vanken 0.1.0 → 0.3.0

data/lib/vanken/ui/settings_operations.rb

@@ -0,0 +1,233 @@
+# frozen_string_literal: true
+
+require_relative "../config/profiles"
+require_relative "../config/analysis_settings"
+
+module Vanken
+  module UI
+    module SettingsOperations
+      SETTING_LABELS = {
+        "appearance.theme" => "テーマ", "appearance.language" => "言語", "appearance.font_size" => "文字サイズ",
+        "packet_list.time_format" => "時刻表示", "packet_list.time_precision" => "時刻の精度", "packet_list.autoscroll" => "自動スクロール",
+        "packet_list.row_cache_rows" => "行キャッシュ容量", "packet_list.coloring" => "色付け",
+        "capture.snaplen" => "Snaplen", "capture.promiscuous" => "プロミスキャスモード", "capture.buffer_size" => "取得バッファ (bytes)",
+        "capture.backend" => "キャプチャ方式", "capture.launcher" => "ヘルパー起動方式", "capture.direction" => "取得方向",
+        "capture.stop_count" => "自動停止: パケット数 (0: 無効)", "capture.stop_duration" => "自動停止: 秒 (0: 無効)", "capture.stop_bytes" => "自動停止: bytes (0: 無効)",
+        "capture.ring_path" => "リング保存先 (空欄: 無効)", "capture.ring_max_bytes" => "リング: ファイルごとのbytes", "capture.ring_interval" => "リング: 秒", "capture.ring_file_count" => "リング: 保持ファイル数",
+        "analysis.verify_checksums" => "チェックサム検証", "analysis.max_state_mib" => "解析メモリ上限（MiB）", "analysis.max_flows" => "フロー数上限", "analysis.workers" => "ワーカー数",
+        "name_resolution.enabled" => "名前解決", "name_resolution.timeout" => "解決タイムアウト（秒）", "name_resolution.cache_size" => "名前キャッシュ容量"
+      }.freeze
+      def analysis_settings = Config::AnalysisSettings.new(directory: @preferences.directory)
+
+      def preferences_dialog
+        groups = %w[appearance packet_list capture analysis name_resolution].map do |group|
+          defaults = Config::Preferences::DEFAULTS.fetch(group)
+          schema = defaults.map do |key, value|
+            path = "#{group}.#{key}"
+            options = {"appearance.theme" => %w[system dark light high_contrast], "appearance.language" => %w[ja en],
+              "packet_list.time_format" => %w[relative absolute delta delta_displayed epoch], "packet_list.time_precision" => %w[milli micro nano],
+              "capture.backend" => %w[auto ring socket bpf], "capture.launcher" => %w[auto direct sudo pkexec], "capture.direction" => %w[in out inout]}[path]
+            captions = {"system" => "システム設定", "dark" => "ダーク", "light" => "ライト", "high_contrast" => "ハイコントラスト",
+              "ja" => "日本語", "en" => "English", "relative" => "相対時刻", "absolute" => "絶対時刻", "delta" => "前パケットとの差", "delta_displayed" => "前表示パケットとの差", "epoch" => "エポック時刻",
+              "milli" => "ミリ秒", "micro" => "マイクロ秒", "nano" => "ナノ秒", "in" => "受信", "out" => "送信", "inout" => "双方向"}
+            options = options.map { |item| [t(captions.fetch(item, item)), item] } if options
+            type = options ? :select : [true, false].include?(value) ? :boolean : value.is_a?(Numeric) ? :number : :text
+            {key: path, label: setting_label(path), type: type, options: options || []}
+          end
+          values = defaults.keys.to_h { |key| [:"#{group}.#{key}", @preferences.get("#{group}.#{key}")] }
+          grid = Zaniah::UI::PropertyGrid.new(schema, values, height: 240, label: setting_label(group)).test_id("vk.preferences.#{group}")
+            .on_change { |key, value, *_| apply_preference(key.to_s, value) }
+          [setting_label(group), grid]
+        end
+        content = Zaniah::Div.new.flex_col.gap(8)
+          .child(Zaniah::UI::Button.new(t("プロファイルの管理")).on_click { profiles_dialog })
+          .child(Zaniah::UI::Tabs.new(groups))
+        show_dialog(:preferences, t("設定"), content, reopen: -> { preferences_dialog })
+      end
+
+      def apply_preference(path, value)
+        old = @preferences.get(path)
+        value = Integer(value) if old.is_a?(Integer)
+        value = Float(value) if old.is_a?(Float)
+        @preferences.set(path, value)
+        if path.start_with?("appearance.")
