PyBreeze 1.0.25__tar.gz → 1.0.26__tar.gz

{pybreeze-1.0.25 → pybreeze-1.0.26}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pybreeze
-Version: 1.0.25
+Version: 1.0.26
 Summary: IDE for multi automation
 Author-email: JE-Chen <jechenmailman@gmail.com>
 Project-URL: Homepage, https://github.com/Intergration-Automation-Testing/AutomationEditor
@@ -109,16 +109,18 @@ PyBreeze is not just a code editor — it is a command center for the automation
   - Mermaid `flowchart` / `graph` import
   - Save/Open as `.diagram.json`, export to PNG or SVG
   - Undo/redo, align, distribute, grid, snap, and zoom controls
-- **cURL Import** — Paste a `curl` command copied from your browser's dev tools and generate a ready-to-run script for the target of your choice: **Python `requests`**, an **APITestka Python** snippet (`test_api_method_requests(...)`), an **APITestka JSON action** (`[["AT_test_api_method", {...}]]`) that `execute_files` runs directly, or a **LoadDensity** Locust load-test (`start_test(...)`). (These are the HTTP-oriented modules; a curl request has no meaningful mapping to the browser or desktop-GUI automation modules.) Parses the method, URL, headers, body, basic auth, `-G` query parameters, `-F` multipart form fields (file uploads become `files=open(...)`), the `--json` shortcut (which also sets the JSON `Content-Type`/`Accept`), and `-d @file` bodies (which become `open(...).read()`, while `--data-raw` stays literal) — all with multi-line `\` / `^` continuations. It knows the arity of curl's common flags, so value-taking options like `--max-time 30` or `-o out.json` never leak into the URL; it URL-encodes `--data-urlencode` values the way curl does; and it infers `POST` when a body or form is present and sends JSON bodies as JSON. Targets include Python `requests`, a ready-to-run **pytest test** (a named `test_...` function that sends the request and asserts the status), APITestka (Python and JSON action), and a LoadDensity load test. Pick one from the dropdown, then copy the result, **open it straight into a new editor tab**, or **save it to a `.py` / `.json` file** (the extension follows the chosen target). The parser is pure logic and never executes the command.
+- **cURL Import** — Paste a `curl` command copied from your browser's dev tools and generate a ready-to-run script for the target of your choice: **Python `requests`**, an **APITestka Python** snippet (`test_api_method_requests(...)`), an **APITestka JSON action** (`[["AT_test_api_method", {...}]]`) that `execute_files` runs directly, or a **LoadDensity** Locust load-test (`start_test(...)`). (These are the HTTP-oriented modules; a curl request has no meaningful mapping to the browser or desktop-GUI automation modules.) Parses the method, URL, headers, body, basic auth, `-G` query parameters, `-F` multipart form fields (file uploads become `files=open(...)`), the `--json` shortcut (which also sets the JSON `Content-Type`/`Accept`), and `-d @file` bodies (which become `open(...).read()`, while `--data-raw` stays literal) — all with multi-line `\` / `^` continuations. It knows the arity of curl's common flags, so value-taking options like `--max-time 30` or `-o out.json` never leak into the URL; it URL-encodes `--data-urlencode` values the way curl does; and it infers `POST` when a body or form is present and sends JSON bodies as JSON. Targets include Python `requests`, a ready-to-run **pytest test** (a named `test_...` function that sends the request and asserts the status), APITestka (Python and JSON action), and a LoadDensity load test. Pick one from the dropdown, then copy the result, **open it straight into a new editor tab**, or **save it to a `.py` / `.json` file** (the extension follows the chosen target). A repeated `-H` is handled the way HTTP handles it — the values are combined into one header (with `; ` for cookies) rather than the last one silently winning, and names are matched case-insensitively so an explicit header always beats one implied by another flag. One click also **hands the parsed URL to the URL parser/builder**, query string and all. The parser is pure logic and never executes the command.
 - **JWT Decoder** — Paste a JSON Web Token and read its header and payload as pretty-printed JSON, with standard timestamp claims (`exp`, `iat`, `nbf`, `auth_time`) rendered as readable UTC times. Inspection only — the signature is never verified and the token is never trusted.
