@eyeauras/insight-cli 0.1.0 → 0.2.1

package/skills/insight-ilspy/references/agent-execution.md

@@ -0,0 +1,36 @@
+# Agent host execution permissions
+
+Keep the user/project host policy and the selected profile. A sandbox can deny writes
+to runtime AppData or access to the local IPC endpoint, including during local help.
+This is a host execution boundary, not evidence that the tool or its inputs are absent.
+
+First retry only `insight-cli --help`, `tools list`, `skill`, or the selected application's
+read-only `status` using the host's normal permission escalation. In Codex, use the
+execution tool's `sandbox_permissions: "require_escalated"` with a scoped explanation
+that the installed CLI needs its existing profile storage/local IPC. Automatic approval
+review or the user decides that request; do not disable the sandbox or approval policy.
+
+Do not work around this by changing HOME/AppData/profile paths, creating another host,
+deleting owner/endpoint files, killing unrelated processes or claiming a missing runtime.
+After the read-only probe succeeds, use the approved execution route for the intended
+public CLI commands. An access refusal explicitly stating **no command was sent** is
+known not dispatched; it is safe to submit that authorized command through the approved
+route. This includes a mutation refused before dispatch. Do not mistake that definite
+pre-dispatch refusal for an unknown execution outcome. Downloads still require their explicit
+network access.
+
+A lost mutation response is different from a denied startup probe: inspect retained
+request/status/recovery evidence and use its request ID when supported. Never blindly
+repeat a publication, script or program run whose outcome is unknown. External-tool
+fallback is allowed by project rules, but record that the intended facade was not used
+and do not invent a successful checkpoint or native result.
+
+## Wait for the original execution
+
+A tool operation may outlast the host execution tool's initial wait. A returned running
+session/cell ID means that command is still in progress, not that the CLI returned no data.
+Use the host's session poll/wait facility until terminal exit and consume stdout/stderr
+before issuing a dependent command. In Codex, an `exec_command` session is continued with
+`write_stdin`; a yielded execution cell uses that host's cell wait. Do not launch a second
+open/install or repeat a CPU action just because the first chunk was empty. If the execution
+really loses its terminal result, use the CLI's request/status recovery as described above.

package/skills/insight-ilspy/references/ilspy.md

@@ -0,0 +1,33 @@
+# Static .NET research
+
+Use the project's preferred tools and evidence conventions. When ILSpy is appropriate,
+`insight-cli ilspy install` prepares its pinned CLI and private .NET runtime; a global SDK
+or dotnet installation is unnecessary. Lifecycle and archive options appear in `--help`.
+The ILSpy and runtime distributions come from our pinned GitHub Releases. For offline
+installation supply `--archive` and `--dotnet-archive`, or use an already verified cache.
+`--executable` selects a compatible external ilspycmd; uninstall preserves its files.
+
+```sh
+insight-cli ilspy types ./client.dll --json
+insight-cli ilspy decompile --target <returned-target> --type Example.Policy --output policy.cs --json
+insight-cli ilspy il --target <target> --type Example.Policy --json
+insight-cli ilspy resources --target <target> --json
+insight-cli ilspy resource --target <target> --name Example.settings.json --output extracted --json
+insight-cli ilspy project --target <target> --output recovered-project --json
+insight-cli ilspy metadata --target <target> --table MethodDef --json
+```
+
+Use either an input file or an existing target. Reusing the target associates Ghidra and
+ILSpy results with the same immutable bytes. No Ghidra context or merge is needed for a
+stateless ILSpy read. An optional `--session` associates an existing session; it does not
+create one. These calls require Update to capture input and run a tool.
+
+Text responses include `content`, input SHA, process ID, elapsed time and diagnostic paths.
+`--member` selects a metadata token or XML member ID for decompilation. Output paths must
+be new: text operations create one ordinary file, project/resource operations create a
+folder. Keep useful output in the project's chosen evidence location; `artifacts save`
+is an optional explicit checkpoint. Static decompilation does not execute an assembly.
+
+Use `tools processes --tool ilspy --all` for execution history and `tools processes show
+<process-id>` for retained diagnostics. A failed or interrupted export can leave partial
+files/staging; inspect them and choose a new output path for another intentional run.

