Add a HAR importer that turns a captured session into tests

README.md

@@ -76,18 +76,19 @@ PyBreeze is not just a code editor — it is a command center for the automation
   - Mermaid `flowchart` / `graph` import
   - Save/Open as `.diagram.json`, export to PNG or SVG
   - Undo/redo, align, distribute, grid, snap, and zoom controls
-- **cURL Import** — Paste a `curl` command copied from your browser's dev tools and generate a ready-to-run script for the target of your choice: **Python `requests`**, an **APITestka Python** snippet (`test_api_method_requests(...)`), an **APITestka JSON action** (`[["AT_test_api_method", {...}]]`) that `execute_files` runs directly, or a **LoadDensity** Locust load-test (`start_test(...)`). (These are the HTTP-oriented modules; a curl request has no meaningful mapping to the browser or desktop-GUI automation modules.) Parses the method, URL, headers, body, basic auth, `-G` query parameters, `-F` multipart form fields (file uploads become `files=open(...)`), the `--json` shortcut (which also sets the JSON `Content-Type`/`Accept`), and `-d @file` bodies (which become `open(...).read()`, while `--data-raw` stays literal) — all with multi-line `\` / `^` continuations. It knows the arity of curl's common flags, so value-taking options like `--max-time 30` or `-o out.json` never leak into the URL; it URL-encodes `--data-urlencode` values the way curl does; and it infers `POST` when a body or form is present and sends JSON bodies as JSON. Targets include Python `requests`, a ready-to-run **pytest test** (a named `test_...` function that sends the request and asserts the status), APITestka (Python and JSON action), and a LoadDensity load test. Pick one from the dropdown, then copy the result, **open it straight into a new editor tab**, or **save it to a `.py` / `.json` file** (the extension follows the chosen target). A repeated `-H` is handled the way HTTP handles it — the values are combined into one header (with `; ` for cookies) rather than the last one silently winning, and names are matched case-insensitively so an explicit header always beats one implied by another flag. One click also **hands the parsed URL to the URL parser/builder**, query string and all. The parser is pure logic and never executes the command.
+- **cURL Import** — Paste a `curl` command copied from your browser's dev tools and generate a ready-to-run script for the target of your choice: **Python `requests`**, an **APITestka Python** snippet (`test_api_method_requests(...)`), an **APITestka JSON action** (`[["AT_test_api_method", {...}]]`) that `execute_files` runs directly, or a **LoadDensity** Locust load-test (`start_test(...)`). (These are the HTTP-oriented modules; a curl request has no meaningful mapping to the browser or desktop-GUI automation modules.) Parses the method, URL, headers, body, basic auth, `-G` query parameters, `-F` multipart form fields (file uploads become `files=open(...)`), the `--json` shortcut (which also sets the JSON `Content-Type`/`Accept`), and `-d @file` bodies (which become `open(...).read()`, while `--data-raw` stays literal) — all with multi-line `\` / `^` continuations. It knows the arity of curl's common flags, so value-taking options like `--max-time 30` or `-o out.json` never leak into the URL; it URL-encodes `--data-urlencode` values the way curl does; and it infers `POST` when a body or form is present and sends JSON bodies as JSON. Targets include Python `requests`, a ready-to-run **pytest test** (a named `test_...` function that sends the request and asserts the status), APITestka (Python and JSON action), and a LoadDensity load test. Pick one from the dropdown, then copy the result, **open it straight into a new editor tab**, or **save it to a `.py` / `.json` file** (the extension follows the chosen target). A repeated `-H` is handled the way HTTP handles it — the values are combined into one header (with `; ` for cookies) rather than the last one silently winning, and names are matched case-insensitively so an explicit header always beats one implied by another flag. One click also hands the parsed parts to the tool that specialises in them: the **URL to the URL parser/builder** (query string and all) or the **headers to the header analyzer**. The parser is pure logic and never executes the command.
+- **HAR Import** — "Copy as cURL" captures one request; **Save all as HAR** captures the session. Open that `.har` export and every recorded call is listed with its method, path, status and media type — page furniture (stylesheets, images, fonts) filtered out by default so what remains is the API traffic. Select the calls you want, or take everything listed, and generate one script for the whole set using the same targets as the cURL importer: a **pytest file** with one test per call (repeated endpoints get numbered names so no test silently replaces another), an **APITestka action list** that replays the flow in capture order, a **`requests` walkthrough**, an APITestka Python script, or LoadDensity runs. Recorded headers, cookies, query parameters and bodies (raw, URL-encoded and multipart, including file uploads) all come across; HTTP/2 pseudo-headers are dropped and a `Cookie` header that duplicates the recorded cookie list is removed, so the generated code sends each value once. A single selected request produces exactly what the cURL importer would, so the two tools never disagree. HAR is JSON, so this needs nothing beyond the standard library, and nothing is ever replayed for you.
