AKJ7 · Nov 1, 2026 · Oct 31, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -6,6 +6,115 @@ All notable changes to CANExplorer are documented in this file. The format follo
 CANExplorer follows [semantic versioning](https://semver.org/) from 1.0.0 on. Between `0.0.1` and `1.0.0`, the
 development stages are listed by date and commit, newest first.
 
+## [1.6.0] – 2026-10-31
+
+### Added
+
+- **Automotive Ethernet capture** tool: open a **pcap** or **pcapng** file (or capture live on Linux) and see the
+  decoded packets — Ethernet, 802.1Q VLAN, IPv4/IPv6, ARP, UDP/TCP — with the automotive protocols on top
+  recognised: **SOME/IP** (and SOME/IP-SD), **DoIP**, **gPTP** (IEEE 802.1AS), **AVTP** (IEEE 1722, with the stream
+  id and sequence number) and **LLDP** (neighbour chassis/port, system name, TTL). SOME/IP carried over **TCP**
+  (reassembled across segments) and **SOME/IP-TP** segmented messages are decoded in full; a **SOME/IP services**
+  card lists the services offered in Service Discovery (ids, version, endpoints, offer count), and when the capture
+  contains gPTP a **time-sync** card summarises the grandmaster and its clock quality, the clocks and domains seen,
+  and the configured and observed Sync rate. Filter by protocol, address or port, see the protocol breakdown, and
+  export back to pcap. Live capture needs root/`CAP_NET_RAW` and a tap or mirror port for a full view.
+
+- **Much larger MCP surface.** The `can-mcp` server gains **diagnostics** tools — OBD-II (`obd_status`, `obd_dtcs`,
+  `obd_vin`, `obd_supported`, `obd_read`, `obd_clear`) and UDS (`uds_read_did`, `uds_read_dtcs`, `uds_reset`,
+  `uds_routine`, `uds_request`) — **protocol decoding** (`decode_protocol`), more **reverse-engineering** verbs
+  (`timing`, `related_signals`, `capture_reaction`), **transmit by name** (`send_message`), and `list_interfaces`.
+  The bus is also exposed as read-only **resources** (`can://status`, `can://identifiers`, `can://frames`,
+  `can://database`) and guided **prompts** (reverse-engineer an identifier, diagnose trouble codes, find a signal).
+  New **permission tiers** gate them: `--allow-diagnostics` (safe reads), `--allow-control` (active diagnostics) and
+  `--allow-send` (transmit), each granting the ones below it. `--interface`/`--channel` are now optional — the
+  server can start unconnected and the agent opens a bus itself with the `connect` tool (after `list_interfaces`),
+  and can switch buses with `disconnect`. A database can be loaded or cleared at runtime (`load_database` /
+  `unload_database`).
+- **In-app MCP server.** The GUI can host the MCP server for a connection it already has open (the **Agent…**
+  button on the Trace toolbar), so an agent attaches to the same live bus you are watching — which a separate
+  `can-mcp` process usually cannot, as most adapters are single-access. It is off by default, listens on
+  `127.0.0.1` only over the streamable-HTTP transport, is gated by a generated token, and uses the same permission
+  tiers (read-only by default).
+- **OBD-II page** (SAE J1979 over CAN): a dedicated page for the standard emissions diagnostics. Scan a vehicle
+  for its VIN, MIL status and supported values; watch the live values (engine speed, vehicle speed, temperatures,
+  load, throttle, fuel level, voltage…) as tiles; and read the stored and pending trouble codes (decoded to
+  `P`/`C`/`B`/`U` codes) or clear them. Built on the UDS/ISO-TP stack; an `ObdServer` answers for use without a
+  vehicle.
+- **NMEA 2000 and J1587 trace decoders.** NMEA 2000 (the marine protocol, built on J1939) decodes the common PGNs
+  into fields — engine, position, COG/SOG, heading, wind, depth, speed, battery — in marine units, with Fast Packet
+  reassembly. J1587 decodes the older heavy-truck bus's messages (MID and PIDs), with common parameters scaled;
+  J1708 is a serial bus (not CAN), so the decoder works on J1587 message bytes from a log or gateway, not a live
+  capture. Both are selectable as the connection protocol, like J1939 and CANopen.
+- **Bit-transition activity map** in the reverse engineering view (the **Activity** tab): a raster of every bit of
+  the selected identifier across the whole capture — frames across, bits down (byte 0 at the top) — so counters
+  (diagonal ramps), constant bits (flat), toggles and multiplexed regions stand out at a glance, with changed bits
+  highlighted. Complements the frame-at-a-time temporal replay.