package/skills/insight-interop/SKILL.md

@@ -0,0 +1,54 @@
+---
+name: insight-interop
+description: Trace a .NET P/Invoke declaration to an explicitly supplied native library export and Ghidra function through insight-cli ilspy query, binary query and scoped ghidra APIs. Use for managed/native linkage evidence while keeping static correspondence separate from observed loading or execution.
+---
+
+# Insight Interop 0.2.1
+
+If local help/status reports AppData or IPC access denied, retry that **read-only probe**
+with the agent host's normal permission escalation, then use that route for later authorized
+CLI calls too. An explicit **no command was sent** denial is known undispatched and can be
+retried through that route. Keep HOME, profile and owner state; see
+[host execution permissions](references/agent-execution.md). A lost mutation reply needs
+request/status recovery, never blind retry.
+
+Respect project RE/evidence rules. This workflow composes existing public APIs, without
+another runtime, global active binary or universal library resolver. Tokens and native
+addresses identify different immutable targets; preserve both hashes in the finding.
+
+1. Read `ilspy query managed.dll --view imports --json`. Select the exact managed signature,
+   MethodDef token, declared module/entrypoint, calling convention, charset and spelling
+   flags. Drill into `--view method --method TOKEN` when needed. An absent declaration
+   does not exclude dynamic loading, generated interop, reflection or runtime resolvers.
+2. Select candidate native files explicitly. `binary query candidate.dll --json` identifies
+   format, architecture and image base. A filename match alone is insufficient. A neutral
+   IL assembly does not select the eventual runtime architecture by itself.
+3. Query `--view exports --filter ENTRYPOINT`, then verify the **exact** name in the returned
+   row: the filter is a substring. Keep its native target/hash, ordinal, RVA and VA. Do not
+   treat a forwarded PE export as code; follow its named library/export using another
+   explicitly supplied candidate. Ordinal imports, name decoration, charset A/W probing,
+   Mach-O leading underscores and ambiguous candidates need explicit ABI/loader evidence;
+   never silently choose a winner by stripping names or comparing addresses alone.
+4. `ghidra open candidate.dll --session new --json` opens an isolated native context. Match
+   this returned native target identity to the file just queried. Use
+   `ghidra functions get --session S --target T --address VA --json`, then
+   `ghidra functions decompile --session S --target T --address VA --json` to inspect the
+   exact implementation candidate. An address pointing to data or an unavailable function
+   is unresolved; do not create a claimed implementation merely to finish the workflow.
+5. Write ordinary project evidence linking the managed declaration, concrete native export,
+   scoped Ghidra function and useful behavior. Label this **static correspondence**. It
+   proves neither that this file was selected by the runtime nor that the call occurred:
+   search paths, architecture, custom resolvers and marshaling can change the actual route.
+   An authorized Frida/LLDB/dnSpy observation is separate evidence when execution is needed.
+6. If a useful annotation belongs in the shared Ghidra model, edit the chosen session/target
+   and explicitly `ghidra merge --session S --target T`. Verify it from a new context;
+   other workers refresh explicitly and retain their local changes. Metadata/binary reads
+   have no independent merge. Checkpoint ordinary materials with `artifacts save` as useful.
+7. Close the contexts you own. If the profile's local server belongs exclusively to this
+   investigation, stop it with `ghidra server stop` and verify `ghidra status` before stopping
+   the CLI owner. `ipc-server stop` does not stop that Ghidra server. For shared work, leave
+   server shutdown to the coordinator; never stop another worker's contexts or server.
+
+Use each tool's dedicated packaged skill for install/status, bounds and generated help.
+MacOS native workflow acceptance uses static Windows PE/.NET fixtures; it does not claim
+those Windows binaries execute on macOS. Project-specific formats and tools take precedence.