 - **JWT Decoder** — Paste a JSON Web Token and read its header and payload as pretty-printed JSON, with standard timestamp claims (`exp`, `iat`, `nbf`, `auth_time`) rendered as readable UTC times. Inspection only — the signature is never verified and the token is never trusted.
 - **Timestamp Converter** — Enter a Unix epoch value (seconds or milliseconds, auto-detected) or an ISO-8601 date-time (with `Z` or an offset) and get every representation back in UTC. Deterministic and independent of the local time zone.
 - **Hash Generator** — Compute SHA-256, SHA-512, SHA-1 and MD5 digests of any text at once. A general-purpose checksum tool (MD5/SHA-1 are provided for interoperability with `usedforsecurity=False`, never for security decisions).
 - **Query ⇄ JSON** — Convert an `application/x-www-form-urlencoded` query string to pretty JSON and back, URL-decoding and -encoding as needed. Repeated keys become JSON arrays and vice versa. Copy the result, open it in an editor tab, or save it to a file.
 - **URL Parser / Builder** — Paste a URL to see its scheme, host, port, path, query, fragment and credentials as an editable JSON object, tweak any part, and turn it back into a URL. Round-trips both ways, brackets IPv6 literals, and re-encodes query parameters for you. The cURL importer can send a request's URL straight here.
-- **HTTP Header Analyzer** — Paste a request or response header block (from dev tools, `curl -i`, or a proxy log) and read back every field plus what is worth knowing about it: names sent more than once, `Set-Cookie` entries missing `Secure` / `HttpOnly` / `SameSite`, a wildcard CORS policy (and the wildcard-plus-credentials combination browsers reject outright), an HSTS `max-age` too short to survive a restart, CSP `unsafe-inline` / `unsafe-eval`, product banners, deprecated headers, and — for responses — the security headers that are absent. Headers carrying credentials are reported by name only; their values are never copied into the report. The Response Inspector hands its headers here in one click.
+- **HTTP Header Analyzer** — Paste a request or response header block (from dev tools, `curl -i`, or a proxy log) and read back every field plus what is worth knowing about it: names sent more than once, `Set-Cookie` entries missing `Secure` / `HttpOnly` / `SameSite`, a wildcard CORS policy (and the wildcard-plus-credentials combination browsers reject outright), an HSTS `max-age` too short to survive a restart, CSP `unsafe-inline` / `unsafe-eval`, product banners, deprecated headers, and — for responses — the security headers that are absent. Headers carrying credentials are reported by name only; their values are never copied into the report. The cURL importer and the Response Inspector both hand their headers here in one click, and a bearer token spotted in any header opens in the JWT decoder, already decoded.
 - **Regex Tester** — Try a regular expression against sample text with `IGNORECASE` / `MULTILINE` / `DOTALL` / `VERBOSE` flags, and see every match with its offsets, numbered groups and named groups. Invalid patterns report a friendly error instead of crashing.
 - **HTTP Status Reference** — Search the full HTTP status code table (sourced from the standard library, so it stays current) by code prefix or keyword, with the reason phrase, description and status class for each.
 - **Text Diff** — Compare two pieces of text (for example an expected vs. actual API response) side by side and get a unified diff plus a one-line summary of how many lines were added or removed. Copy the diff, open it in an editor tab, or save it to a file.
 - **JSON Format** — Pretty-print or minify a JSON payload, with a clear validation error when the input is not valid JSON. Copy the result, open it in a new editor tab, or save it to a file.
-- **Response Inspector** — Paste a raw HTTP response and get a decoded summary in one step: the status code is looked up in the HTTP reference, headers are parsed, a JSON body is pretty-printed, and any JWTs anywhere in the text (for example an `Authorization: Bearer` header) are decoded with their timestamp claims shown in UTC. Ties the HTTP-status, JSON-format and JWT tools together, and can open a found status code, JWT, or the whole header block directly in its dedicated tool tab, pre-filled.
+- **Response Inspector** — Paste a raw HTTP response and get a decoded summary in one step: the status code is looked up in the HTTP reference, headers are parsed, a JSON body is pretty-printed, and any JWTs anywhere in the text (for example an `Authorization: Bearer` header) are decoded with their timestamp claims shown in UTC. Ties the HTTP-status, JSON-format and JWT tools together, and can open a found status code, JWT, the whole header block, or a JSON body directly in its dedicated tool tab, pre-filled.
 - **File Tree Context Menu** — Right-click any file or folder in the project tree to create files/folders, rename, delete, copy absolute or relative paths, or reveal the item in your platform file manager. Renaming or deleting a file that is currently open in an editor tab keeps the tab in sync.
 - **Package Manager** — Install automation modules and build tools directly from the IDE menu without leaving the editor.
 - **Integrated Documentation** — Quick access to documentation and GitHub pages for each automation module directly from the menu bar.
@@ -219,6 +220,7 @@ PyBreeze UI (PySide6)
 │   ├── Skill Send GUI
 │   ├── Diagram Editor (WYSIWYG, Mermaid import, PNG/SVG export)
 │   ├── cURL Import (curl → Python requests code)
+│   ├── HAR Import (browser session → test suite)
 │   ├── JWT Decoder (header/payload inspection)
 │   ├── Timestamp Converter (epoch ⇄ ISO-8601)
 │   ├── Hash Generator (SHA-256/512, SHA-1, MD5)