+- **Interactive scripting console** in the reverse engineering view (the **Console** tab): run Python over the
+  frames captured so far, with the reverse-engineering primitives (`collect`, `analyse`, `BitField`, `candidates`,
+  `signal_groups`, `correlate`) and the current frames, found fields and helpers in scope, with Python syntax
+  highlighting. Variables persist between runs and a trailing expression's value is shown, like a REPL — the
+  scriptable surface the MCP service gives an AI agent, for a human at the keyboard.
+- **Frame-interval (Δt) and per-byte timing graphs** in the reverse engineering view: **Plot Δt** graphs a
+  selected identifier's inter-frame interval over time (on the Signals page, with cursors, statistics and CSV
+  export) to spot gateways, bursts and event-triggered messages, and **Plot bytes** graphs every payload byte as
+  a value over time.
+- **GM Class 2 / SAE J1850 VPW** support, for the pre-CAN GM vehicles such as the 1999–2006 P01/P59 PCMs. A new
+  python-can interface (**elm327_vpw**) drives an ELM327/OBDLink adapter in J1850 VPW mode (`AT SP 2`), so the
+  10.4 kbit/s single-wire Class 2 bus appears in the connection dialog and the whole application — trace,
+  dashboard, reverse engineering, recording — works on it, with each VPW frame's
+  three-byte header (priority, target, source) in the extended identifier. A **J1850 / Class 2** diagnostics page
+  (shown on these connections) runs SAE J1979 over the shared adapter: read current-data PIDs and the VIN, read
+  the stored trouble codes (`P0143`…) or clear them, and send raw requests. Monitoring and diagnostics are
+  time-multiplexed on the one adapter. Scripts use `can_explorer.core.j1850` (`J1850Client`) and
+  `can_explorer.core.elm327_vpw`; a `Class2EcuSimulator` allows trying it without hardware.
+- **ARXML SOME/IP descriptions**: the SOME/IP tool reads AUTOSAR **ARXML** service interfaces (chosen by the
+  `.arxml` extension) in addition to FIBEX, resolving the `SOMEIP-SERVICE-INTERFACE-DEPLOYMENT` service/method/event
+  ids to the referenced interfaces and their data types to decode payloads into named signals. The same subset as
+  FIBEX is supported — scalars, fixed and dynamic arrays, strings and nested structures.
+- **AUTOSAR E2E protection** library (`can_explorer.core.e2e`): the AUTOSAR CRC routines (`crc8`, `crc8h2f`,
+  `crc16`, `crc32`, `crc32p4`, verified against the published check values) and E2E Profile 2 protect/check, for
+  verifying a SOME/IP or signal PDU's end-to-end CRC and sequence counter.
+- **German, French, Japanese and Chinese translations** for the newer views (Ethernet capture, SOME/IP, OBD-II,
+  J1850, the AI agent/MCP dialog and the reverse-engineering panels), which were previously untranslated.
+
+### Changed
+
+- **`mcp` is now a core dependency**, not an optional extra: the `can-mcp` command and the in-app **Agent** server
+  work out of the box (no `pip install 'can-explorer[mcp]'`).
+- **More reverse-engineering over MCP.** New tools let an agent inspect raw bit behaviour and test and commit its
+  own hypotheses: `bit_activity` (per-bit set/flip rates and a per-byte summary), `extract_field` (decode a
+  candidate bit range over time without a database), `mark`/`clear_markers`/`reaction_at_markers` (find the fields
+  that react at the moments of a repeated action); `timing` gains a `series` option (the Δt over time) and
+  `promote_to_dbc` can now write field specs the agent supplies (`fields=[…]`), not only auto-found fields.
+- **Download buttons on the documentation home page**: per-platform buttons (Windows, macOS, Linux AppImage and
+  .deb) that link straight to the release's installers, resolved from the GitHub release at page load and with the
+  visitor's platform highlighted; they fall back to the releases page without JavaScript.
+- **Expanded documentation**: the MCP page leads with the in-app server and a screenshot, plus runnable Python
+  scripting examples for both the in-app server and the `can-mcp` command; the OBD-II page gains a screenshot and an
+  `ObdClient` scripting example.
+
+### Fixed
+
+- **UDS discovery** scans now stop immediately when **Stop** is pressed, and the button returns to **Start**.