package/skills/insight-interop/references/agent-execution.md

@@ -0,0 +1,36 @@
+# Agent host execution permissions
+
+Keep the user/project host policy and the selected profile. A sandbox can deny writes
+to runtime AppData or access to the local IPC endpoint, including during local help.
+This is a host execution boundary, not evidence that the tool or its inputs are absent.
+
+First retry only `insight-cli --help`, `tools list`, `skill`, or the selected application's
+read-only `status` using the host's normal permission escalation. In Codex, use the
+execution tool's `sandbox_permissions: "require_escalated"` with a scoped explanation
+that the installed CLI needs its existing profile storage/local IPC. Automatic approval
+review or the user decides that request; do not disable the sandbox or approval policy.
+
+Do not work around this by changing HOME/AppData/profile paths, creating another host,
+deleting owner/endpoint files, killing unrelated processes or claiming a missing runtime.
+After the read-only probe succeeds, use the approved execution route for the intended
+public CLI commands. An access refusal explicitly stating **no command was sent** is
+known not dispatched; it is safe to submit that authorized command through the approved
+route. This includes a mutation refused before dispatch. Do not mistake that definite
+pre-dispatch refusal for an unknown execution outcome. Downloads still require their explicit
+network access.
+
+A lost mutation response is different from a denied startup probe: inspect retained
+request/status/recovery evidence and use its request ID when supported. Never blindly
+repeat a publication, script or program run whose outcome is unknown. External-tool
+fallback is allowed by project rules, but record that the intended facade was not used
+and do not invent a successful checkpoint or native result.
+
+## Wait for the original execution
+
+A tool operation may outlast the host execution tool's initial wait. A returned running
+session/cell ID means that command is still in progress, not that the CLI returned no data.
+Use the host's session poll/wait facility until terminal exit and consume stdout/stderr
+before issuing a dependent command. In Codex, an `exec_command` session is continued with
+`write_stdin`; a yielded execution cell uses that host's cell wait. Do not launch a second
+open/install or repeat a CPU action just because the first chunk was empty. If the execution
+really loses its terminal result, use the CLI's request/status recovery as described above.

package/skills/insight-lldb/SKILL.md

@@ -0,0 +1,54 @@
+---
+name: insight-lldb
+description: Observe native runtime arguments, return values, registers, stacks and bounded memory at a selected breakpoint using an owned LLDB launch. Use insight-cli lldb on macOS ARM64 when static findings need a concrete execution check.
+---
+
+# Insight LLDB 0.2.1
+
+If local help/status reports AppData or IPC access denied, retry that **read-only probe**
+with the agent host's normal permission escalation, then use that route for later authorized
+CLI calls too. An explicit **no command was sent** denial is known undispatched and can be
+retried through that route. Keep HOME, profile and owner state; see
+[host execution permissions](references/agent-execution.md). A lost mutation reply needs
+request/status recovery, never blind retry.
+
+Follow the project's RE and evidence conventions. This debugger runs a native input; choose
+an input whose execution and application side effects are authorized. It launches a separate
+owned copy, captures one breakpoint observation and terminates that launch. It does not attach
+to an existing process or resume a crashed execution.
+
+1. `insight-cli lldb status --json` checks readiness. `lldb install` obtains our pinned
+   LLDB 23.1.3 bundle (debugger, debugserver and library) from GitHub Releases. Managed delivery
+   requires macOS 14+ ARM64. `download`, `install --archive FILE --offline`, `doctor` and
+   `uninstall` use the shared lifecycle. `install --executable /path/to/bin/lldb` selects
+   an external compatible bundle with its adjacent bin/debugserver and lib directory;
+   these dependencies are fingerprinted. External files and research survive uninstall.
+2. Start from static evidence identifying the relevant function and a useful input.
+   `insight-cli lldb inspect INPUT --breakpoint FUNCTION --step-out --json` records arguments,
+   registers, backtrace and the return from that call. `--target ID` reuses a captured input.
+   Only a native thin ARM64 Mach-O is supported here; a Windows PE imported into Ghidra cannot run
+   on this host. An optimized/stripped binary may omit names, arguments or source variables.
+   `--symbols FILE` captures a matching DWARF file from a dSYM bundle and loads it before launch.
+   `--variables` explicitly requests locals when debug information is available; without it
+   registers/backtraces remain useful for stripped code. Moving an executable alone does not
+   retain its adjacent dSYM.
+3. `--hit N` skips earlier calls; compare calls around the relevant boundary. `--arg` supplies
+   literal program arguments without shell expansion. Backticks are rejected because LLDB uses them
+   for expression substitution. `--registers pc,sp,x0` selects registers.
+   `--memory-address '$sp' --memory-bytes 64` records a bounded memory window. A `0x` breakpoint
+   is a file address; memory addresses and printed pointers are runtime addresses affected by
+   ASLR. Establish correspondence before combining them with static analysis.
+4. A snapshot proves one observed path and input, not all possible behavior. `--limit` and
+   `--offset` page native lines. `--output research/snapshot.json` saves the full bounded
+   snapshot to a new ordinary file, creating parents. Raw diagnostics remain under the
+   returned process directory. Preserve useful files with `artifacts save` when appropriate.
+5. The deadline (default 30 seconds, up to 600) survives owner loss. LLDB is configured to
+   kill its inferior on debugger connection loss. `tools processes --tool lldb --all` shows
+   history; stop/kill applies to verified owned collectors. After an owner crash a live
+   recovered macOS PID may be unverified: wait for its kernel deadline, inspect retained
+   records and do not replay an execution blindly. Observed exit after loss means an unknown
+   result, not a completed snapshot. Init files are disabled; no arbitrary debugger script
+   or expression evaluation is exposed by this facade.
+
+Generated `lldb inspect --help` owns exact syntax. No Ghidra session or merge is required;
+these are runtime observations to corroborate static research.