pybreeze/extend_multi_language/extend_english.py

@@ -332,6 +332,25 @@
     "curl_import_target_apitestka_action": "APITestka (JSON action)",
     "curl_import_target_loaddensity_python": "LoadDensity (Python)",
     "curl_import_open_url_button": "Open URL in parser / builder",
+    "curl_import_open_headers_button": "Open headers in analyzer",
+    # HAR Import — Menu
+    "extend_tools_menu_har_import_tab_action": "HAR Import Tab",
+    "extend_tools_menu_har_import_tab_label": "HAR Import",
+    "extend_tools_menu_har_import_dock_action": "HAR Import Dock",
+    "extend_tools_menu_har_import_dock_title": "HAR Import",
+    # HAR Import — Widget
+    "har_import_open_button": "Open .har file...",
+    "har_import_file_dialog_title": "Open a HAR export",
+    "har_import_file_filter": "HAR export (*.har *.json)",
+    "har_import_api_only": "Only API-like requests",
+    "har_import_summary": "{total} request(s), {api} API-like — {hosts}",
+    "har_import_generate_selected": "Generate for selection",
+    "har_import_generate_all": "Generate for all listed",
+    "har_import_no_selection": "Select one or more requests, or generate for all listed.",
+    "har_import_empty_hint":
+        "Open a .har file saved from your browser's dev tools (Network → Save all as HAR).",
+    "har_import_error": "Could not read the HAR export: {error}",
+    "har_import_read_error": "Could not open the file: {error}",
     # Shared output actions (copy / open in editor / save to file)
     "output_actions_copy": "Copy",
     "output_actions_open_editor": "Open in editor tab",
@@ -469,6 +488,7 @@
     "response_open_jwt_button": "Open JWT in decoder",
     "response_open_status_button": "Open status in reference",
     "response_open_headers_button": "Open headers in analyzer",
+    "response_open_body_button": "Open body in JSON format",
     "response_empty_hint": "Paste a response above, then click analyze.",
     "response_status_label": "== Status ==",
     "response_headers_label": "== Headers ==",
@@ -493,6 +513,7 @@
     "header_analyzer_empty_hint": "Paste a header block above, then click analyze.",
     "header_analyzer_level_warning": "WARNING",
     "header_analyzer_level_info": "INFO",
+    "header_analyzer_open_jwt_button": "Open token in JWT decoder",
     # HTTP Header Analyzer — Findings ({header} is the header, {detail} its value)
     "header_finding_duplicate_header":
         "{header}: sent {detail} times; the receiver joins the values into one.",