+  Stopping interrupts the in-flight request instead of only taking effect between requests (so a scan of an
+  unresponsive bus, or an ECU looping on "response pending", no longer appears to ignore Stop until the per-request
+  timeout elapses), and the running state is updated once the scan task has actually finished.
+- **Closing a connection** no longer leaves the remaining connection's view squeezed into a narrow column: the
+  connection views are no longer hosted in a `StackLayout`, which did not reliably resize its current view when a
+  connection was added or removed.
+- **Closing a connection** no longer empties the sidebar's view list: when a connection was removed, the current
+  view binding kept pointing at the destroyed delegate, so the per-connection views (Dashboard, Trace, …)
+  disappeared from the sidebar for the connection that remained; it now re-resolves when connections change.
+- **UDS/OBD requests now skip stale responses** left on a shared response id (for example by a live poll that was
+  just stopped), rather than mistaking the first unrelated response for the answer — a response is accepted only if
+  it matches the request's service. This fixes an intermittent "Unexpected response …" failure when reading trouble
+  codes right after toggling live data off.
+- **Reverse-engineering frame replay steps by frame, not by time**, so stepping and scrubbing are exact even when a
+  coarse clock gives several frames the same timestamp (seen on Windows); playback still runs at the recorded pace.
+- **Example engine simulation**: the coolant temperature now cools down when the engine is off or idling instead of
+  only ever warming up — it tracks a load-dependent operating temperature and falls toward ambient when off.
+
 ## [1.5.0] – 2026-10-30
 
 ### Added
@@ -625,7 +734,10 @@ Called "Milestone 0.1.0" in the commit message and the README roadmap.
 - Qt Widgets user interface: main window, new connection dialog, about dialog and a raw CAN frame table.
 - Pipenv based project setup, VS Code development container, Dockerfile and a CI workflow skeleton.
 
-[Unreleased]: https://github.com/AKJ7/CANExplorer/compare/v1.2.0...HEAD
+[1.6.0]: https://github.com/AKJ7/CANExplorer/compare/v1.5.0...HEAD
+[1.5.0]: https://github.com/AKJ7/CANExplorer/compare/v1.4.0...v1.5.0
+[1.4.0]: https://github.com/AKJ7/CANExplorer/compare/v1.3.0...v1.4.0
+[1.3.0]: https://github.com/AKJ7/CANExplorer/compare/v1.2.0...v1.3.0
 [1.2.0]: https://github.com/AKJ7/CANExplorer/compare/v1.1.1...v1.2.0
 [1.1.1]: https://github.com/AKJ7/CANExplorer/compare/v1.1.0...v1.1.1
 [1.1.0]: https://github.com/AKJ7/CANExplorer/compare/v1.0.0...v1.1.0

diff --git a/README.md b/README.md
@@ -31,14 +31,15 @@
 - Remote buses: `can-server` shares the interfaces of e.g. a Raspberry Pi in a vehicle over the network
 - MQTT: publish decoded signals (and frames) to a broker for dashboards and home automation, from the application or
   `can-server`, and optionally send frames requested over MQTT
-- MCP: `can-mcp` exposes a bus to an AI agent over the Model Context Protocol — inspect identifiers, decode frames,
-  run the automatic signal analysis, correlate fields to a reference, promote results to a DBC, and optionally transmit
+- MCP: `can-mcp` exposes a bus to an AI agent over the Model Context Protocol — inspect identifiers, decode frames
+  and protocols, run the reverse-engineering analysis, correlate fields, promote results to a DBC, read trouble
+  codes over OBD-II/UDS, and optionally transmit; as tools, resources and prompts, behind permission tiers
 - Signal plots with zoom and pan over the whole buffer, two cursors with values and statistics, several signals per
   chart and CSV export
 - Reverse engineering: bit and byte statistics per identifier and a notch; automatic detection of checksums,
   counters, multiplexers and values; matching fields to database signals, CSV/GPS logs or polled OBD-II values;
-  grouping fields that carry the same signal across messages; event markers; and bit fields to plot without a
-  database or add to one
+  grouping fields that carry the same signal across messages; event markers; frame-interval (Δt) and per-byte
