Replaces the static-only ExportRoot / env-var-only configuration in NodeSetExportTools with an instance-aware ResolveExportRoot(IServiceProvider) that consults McpServerOptions from DI first. Same pattern applied to PacketDecodeTools.GetDecodeAllowedRoot for symmetric naming.
Precedence (both options): services.GetService<McpServerOptions>().Property > OPCUA_MCP_EXPORT_ROOT env var (NodeSet) or PcapOptions.BaseFolder (Decode) > per-tool default. Backward-compat: ExportRoot static property + OPCUA_MCP_EXPORT_ROOT env var both still work.
Program.cs now seeds McpServerOptions from OPCUA_MCP_NODESET_EXPORT_ROOT and OPCUA_MCP_PCAP_BASE_FOLDER environment variables so hosts can override without code changes.
Tests: 7 NUnit tests in McpServerOptionsTests covering DI > env var > default precedence for both options. Reflection-based to reach internal/private helpers — same pattern as the existing PacketDecodePathValidationTests.
Build: 0 warnings / 0 errors on Applications/McpServer for net10.0. Pcap.Tests build blocked locally by the unrelated SDK 10 workload manifest issue (see prior commit for details).
Brings the packet-capture / dissection / replay engine
(Opc.Ua.Bindings.Pcap) onto the channel-refinements branch so it
composes cleanly with the central IClientChannelManager work landed in
PR #3852 (channelrefinements).
Conflicts resolved:
- Applications/McpServer/Program.cs: union of both ConfigureServices
changes — registers AddOpcUa().AddClient() (channel manager) AND
AddOpcUaBindingsPcap() / Formatters / Replay (capture). Channel
manager picks up the capture binding automatically via the shared
TransportBindings.Channels registry.
- Stack/Opc.Ua.Core/Stack/Tcp/TcpListenerChannel.cs: keep both
m_sessionCount (channelrefinements2) and m_tokenActivated event
(origin/capture). Server-side capture relies on
TcpListenerChannel.OnTokenActivated to snapshot per-channel
ChannelToken keys for offline decoding.
- UA.slnx: keep both Opc.Ua.Di.Tests and Opc.Ua.Bindings.Pcap.Tests
project entries.
Pre-existing fix folded in (build-blocker introduced earlier on
channelrefinements2, not by the capture merge):
- Applications/Quickstarts.Servers/ReferenceServer/ReferenceServerConfigurationNodeManager.cs
s_optionalPubSubFolders previously referenced ObjectIds.SecurityGroups
and ObjectIds.KeyPushTargets, neither of which exists on the curated
Stack/Opc.Ua.Types/Internal/ObjectIds.cs surface. Inlined the
NodeId literals (i=15443 / i=25440) per the docstring above the
array so the merged tree builds end-to-end across all TFMs and
every transitive test project (Tests/Opc.Ua.Client.Tests,
Tests/Opc.Ua.Sessions.Tests, etc.) compiles.
Architectural fit ("take advantage of all the changes you made here"):
1. Pcap integrates with the central channel manager via the global
TransportBindings.Channels registry. ClientChannelManager.ctor
accepts an injected ITransportChannelBindings? that defaults to the
global registry, so the Pcap binding installed by
AddOpcUaBindingsPcap is automatically picked up by every channel
created through the manager. No code wiring needed — the
composition is pure layering.
2. Channel sharing transparently includes capture. When multiple
participants share a single IManagedTransportChannel (the F1
refcount + key-equivalence work), the underlying CapturingMessageSocket
captures all participant traffic on the same wire, automatically.
3. Transparent reconnect preserves the capture session. The F8
diagnostics events on ClientChannelManager (state-change /
close notifications) and the Phase E SwapFaultedEntryAsync swap
path produce fresh ChannelEntry instances under the same
ManagedChannelKey — IChannelCaptureRegistry is keyed by channel
identity, so a swap rolls the active observer into the new entry
and the capture session continues recording across the
reconnect / faulted-swap cycle.