package/skills/insight-lldb/references/agent-execution.md

@@ -0,0 +1,36 @@
+# Agent host execution permissions
+
+Keep the user/project host policy and the selected profile. A sandbox can deny writes
+to runtime AppData or access to the local IPC endpoint, including during local help.
+This is a host execution boundary, not evidence that the tool or its inputs are absent.
+
+First retry only `insight-cli --help`, `tools list`, `skill`, or the selected application's
+read-only `status` using the host's normal permission escalation. In Codex, use the
+execution tool's `sandbox_permissions: "require_escalated"` with a scoped explanation
+that the installed CLI needs its existing profile storage/local IPC. Automatic approval
+review or the user decides that request; do not disable the sandbox or approval policy.
+
+Do not work around this by changing HOME/AppData/profile paths, creating another host,
+deleting owner/endpoint files, killing unrelated processes or claiming a missing runtime.
+After the read-only probe succeeds, use the approved execution route for the intended
+public CLI commands. An access refusal explicitly stating **no command was sent** is
+known not dispatched; it is safe to submit that authorized command through the approved
+route. This includes a mutation refused before dispatch. Do not mistake that definite
+pre-dispatch refusal for an unknown execution outcome. Downloads still require their explicit
+network access.
+
+A lost mutation response is different from a denied startup probe: inspect retained
+request/status/recovery evidence and use its request ID when supported. Never blindly
+repeat a publication, script or program run whose outcome is unknown. External-tool
+fallback is allowed by project rules, but record that the intended facade was not used
+and do not invent a successful checkpoint or native result.
+
+## Wait for the original execution
+
+A tool operation may outlast the host execution tool's initial wait. A returned running
+session/cell ID means that command is still in progress, not that the CLI returned no data.
+Use the host's session poll/wait facility until terminal exit and consume stdout/stderr
+before issuing a dependent command. In Codex, an `exec_command` session is continued with
+`write_stdin`; a yielded execution cell uses that host's cell wait. Do not launch a second
+open/install or repeat a CPU action just because the first chunk was empty. If the execution
+really loses its terminal result, use the CLI's request/status recovery as described above.

