chore(deps): bump actions/setup-python from 5 to 7

.github/copilot-instructions.md

@@ -0,0 +1,12 @@
+# GitHub Copilot Repository Instructions
+
+For packet capture, protocol analysis, network security monitoring, incident response, and troubleshooting tasks, prefer the project skill in `.github/skills/wireshark-traffic-analysis/`.
+
+Use the skill to:
+
+- start with `wireshark_open_file` and capture-wide context
+- choose the correct playbook before drilling into packets
+- separate observation from interpretation
+- report exact filters, stream indexes, frame numbers, and confidence
+
+Do not treat `Expert Info` or a single heuristic as proof on their own.

.github/prompts/wireshark-traffic-analysis.prompt.md

@@ -0,0 +1,22 @@
+Use the `wireshark-traffic-analysis` project skill in this repository to investigate a packet capture with a professional, evidence-backed workflow.
+
+Inputs:
+
+- Capture path: `${input:capture_path:Path to the pcap or pcapng file}`
+- Goal: `${input:goal:triage | security | incident-response | troubleshoot}`
+- Optional scope: `${input:scope:Suspicious host, protocol, time window, domain, stream, or symptom}`
+
+Requirements:
+
+- Start broad, then narrow.
+- Use the project skill playbook that matches the goal.
+- Include exact filters, streams, frames, or extracted fields for every important finding.
+- Label confidence as `confirmed`, `likely`, `possible`, or `unresolved`.
+- End with concrete next steps.
+
+Relevant files:
+
+- [Canonical skill](../../skills/wireshark-traffic-analysis/SKILL.md)
+- [Playbooks](../../skills/wireshark-traffic-analysis/references/playbooks.md)
+- [Evidence rubric](../../skills/wireshark-traffic-analysis/references/evidence-rubric.md)
+- [Report template](../../skills/wireshark-traffic-analysis/references/report-template.md)

.github/pull_request_template.md

@@ -37,5 +37,5 @@
 
 - [ ] Updated `README.md`
 - [ ] Updated `README_zh.md`
-- [ ] Updated `CHANGELOG.md` (under `[Unreleased]`)
+- [ ] Updated release notes (if applicable)
 - [ ] N/A

.github/workflows/ci.yml

@@ -2,9 +2,10 @@ name: CI
 
 on:
   push:
-    branches: [ "master", "main" ]
+    branches: [ "master", "main", "codex/**" ]
   pull_request:
     branches: [ "master", "main" ]
+  workflow_dispatch:
 
 jobs:
   lint:
@@ -13,7 +14,7 @@ jobs:
     - uses: actions/checkout@v4
 
     - name: Set up Python
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v7
       with:
         python-version: "3.12"
 
@@ -29,19 +30,26 @@ jobs:
       run: ruff format --check src/ tests/
 
     - name: Type check
-      run: mypy src/wireshark_mcp/ --ignore-missing-imports
+      run: mypy --package wireshark_mcp --ignore-missing-imports --no-namespace-packages
+
+    - name: Dependency audit
+      run: |
+        pip install pip-audit
+        pip-audit
 
   test:
-    runs-on: ubuntu-latest
+    runs-on: ${{ matrix.os }}
     strategy:
+      fail-fast: false
       matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
         python-version: ["3.10", "3.11", "3.12", "3.13"]
 
     steps:
     - uses: actions/checkout@v4
 
     - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v7
       with:
         python-version: ${{ matrix.python-version }}
 
@@ -50,15 +58,76 @@ jobs:
         python -m pip install --upgrade pip
         pip install .[dev]
 
+    - name: Run tests with coverage
+      run: |
+        pytest tests/ --cov=wireshark_mcp --cov-report=term-missing --cov-fail-under=50 -v
+
+    - name: Compile check
+      run: python -m compileall src/
+
+  integration-linux:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+
+    - name: Set up Python
+      uses: actions/setup-python@v7
+      with:
+        python-version: "3.12"
+
+    - name: Install dependencies
+      run: |
+        python -m pip install --upgrade pip
+        pip install .[dev]
+
     - name: Install TShark
       run: |
         sudo apt-get update
-        sudo apt-get install -y tshark
-        sudo usermod -aG wireshark $USER
+        sudo env DEBIAN_FRONTEND=noninteractive apt-get install -y tshark
+        tshark -v
 
-    - name: Run tests with coverage
+    - name: Run Linux TShark integration smoke tests
       run: |
-        pytest tests/ --cov=wireshark_mcp --cov-report=term-missing -v
+        pytest tests/test_client.py -k "real_tshark" -v
 
-    - name: Compile check
-      run: python -m compileall src/
+  package-smoke:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+
+    steps:
+    - uses: actions/checkout@v4
+
+    - name: Set up Python
+      uses: actions/setup-python@v7
+      with:
+        python-version: "3.12"
+
+    - name: Install build tools
+      run: |
+        python -m pip install --upgrade pip
+        pip install build
+
+    - name: Build package
+      run: python -m build
+
+    - name: Validate packaged skill files
+      run: |
+        python -c "import glob, os, zipfile; wheel = max(glob.glob('dist/*.whl'), key=os.path.getmtime); names = set(zipfile.ZipFile(wheel).namelist()); assert any(name.endswith('wireshark_mcp/skills/wireshark-traffic-analysis/SKILL.md') for name in names), 'Skill package missing from wheel'"
+
+    - name: Install built wheel
+      run: |
+        python -c "import glob, os, subprocess, sys; wheel = max(glob.glob('dist/*.whl'), key=os.path.getmtime); subprocess.check_call([sys.executable, '-m', 'pip', 'install', '--force-reinstall', wheel])"
+
+    - name: Run packaged CLI smoke tests
+      run: |
+        wireshark-mcp --version
+        python -m wireshark_mcp.server --version
+        wireshark-mcp config
+        wireshark-mcp doctor
+        wireshark-mcp doctor --format json
+        wireshark-mcp clients
+        wireshark-mcp clients --format json
+        wireshark-mcp --config