+          change_theme(@preferences.get("appearance.theme"), persist: false)
+          rebuild_view if path == "appearance.language"
+        elsif path.start_with?("packet_list.", "name_resolution.")
+          reset_resolver if path.start_with?("name_resolution.")
+          if path == "packet_list.autoscroll"
+            @autoscroll = value
+            @table.follow_tail = value if @table
+          end
+          @packet_source.reset
+        elsif path.start_with?("analysis.")
+          @pending_analysis_settings = true
+          apply_analysis_settings
+        end
+        @window.request_frame
+      rescue StandardError => error
+        show_error(error)
+      end
+
+      def profiles_dialog
+        content = Zaniah::Div.new.flex_col.gap(8)
+        @profiles.names.each do |name|
+          row = Zaniah::Div.new.flex_row.gap(6)
+            .child(Zaniah::UI::Button.new(name, variant: name == @profiles.active ? :secondary : :ghost).on_click { switch_profile(name) }.flex_1)
+            .child(Zaniah::UI::Button.new(t("複製")).on_click { path_dialog(t("新しいプロファイル名")) { |value| @profiles.create(value, copy_from: name); profiles_dialog } })
+          row.child(Zaniah::UI::Button.new(t("削除")).disabled(name == @profiles.active || name == "default").on_click { @profiles.delete(name); profiles_dialog })
+          content.child(row)
+        end
+        content.child(Zaniah::UI::Button.new(t("新規作成")).on_click { path_dialog(t("新しいプロファイル名")) { |value| @profiles.create(value); profiles_dialog } })
+        show_dialog(:profiles, t("プロファイル"), Zaniah::ScrollView.new.h(240).child(content), reopen: -> { profiles_dialog })
+      end
+
+      def switch_profile(name)
+        raise Vanken::Error, "stop capture before switching profiles" if @capture.running?
+        raise Vanken::Error, "finish loading before switching profiles" if document&.loading? && !@reanalysis_in_flight
+        close_analysis if respond_to?(:close_analysis)
+        @preferences = @profiles.switch(name)
+        @capture.preferences = @preferences
+        reset_resolver
+        reload_columns
+        reload_coloring_rules
+        change_theme(@preferences.get("appearance.theme"), persist: false)
+        rebuild_view
+        dismiss_dialog
+        reconfigure_analysis if document
+      rescue StandardError => error
+        show_error(error)
+      end
+
+      def decode_as
+        field = Zaniah::UI::TextField.new(analysis_settings.decode_as.join("; "), label: t("例: udp.port==8443,dns")).test_id("vk.decode_as.rules")
+        content = Zaniah::Div.new.flex_col.gap(12).child(field)
+          .child(Zaniah::UI::Button.new(t("適用")).on_click do
+            rules = field.value.split(";").map(&:strip).reject(&:empty?)