package/skills/insight-llvm/SKILL.md

@@ -0,0 +1,56 @@
+---
+name: insight-llvm
+description: Inspect PE, ELF and Mach-O headers, dependencies, exports and symbols; query PDB debug information or a small instruction window with insight-cli LLVM utilities before opening a full analysis project.
+---
+
+# Insight LLVM 0.2.1
+
+If local help/status reports AppData or IPC access denied, retry that **read-only probe**
+with the agent host's normal permission escalation, then use that route for later authorized
+CLI calls too. An explicit **no command was sent** denial is known undispatched and can be
+retried through that route. Keep HOME, profile and owner state; see
+[host execution permissions](references/agent-execution.md). A lost mutation reply needs
+request/status recovery, never blind retry.
+
+Use existing project RE rules and evidence paths. These are static reads; no Ghidra project,
+program execution or shared merge is needed. Use Ghidra when the question needs recovered
+control flow, decompilation or persistent annotations.
+
+1. `insight-cli llvm status --json` checks readiness. `llvm install` prepares the pinned
+   four-utility bundle from our GitHub Release; `--archive` and `--offline` support local
+   installation. Managed LLVM 23.1.3 requires macOS 14+ ARM64. `--executable` selects an
+   external llvm-readobj with compatible llvm-nm, llvm-objdump and llvm-pdbutil siblings.
+   The whole known external family is fingerprinted; uninstall preserves external files.
+2. Use `llvm headers INPUT`, `sections`, `imports`, `exports` or `symbols` for focused
+   inventories. Reuse `--target` instead of INPUT for the same immutable bytes. Stripped
+   images can have no ordinary symbols; that does not prove there are no functions.
+   `symbols` includes local/static definitions; these are not automatically exported APIs.
+   For ELF, `exports` uses the dynamic symbol table while `symbols` uses ordinary symbols.
+3. For a supplied PDB, start with `llvm pdb FILE --view summary` and `--view modules`.
+   Use `--view globals --symbol NAME` for a named global, `--view publics` for public
+   addresses, or `--view symbols --module INDEX` for procedure/local records. `--view types`
+   gives statistics until `--type-index 0xINDEX` selects a particular record. PDB symbol
+   addresses are section:offset pairs: combine the corresponding image section RVA and
+   image base from headers/sections; they are not file offsets. In pdbutil these padded
+   section:offset numbers are decimal (an explicit `0x` elsewhere means hexadecimal).
+4. `llvm disassemble IMAGE --address 0xVIRTUAL_ADDRESS --bytes 128` returns a bounded
+   instruction interval. Distinguish static virtual addresses, RVAs and file offsets;
+   runtime load bias is not established by these static commands. If the instructions load
+   constants from a section, use `llvm section-data IMAGE --section NAME` and the section
+   address/endianness to inspect their actual values. The complete section must fit the
+   4-MiB native-output bound; oversized sections fail explicitly and need another focused
+   binary-reading tool rather than an assumed complete result.
+5. Keep useful output in the project's format. Text views page with `--limit`/`--offset`;
+   `--filter` selects matching native lines and can omit surrounding context. `--output`
+   writes full bounded native text to a new file, creating missing parent directories.
+   Use focused PDB/module/type queries instead of asking for every symbol or instruction.
+
+The four upstream executables supply native text inside our JSON envelope. In particular,
+upstream readobj JSON output is not treated as a reliable structured COFF contract. ELF
+imports show needed libraries and undefined dynamic symbols; Mach-O imports show dylibs and
+undefined symbols. This is static linkage evidence, not proof of observed runtime calls.
+
+These calls need Update permission to capture input and run tools. Generated `--help` owns
+exact syntax. `tools processes --tool llvm --all` and `show <id>` retain execution diagnostics;
+failed/limited output is not a complete inventory. Save completed ordinary files through
+`artifacts save` when a checkpoint is useful.

package/skills/insight-llvm/references/agent-execution.md

@@ -0,0 +1,36 @@
+# Agent host execution permissions
+
+Keep the user/project host policy and the selected profile. A sandbox can deny writes
+to runtime AppData or access to the local IPC endpoint, including during local help.
+This is a host execution boundary, not evidence that the tool or its inputs are absent.
+
+First retry only `insight-cli --help`, `tools list`, `skill`, or the selected application's
+read-only `status` using the host's normal permission escalation. In Codex, use the
+execution tool's `sandbox_permissions: "require_escalated"` with a scoped explanation
+that the installed CLI needs its existing profile storage/local IPC. Automatic approval
+review or the user decides that request; do not disable the sandbox or approval policy.
+
+Do not work around this by changing HOME/AppData/profile paths, creating another host,
+deleting owner/endpoint files, killing unrelated processes or claiming a missing runtime.
+After the read-only probe succeeds, use the approved execution route for the intended
+public CLI commands. An access refusal explicitly stating **no command was sent** is
+known not dispatched; it is safe to submit that authorized command through the approved
+route. This includes a mutation refused before dispatch. Do not mistake that definite
+pre-dispatch refusal for an unknown execution outcome. Downloads still require their explicit
+network access.
+
+A lost mutation response is different from a denied startup probe: inspect retained
+request/status/recovery evidence and use its request ID when supported. Never blindly
+repeat a publication, script or program run whose outcome is unknown. External-tool
+fallback is allowed by project rules, but record that the intended facade was not used
+and do not invent a successful checkpoint or native result.
+
+## Wait for the original execution
+
+A tool operation may outlast the host execution tool's initial wait. A returned running
+session/cell ID means that command is still in progress, not that the CLI returned no data.
+Use the host's session poll/wait facility until terminal exit and consume stdout/stderr
+before issuing a dependent command. In Codex, an `exec_command` session is continued with
+`write_stdin`; a yielded execution cell uses that host's cell wait. Do not launch a second
+open/install or repeat a CPU action just because the first chunk was empty. If the execution
+really loses its terminal result, use the CLI's request/status recovery as described above.