.github/workflows/publish.yml

@@ -9,13 +9,14 @@ jobs:
     name: Build and publish to PyPI
     runs-on: ubuntu-latest
     permissions:
+      contents: read
       id-token: write  # IMPORTANT: this permission is mandatory for trusted publishing
 
     steps:
     - uses: actions/checkout@v4
 
     - name: Set up Python
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v7
       with:
         python-version: "3.10"
 
@@ -26,10 +27,43 @@ jobs:
 
     - name: Build package
       run: python -m build
+
+    - name: Validate built wheel contents
+      run: |
+        python -c "import glob, os, zipfile; wheel = max(glob.glob('dist/*.whl'), key=os.path.getmtime); names = set(zipfile.ZipFile(wheel).namelist()); assert any(name.endswith('wireshark_mcp/skills/wireshark-traffic-analysis/SKILL.md') for name in names), 'Skill package missing from wheel'"
+
+    - name: Install built wheel
+      run: |
+        python -c "import glob, os, subprocess, sys; wheel = max(glob.glob('dist/*.whl'), key=os.path.getmtime); subprocess.check_call([sys.executable, '-m', 'pip', 'install', '--force-reinstall', wheel])"
+
+    - name: Run release smoke tests
+      run: |
+        wireshark-mcp --version
+        python -m wireshark_mcp.server --version
+        wireshark-mcp config
+        wireshark-mcp doctor
+        wireshark-mcp doctor --format json
+        wireshark-mcp clients
+        wireshark-mcp clients --format json
+        wireshark-mcp --config
 
     - name: Publish to PyPI
       uses: pypa/gh-action-pypi-publish@release/v1
       # Note: No username/password needed if using Trusted Publishing (OIDC).
       # If using legacy token, uncomment below:
       # with:
       #   password: ${{ secrets.PYPI_API_TOKEN }}
+
+    - name: Notify Homebrew tap to bump formula
+      env:
+        TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
+      # Only fire when the secret is present (forks / PRs won't have it)
+      if: env.TAP_TOKEN != ''
+      run: |
+        VERSION="${{ github.event.release.tag_name }}"
+        VERSION="${VERSION#v}"   # strip leading 'v' if present
+        curl --fail-with-body -sS -X POST \
+          -H "Authorization: Bearer $TAP_TOKEN" \
+          -H "Accept: application/vnd.github+json" \
+          https://api.github.com/repos/bx33661/homebrew-wireshark-mcp/dispatches \
+          -d "{\"event_type\":\"new-release\",\"client_payload\":{\"version\":\"$VERSION\"}}"

.gitignore

@@ -18,7 +18,27 @@ htmlcov/
 .pytest_cache/
 
 # Runtime caches
-urlhaus_cache.txt
+.mcpregistry_*
+.claude/worktrees/
+.codex_resume_work/
+
+# OS metadata
+.DS_Store
+
+# Documentation site
 
 # Spec (internal)
-spec/
+spec/
+.omx/
+
+# Local / duplicated docs
+docs/
+changelog/
+AGENTS.md
+GEMINI.md
+CODE_OF_CONDUCT.md
+CHANGELOG.md
+
+# Auto-generated skill mirrors (canonical source lives in skills/)
+.github/skills/
+.claude/skills/

.pre-commit-config.yaml

@@ -0,0 +1,19 @@
+repos:
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: v0.9.9
+    hooks:
+      - id: ruff
+        args: [--fix]
+      - id: ruff-format
+
+  - repo: https://github.com/pre-commit/mirrors-mypy
+    rev: v1.10.0
+    hooks:
+      - id: mypy
+        additional_dependencies:
+          - "mcp>=1.0.0"
+          - "pyyaml>=6.0"
+          - "types-PyYAML>=6.0"
+        args: [--strict, --ignore-missing-imports, --no-namespace-packages]
+        pass_filenames: false
+        entry: mypy --package wireshark_mcp

.well-known/mcp/server.json

@@ -0,0 +1,28 @@
+{
+  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
+  "name": "io.github.bx33661/wireshark-mcp",
+  "title": "Wireshark MCP",
+  "description": "Analyze packet captures with Wireshark and tshark through the Model Context Protocol.",
+  "version": "2.0.0",
+  "repository": {
+    "url": "https://github.com/bx33661/Wireshark-MCP",
+    "source": "github"
+  },
+  "websiteUrl": "https://github.com/bx33661/Wireshark-MCP",
+  "icons": [
+    {
+      "src": "https://raw.githubusercontent.com/bx33661/Wireshark-MCP/main/Logo.png",
+      "mimeType": "image/png"
+    }
+  ],
+  "packages": [
+    {
+      "registryType": "pypi",
+      "identifier": "wireshark-mcp",
+      "version": "2.0.0",
+      "transport": {
+        "type": "stdio"
+      }
+    }
+  ]
+}