+            Gateway::Dissector.new(decode_as: rules, plugins: analysis_settings.plugins)
+            analysis_settings.decode_as = rules
+            dismiss_dialog
+            reconfigure_analysis
+          rescue StandardError => error
+            show_error(error)
+          end)
+        show_dialog(:decode_as, t("別プロトコルとして解析"), content, reopen: -> { decode_as })
+      end
+
+      def plugins_dialog
+        content = Zaniah::Div.new.flex_col.gap(8)
+        analysis_settings.plugin_entries.each do |entry|
+          path = entry.fetch("path")
+          content.child(Zaniah::Div.new.flex_row.gap(8).child(Zaniah::UI::Label.new(path, wrap: :word).flex_1)
+            .child(Zaniah::UI::Button.new(t("削除")).on_click { analysis_settings.remove_plugin(path); plugins_dialog }))
+        end
+        content.child(Zaniah::UI::Button.new(t("追加")).on_click { path_dialog(t("Ruby ディセクタのパス")) { |path| analysis_settings.register_plugin(path); reload_plugins } })
+        content.child(Zaniah::UI::Button.new(t("再読み込み")).on_click { reload_plugins })
+        show_dialog(:plugins, t("ディセクタプラグイン"), Zaniah::ScrollView.new.h(240).child(content), reopen: -> { plugins_dialog })
+      end
+
+      def reload_plugins
+        paths = analysis_settings.untrusted_plugins
+        return reconfigure_analysis if paths.empty?
+        content = Zaniah::Div.new.flex_col.gap(12).child(Zaniah::UI::Label.new(t("Ruby プラグインはユーザー権限で任意のコードを実行します。信頼するファイルだけを読み込んでください。\n%{paths}", paths: paths.join("\n")), wrap: :word))
+          .child(Zaniah::UI::Button.new(t("信頼して読み込む")).test_id("vk.plugins.trust").on_click { analysis_settings.trust_plugins(paths); dismiss_dialog; reconfigure_analysis })
+          .child(Zaniah::UI::Button.new(t("キャンセル"), variant: :secondary).on_click { dismiss_dialog })
+        show_dialog(:plugin_trust, t("プラグインの確認"), content, reopen: -> { reload_plugins })
+      end
+
+      def reconfigure_analysis
+        doc = document
+        return unless doc
+        raise Vanken::Error, "finish loading or stop capture before changing analysis" if @capture.running? || (doc.loading? && !@reanalysis_in_flight)
+        @pending_reanalysis = {document: doc, options: {decode_as: analysis_settings.decode_as, plugins: analysis_settings.plugins, preferences: @preferences}, number: selected_number}
+        begin_reanalysis
+      end
+
+      def begin_reanalysis
+        request = @pending_reanalysis
+        return unless request && !document&.loading? && (!@reanalysis_task || @reanalysis_task.done?)
+        @pending_reanalysis = nil
+        doc = request[:document]
+        return unless document.equal?(doc) && !@closing
+        close_analysis if respond_to?(:close_analysis)
+        @selection_generation += 1
+        selection_generation = @selection_generation
+        @reanalysis_selection = nil
+        @reanalysis_in_flight = true
+        @active_reanalysis = request
+        @packet_source.reset
+        @reanalysis_task = @app.executor.background do
+          doc.reanalyze(**request[:options])
+          doc.cancel_reanalysis unless @active_reanalysis.equal?(request)
+          doc.wait
+          raise doc.error if doc.error
+          @app.executor.post do
+            next if @closing || !document.equal?(doc)
+            @packet_source.reset
+            @reanalysis_selection = [doc, request[:number], selection_generation]
+            changed
+          end
+        rescue StandardError => error
+          @app.executor.post do
+            next if @closing || !document.equal?(doc)
+            @reanalysis_in_flight = false
+            show_error(error)
+            begin_reanalysis
+          end
+        end
+        @reanalysis_task.on_complete { @app.executor.post { changed if !@closing && document.equal?(doc) } }
+      end
+
+      def wait_reanalysis
+        task, @reanalysis_task = @reanalysis_task, nil
+        @active_reanalysis = nil
+        document&.cancel_reanalysis if @reanalysis_in_flight && task && !task.done?
+        task&.await
+      end
+
+      def apply_analysis_settings
+        return unless @pending_analysis_settings
+        return if @capture.running? || document&.loading?