4. MCP server composes both: services.AddOpcUa().AddClient() (channel
manager + DI), services.AddSingleton<OpcUaSessionManager>(),
services.AddOpcUaBindingsPcap() (capture binding). OpcUaSessionManager
resolves IClientChannelManager from IServiceProvider; the Pcap tools
(Tools/PacketCapture/Decode/ReplayTools.cs) resolve
CaptureSessionManager and IChannelCaptureRegistry from the same
provider.
Verified locally on net10.0:
- Stack/Opc.Ua.Bindings.Pcap build: 0 warnings, 0 errors.
- Libraries/Opc.Ua.Client build (channel manager): 0 warnings, 0 errors.
- Tests/Opc.Ua.Bindings.Pcap.Tests: 53/53 passed.
- Tests/Opc.Ua.Client.Tests ClientChannelManager filter: 29/29 passed.
- Tests/Opc.Ua.Sessions.Tests ChannelManager filter: 7/7 passed,
1 skipped (RequiresSessionRecreate carry-forward).
- Applications/McpServer build: 0 warnings, 0 errors.
Three changes addressing the design feedback on PR #3855:
1. Renamed Stack/Opc.Ua.Diagnostics.Pcap -> Stack/Opc.Ua.Bindings.Pcap (and the corresponding test project). PackageId, AssemblyName and RootNamespace updated to Opc.Ua.Bindings.Pcap; references in McpServer, signlists, slnx files, docs, and the interop-tester agent updated; Opc.Ua.Core's InternalsVisibleTo entries updated.
2. Replaced UaSCUaBinaryChannel.FrameCaptureSink + per-call NotifyFrameCaptureSink null check with a transport-binding decorator. New files in Opc.Ua.Bindings.Pcap/Bindings:
- IChannelCaptureRegistry / ChannelCaptureRegistry: singleton with a volatile IFrameCaptureSink slot (1 atomic write to switch recording on/off).
- CapturingMessageSocket / CapturingMessageSocketFactory: IMessageSocket decorator that taps Send/Receive bytes via a single volatile read of CurrentObserver.
- PcapTransportChannelBinding: ITransportChannelFactory decorator that injects the capturing socket factory into every TcpTransportChannel and wires ISecureChannel.OnTokenActivated through to the active observer.
- PcapBindings.Install(): non-DI installer for direct TransportBindings.Channels.SetBinding wiring.
IFrameCaptureSink moved to Opc.Ua.Core/Stack/Bindings and gained an OnTokenActivated method so the binding can publish key material alongside chunks. UaSCUaBinaryChannel.FrameCaptureSink property and all three NotifyFrameCaptureSink call sites removed - hot path returns to original shape with zero indirection when the binding is not installed. IMessageSocketAsyncEventArgs gains Offset + Count getters (additive).
AddOpcUaDiagnosticsPcap/Formatters/Replay extension methods renamed to AddOpcUaBindingsPcap[Formatters|Replay]; the new AddOpcUaBindingsPcap also installs the binding into TransportBindings.Channels.
InProcessClientCaptureSource / InProcessServerCaptureSource: dropped reflection-based AttachClientChannel/AttachServerChannel. The source itself implements IFrameCaptureSink and on Start publishes itself as the registry observer; on Stop clears it. McpServer's PacketCaptureTools simplified accordingly (no more per-channel attach loop).
3. Discarded the source-generator suggestion. Confirmed that the dissection path already 100% reuses the source-generated decoders: UaSCUaBinaryChannel.ReadSymmetricMessage for chunk decryption and BinaryDecoder.ReadEncodeable + EncodeableFactory.GlobalFactory (populated by Tools/Opc.Ua.SourceGeneration's DataTypeGenerator) for service-type decoding. Emitting additional dissection code would duplicate what's already there.
Validation:
- Full UA.slnx builds clean: 0 errors, 2 pre-existing unrelated warnings.
