refuses its input and the run window's own notices (`[Error] …`, `[Run] …`) all follow the chosen language. Both dictionaries carry the same 995 keys, and a test enforces that parity so a new string can never land in one language only. English and Traditional Chinese are the languages PyBreeze maintains. The Language menu also lists JEditor's Japanese (日本語) and Simplified Chinese (简体中文), which PyBreeze passes on without translating: picked, JEditor's own menus change and PyBreeze's strings stay in English. Further languages can be added via translation plugins.
 
 ---
 
@@ -344,6 +408,8 @@ Once launched:
 4. **Generate** an HTML / JSON / XML report
 5. **Send** it by email through the MailThunder integration
 
+New here? The [tutorials](https://pybreeze.readthedocs.io/en/latest/Eng/tutorials/index.html) are thirteen short pages, each with an example that runs and what to expect from it: the first launch, a first API, browser, desktop and load run, tests from cURL and HAR, header findings as SARIF in CI, the JSON editor, keywords for action scripts, the MCP client, reports in CI, plugins, and troubleshooting. They test a small site on your own machine, so none of them needs an account.
+
 ### Log file
 
 PyBreeze writes its log to `~/.pybreeze/logs/PyBreeze.log`: UTF-8, appended to by every run, each line carrying the process ID. Only warnings and errors also appear in the editor's Code Result panel. Two environment variables change this:
@@ -449,7 +515,7 @@ python -m pytest test/test_utils/ -v --tb=short
 
 - **Unit tests** — `test/test_utils/`, covering the pure-logic layer (curl and HAR parsing, header analysis, SSRF validation, JWT, hashing, timestamps, diffing) plus headless Qt widget tests via `QT_QPA_PLATFORM=offscreen`, with Hypothesis property tests over the parsers. The SSH terminal and the SFTP file tree also log in to an SSH server the tests start on the loopback address, which serves a temporary folder over SFTP
 - **Startup tests** — `test/unit_test/start_automation/` launches the IDE in debug mode and verifies it comes up and exits cleanly
-- **CI** — GitHub Actions on Windows across Python 3.10 – 3.14, on every push and PR plus a nightly run; a push to `dev` that passes also publishes `pybreeze_dev` when the package changed
+- **CI** — GitHub Actions: the whole suite on Windows across Python 3.10 – 3.14, and a short set of platform smoke tests on Linux and macOS, on every push and PR plus a nightly run; a push to `dev` that passes the suite also publishes `pybreeze_dev` when the package changed
 - **Static analysis** — SonarCloud, Codacy and Bandit
 
 ---
@@ -463,6 +529,10 @@ python -m pytest test/test_utils/ -v --tb=short
 
 ---
 
+## Security
+
+Report vulnerabilities privately. The policy, supported versions, and operator notes are in [SECURITY.md](SECURITY.md).
+
 ## License
 
 MIT — see [LICENSE](LICENSE). Copyright (c) 2022 JE-Chen

pybreeze_dev-1.0.19/pybreeze/extend/language_server/__init__.py

@@ -0,0 +1,6 @@
+"""The action language server as a process the editor starts (``python -m pybreeze.extend.language_server``).
+
+The protocol and the answers are in ``pybreeze/utils/language_service/``. Here
+is what makes a process of them: the entry point, the frameworks asked for
+their keywords, and the command JEditor's editors start it with.
+"""

pybreeze_dev-1.0.19/pybreeze/extend/language_server/__main__.py

@@ -0,0 +1,17 @@
+"""Start the action language server on this process's standard input and output."""
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+# The editor starts this file by its path, not with -m: the folder the IDE is
+# in (a project someone opened) is then not on the import path, and a package
+# there called pybreeze is not what gets imported. Started that way the path
+# begins with this folder, and the folder PyBreeze is in takes its place.
+if not __package__:
+    sys.path[0] = str(Path(__file__).resolve().parents[3])
+
+from pybreeze.extend.language_server.server_main import main  # noqa: E402 — the import path is set first
+
+if __name__ == "__main__":
+    raise SystemExit(main(sys.argv[1:]))