+        @pending_analysis_settings = false
+        document&.cancel_scan
+        @pool_mutex.synchronize do
+          @pool&.shutdown
+          @pool = nil
+        end
+        reconfigure_analysis if document
+      end
+
+      def command_palette
+        dismiss_dialog
+        @dialog_kind = :command_palette
+        @dialog_reopen = -> { command_palette }
+        @dialog = Zaniah::UI::CommandPalette.from(@app.actions, open: true, placeholder: t("コマンドを検索"), title: t("コマンドパレット"), close_label: t("閉じる")).test_id("vk.command_palette")
+          .on_close { dismiss_dialog }
+        @window.request_frame
+      end
+
+      def rebuild_view
+        expanded = @tree&.expanded&.dup || []
+        text = @filter_field.value
+        @filter_field = Zaniah::UI::TextField.new(text, placeholder: t("表示フィルタ"), clearable: false).test_id("vk.filter.input")
+        @filter_field.completion(CompletionProvider.new(self)).on_change { |value, _| validate_filter(value) }
+        Actions.install(self)
+        @main_view = MainView.new(self).test_id("vk.main")
+        @tree.replace(detail_nodes)
+        expanded.each { |id| @tree.expand(id) }
+        @hex.bytes = selected_bytes
+        @table.selection.add(selected_number) if selected_number
+        @packet_source.reset
+        reopen_dialog
+        @window.request_frame
+      end
+
+      private
+
+      def setting_label(path)
+        label = SETTING_LABELS[path] || {"appearance" => "表示", "packet_list" => "パケット一覧", "capture" => "キャプチャ", "analysis" => "解析", "name_resolution" => "名前解決"}.fetch(path, path)
+        t(label)
+      end
+    end
+  end
+end

data/lib/vanken/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Vanken
-  VERSION = "0.1.0"
+  VERSION = "0.3.0"
 end

data/packaging/README.md

@@ -1,5 +1,45 @@
 # Live capture permissions
 
+`vanken-setup-permissions` installs the files shipped in `packaging/linux/` or `packaging/macos/`. Review the macOS plan first:
+
+```sh
+vanken-setup-permissions --platform darwin --dry-run
+```
+
+On Linux, provide the canonical absolute paths of a root-owned Ruby 3.3 or newer runtime and its isolated gem home:
+
+```sh
+vanken-setup-permissions --platform linux --dry-run \
+  --ruby /opt/vanken-ruby/bin/ruby --gem-home /opt/vanken-ruby/gems
+```
+
+The following administrator installation assumes Ruby is already installed under `/opt/vanken-ruby`, with root-owned runtime files that are not writable by group or other users. Install Vanken into the isolated root-owned gem home, then run its packaged setup command with that same interpreter:
+
+```sh
+sudo /usr/bin/env -i PATH=/usr/bin:/bin GEM_HOME=/opt/vanken-ruby/gems GEM_PATH=/opt/vanken-ruby/gems \
+  /opt/vanken-ruby/bin/ruby /opt/vanken-ruby/bin/gem install vanken --version 0.3.0 --no-document
+sudo /usr/bin/env -i PATH=/usr/bin:/bin GEM_HOME=/opt/vanken-ruby/gems GEM_PATH=/opt/vanken-ruby/gems \
+  /opt/vanken-ruby/bin/ruby /opt/vanken-ruby/gems/bin/vanken-setup-permissions \
+  --ruby /opt/vanken-ruby/bin/ruby --gem-home /opt/vanken-ruby/gems --policy polkit
+```
+
+The installer checks the interpreter, its library paths, runtime tree, gem home, and source tree for root ownership and writable paths before copying anything. Root-owned runtime library aliases are allowed only when every link, target, and parent path passes the same checks. The wrapper clears all inherited environment variables, fixes the interpreter and gem paths, and runs only `/usr/local/libexec/vanken/helper`. The polkit policy authorizes that exact wrapper path. Launch Vanken as your ordinary user; polkit provides the administrator authentication dialog when capture requires elevation.