pybreeze/extend_multi_language/extend_traditional_chinese.py

@@ -310,6 +310,25 @@
     "curl_import_target_apitestka_action": "APITestka（JSON action）",
     "curl_import_target_loaddensity_python": "LoadDensity（Python）",
     "curl_import_open_url_button": "在 URL 解析／組建器開啟網址",
+    "curl_import_open_headers_button": "在分析器開啟標頭",
+    # HAR 匯入 — 選單
+    "extend_tools_menu_har_import_tab_action": "HAR 匯入分頁",
+    "extend_tools_menu_har_import_tab_label": "HAR 匯入",
+    "extend_tools_menu_har_import_dock_action": "HAR 匯入停駐窗格",
+    "extend_tools_menu_har_import_dock_title": "HAR 匯入",
+    # HAR 匯入 — 介面
+    "har_import_open_button": "開啟 .har 檔...",
+    "har_import_file_dialog_title": "開啟 HAR 匯出檔",
+    "har_import_file_filter": "HAR 匯出檔 (*.har *.json)",
+    "har_import_api_only": "只列出像 API 的請求",
+    "har_import_summary": "{total} 個請求，其中 {api} 個像 API — {hosts}",
+    "har_import_generate_selected": "為選取項產生",
+    "har_import_generate_all": "為列出的全部產生",
+    "har_import_no_selection": "請選取一個以上的請求，或改用「為列出的全部產生」。",
+    "har_import_empty_hint":
+        "請開啟從瀏覽器開發者工具存出的 .har 檔（Network → Save all as HAR）。",
+    "har_import_error": "無法讀取這份 HAR 匯出檔：{error}",
+    "har_import_read_error": "無法開啟檔案：{error}",
     # 共用輸出動作（複製 / 開成分頁 / 存檔）
     "output_actions_copy": "複製",
     "output_actions_open_editor": "開成編輯器分頁",
@@ -447,6 +466,7 @@
     "response_open_jwt_button": "在解碼器開啟 JWT",
     "response_open_status_button": "在參考開啟狀態碼",
     "response_open_headers_button": "在分析器開啟標頭",
+    "response_open_body_button": "在 JSON 格式化開啟內容",
     "response_empty_hint": "請先在上方貼上回應，再按分析。",
     "response_status_label": "== 狀態 Status ==",
     "response_headers_label": "== 標頭 Headers ==",
@@ -471,6 +491,7 @@
     "header_analyzer_empty_hint": "請先在上方貼上標頭，再按分析。",
     "header_analyzer_level_warning": "警告",
     "header_analyzer_level_info": "資訊",
+    "header_analyzer_open_jwt_button": "在 JWT 解碼器開啟權杖",
     # HTTP 標頭分析器 — 發現（{header} 為標頭名稱，{detail} 為其值）
     "header_finding_duplicate_header":
         "{header}：送出 {detail} 次，接收端會把這些值合併成一個。",

