Add an HTTP header analyzer, cross-tool hand-offs, and repeated-header handling

README.md

@@ -76,16 +76,18 @@ PyBreeze is not just a code editor — it is a command center for the automation
   - Mermaid `flowchart` / `graph` import
   - Save/Open as `.diagram.json`, export to PNG or SVG
   - Undo/redo, align, distribute, grid, snap, and zoom controls
-- **cURL Import** — Paste a `curl` command copied from your browser's dev tools and generate a ready-to-run script for the target of your choice: **Python `requests`**, an **APITestka Python** snippet (`test_api_method_requests(...)`), an **APITestka JSON action** (`[["AT_test_api_method", {...}]]`) that `execute_files` runs directly, or a **LoadDensity** Locust load-test (`start_test(...)`). (These are the HTTP-oriented modules; a curl request has no meaningful mapping to the browser or desktop-GUI automation modules.) Parses the method, URL, headers, body, basic auth, `-G` query parameters, `-F` multipart form fields (file uploads become `files=open(...)`), the `--json` shortcut (which also sets the JSON `Content-Type`/`Accept`), and `-d @file` bodies (which become `open(...).read()`, while `--data-raw` stays literal) — all with multi-line `\` / `^` continuations. It knows the arity of curl's common flags, so value-taking options like `--max-time 30` or `-o out.json` never leak into the URL; it URL-encodes `--data-urlencode` values the way curl does; and it infers `POST` when a body or form is present and sends JSON bodies as JSON. Targets include Python `requests`, a ready-to-run **pytest test** (a named `test_...` function that sends the request and asserts the status), APITestka (Python and JSON action), and a LoadDensity load test. Pick one from the dropdown, then copy the result, **open it straight into a new editor tab**, or **save it to a `.py` / `.json` file** (the extension follows the chosen target). The parser is pure logic and never executes the command.
+- **cURL Import** — Paste a `curl` command copied from your browser's dev tools and generate a ready-to-run script for the target of your choice: **Python `requests`**, an **APITestka Python** snippet (`test_api_method_requests(...)`), an **APITestka JSON action** (`[["AT_test_api_method", {...}]]`) that `execute_files` runs directly, or a **LoadDensity** Locust load-test (`start_test(...)`). (These are the HTTP-oriented modules; a curl request has no meaningful mapping to the browser or desktop-GUI automation modules.) Parses the method, URL, headers, body, basic auth, `-G` query parameters, `-F` multipart form fields (file uploads become `files=open(...)`), the `--json` shortcut (which also sets the JSON `Content-Type`/`Accept`), and `-d @file` bodies (which become `open(...).read()`, while `--data-raw` stays literal) — all with multi-line `\` / `^` continuations. It knows the arity of curl's common flags, so value-taking options like `--max-time 30` or `-o out.json` never leak into the URL; it URL-encodes `--data-urlencode` values the way curl does; and it infers `POST` when a body or form is present and sends JSON bodies as JSON. Targets include Python `requests`, a ready-to-run **pytest test** (a named `test_...` function that sends the request and asserts the status), APITestka (Python and JSON action), and a LoadDensity load test. Pick one from the dropdown, then copy the result, **open it straight into a new editor tab**, or **save it to a `.py` / `.json` file** (the extension follows the chosen target). A repeated `-H` is handled the way HTTP handles it — the values are combined into one header (with `; ` for cookies) rather than the last one silently winning, and names are matched case-insensitively so an explicit header always beats one implied by another flag. One click also **hands the parsed URL to the URL parser/builder**, query string and all. The parser is pure logic and never executes the command.
 - **JWT Decoder** — Paste a JSON Web Token and read its header and payload as pretty-printed JSON, with standard timestamp claims (`exp`, `iat`, `nbf`, `auth_time`) rendered as readable UTC times. Inspection only — the signature is never verified and the token is never trusted.
 - **Timestamp Converter** — Enter a Unix epoch value (seconds or milliseconds, auto-detected) or an ISO-8601 date-time (with `Z` or an offset) and get every representation back in UTC. Deterministic and independent of the local time zone.
 - **Hash Generator** — Compute SHA-256, SHA-512, SHA-1 and MD5 digests of any text at once. A general-purpose checksum tool (MD5/SHA-1 are provided for interoperability with `usedforsecurity=False`, never for security decisions).
 - **Query ⇄ JSON** — Convert an `application/x-www-form-urlencoded` query string to pretty JSON and back, URL-decoding and -encoding as needed. Repeated keys become JSON arrays and vice versa. Copy the result, open it in an editor tab, or save it to a file.
+- **URL Parser / Builder** — Paste a URL to see its scheme, host, port, path, query, fragment and credentials as an editable JSON object, tweak any part, and turn it back into a URL. Round-trips both ways, brackets IPv6 literals, and re-encodes query parameters for you. The cURL importer can send a request's URL straight here.