+
+For headless Linux or sudo instead of polkit, create a dedicated capture group and add only users who should inspect network traffic. Log out and log in after changing group membership, then use `--policy sudoers --group vanken` in the setup command. The installer requires `visudo` and validates the rule before installing `/etc/sudoers.d/vanken`. It never grants capabilities to a shared Ruby interpreter.
+
+On macOS, create the intended group, install the BPF daemon, and activate it:
+
+```sh
+sudo dseditgroup -o create vanken
+sudo dseditgroup -o edit -a "$USER" -t user vanken
+sudo "$(command -v vanken-setup-permissions)" --group vanken
+sudo launchctl bootstrap system /Library/LaunchDaemons/org.vanken.chmod-bpf.plist
+```
+
+Log out and log in after joining the group. The daemon grants the group mode `0660` on existing BPF devices at startup and every ten seconds, including devices added later. It runs the fixed root-owned shell script; Vanken and the capture helper run as the normal user. Verify access with `vanken-capture --check --interface lo0`. If Wireshark's ChmodBPF already manages these devices, use that configuration instead of installing a second daemon.
+
+Use `--root /absolute/staging-directory` to prepare files in an existing directory without activating system permissions. A staged tree is for review and packaging; it does not validate or grant trust to the runtime paths. Neither `--dry-run` nor staging loads the macOS daemon. To remove the installed macOS configuration, unload `org.vanken.chmod-bpf` with `launchctl bootout`, remove its plist and `chmod-bpf` script, and restore the BPF device ownership/permissions prescribed by your administrator.
+
 The application runs as your normal user. The capture helper opens the capture device, drops supplementary groups and both real and effective group/user IDs, and writes pcapng to stdout. The interpreter, helper, libraries, gems, and every parent directory of the privileged wrapper must be owned by root and must not be writable by group or other users.
 
 On macOS, grant the intended capture group access to `/dev/bpf*` using an administrator-managed startup configuration. Once `vanken-capture --check --interface lo0` reports `"direct":true`, Vanken can capture without sudo. Device permissions may need to be restored after a reboot.
@@ -30,4 +70,4 @@ Validate the rule with `visudo`. Members of this group can capture network traff
 sudo /usr/local/libexec/vanken/vanken-capture -i eth0 --drop-to "$(id -u):$(id -g)" > capture.pcapng
 ```
 
-For the isolated Linux integration check, run `script/capture-ci.sh` with Docker available. It creates a disposable privileged container, installs root-owned Ruby/gems and the fixed helper wrapper, creates the `vanken-test` namespace and a veth pair, then runs the tests as an unprivileged user. The tests verify UID dropping, packet capture, statistics, and clean shutdown. The nightly `Live capture` workflow runs this same command.
+For the isolated Linux integration check, run `script/capture-ci.sh` with Docker available. It creates a disposable privileged container, runs `vanken-setup-permissions` against its root-owned Ruby/gems to install the fixed wrapper and sudoers policy, creates the `vanken-test` namespace and a veth pair, then runs the tests as an unprivileged user. The tests verify environment isolation, UID dropping, packet capture, statistics, and clean shutdown. The installer plan is saved as `permission-install.json`. The nightly `Live capture` workflow runs this same command.

