Add optional Wireshark suite tooling

Codex/dev

feat: Add Cursor one-click installation instructions to READMEs

Release 0.6.5

docs: add Fronteir AI hosted deployment option

…, and changelog directory

- Add OpenCode MCP client support with correct flat `"mcp"` config schema,
  array command format, and `"environment"` key; registered on macOS/Linux/Windows
- Replace numbered-menu install selector with arrow-key + space TUI checkbox
  (pure stdlib termios/msvcrt, no external deps)
- Add explicit `wireshark-mcp update` subcommand that only rewrites config for
  clients already have wireshark-mcp installed, skipping uninstalled ones
- Restructure CHANGELOG.md into per-release files under changelog/ with
  bilingual (EN/ZH) content for every version from 0.2.1 to unreleased
- Add manual-configuration docs for OpenCode (EN + ZH)
- Add Changelog section to AGENTS.md documenting the new directory convention

Co-Authored-By: iam0range <iam0range@users.noreply.github.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Co-Authored-By: iam0range <iam0range@users.noreply.github.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- Fix ruff E402: move toolchain import to file top
- Fix ruff SIM102: collapse nested if into single condition
- Fix ruff SIM108: replace if/else block with ternary
- Bump server.json version to 1.1.0
- Add update=False to run_install call assertions in test_server.py

Co-Authored-By: iam0range <iam0range@users.noreply.github.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- Fix TUI arrow-key input: handle SS3 escape sequences (\x1bOA/B)
  in addition to CSI (\x1b[A/B) for macOS Terminal, iTerm2, and
  Claude Code terminal compatibility
- Fix BufferedReader race: replace sys.stdin.buffer.read(1) with
  os.read(fd, 1) to avoid pre-buffering escape sequences that
  emptied the fd before select.select() could detect data
- Raise select timeout from 50ms to 100ms
- Add MCP client support: Void, BoltAI, Kiro

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…mization

- Add QUIC/HTTP3, WebSocket, MQTT, gRPC analysis tools
- Concurrent execution for security audit, quick analysis, and TCP health
- LRU result cache with file-identity invalidation for tshark commands
- Slim all tool docstrings (4851 → 4447 chars), replace emoji with text tags
- Smart truncation for stats tools (expert_info, service_response_time)
- Publish workflow: add contents:read permission and Homebrew tap notification
- Add tests for cache, concurrency, new protocols, and token budget

Bump version to 1.2.0

Astro Starlight site covering all 51 tools across EN and zh-CN:
- Protocol analysis, packet inspection, extraction, security, stats pages
- Architecture reference (concurrency, cache, token optimization)
- Changelog, playbooks, evidence standard, troubleshooting guides
- Landing page, installation, MCP client configuration

Three-phase plan for security research enhancement:
- Phase 1 (v1.3): protocol expansion + forensics
- Phase 2 (v1.4): AI anomaly detection + NL query
- Phase 3 (v2.0): intelligent investigation assistant

…extraction

8-task plan covering anomaly detection (beacon, exfil, protocol),
natural language query engine, and enhanced MCP prompts.

…ybooks

Adds YAML-based playbook engine for structured investigation workflows:
- malware_c2: C2 beacon detection and fingerprinting
- lateral_movement: internal port scan and credential exposure
- data_exfil: exfiltration and DNS tunneling detection
- initial_access: phishing and initial compromise analysis

Includes loader with caching, user-custom playbook support from
~/.wireshark-mcp/playbooks/, and contextual tool for listing playbooks.

…and playbook execution

…ion, and detection rules

Keep only essential info (what/install/quickstart/tools overview).
Move detailed content to docs/ links. Sync Chinese version.

Decompose the 985-line WiresharkSuiteClient into 7 single-responsibility
mixins while preserving the public API and MockTSharkClient inheritance.

New modules:
- _validation.py: file/path/protocol validation
- _capability.py: tool discovery and availability checks
- _stats.py: protocol hierarchy, endpoints, conversations, I/O graph
- _packets.py: packet list, details, bytes, JSON read
- _extraction.py: field extraction, object export, stream follow, search
- _suite_ops.py: capinfos, mergecap, editcap, text2pcap, filter-save
- _capture.py: interface listing and live capture

Also removes dead register_*_tools stubs from security/threat/protocol tools.

All 296 tests pass without modification.

- Split installer.py into 7-module package
- Split tshark client.py into 6 focused mixins with Protocol typing
- Enable mypy strict mode (0 errors across 51 source files)
- Add pre-commit hooks (ruff + mypy)
- Add coverage threshold (50%) and pip-audit to CI
- Pin CI actions to official versions (checkout@v4, setup-python@v5)
- Add 2.0.0 changelog

- Run ruff format on 18 unformatted files
- Add encoding="utf-8" to all read_text() calls for data files
  (nl_templates.yaml, playbooks, fingerprints) — fixes Windows CI
  where default locale can't decode Chinese characters

Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 7.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v4...v7)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>