pybreeze/pybreeze_ui/menu/tools/tools_menu.py

@@ -19,6 +19,7 @@
 from pybreeze.pybreeze_ui.tools_gui.diff_gui import DiffGUI
 from pybreeze.pybreeze_ui.tools_gui.json_format_gui import JsonFormatGUI
 from pybreeze.pybreeze_ui.tools_gui.jwt_decoder_gui import JwtDecoderGUI
+from pybreeze.pybreeze_ui.tools_gui.har_import_gui import HarImportGUI
 from pybreeze.pybreeze_ui.tools_gui.hash_gui import HashGUI
 from pybreeze.pybreeze_ui.tools_gui.header_analyzer_gui import HeaderAnalyzerGUI
 from pybreeze.pybreeze_ui.tools_gui.http_status_gui import HttpStatusGUI
@@ -114,6 +115,17 @@ def build_tools_menu(ui_we_want_to_set: PyBreezeMainWindow):
     ))
     ui_we_want_to_set.tools_menu.addAction(ui_we_want_to_set.tools_curl_import_action)
 
+    # HAR Import
+    ui_we_want_to_set.tools_har_import_action = QAction(language_wrapper.language_word_dict.get(
+        "extend_tools_menu_har_import_tab_action"
+    ))
+    ui_we_want_to_set.tools_har_import_action.triggered.connect(lambda: ui_we_want_to_set.tab_widget.addTab(
+        HarImportGUI(ui_we_want_to_set), language_wrapper.language_word_dict.get(
+            "extend_tools_menu_har_import_tab_label"
+        )
+    ))
+    ui_we_want_to_set.tools_menu.addAction(ui_we_want_to_set.tools_har_import_action)
+
     # JWT Decoder
     ui_we_want_to_set.tools_jwt_decoder_action = QAction(language_wrapper.language_word_dict.get(
         "extend_tools_menu_jwt_decoder_tab_action"
@@ -292,6 +304,13 @@ def extend_dock_menu(ui_we_want_to_set: PyBreezeMainWindow):
         lambda: add_dock(ui_we_want_to_set, "CurlImport"))
     ui_we_want_to_set.dock_menu.addAction(ui_we_want_to_set.tools_curl_import_dock_action)
 
+    # HAR Import Dock
+    ui_we_want_to_set.tools_har_import_dock_action = QAction(language_wrapper.language_word_dict.get(
+        "extend_tools_menu_har_import_dock_action"))
+    ui_we_want_to_set.tools_har_import_dock_action.triggered.connect(
+        lambda: add_dock(ui_we_want_to_set, "HarImport"))
+    ui_we_want_to_set.dock_menu.addAction(ui_we_want_to_set.tools_har_import_dock_action)
+
     # JWT Decoder Dock
     ui_we_want_to_set.tools_jwt_decoder_dock_action = QAction(language_wrapper.language_word_dict.get(
         "extend_tools_menu_jwt_decoder_dock_action"))
@@ -385,6 +404,7 @@ def extend_dock_menu(ui_we_want_to_set: PyBreezeMainWindow):
         "extend_tools_menu_diagram_editor_dock_title", lambda _win: DiagramEditorWidget()),
     "CurlImport": (
         "extend_tools_menu_curl_import_dock_title", lambda win: CurlImportGUI(win)),
+    "HarImport": ("extend_tools_menu_har_import_dock_title", lambda win: HarImportGUI(win)),
     "JwtDecoder": (
         "extend_tools_menu_jwt_decoder_dock_title", lambda win: JwtDecoderGUI(main_window=win)),
     "Timestamp": ("extend_tools_menu_timestamp_dock_title", lambda win: TimestampGUI(win)),