data/packaging/linux/org.vanken.capture.policy

@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE policyconfig PUBLIC "-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN" "http://www.freedesktop.org/standards/PolicyKit/1/policyconfig.dtd">
+<policyconfig>
+  <action id="org.vanken.capture">
+    <description>Capture network packets with Vanken</description>
+    <message>Authentication is required to capture network packets.</message>
+    <defaults>
+      <allow_any>no</allow_any>
+      <allow_inactive>no</allow_inactive>
+      <allow_active>auth_admin_keep</allow_active>
+    </defaults>
+    <annotate key="org.freedesktop.policykit.exec.path">/usr/local/libexec/vanken/vanken-capture</annotate>
+  </action>
+</policyconfig>

data/packaging/linux/vanken-capture.wrapper

@@ -0,0 +1,6 @@
+#!/bin/sh
+cd / || exit 1
+exec /usr/bin/env -i PATH=/usr/bin:/bin:/usr/sbin:/sbin \
+  GEM_HOME=VANKEN_GEM_HOME GEM_PATH=VANKEN_GEM_HOME \
+  VANKEN_RUBY -I /usr/local/libexec/vanken/lib \
+  /usr/local/libexec/vanken/helper "$@"

data/packaging/linux/vanken.desktop

@@ -0,0 +1,9 @@
+[Desktop Entry]
+Type=Application
+Name=Vanken
+Comment=Capture and inspect network packets
+Exec=vanken %f
+Icon=network-workgroup
+Terminal=false
+Categories=Network;Development;
+MimeType=application/vnd.tcpdump.pcap;application/x-pcapng;

data/packaging/linux/vanken.sudoers

@@ -0,0 +1,2 @@
+# Members of this group can inspect network traffic. Validate with visudo -cf.
+%VANKEN_GROUP ALL=(root) NOPASSWD: /usr/local/libexec/vanken/vanken-capture

data/packaging/macos/chmod-bpf

@@ -0,0 +1,6 @@
+#!/bin/sh
+for device in /dev/bpf[0-9]*; do
+  [ -c "$device" ] || continue
+  /usr/bin/chgrp VANKEN_GROUP "$device" || exit 1
+  /bin/chmod 660 "$device" || exit 1
+done

data/packaging/macos/org.vanken.chmod-bpf.plist

@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0"><dict>
+  <key>Label</key><string>org.vanken.chmod-bpf</string>
+  <key>ProgramArguments</key><array><string>/usr/local/libexec/vanken/chmod-bpf</string></array>
+  <key>RunAtLoad</key><true/>
+  <key>StartInterval</key><integer>10</integer>
+</dict></plist>

data/sig/generated/vanken/app/capture_controller.rbs

@@ -3,6 +3,18 @@
 module Vanken
   module App
     class CaptureController
+      class RingReader
+        def initialize: (untyped reader, untyped writer, on_error: untyped) -> untyped
+
+        def next_frame: (timeout: untyped) -> untyped
+
+        def eof?: () -> untyped
+
+        def stop: () -> untyped
+
+        def close: () -> untyped
+      end
+
       class Error < Vanken::CaptureError
         attr_reader code: untyped
 
@@ -29,6 +41,8 @@ module Vanken
 
       def snapshot: () -> untyped
 
+      def preferences=: (untyped value) -> untyped
+
       def start: (untyped options) -> untyped
 
       def stop: () -> untyped
@@ -43,6 +57,8 @@ module Vanken
 
       def run: () -> untyped
 
+      def open_ring: () -> untyped
+
       def consume_control: (untyped io) -> untyped
 