 - **Timestamp Converter** — Enter a Unix epoch value (seconds or milliseconds, auto-detected) or an ISO-8601 date-time (with `Z` or an offset) and get every representation back in UTC. Deterministic and independent of the local time zone.
 - **Hash Generator** — Compute SHA-256, SHA-512, SHA-1 and MD5 digests of any text at once. A general-purpose checksum tool (MD5/SHA-1 are provided for interoperability with `usedforsecurity=False`, never for security decisions).
 - **Query ⇄ JSON** — Convert an `application/x-www-form-urlencoded` query string to pretty JSON and back, URL-decoding and -encoding as needed. Repeated keys become JSON arrays and vice versa. Copy the result, open it in an editor tab, or save it to a file.
+- **URL Parser / Builder** — Paste a URL to see its scheme, host, port, path, query, fragment and credentials as an editable JSON object, tweak any part, and turn it back into a URL. Round-trips both ways, brackets IPv6 literals, and re-encodes query parameters for you. The cURL importer can send a request's URL straight here.
+- **HTTP Header Analyzer** — Paste a request or response header block (from dev tools, `curl -i`, or a proxy log) and read back every field plus what is worth knowing about it: names sent more than once, `Set-Cookie` entries missing `Secure` / `HttpOnly` / `SameSite`, a wildcard CORS policy (and the wildcard-plus-credentials combination browsers reject outright), an HSTS `max-age` too short to survive a restart, CSP `unsafe-inline` / `unsafe-eval`, product banners, deprecated headers, and — for responses — the security headers that are absent. Headers carrying credentials are reported by name only; their values are never copied into the report. The Response Inspector hands its headers here in one click.
 - **Regex Tester** — Try a regular expression against sample text with `IGNORECASE` / `MULTILINE` / `DOTALL` / `VERBOSE` flags, and see every match with its offsets, numbered groups and named groups. Invalid patterns report a friendly error instead of crashing.
 - **HTTP Status Reference** — Search the full HTTP status code table (sourced from the standard library, so it stays current) by code prefix or keyword, with the reason phrase, description and status class for each.
 - **Text Diff** — Compare two pieces of text (for example an expected vs. actual API response) side by side and get a unified diff plus a one-line summary of how many lines were added or removed. Copy the diff, open it in an editor tab, or save it to a file.
 - **JSON Format** — Pretty-print or minify a JSON payload, with a clear validation error when the input is not valid JSON. Copy the result, open it in a new editor tab, or save it to a file.
-- **Response Inspector** — Paste a raw HTTP response and get a decoded summary in one step: the status code is looked up in the HTTP reference, headers are parsed, a JSON body is pretty-printed, and any JWTs anywhere in the text (for example an `Authorization: Bearer` header) are decoded with their timestamp claims shown in UTC. Ties the HTTP-status, JSON-format and JWT tools together, and can open a found status code or JWT directly in its dedicated tool tab, pre-filled.
+- **Response Inspector** — Paste a raw HTTP response and get a decoded summary in one step: the status code is looked up in the HTTP reference, headers are parsed, a JSON body is pretty-printed, and any JWTs anywhere in the text (for example an `Authorization: Bearer` header) are decoded with their timestamp claims shown in UTC. Ties the HTTP-status, JSON-format and JWT tools together, and can open a found status code, JWT, or the whole header block directly in its dedicated tool tab, pre-filled.
 - **File Tree Context Menu** — Right-click any file or folder in the project tree to create files/folders, rename, delete, copy absolute or relative paths, or reveal the item in your platform file manager. Renaming or deleting a file that is currently open in an editor tab keeps the tab in sync.
 - **Package Manager** — Install automation modules and build tools directly from the IDE menu without leaving the editor.
 - **Integrated Documentation** — Quick access to documentation and GitHub pages for each automation module directly from the menu bar.
@@ -254,6 +256,8 @@ PyBreeze UI (PySide6)
 │   ├── Timestamp Converter (epoch ⇄ ISO-8601)
 │   ├── Hash Generator (SHA-256/512, SHA-1, MD5)
 │   ├── Query ⇄ JSON Converter
+│   ├── URL Parser / Builder (URL ⇄ JSON parts)
+│   ├── HTTP Header Analyzer (duplicates, cookie flags, security headers)
 │   ├── Regex Tester
 │   ├── HTTP Status Reference
 │   ├── Text Diff