pybreeze_dev-1.0.19/pybreeze/extend/language_server/launch.py

@@ -0,0 +1,42 @@
+"""Have JEditor's editors start the action language server for JSON files.
+
+JEditor's editor asks a language server about the file it holds, chosen by the
+file's suffix from ``je_editor.utils.lsp.language_servers.DEFAULT_SERVERS``.
+PyBreeze puts its own server there for ``.json``: the automation scripts are
+JSON, and for any other JSON file the server says only whether it is JSON.
+"""
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+from je_editor.utils.lsp.language_servers import DEFAULT_SERVERS
+
+# The files the server answers for
+ACTION_SCRIPT_SUFFIX = ".json"
+_ENTRY = Path(__file__).with_name("__main__.py")
+
+
+def can_serve() -> bool:
+    """Whether there is an interpreter to run the server with: not in a packaged build, where ``sys.executable`` is the app."""
+    return not getattr(sys, "frozen", False)
+
+
+def server_command(interpreter: str | None, language: str) -> list[str]:
+    """The command that starts the server.
+
+    The entry is named by its path rather than with ``-m``, which would put
+    the folder the IDE is in first on the server's import path.
+
+    :param interpreter: the Python that runs the scripts; the IDE's own when ``None``
+    :param language: the IDE's language, by JEditor's name for it
+    """
+    command = [sys.executable, str(_ENTRY), "--language", language]
+    if interpreter:
+        command += ["--interpreter", interpreter]
+    return command
+
+
+def offer_to_jeditor(interpreter: str | None, language: str) -> None:
+    """Make the action language server the one JEditor's editors start for a JSON file."""
+    DEFAULT_SERVERS[ACTION_SCRIPT_SUFFIX] = server_command(interpreter, language)

pybreeze_dev-1.0.19/pybreeze/extend/language_server/server_main.py

@@ -0,0 +1,59 @@
+"""The action language server's process: its arguments, the frameworks it asks, the language it answers in."""
+from __future__ import annotations
+
+import argparse
+import sys
+from collections.abc import Callable
+from functools import partial
+from importlib import metadata as installed
+
+from pybreeze.extend_multi_language.supported_languages import MAINTAINED
+from pybreeze.utils.exception.exceptions import LanguageServiceException
+from pybreeze.utils.language_service.framework_profiles import PROFILES, FrameworkProfile
+from pybreeze.utils.language_service.lsp_server import ActionLanguageServer, serve
+from pybreeze.utils.language_service.metadata_probe import read_metadata
+
+
+def words_of(language: str) -> dict[str, str]:
+    """PyBreeze's strings in *language*; in English for a language PyBreeze does not maintain."""
+    return next((each.words for each in MAINTAINED if each.key == language), MAINTAINED[0].words)
+
+
+def server_version() -> str:
+    """The installed PyBreeze's version; empty when it runs from a source tree."""
+    try:
+        return installed.version("pybreeze")
+    except installed.PackageNotFoundError:
+        return ""
+
+
+def ask_framework(
+        server: ActionLanguageServer, profile: FrameworkProfile, interpreter: str | None) -> Callable[[], list[dict]]:
+    """Ask *profile*'s framework for its keywords, and return what gives *server* the answer.
+
+    The asking imports the framework in a process of its own and takes
+    seconds: the server runs this on a thread and goes on answering.
+    """
+    try:
+        metadata = read_metadata(profile, interpreter)
+    except LanguageServiceException as error:
+        return partial(server.decline, profile.framework, str(error))
+    return partial(server.offer, metadata)
+
+
+def main(arguments: list[str]) -> int:
+    """Serve the protocol on standard input and output until the editor says ``exit`` or goes away."""
+    parser = argparse.ArgumentParser(
+        prog="python -m pybreeze.extend.language_server",
+        description="Language server for WebRunner, AutoControl and LoadDensity action scripts (JSON), "
+                    "speaking the Language Server Protocol on standard input and output.")
+    parser.add_argument("--interpreter", default=None,
+                        help="the Python that runs the scripts, whose installed frameworks are asked for their "
+                             "keywords (default: the one running this server)")
+    parser.add_argument("--language", default=MAINTAINED[0].key,
+                        help="the language of the diagnostics, as the IDE names it (default: %(default)s)")
+    options = parser.parse_args(arguments)
+    server = ActionLanguageServer(words_of(options.language), server_version())
+    serve(server, sys.stdin.buffer, sys.stdout.buffer,
+          [partial(ask_framework, server, profile, options.interpreter) for profile in PROFILES])
+    return 0

