chore(deps): bump actions/setup-python from 5 to 7 - #34

Add optional Wireshark suite tooling

Codex/dev

feat: Add Cursor one-click installation instructions to READMEs

Release 0.6.5

docs: add Fronteir AI hosted deployment option

…, and changelog directory

- Add OpenCode MCP client support with correct flat `"mcp"` config schema,
  array command format, and `"environment"` key; registered on macOS/Linux/Windows
- Replace numbered-menu install selector with arrow-key + space TUI checkbox
  (pure stdlib termios/msvcrt, no external deps)
- Add explicit `wireshark-mcp update` subcommand that only rewrites config for
  clients already have wireshark-mcp installed, skipping uninstalled ones
- Restructure CHANGELOG.md into per-release files under changelog/ with
  bilingual (EN/ZH) content for every version from 0.2.1 to unreleased
- Add manual-configuration docs for OpenCode (EN + ZH)
- Add Changelog section to AGENTS.md documenting the new directory convention

Co-Authored-By: iam0range <iam0range@users.noreply.github.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Co-Authored-By: iam0range <iam0range@users.noreply.github.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- Fix ruff E402: move toolchain import to file top
- Fix ruff SIM102: collapse nested if into single condition
- Fix ruff SIM108: replace if/else block with ternary
- Bump server.json version to 1.1.0
- Add update=False to run_install call assertions in test_server.py

Co-Authored-By: iam0range <iam0range@users.noreply.github.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- Fix TUI arrow-key input: handle SS3 escape sequences (\x1bOA/B)
  in addition to CSI (\x1b[A/B) for macOS Terminal, iTerm2, and
  Claude Code terminal compatibility
- Fix BufferedReader race: replace sys.stdin.buffer.read(1) with
  os.read(fd, 1) to avoid pre-buffering escape sequences that
  emptied the fd before select.select() could detect data
- Raise select timeout from 50ms to 100ms
- Add MCP client support: Void, BoltAI, Kiro

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…mization

- Add QUIC/HTTP3, WebSocket, MQTT, gRPC analysis tools
- Concurrent execution for security audit, quick analysis, and TCP health
- LRU result cache with file-identity invalidation for tshark commands
- Slim all tool docstrings (4851 → 4447 chars), replace emoji with text tags
- Smart truncation for stats tools (expert_info, service_response_time)
- Publish workflow: add contents:read permission and Homebrew tap notification
- Add tests for cache, concurrency, new protocols, and token budget

Bump version to 1.2.0

Astro Starlight site covering all 51 tools across EN and zh-CN:
- Protocol analysis, packet inspection, extraction, security, stats pages
- Architecture reference (concurrency, cache, token optimization)
- Changelog, playbooks, evidence standard, troubleshooting guides
- Landing page, installation, MCP client configuration

Three-phase plan for security research enhancement:
- Phase 1 (v1.3): protocol expansion + forensics
- Phase 2 (v1.4): AI anomaly detection + NL query
- Phase 3 (v2.0): intelligent investigation assistant

…ybooks

Adds YAML-based playbook engine for structured investigation workflows:
- malware_c2: C2 beacon detection and fingerprinting
- lateral_movement: internal port scan and credential exposure
- data_exfil: exfiltration and DNS tunneling detection
- initial_access: phishing and initial compromise analysis

Includes loader with caching, user-custom playbook support from
~/.wireshark-mcp/playbooks/, and contextual tool for listing playbooks.

…and playbook execution

…ion, and detection rules

Keep only essential info (what/install/quickstart/tools overview).
Move detailed content to docs/ links. Sync Chinese version.

Decompose the 985-line WiresharkSuiteClient into 7 single-responsibility
mixins while preserving the public API and MockTSharkClient inheritance.