- All 53 tests pass on net10.0 (49 existing + 4 new CapturingMessageSocketTests covering hot-path: not-installed/installed-off/installed-on costs, byte equality, exception isolation).
- CI command line (dotnet build/test --framework net10.0 --configuration Release /p:CustomTestTarget=net10.0) reproduces clean locally.
Adds a new diagnostics library (Stack/Opc.Ua.Diagnostics.Pcap) plus 13 MCP tools that capture OPC UA traffic, decode it offline by reusing the stack's own UaSCUaBinaryChannel, and replay it. Includes additive stack hooks (IFrameCaptureSink, TcpListenerChannel.OnTokenActivated), four capture sources (nic / inproc-client / inproc-server / replay), two keylog formats (.uakeys.json, .uakeys.txt), six output formats (pcap, pcapng, json, csv, text, service-timeline), and mock-server / mock-client replay engines. 49 new tests pass; no regressions in the 163 existing transport tests; full UA.slnx builds clean.
- Move all channel-related types into `Stack/Opc.Ua.Core/Stack/Client/Channels/`
subfolder (#13).
- Un-obsolete `SessionReconnectHandler` and the SessionExtensions
`ReconnectAsync(connection, ct)` / `(channel, ct)` extensions; remove
all SRH-related `#pragma warning disable CS0618` suppressions from
applications and tests. AttachChannel/DetachChannel remain obsolete (#1, #4).
- Remove the shared-budget section from MigrationGuide.md (#3).
- Mark `ManagedSession.AttachChannel`/`DetachChannel` `[Obsolete]` so the
warning surfaces all the way up the supported API surface (#9).
- Break the `<see cref=…>` line in `Session.ChannelManager.cs` to stay under
140 chars (#10).
- Move `ChannelManagerSessionFactory` from `Opc.Ua.Gds.Client.Common` into
`Opc.Ua.Client` as a public, documented session-factory option (#11).
- Audit other client classes for `IClientChannelManager`-aware overloads;
add `ISessionFactory`-accepting overloads on `GlobalDiscoveryServerClient`,
`LocalDiscoveryServerClient`, `ServerPushConfigurationClient` so any
session factory (including `ChannelManagerSessionFactory`) works (#12).
- Refactor MCP server (`OpcUaSessionManager`, `Program`) to use
`ManagedSession` + DI-resolved `IClientChannelManager`; remove
`SessionReconnectHandler` and manual keep-alive reconnect (#2).
- ConnectionStateMachine code-style fixes: use named delegate types,
collapse multi-line callback properties to single lines, swap
`timeProvider`/`maxTotalReconnectTime` constructor param order,
fix multi-line declaration (#6, #7, #8).
- HTTPS resilience: confirmed `Microsoft.Extensions.Http` and
`Microsoft.Extensions.Http.Resilience` 10.6.0 support
`net472`/`net48`/`netstandard2.1`; removed `#if NET8_0_OR_GREATER`
gating from `ManagedSessionBuilder` and `OpcUaClientBuilderExtensions`
and HTTPS csproj package refs (#5).
Verification:
- `Opc.Ua.Client` + `Opc.Ua.Core` + `Opc.Ua.Gds.Client.Common` build
clean (0 warnings, 0 errors).
- 56/56 core channel-manager / retry-budget / HTTPS factory tests pass.
- 129/129 client (ManagedSession + legacy SRH back-compat + SessionExtensions)
tests pass.
* New certificate and secrete abstraction with certificate infrastructure and certificate/secret stores.
* leak testing for certificate resources to validate new ref counting in every test assembly
* Migration guide updated and documentation added for all
* Remove IDisposable from Nodestate and UserIdentity.
* UserCertificateTokenHandler now just points into certificate registry/stores, no dispose required
* Fix CA2000 warnings and cleanup of other diagnostics, increase warning levels in .editorconfig
Marc Schier