pybreeze_dev-1.0.19/pybreeze/extend_multi_language/english_integrations.py

@@ -0,0 +1,165 @@
+"""PyBreeze's English strings for the features that reach outside the IDE.
+
+The frameworks' keywords and the language service that answers the editor from
+them, and the MCP client. They are merged into ``pybreeze_english_word_dict``
+(``extend_english.py``), which is the dictionary everything reads: this file
+only keeps that one under a thousand lines.
+"""
+from __future__ import annotations
+
+ENGLISH_INTEGRATION_WORDS: dict[str, str] = {
+    # MCP client
+    "extend_tools_menu_mcp_client_tab_action": "MCP Client Tab",
+    "extend_tools_menu_mcp_client_tab_label": "MCP Client",
+    "extend_tools_menu_mcp_client_dock_action": "MCP Client Dock",
+    "extend_tools_menu_mcp_client_dock_title": "MCP Client",
+    "mcp_servers_label": "Servers",
+    "mcp_servers_found_label": "{name} (from this project)",
+    "mcp_servers_add_button": "Add...",
+    "mcp_servers_edit_button": "Edit...",
+    "mcp_servers_remove_button": "Remove",
+    "mcp_servers_connect_button": "Connect",
+    "mcp_servers_disconnect_button": "Disconnect",
+    "mcp_servers_remove_title": "Remove a server",
+    "mcp_servers_remove_question": "Remove {name} from your servers?",
+    "mcp_page_tools": "Tools",
+    "mcp_page_resources": "Resources",
+    "mcp_page_prompts": "Prompts",
+    "mcp_page_calls": "Calls",
+    "mcp_tools_filter_placeholder": "Filter the tools",
+    "mcp_tools_arguments_label": "Arguments (a JSON object):",
+    "mcp_tools_call_button": "Call",
+    "mcp_tools_cancel_button": "Cancel",
+    "mcp_tools_hint_read_only": "The server says this tool changes nothing.",
+    "mcp_tools_hint_destructive": "The server says this tool may destroy or overwrite something.",
+    "mcp_tools_hint_unknown": "The server does not say whether this tool changes anything.",
+    "mcp_result_cut": "(cut here: {shown} of {whole} characters are shown)",
+    "mcp_resources_read_button": "Read",
+    "mcp_prompts_get_button": "Get",
+    "mcp_prompts_arguments_label": "Arguments (a JSON object of texts):",
+    "mcp_calls_column_when": "When",
+    "mcp_calls_column_tool": "Tool",
+    "mcp_calls_column_status": "Ended",
+    "mcp_calls_column_seconds": "Seconds",
+    "mcp_calls_status_passed": "answered",
+    "mcp_calls_status_failed": "failed",
+    "mcp_calls_status_error": "not answered",
+    "mcp_calls_status_skipped": "not called",
+    "mcp_calls_export_button": "Export Session...",
+    "mcp_calls_export_title": "Export the session",
+    "mcp_calls_file_filter": "JSON (*.json)",
+    "mcp_client_not_connected": "Not connected. Choose a server and connect.",
+    "mcp_client_servers_unreadable": "Your MCP servers could not be read: {reason}",
+    "mcp_client_connecting": "Connecting to {name}...",
+    "mcp_client_connected": "Connected to {server}: {tools} tools, {resources} resources, {prompts} prompts",
+    "mcp_client_disconnected": "Disconnected from {name}",
+    "mcp_client_failed_with_log": "{reason}. The server's log ends: {line}",
+    "mcp_client_arguments_not_object": "The arguments have to be a JSON object: names and their values, in braces",
+    "mcp_client_calling": "Calling {tool}...",
+    "mcp_client_called": "{tool} answered in {seconds} s",
+    "mcp_client_tool_failed": "{tool} ran and says it failed",
+    "mcp_client_declined": "{tool} was not called",
+    "mcp_client_fetching": "Getting {name}...",
+    "mcp_client_fetched": "Done",
+    "mcp_client_exported": "The session was saved to {file}",
+    "mcp_confirm_title": "Call an MCP tool",
+    "mcp_confirm_question": "Call {tool} on {server}?",
+    "mcp_confirm_arguments": "It will be called with:",
+    "mcp_confirm_trust": "Do not ask again for {tool} on {server}",
+    "mcp_found_title": "Start a server from this project",
+    "mcp_found_question":
+        "{name} comes from a file in the project folder (.mcp.json), not from your own servers. Starting it runs this command on your machine. Start it?",
+    "mcp_profile_dialog_title": "MCP server",
+    "mcp_profile_name_label": "Name:",
+    "mcp_profile_command_label": "Command:",
+    "mcp_profile_command_placeholder": "The program, then one argument on each line",
+    "mcp_profile_folder_label": "Start in:",
+    "mcp_profile_browse_button": "Browse...",
+    "mcp_profile_timeout_label": "Seconds a request may take:",
+    "mcp_profile_environment_label": "Environment variables:",
+    "mcp_profile_environment_note":
+        "Keys and tokens go here, not in the command: the command is shown when the server is started, and these values are not. They are kept in a file only you can read, and left out of the log and of exported sessions.",
+    "mcp_profile_variable_name": "Name",
+    "mcp_profile_variable_value": "Value",
+    "mcp_profile_add_variable_button": "Add Variable",