{pybreeze-1.0.25 → pybreeze-1.0.26}/README.md

@@ -76,16 +76,18 @@ PyBreeze is not just a code editor — it is a command center for the automation
   - Mermaid `flowchart` / `graph` import
   - Save/Open as `.diagram.json`, export to PNG or SVG
   - Undo/redo, align, distribute, grid, snap, and zoom controls
-- **cURL Import** — Paste a `curl` command copied from your browser's dev tools and generate a ready-to-run script for the target of your choice: **Python `requests`**, an **APITestka Python** snippet (`test_api_method_requests(...)`), an **APITestka JSON action** (`[["AT_test_api_method", {...}]]`) that `execute_files` runs directly, or a **LoadDensity** Locust load-test (`start_test(...)`). (These are the HTTP-oriented modules; a curl request has no meaningful mapping to the browser or desktop-GUI automation modules.) Parses the method, URL, headers, body, basic auth, `-G` query parameters, `-F` multipart form fields (file uploads become `files=open(...)`), the `--json` shortcut (which also sets the JSON `Content-Type`/`Accept`), and `-d @file` bodies (which become `open(...).read()`, while `--data-raw` stays literal) — all with multi-line `\` / `^` continuations. It knows the arity of curl's common flags, so value-taking options like `--max-time 30` or `-o out.json` never leak into the URL; it URL-encodes `--data-urlencode` values the way curl does; and it infers `POST` when a body or form is present and sends JSON bodies as JSON. Targets include Python `requests`, a ready-to-run **pytest test** (a named `test_...` function that sends the request and asserts the status), APITestka (Python and JSON action), and a LoadDensity load test. Pick one from the dropdown, then copy the result, **open it straight into a new editor tab**, or **save it to a `.py` / `.json` file** (the extension follows the chosen target). The parser is pure logic and never executes the command.
+- **cURL Import** — Paste a `curl` command copied from your browser's dev tools and generate a ready-to-run script for the target of your choice: **Python `requests`**, an **APITestka Python** snippet (`test_api_method_requests(...)`), an **APITestka JSON action** (`[["AT_test_api_method", {...}]]`) that `execute_files` runs directly, or a **LoadDensity** Locust load-test (`start_test(...)`). (These are the HTTP-oriented modules; a curl request has no meaningful mapping to the browser or desktop-GUI automation modules.) Parses the method, URL, headers, body, basic auth, `-G` query parameters, `-F` multipart form fields (file uploads become `files=open(...)`), the `--json` shortcut (which also sets the JSON `Content-Type`/`Accept`), and `-d @file` bodies (which become `open(...).read()`, while `--data-raw` stays literal) — all with multi-line `\` / `^` continuations. It knows the arity of curl's common flags, so value-taking options like `--max-time 30` or `-o out.json` never leak into the URL; it URL-encodes `--data-urlencode` values the way curl does; and it infers `POST` when a body or form is present and sends JSON bodies as JSON. Targets include Python `requests`, a ready-to-run **pytest test** (a named `test_...` function that sends the request and asserts the status), APITestka (Python and JSON action), and a LoadDensity load test. Pick one from the dropdown, then copy the result, **open it straight into a new editor tab**, or **save it to a `.py` / `.json` file** (the extension follows the chosen target). A repeated `-H` is handled the way HTTP handles it — the values are combined into one header (with `; ` for cookies) rather than the last one silently winning, and names are matched case-insensitively so an explicit header always beats one implied by another flag. One click also **hands the parsed URL to the URL parser/builder**, query string and all. The parser is pure logic and never executes the command.
 - **JWT Decoder** — Paste a JSON Web Token and read its header and payload as pretty-printed JSON, with standard timestamp claims (`exp`, `iat`, `nbf`, `auth_time`) rendered as readable UTC times. Inspection only — the signature is never verified and the token is never trusted.
 - **Timestamp Converter** — Enter a Unix epoch value (seconds or milliseconds, auto-detected) or an ISO-8601 date-time (with `Z` or an offset) and get every representation back in UTC. Deterministic and independent of the local time zone.
 - **Hash Generator** — Compute SHA-256, SHA-512, SHA-1 and MD5 digests of any text at once. A general-purpose checksum tool (MD5/SHA-1 are provided for interoperability with `usedforsecurity=False`, never for security decisions).
 - **Query ⇄ JSON** — Convert an `application/x-www-form-urlencoded` query string to pretty JSON and back, URL-decoding and -encoding as needed. Repeated keys become JSON arrays and vice versa. Copy the result, open it in an editor tab, or save it to a file.
+- **URL Parser / Builder** — Paste a URL to see its scheme, host, port, path, query, fragment and credentials as an editable JSON object, tweak any part, and turn it back into a URL. Round-trips both ways, brackets IPv6 literals, and re-encodes query parameters for you. The cURL importer can send a request's URL straight here.
+- **HTTP Header Analyzer** — Paste a request or response header block (from dev tools, `curl -i`, or a proxy log) and read back every field plus what is worth knowing about it: names sent more than once, `Set-Cookie` entries missing `Secure` / `HttpOnly` / `SameSite`, a wildcard CORS policy (and the wildcard-plus-credentials combination browsers reject outright), an HSTS `max-age` too short to survive a restart, CSP `unsafe-inline` / `unsafe-eval`, product banners, deprecated headers, and — for responses — the security headers that are absent. Headers carrying credentials are reported by name only; their values are never copied into the report. The Response Inspector hands its headers here in one click.
 - **Regex Tester** — Try a regular expression against sample text with `IGNORECASE` / `MULTILINE` / `DOTALL` / `VERBOSE` flags, and see every match with its offsets, numbered groups and named groups. Invalid patterns report a friendly error instead of crashing.
 - **HTTP Status Reference** — Search the full HTTP status code table (sourced from the standard library, so it stays current) by code prefix or keyword, with the reason phrase, description and status class for each.
 - **Text Diff** — Compare two pieces of text (for example an expected vs. actual API response) side by side and get a unified diff plus a one-line summary of how many lines were added or removed. Copy the diff, open it in an editor tab, or save it to a file.
 - **JSON Format** — Pretty-print or minify a JSON payload, with a clear validation error when the input is not valid JSON. Copy the result, open it in a new editor tab, or save it to a file.
-- **Response Inspector** — Paste a raw HTTP response and get a decoded summary in one step: the status code is looked up in the HTTP reference, headers are parsed, a JSON body is pretty-printed, and any JWTs anywhere in the text (for example an `Authorization: Bearer` header) are decoded with their timestamp claims shown in UTC. Ties the HTTP-status, JSON-format and JWT tools together, and can open a found status code or JWT directly in its dedicated tool tab, pre-filled.
+- **Response Inspector** — Paste a raw HTTP response and get a decoded summary in one step: the status code is looked up in the HTTP reference, headers are parsed, a JSON body is pretty-printed, and any JWTs anywhere in the text (for example an `Authorization: Bearer` header) are decoded with their timestamp claims shown in UTC. Ties the HTTP-status, JSON-format and JWT tools together, and can open a found status code, JWT, or the whole header block directly in its dedicated tool tab, pre-filled.
 - **File Tree Context Menu** — Right-click any file or folder in the project tree to create files/folders, rename, delete, copy absolute or relative paths, or reveal the item in your platform file manager. Renaming or deleting a file that is currently open in an editor tab keeps the tab in sync.
 - **Package Manager** — Install automation modules and build tools directly from the IDE menu without leaving the editor.
 - **Integrated Documentation** — Quick access to documentation and GitHub pages for each automation module directly from the menu bar.
@@ -221,6 +223,8 @@ PyBreeze UI (PySide6)
 │   ├── Timestamp Converter (epoch ⇄ ISO-8601)
 │   ├── Hash Generator (SHA-256/512, SHA-1, MD5)
 │   ├── Query ⇄ JSON Converter
+│   ├── URL Parser / Builder (URL ⇄ JSON parts)
+│   ├── HTTP Header Analyzer (duplicates, cookie flags, security headers)
 │   ├── Regex Tester
 │   ├── HTTP Status Reference
 │   ├── Text Diff

{pybreeze-1.0.25 → pybreeze-1.0.26}/pybreeze/extend_multi_language/extend_english.py