+- **HTTP Header Analyzer** — Paste a request or response header block (from dev tools, `curl -i`, or a proxy log) and read back every field plus what is worth knowing about it: names sent more than once, `Set-Cookie` entries missing `Secure` / `HttpOnly` / `SameSite`, a wildcard CORS policy (and the wildcard-plus-credentials combination browsers reject outright), an HSTS `max-age` too short to survive a restart, CSP `unsafe-inline` / `unsafe-eval`, product banners, deprecated headers, and — for responses — the security headers that are absent. Headers carrying credentials are reported by name only; their values are never copied into the report. The Response Inspector hands its headers here in one click.
 - **Regex Tester** — Try a regular expression against sample text with `IGNORECASE` / `MULTILINE` / `DOTALL` / `VERBOSE` flags, and see every match with its offsets, numbered groups and named groups. Invalid patterns report a friendly error instead of crashing.
 - **HTTP Status Reference** — Search the full HTTP status code table (sourced from the standard library, so it stays current) by code prefix or keyword, with the reason phrase, description and status class for each.
 - **Text Diff** — Compare two pieces of text (for example an expected vs. actual API response) side by side and get a unified diff plus a one-line summary of how many lines were added or removed. Copy the diff, open it in an editor tab, or save it to a file.
 - **JSON Format** — Pretty-print or minify a JSON payload, with a clear validation error when the input is not valid JSON. Copy the result, open it in a new editor tab, or save it to a file.
-- **Response Inspector** — Paste a raw HTTP response and get a decoded summary in one step: the status code is looked up in the HTTP reference, headers are parsed, a JSON body is pretty-printed, and any JWTs anywhere in the text (for example an `Authorization: Bearer` header) are decoded with their timestamp claims shown in UTC. Ties the HTTP-status, JSON-format and JWT tools together, and can open a found status code or JWT directly in its dedicated tool tab, pre-filled.
+- **Response Inspector** — Paste a raw HTTP response and get a decoded summary in one step: the status code is looked up in the HTTP reference, headers are parsed, a JSON body is pretty-printed, and any JWTs anywhere in the text (for example an `Authorization: Bearer` header) are decoded with their timestamp claims shown in UTC. Ties the HTTP-status, JSON-format and JWT tools together, and can open a found status code, JWT, or the whole header block directly in its dedicated tool tab, pre-filled.
 - **File Tree Context Menu** — Right-click any file or folder in the project tree to create files/folders, rename, delete, copy absolute or relative paths, or reveal the item in your platform file manager. Renaming or deleting a file that is currently open in an editor tab keeps the tab in sync.
 - **Package Manager** — Install automation modules and build tools directly from the IDE menu without leaving the editor.
 - **Integrated Documentation** — Quick access to documentation and GitHub pages for each automation module directly from the menu bar.
@@ -221,6 +223,8 @@ PyBreeze UI (PySide6)
 │   ├── Timestamp Converter (epoch ⇄ ISO-8601)
 │   ├── Hash Generator (SHA-256/512, SHA-1, MD5)
 │   ├── Query ⇄ JSON Converter
+│   ├── URL Parser / Builder (URL ⇄ JSON parts)
+│   ├── HTTP Header Analyzer (duplicates, cookie flags, security headers)
 │   ├── Regex Tester
 │   ├── HTTP Status Reference
 │   ├── Text Diff

pybreeze/extend_multi_language/extend_english.py

@@ -331,6 +331,7 @@
     "curl_import_target_apitestka_python": "APITestka (Python)",
     "curl_import_target_apitestka_action": "APITestka (JSON action)",
     "curl_import_target_loaddensity_python": "LoadDensity (Python)",
+    "curl_import_open_url_button": "Open URL in parser / builder",
     # Shared output actions (copy / open in editor / save to file)
     "output_actions_copy": "Copy",
     "output_actions_open_editor": "Open in editor tab",
@@ -390,9 +391,23 @@
     "query_json_input_placeholder": "a=1&b=2   or   {\"a\": \"1\", \"b\": \"2\"}",
     "query_json_to_json_button": "Query → JSON",
     "query_json_to_query_button": "JSON → Query",
     "query_json_output_label": "Result:",
     "query_json_error": "Could not convert: {error}",
     "query_json_empty_hint": "Enter a query string or a JSON object above.",
+    # URL Parser / Builder — Menu
+    "extend_tools_menu_url_builder_tab_action": "URL Parser / Builder Tab",
+    "extend_tools_menu_url_builder_tab_label": "URL Parser / Builder",
+    "extend_tools_menu_url_builder_dock_action": "URL Parser / Builder Dock",
+    "extend_tools_menu_url_builder_dock_title": "URL Parser / Builder",
+    # URL Parser / Builder — Widget