New modules:
- _validation.py: file/path/protocol validation
- _capability.py: tool discovery and availability checks
- _stats.py: protocol hierarchy, endpoints, conversations, I/O graph
- _packets.py: packet list, details, bytes, JSON read
- _extraction.py: field extraction, object export, stream follow, search
- _suite_ops.py: capinfos, mergecap, editcap, text2pcap, filter-save
- _capture.py: interface listing and live capture

Also removes dead register_*_tools stubs from security/threat/protocol tools.

All 296 tests pass without modification.

- Split installer.py into 7-module package
- Split tshark client.py into 6 focused mixins with Protocol typing
- Enable mypy strict mode (0 errors across 51 source files)
- Add pre-commit hooks (ruff + mypy)
- Add coverage threshold (50%) and pip-audit to CI
- Pin CI actions to official versions (checkout@v4, setup-python@v5)
- Add 2.0.0 changelog

- Run ruff format on 18 unformatted files
- Add encoding="utf-8" to all read_text() calls for data files
  (nl_templates.yaml, playbooks, fingerprints) — fixes Windows CI
  where default locale can't decode Chinese characters

- Drop Dockerfile, docker-compose.yml, .dockerignore and Docker
  references in deployment/troubleshooting/manual-config docs (EN+ZH)
- Delete .agents/ skills mirror (byte-identical duplicate of skills/;
  not produced by scripts/sync_skills.py and unreferenced)
- Drop unused docs media: install.mp4, run.mp4, install-demo.png,
  run-demo.png (~11M, no references in repo)
- Fold unreleased changelogs into release files: unreleased-opencode
  was already covered by 1.1.0; merge release-automation into 1.2.0;
  drop the Unreleased row from CHANGELOG.md index
- Ignore .DS_Store

…he bugs

Lean the server down to tools that do real tshark work, and fix three
classes of bug that could return wrong results.

Removed (fake / self-referential / suggest-only surfaces):
- investigator, reporter, playbooks, nl_query modules (11 tools) + their
  data files and tests. execute_playbook_step literally faked execution;
  the rest were in-memory CRUD / rule-gen from self-authored text / tool
  suggestions the LLM already does itself.
- Collapsed the two-layer "dynamic contextual" registry into an honest
  static catalog; PROTOCOL_TOOL_MAP is now purely for recommendations.
  Renamed make_contextual_* factories to make_*.

Correctness fixes:
- Cache pagination pollution: results were cached keyed by command only,
  with offset/limit applied before caching, so different windows corrupted
  each other. Cache now stores full stdout; pagination applied after.
- invalidate_file() ignored its argument and cleared everything; now
  invalidates per file, and -w write outputs are invalidated automatically.
- Response contract: _run_command returned bare text on success but a JSON
  envelope on error, forcing normalize_tool_result to guess a string's
  shape -- and misclassify tshark -T json output, packet data that looks
  like {"success": false}, and bare 123/true. Success now also returns an
  envelope, so data is opaque and never re-parsed.

Tooling / docs:
- mypy strict now runs locally (from . import __version__; geoip2/yara
  overrides), matching CI.
- README/README_zh tool table corrected to the real 80+ tools/9 categories.
- Guard tests pin the tool surface and prove the corruption cases are fixed.

Net: 504 insertions, 1734 deletions. 293 tests pass; ruff/format/mypy clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

wireshark_carve_files reported every magic-byte type as "detected" on any
capture: it checked `"No packets" not in result`, but tshark -T fields never
emits that string (and the result is now an envelope), so the guard was always
true. Now it parses the envelope, checks success, and counts real match rows —
reporting only types with >=1 hit, plus the packet count.

Also stopped concatenating command stderr into `data`, which corrupted
structured `-T json` / `-T fields` output. Diagnostic stderr now lives in a
separate `stderr` envelope field.

Regression tests cover zero-match, partial-match, and search-error cases for
carving, and the stderr/data separation.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Bumps [actions/setup-python](https://github.com/actions/setup-python) from 5 to 7.
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@v5...v7)

---
updated-dependencies:
- dependency-name: actions/setup-python
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>