@@ -331,6 +331,7 @@ pybreeze_english_word_dict = {
     "curl_import_target_apitestka_python": "APITestka (Python)",
     "curl_import_target_apitestka_action": "APITestka (JSON action)",
     "curl_import_target_loaddensity_python": "LoadDensity (Python)",
+    "curl_import_open_url_button": "Open URL in parser / builder",
     # Shared output actions (copy / open in editor / save to file)
     "output_actions_copy": "Copy",
     "output_actions_open_editor": "Open in editor tab",
@@ -393,6 +394,20 @@ pybreeze_english_word_dict = {
     "query_json_output_label": "Result:",
     "query_json_error": "Could not convert: {error}",
     "query_json_empty_hint": "Enter a query string or a JSON object above.",
+    # URL Parser / Builder — Menu
+    "extend_tools_menu_url_builder_tab_action": "URL Parser / Builder Tab",
+    "extend_tools_menu_url_builder_tab_label": "URL Parser / Builder",
+    "extend_tools_menu_url_builder_dock_action": "URL Parser / Builder Dock",
+    "extend_tools_menu_url_builder_dock_title": "URL Parser / Builder",
+    # URL Parser / Builder — Widget
+    "url_builder_input_label": "A URL, or a JSON object of URL parts:",
+    "url_builder_input_placeholder":
+        "https://user@host:8080/path?a=1#frag   or   {\"scheme\": \"https\", \"host\": \"host\"}",
+    "url_builder_to_json_button": "URL → JSON",
+    "url_builder_to_url_button": "JSON → URL",
+    "url_builder_output_label": "Result:",
+    "url_builder_error": "Could not build URL: {error}",
+    "url_builder_empty_hint": "Enter a URL or a JSON object of URL parts above.",
     # Regex Tester — Menu
     "extend_tools_menu_regex_tab_action": "Regex Tester Tab",
     "extend_tools_menu_regex_tab_label": "Regex",
@@ -453,11 +468,66 @@ pybreeze_english_word_dict = {
     "response_output_label": "Analysis:",
     "response_open_jwt_button": "Open JWT in decoder",
     "response_open_status_button": "Open status in reference",
+    "response_open_headers_button": "Open headers in analyzer",
     "response_empty_hint": "Paste a response above, then click analyze.",
     "response_status_label": "== Status ==",
     "response_headers_label": "== Headers ==",
     "response_jwt_label": "== JWT(s) found ==",
     "response_body_label": "== Body ==",
+    # HTTP Header Analyzer — Menu
+    "extend_tools_menu_header_analyzer_tab_action": "HTTP Header Analyzer Tab",
+    "extend_tools_menu_header_analyzer_tab_label": "Header Analyzer",
+    "extend_tools_menu_header_analyzer_dock_action": "HTTP Header Analyzer Dock",
+    "extend_tools_menu_header_analyzer_dock_title": "Header Analyzer",
+    # HTTP Header Analyzer — Widget
+    "header_analyzer_input_label": "Paste request or response headers:",
+    "header_analyzer_input_placeholder":
+        "HTTP/1.1 200 OK\nContent-Type: text/html\nSet-Cookie: sid=abc; Path=/",
+    "header_analyzer_analyze_button": "Analyze headers",
+    "header_analyzer_output_label": "Analysis:",
+    "header_analyzer_headers_label": "== Headers ({count}) ==",
+    "header_analyzer_duplicates_label": "== Repeated names ==",
+    "header_analyzer_findings_label": "== Findings ==",
+    "header_analyzer_no_findings": "Nothing worth reporting.",
+    "header_analyzer_no_headers": "No header lines found in that text.",
+    "header_analyzer_empty_hint": "Paste a header block above, then click analyze.",
+    "header_analyzer_level_warning": "WARNING",
+    "header_analyzer_level_info": "INFO",
+    # HTTP Header Analyzer — Findings ({header} is the header, {detail} its value)
+    "header_finding_duplicate_header":
+        "{header}: sent {detail} times; the receiver joins the values into one.",
+    "header_finding_content_type_options_not_nosniff":
+        "{header}: '{detail}' has no effect, only 'nosniff' stops MIME sniffing.",
+    "header_finding_hsts_weak_max_age":
+        "{header}: max-age={detail} is short; 15552000 (180 days) is the usual minimum.",
+    "header_finding_csp_unsafe_directive":
+        "{header}: contains '{detail}', which re-allows what the policy should block.",
+    "header_finding_cors_wildcard_origin": "{header}: every origin is allowed (*).",
+    "header_finding_cors_wildcard_with_credentials":
+        "{header}: '*' with Access-Control-Allow-Credentials: true is rejected by browsers.",
+    "header_finding_cookie_not_secure":
+        "{header}: cookie '{detail}' has no Secure attribute, so it can travel over plain HTTP.",
+    "header_finding_cookie_not_httponly":
+        "{header}: cookie '{detail}' has no HttpOnly attribute, so scripts can read it.",
+    "header_finding_cookie_no_samesite":
+        "{header}: cookie '{detail}' has no SameSite attribute; browsers default it to Lax.",
+    "header_finding_content_type_no_charset":
+        "{header}: '{detail}' names no charset, so the client has to guess the encoding.",
+    "header_finding_server_banner": "{header}: '{detail}' reveals the software in use.",
+    "header_finding_deprecated_header":
+        "{header}: '{detail}' is deprecated and ignored by current browsers.",
+    "header_finding_sensitive_header":
+        "{header}: carries a credential; mask it before sharing this output.",
+    "header_finding_missing_hsts":
+        "{header}: not set, so a browser may fall back to plain HTTP.",
+    "header_finding_missing_csp":
+        "{header}: not set, so nothing limits where scripts may be loaded from.",
+    "header_finding_missing_content_type_options":
+        "{header}: not set, so a browser may MIME-sniff the response.",
+    "header_finding_missing_frame_options":
+        "{header}: not set; it (or CSP frame-ancestors) controls who may frame the page.",
+    "header_finding_missing_referrer_policy":
+        "{header}: not set, so full URLs may leak to other sites.",
     # Diagram Editor — Tools
     "diagram_editor_tool_select": "Select",
     "diagram_editor_tool_rect": "Rect",

{pybreeze-1.0.25 → pybreeze-1.0.26}/pybreeze/extend_multi_language/extend_traditional_chinese.py