       # Called under @mutex; the helper stop runs separately so UI callbacks never wait for it.

data/sig/generated/vanken/app/document.rbs

@@ -5,6 +5,10 @@ module Vanken
     class Document
       include DocumentJobs
 
+      include DocumentAnalysis
+
+      include Navigation
+
       attr_reader store: untyped
 
       attr_reader columns: untyped
@@ -31,11 +35,13 @@ module Vanken
 
       attr_reader analysis_options: untyped
 
+      attr_reader analysis_gateway_options: untyped
+
       attr_accessor frame_latency: untyped
 
       attr_accessor scanner: untyped
 
-      def initialize: (?on_update: untyped, ?preferences: untyped, ?store: untyped, ?scanner: untyped, ?process_analysis: untyped) -> untyped
+      def initialize: (?on_update: untyped, ?preferences: untyped, ?store: untyped, ?scanner: untyped, ?process_analysis: untyped, ?decode_as: untyped, ?plugins: untyped) -> untyped
 
       def open: (untyped path) -> untyped
 
@@ -61,6 +67,12 @@ module Vanken
 
       def closing?: () -> untyped
 
+      def analysis_stopped?: () -> untyped
+
+      def capture_stats: () -> untyped
+
+      def expert_summary: () -> untyped
+
       def stream_frames: (untyped stream) -> untyped
 
       def packet: (untyped number) -> untyped
@@ -72,6 +84,14 @@ module Vanken
 
       def row: (untyped number) -> untyped
 
+      def custom_columns: () -> untyped
+
+      def custom_columns=: (untyped columns) -> untyped
+
+      def custom_row: (untyped number) -> untyped
+
+      def custom_sort_value: (untyped number, untyped field) -> untyped
+
       def details: (untyped number) -> untyped
 
       def publish: (untyped number, untyped packet) -> untyped
@@ -97,6 +117,8 @@ module Vanken
 
       def cancel: () -> untyped
 
+      def cancel_reanalysis: () -> untyped
+
       def wait: (?untyped timeout) -> untyped
 
       def close: () -> untyped

data/sig/generated/vanken/app/document_analysis.rbs

@@ -0,0 +1,21 @@
+# Generated from lib/vanken/app/document_analysis.rb with RBS::Inline
+
+module Vanken
+  module App
+    module DocumentAnalysis
+      def self.included: (untyped base) -> untyped
+
+      module ClassMethods
+        def recover: (untyped directory, **untyped options) -> untyped
+      end
+
+      def analyze_store: () -> untyped
+
+      def reanalyze: (?decode_as: untyped, ?plugins: untyped, ?preferences: untyped) -> untyped
+
+      private
+
+      def open_analysis_files: () -> untyped
+    end
+  end
+end

data/sig/generated/vanken/app/document_jobs.rbs

@@ -21,6 +21,12 @@ module Vanken
 
       def stale_job?: (untyped generation) -> untyped
 
+      # Retain only post-filter arrivals, at eight bytes per packet, and only for
+      # displayed-delta filters. Rebuilds read this basis without replacing it.
+      def record_live_predecessors: (untyped first, untyped last, untyped matches, ?context: untyped) -> untyped
+
+      def reanalysis_snapshot: () -> untyped
+
       def filter_snapshot: (?displayed_delta: untyped) -> untyped
     end
   end

data/sig/generated/vanken/app/expert_info.rbs

@@ -0,0 +1,30 @@
+# Generated from lib/vanken/app/expert_info.rb with RBS::Inline
+
+module Vanken
+  module App
+    class ExpertRow < Data
+      attr_reader severity(): untyped
+
+      attr_reader code(): untyped
+
+      attr_reader protocol(): untyped
+
+      attr_reader message(): untyped
+
+      attr_reader count(): untyped
+
+      attr_reader numbers(): untyped
+
+      def self.new: (untyped severity, untyped code, untyped protocol, untyped message, untyped count, untyped numbers) -> instance
+                  | (severity: untyped, code: untyped, protocol: untyped, message: untyped, count: untyped, numbers: untyped) -> instance
+
+      def self.members: () -> [ :severity, :code, :protocol, :message, :count, :numbers ]
+
+      def members: () -> [ :severity, :code, :protocol, :message, :count, :numbers ]
+    end
+
+    module ExpertInfo