+  timing graphs; and bit fields to plot without a database or add to one
 
 **Recording and replay**
 - ASC, BLF, CSV, candump LOG, PEAK TRC, SQLite, ASAM MF4 and gzip compressed text logs
@@ -58,18 +59,25 @@
 **Diagnostics and protocols**
 - UDS over ISO-TP and the LIN transport layer: sessions, reset, data identifiers, security access with your own
   seed/key algorithm, DTCs, routines; CANdelaStudio CDD and ASAM ODX/PDX descriptions for named and decoded identifiers
+- OBD-II (SAE J1979): a dedicated page for the standard emissions diagnostics — scan for supported values, watch
+  them live, read and clear trouble codes, and read the VIN
 - ECU flashing over UDS (RequestDownload/TransferData) from Intel HEX, S-record or binary files, with progress
 - DoIP (Diagnostics over IP, ISO 13400-2): finds DoIP entities, connects with routing activation (optionally over
   TLS) and runs diagnostics and flashing over Ethernet; a simulated entity works without a vehicle
 - SOME/IP over automotive Ethernet: listens on UDP, discovers the services offered through SOME/IP-SD and shows the
   decoded messages; load a FIBEX file to deserialize the payloads into named signals
+- Automotive Ethernet capture: open a pcap file (or capture live on Linux) and decode the stack (Ethernet, VLAN,
+  IPv4/IPv6, UDP/TCP) and the protocols on top — SOME/IP, DoIP, gPTP and AVTP
 - UDS discovery: scan an ECU for the services, data identifiers, subfunctions and routines it exposes, classifying
   the answers, for reverse engineering diagnostics; and fuzz it with mutated requests, detecting hangs and crashes
 - Bus gateway: forward frames between two connections with filtering, identifier rewriting and rate limiting
 - XCP/CCP measurement and calibration: read measurements live and read/write calibration values by address or by
   name from an A2L file, with simulated slaves for trying it without hardware
 - GMLAN (GMW3110) diagnostics for GM/Opel vehicles — data identifiers, modes, security access and trouble codes —
   over CAN, including single-wire (SWCAN, 33.3 kbit/s) buses; a simulated ECU works without hardware
+- GM Class 2 (SAE J1850 VPW) for the pre-CAN GM vehicles of 1996–2007 (e.g. the 99–06 P01/P59 PCMs): monitor the
+  10.4 kbit/s single-wire bus and run SAE J1979 diagnostics (PIDs, VIN, trouble codes) through an ELM327/OBDLink
+  adapter; a simulated ECU works without hardware
 - J1939: nodes with their address claims, DM1/DM2 trouble codes and lamps, clearing codes, requests and sending
   parameter groups by name with BAM or RTS/CTS
 - CANopen master: NMT, SDO access to object dictionaries from EDS/DCF files, PDO mappings with live values,
@@ -78,7 +86,7 @@
   PDO assignment and emergencies; real adapters need the `ethercat` extra, a simulated network works without
 - Physical I/O: switch the digital outputs of a USB I/O adapter (aio_usb) and watch its inputs and analogue values,
   from the tool or test scripts; needs the `io` extra, a simulated device works without
-- Decoding of ISO-TP, UDS, J1939, CANopen and LIN diagnostic frames in the trace
+- Decoding of ISO-TP, UDS, J1939, NMEA 2000 (marine, with Fast Packet), CANopen, LIN and J1587 frames in the trace
 - LIN master schedule tables
 
 **Simulation and test automation**
@@ -148,6 +156,7 @@ support and the Linux kernel drivers.
 | GVRET (`gvret`) | ESP32RET boards, Macchina M2 (M2RET), CANDue: SavvyCAN's GVRET protocol over USB serial or WiFi | Windows, Linux, macOS |
 | J2534 (`j2534`) | J2534 pass-thru devices: Mongoose, CarDAQ, OpenPort 2.0, Bosch, Autel …; 32-bit drivers through a bridge process | Windows |
 | ELM327 / OBDLink (`elm327`) | OBDLink MX+, LX, SX, EX and ELM327 compatible OBD adapters over USB, Bluetooth or WiFi, for diagnostics | Windows, Linux, macOS |
+| J1850 VPW / GM Class 2 (`elm327_vpw`) | GM "Class 2" 10.4 kbit/s single-wire bus of 1996–2007 GM vehicles, through an ELM327/OBDLink adapter (not CAN) | Windows, Linux, macOS |
 | python-can serial (`serial`) | Adapters with python-can's serial protocol | Windows, Linux, macOS |
 | Robotell (`robotell`) | Robotell USB-CAN | Windows, Linux, macOS |
 | Seeed Studio (`seeedstudio`) | USB-CAN Analyzer | Windows, Linux, macOS |