@@ -309,6 +309,7 @@ pybreeze_traditional_chinese_word_dict = {
     "curl_import_target_apitestka_python": "APITestka（Python）",
     "curl_import_target_apitestka_action": "APITestka（JSON action）",
     "curl_import_target_loaddensity_python": "LoadDensity（Python）",
+    "curl_import_open_url_button": "在 URL 解析／組建器開啟網址",
     # 共用輸出動作（複製 / 開成分頁 / 存檔）
     "output_actions_copy": "複製",
     "output_actions_open_editor": "開成編輯器分頁",
@@ -371,6 +372,20 @@ pybreeze_traditional_chinese_word_dict = {
     "query_json_output_label": "結果：",
     "query_json_error": "無法轉換：{error}",
     "query_json_empty_hint": "請在上方輸入查詢字串或 JSON 物件。",
+    # URL 解析／組建器 — 選單
+    "extend_tools_menu_url_builder_tab_action": "URL 解析／組建器分頁",
+    "extend_tools_menu_url_builder_tab_label": "URL 解析／組建器",
+    "extend_tools_menu_url_builder_dock_action": "URL 解析／組建器停駐窗格",
+    "extend_tools_menu_url_builder_dock_title": "URL 解析／組建器",
+    # URL 解析／組建器 — 介面
+    "url_builder_input_label": "一個 URL，或描述 URL 各部分的 JSON 物件：",
+    "url_builder_input_placeholder":
+        "https://user@host:8080/path?a=1#frag   或   {\"scheme\": \"https\", \"host\": \"host\"}",
+    "url_builder_to_json_button": "URL → JSON",
+    "url_builder_to_url_button": "JSON → URL",
+    "url_builder_output_label": "結果：",
+    "url_builder_error": "無法組建 URL：{error}",
+    "url_builder_empty_hint": "請在上方輸入 URL 或描述 URL 各部分的 JSON 物件。",
     # 正規表示式測試器 — 選單
     "extend_tools_menu_regex_tab_action": "正規表示式測試器分頁",
     "extend_tools_menu_regex_tab_label": "Regex",
@@ -431,11 +446,66 @@ pybreeze_traditional_chinese_word_dict = {
     "response_output_label": "分析結果：",
     "response_open_jwt_button": "在解碼器開啟 JWT",
     "response_open_status_button": "在參考開啟狀態碼",
+    "response_open_headers_button": "在分析器開啟標頭",
     "response_empty_hint": "請先在上方貼上回應，再按分析。",
     "response_status_label": "== 狀態 Status ==",
     "response_headers_label": "== 標頭 Headers ==",
     "response_jwt_label": "== 找到的 JWT ==",
     "response_body_label": "== 內容 Body ==",
+    # HTTP 標頭分析器 — 選單
+    "extend_tools_menu_header_analyzer_tab_action": "HTTP 標頭分析器分頁",
+    "extend_tools_menu_header_analyzer_tab_label": "標頭分析器",
+    "extend_tools_menu_header_analyzer_dock_action": "HTTP 標頭分析器停駐窗格",
+    "extend_tools_menu_header_analyzer_dock_title": "標頭分析器",
+    # HTTP 標頭分析器 — 介面
+    "header_analyzer_input_label": "貼上請求或回應的標頭：",
+    "header_analyzer_input_placeholder":
+        "HTTP/1.1 200 OK\nContent-Type: text/html\nSet-Cookie: sid=abc; Path=/",
+    "header_analyzer_analyze_button": "分析標頭",
+    "header_analyzer_output_label": "分析結果：",
+    "header_analyzer_headers_label": "== 標頭（{count}）==",
+    "header_analyzer_duplicates_label": "== 重複出現的名稱 ==",
+    "header_analyzer_findings_label": "== 分析發現 ==",
+    "header_analyzer_no_findings": "沒有需要注意的項目。",
+    "header_analyzer_no_headers": "這段文字中找不到標頭。",
+    "header_analyzer_empty_hint": "請先在上方貼上標頭，再按分析。",
+    "header_analyzer_level_warning": "警告",
+    "header_analyzer_level_info": "資訊",
+    # HTTP 標頭分析器 — 發現（{header} 為標頭名稱，{detail} 為其值）
+    "header_finding_duplicate_header":
+        "{header}：送出 {detail} 次，接收端會把這些值合併成一個。",
+    "header_finding_content_type_options_not_nosniff":
+        "{header}：'{detail}' 沒有作用，只有 'nosniff' 能阻止 MIME 探測。",
+    "header_finding_hsts_weak_max_age":
+        "{header}：max-age={detail} 太短，一般至少要 15552000（180 天）。",
+    "header_finding_csp_unsafe_directive":
+        "{header}：含有 '{detail}'，等於把此政策原本要擋下的行為又放行了。",
+    "header_finding_cors_wildcard_origin": "{header}：允許任何來源（*）。",
+    "header_finding_cors_wildcard_with_credentials":
+        "{header}：'*' 搭配 Access-Control-Allow-Credentials: true，瀏覽器會直接拒絕。",
+    "header_finding_cookie_not_secure":
+        "{header}：cookie '{detail}' 沒有 Secure 屬性，可能以純 HTTP 傳送。",
+    "header_finding_cookie_not_httponly":
+        "{header}：cookie '{detail}' 沒有 HttpOnly 屬性，指令碼可以讀取。",
+    "header_finding_cookie_no_samesite":
+        "{header}：cookie '{detail}' 沒有 SameSite 屬性，瀏覽器會預設為 Lax。",
+    "header_finding_content_type_no_charset":
+        "{header}：'{detail}' 沒有指定 charset，用戶端只能自行猜測編碼。",
+    "header_finding_server_banner": "{header}：'{detail}' 洩漏了所使用的軟體。",
+    "header_finding_deprecated_header":
+        "{header}：'{detail}' 已淘汰，現行瀏覽器不再處理。",
+    "header_finding_sensitive_header":
+        "{header}：內含憑證，分享這份輸出前請先遮蔽。",
+    "header_finding_missing_hsts":
+        "{header}：未設定，瀏覽器可能退回純 HTTP。",
+    "header_finding_missing_csp":
+        "{header}：未設定，沒有任何規則限制指令碼的載入來源。",
+    "header_finding_missing_content_type_options":
+        "{header}：未設定，瀏覽器可能對回應做 MIME 探測。",
+    "header_finding_missing_frame_options":
+        "{header}：未設定；此標頭（或 CSP frame-ancestors）決定誰能將頁面內嵌成框架。",
+    "header_finding_missing_referrer_policy":
+        "{header}：未設定，完整網址可能外洩給其他網站。",
     # Diagram Editor — 工具
     "diagram_editor_tool_select": "選取",
     "diagram_editor_tool_rect": "矩形",