+      def self.rows: (untyped document, ?displayed_only: untyped) -> untyped
+    end
+  end
+end

data/sig/generated/vanken/app/io_graph.rbs

@@ -0,0 +1,45 @@
+# Generated from lib/vanken/app/io_graph.rb with RBS::Inline
+
+module Vanken
+  module App
+    class IOPoint < Data
+      attr_reader interval(): untyped
+
+      attr_reader start_ns(): untyped
+
+      attr_reader packets(): untyped
+
+      attr_reader bytes(): untyped
+
+      def self.new: (untyped interval, untyped start_ns, untyped packets, untyped bytes) -> instance
+                  | (interval: untyped, start_ns: untyped, packets: untyped, bytes: untyped) -> instance
+
+      def self.members: () -> [ :interval, :start_ns, :packets, :bytes ]
+
+      def members: () -> [ :interval, :start_ns, :packets, :bytes ]
+    end
+
+    class IOSeries < Data
+      attr_reader expression(): untyped
+
+      attr_reader interval_ns(): untyped
+
+      attr_reader points(): untyped
+
+      attr_reader omitted_intervals(): untyped
+
+      def self.new: (untyped expression, untyped interval_ns, untyped points, untyped omitted_intervals) -> instance
+                  | (expression: untyped, interval_ns: untyped, points: untyped, omitted_intervals: untyped) -> instance
+
+      def self.members: () -> [ :expression, :interval_ns, :points, :omitted_intervals ]
+
+      def members: () -> [ :expression, :interval_ns, :points, :omitted_intervals ]
+    end
+
+    module IOGraph
+      INTERVALS: untyped
+
+      def self.build: (untyped document, ?interval: untyped, ?series: untyped, ?displayed_only: untyped, ?cancelled: untyped) -> untyped
+    end
+  end
+end

data/sig/generated/vanken/app/navigation.rbs

@@ -0,0 +1,31 @@
+# Generated from lib/vanken/app/navigation.rb with RBS::Inline
+
+module Vanken
+  module App
+    module Navigation
+      def displayed_index: (untyped number) -> untyped
+
+      def toggle_mark: (untyped number) -> untyped
+
+      def toggle_ignore: (untyped number) -> untyped
+
+      def toggle_time_reference: (untyped number) -> untyped
+
+      def mark_all_displayed: () -> untyped
+
+      def unmark_all: () -> untyped
+
+      def conversation_neighbor: (untyped number, untyped direction) -> untyped
+
+      def search: (untyped query, **untyped options) ?{ (?) -> untyped } -> untyped
+
+      def cancel_search: () -> untyped
+
+      private
+
+      def toggle_packet_state: (untyped values, untyped number, untyped field) -> untyped
+
+      def packet_states_changed: (untyped field) -> untyped
+    end
+  end
+end

data/sig/generated/vanken/app/search_job.rbs

@@ -0,0 +1,21 @@
+# Generated from lib/vanken/app/search_job.rb with RBS::Inline
+
+module Vanken
+  module App
+    class SearchJob
+      attr_reader program: untyped
+
+      def initialize: (untyped document, untyped query, ?mode: untyped, ?target: untyped, ?from: untyped, ?direction: untyped) -> untyped
+
+      def cancel: () -> untyped
+
+      def cancelled?: () -> untyped
+
+      def run: (?snapshot: untyped) -> untyped
+
+      private
+
+      def search_text: (untyped number) -> untyped
+    end
+  end
+end

data/sig/generated/vanken/app/stats_job.rbs

@@ -0,0 +1,18 @@
+# Generated from lib/vanken/app/stats_job.rb with RBS::Inline
+
+module Vanken
+  module App
+    # Invoke refresh on the executor; cancel joins its current frame before store close.
+    class StatsJob
+      def initialize: (untyped document, ?specs: untyped, ?displayed_only: untyped) -> untyped
+
+      def refresh: () -> untyped
+
+      def cancel: () -> untyped
+
+      private
+
+      def reset: () -> untyped
+    end
+  end
+end

data/sig/generated/vanken/capture/helper_options.rbs

@@ -13,6 +13,12 @@ module Vanken
 
       attr_reader flush_interval: untyped
 
+      attr_reader stop_count: untyped
+
+      attr_reader stop_duration: untyped
+
+      attr_reader stop_bytes: untyped
+
       def self.parse: (untyped argv) -> untyped
 
       def initialize: () -> untyped