+    "mcp_profile_remove_variable_button": "Remove Variable",
+    "mcp_profile_show_values": "Show values",
+    "mcp_profile_needs_name": "A server needs a name",
+    "mcp_profile_name_taken": "Another server already has that name",
+    "mcp_profile_needs_command": "A server needs a command: the program that starts it",
+    # Report viewer
+    "extend_tools_menu_report_viewer_tab_action": "Report Viewer Tab",
+    "extend_tools_menu_report_viewer_tab_label": "Report Viewer",
+    "extend_tools_menu_report_viewer_dock_action": "Report Viewer Dock",
+    "extend_tools_menu_report_viewer_dock_title": "Report Viewer",
+    "report_status_passed": "passed",
+    "report_status_failed": "failed",
+    "report_status_error": "error",
+    "report_status_skipped": "skipped",
+    "report_column_name": "Name",
+    "report_column_status": "Ended",
+    "report_column_seconds": "Seconds",
+    "report_html_detail": "What it said",
+    "report_html_output": "Output",
+    "report_html_seconds": "{seconds} s",
+    "report_format_json": "Execution report",
+    "report_format_junit": "JUnit XML",
+    "report_format_html": "HTML page",
+    "report_viewer_open_button": "Open...",
+    "report_viewer_export_button": "Export...",
+    "report_viewer_close_button": "Close Report",
+    "report_viewer_at_least_label": "At least (s):",
+    "report_viewer_every_framework": "Every package",
+    "report_viewer_filter_placeholder": "Filter by name or error",
+    "report_viewer_tab_details": "Details",
+    "report_viewer_tab_output": "Output",
+    "report_viewer_tab_attachments": "Attachments",
+    "report_viewer_tab_raw": "Own record",
+    "report_viewer_open_title": "Open reports",
+    "report_viewer_open_filter": "Reports (*.json *.xml *.html *.htm);;All Files (*)",
+    "report_viewer_export_title": "Export the report",
+    "report_viewer_not_read": "{file} was not opened: {reason}",
+    "report_viewer_exported": "The report was saved to {file}",
+    "report_viewer_nothing_open":
+        "No report is open. Open a package's _success or _failure file, JUnit XML, or an exported report.",
+    "report_viewer_summary": "{shown} of {every} results shown, from {runs} reports, {seconds} s",
+    "mcp_calls_view_button": "Open in Report Viewer",
+    # Automation keywords
+    "keyword_reference_framework_label": "Framework:",
+    "keyword_reference_refresh_button": "Read Again",
+    "keyword_reference_search_placeholder": "Filter by name or description",
+    "keyword_reference_copy_button": "Copy as Action",
+    "keyword_reference_loading": "Reading the keywords of {framework}...",
+    "keyword_reference_ready": "{framework}: {count} keywords. In a .json script the editor offers "
+                               "{capabilities}",
+    "keyword_reference_capability_completion": "completion",
+    "keyword_reference_capability_diagnostics": "diagnostics",
+    "keyword_reference_capability_hover": "hover",
+    "keyword_reference_capability_definition": "go to definition",
+    "keyword_reference_defined_in": "Defined in {file}, line {line}",
+    "keyword_reference_no_interpreter": "No Python interpreter was found to read the keywords with",
+    # Language service for action scripts (diagnostics and hover, shown by the editor)
+    "language_service_json_syntax": "This is not valid JSON",
+    "language_service_unknown_keyword": "{name} is not a keyword of {framework}",
+    "language_service_unknown_keyword_suggestion":
+        "{name} is not a keyword of {framework}. Did you mean {suggestion}?",
+    "language_service_unknown_parameter": "{keyword} has no parameter named {name}",
+    "language_service_unknown_parameter_suggestion":
+        "{keyword} has no parameter named {name}. Did you mean {suggestion}?",
+    "language_service_missing_parameter": "{keyword} needs {names}",
+    "language_service_too_many_values":
+        "{keyword} takes at most {most} values in a list, and this one gives {count}",
+    "language_service_too_few_values":
+        "{keyword} needs at least {least} values in a list, and this one gives {count}",
+    "language_service_needs_names":
+        "{keyword} takes {names} by name only: give an object of named values, not a list",
+    "language_service_action_not_list":
+        "An action is a list: [\"keyword\"] or [\"keyword\", arguments]",
+    "language_service_action_no_keyword": "An action starts with its keyword, in quotes",
+    "language_service_action_too_long": "An action holds a keyword and at most one set of arguments",
+    "language_service_arguments_shape":
+        "Arguments are an object of named values, or a list of values",
+    "language_service_actions_not_list": "{key} holds a list of actions",
+    "language_service_parameter_required": "required",
+    "language_service_parameter_optional": "optional",
+}