{pybreeze-1.0.25 → pybreeze-1.0.26}/pybreeze/pybreeze_ui/menu/tools/tools_menu.py

@@ -20,11 +20,13 @@ from pybreeze.pybreeze_ui.tools_gui.diff_gui import DiffGUI
 from pybreeze.pybreeze_ui.tools_gui.json_format_gui import JsonFormatGUI
 from pybreeze.pybreeze_ui.tools_gui.jwt_decoder_gui import JwtDecoderGUI
 from pybreeze.pybreeze_ui.tools_gui.hash_gui import HashGUI
+from pybreeze.pybreeze_ui.tools_gui.header_analyzer_gui import HeaderAnalyzerGUI
 from pybreeze.pybreeze_ui.tools_gui.http_status_gui import HttpStatusGUI
 from pybreeze.pybreeze_ui.tools_gui.query_json_gui import QueryJsonGUI
 from pybreeze.pybreeze_ui.tools_gui.regex_gui import RegexGUI
 from pybreeze.pybreeze_ui.tools_gui.response_inspector_gui import ResponseInspectorGUI
 from pybreeze.pybreeze_ui.tools_gui.timestamp_gui import TimestampGUI
+from pybreeze.pybreeze_ui.tools_gui.url_builder_gui import UrlBuilderGUI
 
 if TYPE_CHECKING:
     from pybreeze.pybreeze_ui.editor_main.main_ui import PyBreezeMainWindow
@@ -156,6 +158,17 @@ def build_tools_menu(ui_we_want_to_set: PyBreezeMainWindow):
     ))
     ui_we_want_to_set.tools_menu.addAction(ui_we_want_to_set.tools_query_json_action)
 
+    # URL Parser / Builder
+    ui_we_want_to_set.tools_url_builder_action = QAction(language_wrapper.language_word_dict.get(
+        "extend_tools_menu_url_builder_tab_action"
+    ))
+    ui_we_want_to_set.tools_url_builder_action.triggered.connect(lambda: ui_we_want_to_set.tab_widget.addTab(
+        UrlBuilderGUI(ui_we_want_to_set), language_wrapper.language_word_dict.get(
+            "extend_tools_menu_url_builder_tab_label"
+        )
+    ))
+    ui_we_want_to_set.tools_menu.addAction(ui_we_want_to_set.tools_url_builder_action)
+
     # Regex Tester
     ui_we_want_to_set.tools_regex_action = QAction(language_wrapper.language_word_dict.get(
         "extend_tools_menu_regex_tab_action"
@@ -200,6 +213,17 @@ def build_tools_menu(ui_we_want_to_set: PyBreezeMainWindow):
     ))
     ui_we_want_to_set.tools_menu.addAction(ui_we_want_to_set.tools_json_format_action)
 
+    # HTTP Header Analyzer
+    ui_we_want_to_set.tools_header_analyzer_action = QAction(language_wrapper.language_word_dict.get(
+        "extend_tools_menu_header_analyzer_tab_action"
+    ))
+    ui_we_want_to_set.tools_header_analyzer_action.triggered.connect(lambda: ui_we_want_to_set.tab_widget.addTab(
+        HeaderAnalyzerGUI(ui_we_want_to_set), language_wrapper.language_word_dict.get(
+            "extend_tools_menu_header_analyzer_tab_label"
+        )
+    ))
+    ui_we_want_to_set.tools_menu.addAction(ui_we_want_to_set.tools_header_analyzer_action)
+
     # Response Inspector
     ui_we_want_to_set.tools_response_action = QAction(language_wrapper.language_word_dict.get(
         "extend_tools_menu_response_tab_action"
@@ -296,6 +320,13 @@ def extend_dock_menu(ui_we_want_to_set: PyBreezeMainWindow):
         lambda: add_dock(ui_we_want_to_set, "QueryJson"))
     ui_we_want_to_set.dock_menu.addAction(ui_we_want_to_set.tools_query_json_dock_action)
 
+    # URL Parser / Builder Dock
+    ui_we_want_to_set.tools_url_builder_dock_action = QAction(language_wrapper.language_word_dict.get(
+        "extend_tools_menu_url_builder_dock_action"))
+    ui_we_want_to_set.tools_url_builder_dock_action.triggered.connect(
+        lambda: add_dock(ui_we_want_to_set, "UrlBuilder"))
+    ui_we_want_to_set.dock_menu.addAction(ui_we_want_to_set.tools_url_builder_dock_action)
+
     # Regex Tester Dock
     ui_we_want_to_set.tools_regex_dock_action = QAction(language_wrapper.language_word_dict.get(
         "extend_tools_menu_regex_dock_action"))
@@ -324,6 +355,13 @@ def extend_dock_menu(ui_we_want_to_set: PyBreezeMainWindow):
         lambda: add_dock(ui_we_want_to_set, "JsonFormat"))
     ui_we_want_to_set.dock_menu.addAction(ui_we_want_to_set.tools_json_format_dock_action)
 