+    "url_builder_input_label": "A URL, or a JSON object of URL parts:",
+    "url_builder_input_placeholder":
+        "https://user@host:8080/path?a=1#frag   or   {\"scheme\": \"https\", \"host\": \"host\"}",
+    "url_builder_to_json_button": "URL → JSON",
+    "url_builder_to_url_button": "JSON → URL",
+    "url_builder_output_label": "Result:",
+    "url_builder_error": "Could not build URL: {error}",
+    "url_builder_empty_hint": "Enter a URL or a JSON object of URL parts above.",
     # Regex Tester — Menu
     "extend_tools_menu_regex_tab_action": "Regex Tester Tab",
     "extend_tools_menu_regex_tab_label": "Regex",
@@ -453,11 +468,66 @@
     "response_output_label": "Analysis:",
     "response_open_jwt_button": "Open JWT in decoder",
     "response_open_status_button": "Open status in reference",
+    "response_open_headers_button": "Open headers in analyzer",
     "response_empty_hint": "Paste a response above, then click analyze.",
     "response_status_label": "== Status ==",
     "response_headers_label": "== Headers ==",
     "response_jwt_label": "== JWT(s) found ==",
     "response_body_label": "== Body ==",
+    # HTTP Header Analyzer — Menu
+    "extend_tools_menu_header_analyzer_tab_action": "HTTP Header Analyzer Tab",
+    "extend_tools_menu_header_analyzer_tab_label": "Header Analyzer",
+    "extend_tools_menu_header_analyzer_dock_action": "HTTP Header Analyzer Dock",
+    "extend_tools_menu_header_analyzer_dock_title": "Header Analyzer",
+    # HTTP Header Analyzer — Widget
+    "header_analyzer_input_label": "Paste request or response headers:",
+    "header_analyzer_input_placeholder":
+        "HTTP/1.1 200 OK\nContent-Type: text/html\nSet-Cookie: sid=abc; Path=/",
+    "header_analyzer_analyze_button": "Analyze headers",
+    "header_analyzer_output_label": "Analysis:",
+    "header_analyzer_headers_label": "== Headers ({count}) ==",
+    "header_analyzer_duplicates_label": "== Repeated names ==",
+    "header_analyzer_findings_label": "== Findings ==",
+    "header_analyzer_no_findings": "Nothing worth reporting.",
+    "header_analyzer_no_headers": "No header lines found in that text.",
+    "header_analyzer_empty_hint": "Paste a header block above, then click analyze.",
+    "header_analyzer_level_warning": "WARNING",
+    "header_analyzer_level_info": "INFO",
+    # HTTP Header Analyzer — Findings ({header} is the header, {detail} its value)
+    "header_finding_duplicate_header":
+        "{header}: sent {detail} times; the receiver joins the values into one.",
+    "header_finding_content_type_options_not_nosniff":
+        "{header}: '{detail}' has no effect, only 'nosniff' stops MIME sniffing.",
+    "header_finding_hsts_weak_max_age":
+        "{header}: max-age={detail} is short; 15552000 (180 days) is the usual minimum.",
+    "header_finding_csp_unsafe_directive":
+        "{header}: contains '{detail}', which re-allows what the policy should block.",
+    "header_finding_cors_wildcard_origin": "{header}: every origin is allowed (*).",
+    "header_finding_cors_wildcard_with_credentials":
+        "{header}: '*' with Access-Control-Allow-Credentials: true is rejected by browsers.",
+    "header_finding_cookie_not_secure":
+        "{header}: cookie '{detail}' has no Secure attribute, so it can travel over plain HTTP.",
+    "header_finding_cookie_not_httponly":
+        "{header}: cookie '{detail}' has no HttpOnly attribute, so scripts can read it.",
+    "header_finding_cookie_no_samesite":
+        "{header}: cookie '{detail}' has no SameSite attribute; browsers default it to Lax.",
+    "header_finding_content_type_no_charset":
+        "{header}: '{detail}' names no charset, so the client has to guess the encoding.",
+    "header_finding_server_banner": "{header}: '{detail}' reveals the software in use.",
+    "header_finding_deprecated_header":
+        "{header}: '{detail}' is deprecated and ignored by current browsers.",
+    "header_finding_sensitive_header":
+        "{header}: carries a credential; mask it before sharing this output.",
+    "header_finding_missing_hsts":
+        "{header}: not set, so a browser may fall back to plain HTTP.",
+    "header_finding_missing_csp":
+        "{header}: not set, so nothing limits where scripts may be loaded from.",
+    "header_finding_missing_content_type_options":
+        "{header}: not set, so a browser may MIME-sniff the response.",
+    "header_finding_missing_frame_options":
+        "{header}: not set; it (or CSP frame-ancestors) controls who may frame the page.",
+    "header_finding_missing_referrer_policy":
+        "{header}: not set, so full URLs may leak to other sites.",
     # Diagram Editor — Tools
     "diagram_editor_tool_select": "Select",
     "diagram_editor_tool_rect": "Rect",