+    # HTTP Header Analyzer Dock
+    ui_we_want_to_set.tools_header_analyzer_dock_action = QAction(language_wrapper.language_word_dict.get(
+        "extend_tools_menu_header_analyzer_dock_action"))
+    ui_we_want_to_set.tools_header_analyzer_dock_action.triggered.connect(
+        lambda: add_dock(ui_we_want_to_set, "HeaderAnalyzer"))
+    ui_we_want_to_set.dock_menu.addAction(ui_we_want_to_set.tools_header_analyzer_dock_action)
+
     # Response Inspector Dock
     ui_we_want_to_set.tools_response_dock_action = QAction(language_wrapper.language_word_dict.get(
         "extend_tools_menu_response_dock_action"))
@@ -352,11 +390,14 @@ _DOCK_WIDGETS: dict[str, tuple[str, Callable[[PyBreezeMainWindow], object]]] = {
     "Timestamp": ("extend_tools_menu_timestamp_dock_title", lambda win: TimestampGUI(win)),
     "Hash": ("extend_tools_menu_hash_dock_title", lambda win: HashGUI(win)),
     "QueryJson": ("extend_tools_menu_query_json_dock_title", lambda win: QueryJsonGUI(win)),
+    "UrlBuilder": ("extend_tools_menu_url_builder_dock_title", lambda win: UrlBuilderGUI(win)),
     "Regex": ("extend_tools_menu_regex_dock_title", lambda win: RegexGUI(win)),
     "HttpStatus": (
         "extend_tools_menu_http_status_dock_title", lambda win: HttpStatusGUI(main_window=win)),
     "Diff": ("extend_tools_menu_diff_dock_title", lambda win: DiffGUI(win)),
     "JsonFormat": ("extend_tools_menu_json_format_dock_title", lambda win: JsonFormatGUI(win)),
+    "HeaderAnalyzer": (
+        "extend_tools_menu_header_analyzer_dock_title", lambda win: HeaderAnalyzerGUI(win)),
     "ResponseInspector": (
         "extend_tools_menu_response_dock_title", lambda win: ResponseInspectorGUI(win)),
 }

{pybreeze-1.0.25 → pybreeze-1.0.26}/pybreeze/pybreeze_ui/tools_gui/curl_import_gui.py

@@ -4,7 +4,8 @@ Automation engineers routinely copy a request as ``curl`` from browser dev tools
 This widget parses that command and generates a runnable script for a chosen
 target (Python ``requests``, APITestka, LoadDensity), which can then be copied,
 opened straight into a new editor tab, or saved to a ``.py`` / ``.json`` file
-via the shared output actions.
+via the shared output actions. The parsed URL can also be handed straight to the
+URL parser/builder tool for further editing.
 """
 from __future__ import annotations
 
@@ -14,7 +15,9 @@ from PySide6.QtWidgets import (
 from je_editor import language_wrapper
 
 from pybreeze.pybreeze_ui.tools_gui.output_actions import OutputActions
-from pybreeze.utils.curl_import.curl_parser import parse_curl
+from pybreeze.pybreeze_ui.tools_gui.tool_tabs import open_tool_tab
+from pybreeze.pybreeze_ui.tools_gui.url_builder_gui import UrlBuilderGUI
+from pybreeze.utils.curl_import.curl_parser import CurlRequest, parse_curl
 from pybreeze.utils.curl_import.script_templates import TEMPLATE_TARGETS, generate_template
 from pybreeze.utils.exception.exceptions import CurlParseException
 from pybreeze.utils.logging.logger import pybreeze_logger
@@ -31,8 +34,11 @@ class CurlImportGUI(QWidget):
         :param main_window: the window whose ``tab_widget`` "open in editor" uses
         """
         super().__init__()
+        self._main_window = main_window
         # The last successfully generated code (not an error or hint message).
         self._generated_code: str | None = None
+        # The request behind that code, so other tools can be handed its parts.
+        self._request: CurlRequest | None = None
         word = language_wrapper.language_word_dict
 
         self.input_label = QLabel(word.get("curl_import_input_label"))
@@ -54,6 +60,11 @@ class CurlImportGUI(QWidget):
         self.output_edit = QTextEdit()
         self.output_edit.setReadOnly(True)
 
+        # Cross-tool action: send the parsed URL to the URL parser/builder.
+        self.open_url_button = QPushButton(word.get("curl_import_open_url_button"))
+        self.open_url_button.clicked.connect(self.open_url_in_builder)
+        self.open_url_button.setEnabled(False)
+
         # Shared copy / open-in-editor / save actions. The extension and basename
         # follow the selected target; open/save are no-ops until a valid template.
         self.actions = OutputActions(
@@ -66,7 +77,7 @@ class CurlImportGUI(QWidget):
         for widget in (
             self.input_label, self.input_edit,
             self.target_label, self.target_select, self.convert_button,
-            self.output_label, self.output_edit,
+            self.output_label, self.output_edit, self.open_url_button,
         ):
             layout.addWidget(widget)
         layout.addLayout(self.actions.button_row())
@@ -81,21 +92,43 @@ class CurlImportGUI(QWidget):
         if self.input_edit.toPlainText().strip():
             self.convert()
 
+    def _clear_result(self) -> None:
+        """Forget the last result, so the output and cross-tool actions go inactive."""
+        self._generated_code = None
+        self._request = None
+        self.open_url_button.setEnabled(False)
+
     def convert(self) -> None:
         """Parse the input command and show the template for the chosen target."""
         word = language_wrapper.language_word_dict
         command = self.input_edit.toPlainText().strip()
         if not command:
-            self._generated_code = None
+            self._clear_result()
             self.output_edit.setPlainText(word.get("curl_import_empty_hint"))
             return
         try:
-            code = generate_template(self.selected_target(), parse_curl(command))
+            request = parse_curl(command)
+            code = generate_template(self.selected_target(), request)
         except CurlParseException as error:
             pybreeze_logger.info("curl_import_gui.py convert failed: %r", error)
-            self._generated_code = None
+            self._clear_result()
             self.output_edit.setPlainText(
                 word.get("curl_import_error").format(error=str(error)))
             return
         self._generated_code = code
+        self._request = request
+        self.open_url_button.setEnabled(bool(request.url))
         self.output_edit.setPlainText(code)
+
+    def open_url_in_builder(self) -> QWidget | None:
+        """Open the parsed URL in the URL parser/builder tool, already parsed.
+
+        The full URL is handed over (query string included), so the builder shows
+        the address exactly as curl would send it.
+        """
+        if self._request is None or not self._request.url:
+            return None
+        return open_tool_tab(
+            self._main_window,
+            UrlBuilderGUI(main_window=self._main_window, initial_url=self._request.full_url),
+            "extend_tools_menu_url_builder_tab_label")

pybreeze-1.0.26/pybreeze/pybreeze_ui/tools_gui/header_analyzer_gui.py

@@ -0,0 +1,108 @@
+"""A tool tab that analyses a pasted block of HTTP headers.
+
+Paste request or response headers and read back every field, the names that were
+sent more than once, and what is worth knowing about them — cookie flags, CORS
+and HSTS policies, headers carrying credentials, and the response security
+headers that are missing.
+"""
+from __future__ import annotations
+
+from PySide6.QtWidgets import QLabel, QPushButton, QTextEdit, QVBoxLayout, QWidget
+from je_editor import language_wrapper
+
+from pybreeze.pybreeze_ui.tools_gui.output_actions import OutputActions
+from pybreeze.utils.header_tools.header_analyzer import (
+    HeaderAnalysis, HeaderFinding, analyze_headers
+)
+
+
+def _finding_line(finding: HeaderFinding) -> str:
+    """Render one finding as a translated, level-prefixed line."""
+    word = language_wrapper.language_word_dict
+    level = word.get(f"header_analyzer_level_{finding.level}") or finding.level
+    message = word.get(f"header_finding_{finding.code}") or finding.code
+    return f"[{level}] {message.format(header=finding.header, detail=finding.detail)}"
+
+
+def build_header_report(analysis: HeaderAnalysis) -> str:
+    """Render a header analysis into a readable, sectioned report.
+
+    :param analysis: the analysed header block
+    :return: display text, or the "no headers" message when nothing was found
+    """
+    word = language_wrapper.language_word_dict
+    if not analysis.fields:
+        return word.get("header_analyzer_no_headers")
+
+    lines = [word.get("header_analyzer_headers_label").format(count=len(analysis.fields))]
+    lines.extend(f"{header.name}: {header.value}" for header in analysis.fields)
+
+    if analysis.duplicates:
+        lines.extend(["", word.get("header_analyzer_duplicates_label")])
+        lines.extend(f"{name} × {count}" for name, count in analysis.duplicates.items())
+
+    lines.extend(["", word.get("header_analyzer_findings_label")])
+    if analysis.findings:
+        lines.extend(_finding_line(finding) for finding in analysis.findings)
+    else:
+        lines.append(word.get("header_analyzer_no_findings"))
+    return "\n".join(lines)
+
+
+class HeaderAnalyzerGUI(QWidget):
+    """Paste HTTP headers and read what they say about the request or response."""
+
+    def __init__(self, main_window=None, initial_headers: str | None = None) -> None:
+        """
+        :param main_window: window whose ``tab_widget`` "open in editor" uses
+        :param initial_headers: a header block to pre-fill and analyse on open
+        """
+        super().__init__()
+        self._analysis: HeaderAnalysis | None = None
+        word = language_wrapper.language_word_dict
+
+        self.input_label = QLabel(word.get("header_analyzer_input_label"))
+        self.input_edit = QTextEdit()
+        self.input_edit.setPlaceholderText(word.get("header_analyzer_input_placeholder"))
+        self.input_edit.setAcceptRichText(False)
+
+        self.analyze_button = QPushButton(word.get("header_analyzer_analyze_button"))
+        self.analyze_button.clicked.connect(self.analyze)
+
+        self.output_label = QLabel(word.get("header_analyzer_output_label"))
+        self.output_edit = QTextEdit()
+        self.output_edit.setReadOnly(True)
+
+        self.actions = OutputActions(
+            self, self.output_edit, main_window=main_window,
+            basename="headers", extension="txt",
+            is_valid=lambda: self._analysis is not None)
+
+        layout = QVBoxLayout()
+        for widget in (
+            self.input_label, self.input_edit, self.analyze_button,
+            self.output_label, self.output_edit,
+        ):
+            layout.addWidget(widget)
+        layout.addLayout(self.actions.button_row())
+        self.setLayout(layout)
+
+        if initial_headers:
+            self.input_edit.setPlainText(initial_headers)
+            self.analyze()
+
+    def analyze(self) -> None:
+        """Analyse the pasted headers and show the report."""
+        word = language_wrapper.language_word_dict
+        text = self.input_edit.toPlainText().strip()
+        if not text:
+            self._analysis = None
+            self.output_edit.setPlainText(word.get("header_analyzer_empty_hint"))
+            return
+        analysis = analyze_headers(text)
+        if not analysis.fields:
+            self._analysis = None
+            self.output_edit.setPlainText(word.get("header_analyzer_no_headers"))
+            return
+        self._analysis = analysis
+        self.output_edit.setPlainText(build_header_report(analysis))