package/skills/insight-managed-heap/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: insight-managed-heap
+description: Query structured .NET heap objects, primitive fields and managed stacks from a retained CoreCLR dump through insight-cli dotnet-dump query. Use for bounded offline dump investigation with an explicit matching DAC, preserving uncertainty and immutable input identity.
+---
+
+# Insight Managed Heap 0.2.1
+
+If local help/status reports AppData or IPC access denied, retry that **read-only probe**
+with the agent host's normal permission escalation, then use that route for later authorized
+CLI calls too. An explicit **no command was sent** denial is known undispatched and can be
+retried through that route. Keep HOME, profile and owner state; see
+[host execution permissions](references/agent-execution.md). A lost mutation reply needs
+request/status recovery, never blind retry.
+
+Follow project RE/evidence rules. ClrMD is an internal packaged library, not an application
+that needs another install. This API reads one immutable dump; it never attaches to a live
+process, evaluates target expressions or downloads symbols/dependencies.
+
+1. Use `dotnet-dump status` and `dotnet-dump install` for the existing private .NET runtime.
+   No compiler/SDK is needed. Native acceptance is macOS ARM64 CoreCLR only.
+2. `dotnet-dump query worker.dmp --json` identifies the dump architecture, CLR runtime and
+   heap availability. The managed default DAC is 10.0.13. A different runtime needs an
+   explicitly trusted matching `--dac-file /runtime/libmscordaccore.dylib`; matching OS,
+   architecture and runtime are required. An external diagnostics selection also needs
+   `--dotnet-host /runtime/dotnet`. Mismatch fails; it is never silently ignored.
+3. `dotnet-dump query --target TARGET --view objects --type Exact.Type --json` lists object
+   addresses and sizes. Heap/Full dumps are normally needed. `--max-objects` bounds scanning;
+   a reached bound means partial prefix coverage, never proof that a type is absent.
+4. Drill down with `--view object --address 0xADDRESS --type Exact.Type`. Addresses belong
+   only to that exact dump. Primitive fields and up to 256 string characters are returned;
+   reference fields supply an address for another explicit query. Structs, unreadable
+   memory and unsupported field values remain unavailable, without expression evaluation.
+   64-bit numeric values and pointers are strings to preserve precision.
+5. `--view stacks` returns managed frames; `--thread OS_THREAD_ID` focuses one dump thread.
+   Each selected stack is bounded to 128 frames. A dump is a snapshot, not proof that a
+   frame is still executing or consuming CPU. Missing code/symbols can leave methods unknown.
+6. `--limit`/`--offset` page objects, fields or threads. `--output research/query.json` saves
+   this bounded result to a new ordinary JSON file; preserve partial flags in project notes.
+   Checkpoint selected evidence with `artifacts save` when useful. Removing the diagnostics
+   runtime preserves immutable dump inputs and saved research.
+
+Generated `dotnet-dump query --help` owns options. Existing `analyze --command` remains useful
+for focused native SOS text, but SOS output errors are not successful object findings.

package/skills/insight-managed-heap/references/agent-execution.md

@@ -0,0 +1,36 @@
+# Agent host execution permissions
+
+Keep the user/project host policy and the selected profile. A sandbox can deny writes
+to runtime AppData or access to the local IPC endpoint, including during local help.
+This is a host execution boundary, not evidence that the tool or its inputs are absent.
+
+First retry only `insight-cli --help`, `tools list`, `skill`, or the selected application's
+read-only `status` using the host's normal permission escalation. In Codex, use the
+execution tool's `sandbox_permissions: "require_escalated"` with a scoped explanation
+that the installed CLI needs its existing profile storage/local IPC. Automatic approval
+review or the user decides that request; do not disable the sandbox or approval policy.
+
+Do not work around this by changing HOME/AppData/profile paths, creating another host,
+deleting owner/endpoint files, killing unrelated processes or claiming a missing runtime.
+After the read-only probe succeeds, use the approved execution route for the intended
+public CLI commands. An access refusal explicitly stating **no command was sent** is
+known not dispatched; it is safe to submit that authorized command through the approved
+route. This includes a mutation refused before dispatch. Do not mistake that definite
+pre-dispatch refusal for an unknown execution outcome. Downloads still require their explicit
+network access.
+
+A lost mutation response is different from a denied startup probe: inspect retained
+request/status/recovery evidence and use its request ID when supported. Never blindly
+repeat a publication, script or program run whose outcome is unknown. External-tool
+fallback is allowed by project rules, but record that the intended facade was not used
+and do not invent a successful checkpoint or native result.
+
+## Wait for the original execution
+
+A tool operation may outlast the host execution tool's initial wait. A returned running
+session/cell ID means that command is still in progress, not that the CLI returned no data.
+Use the host's session poll/wait facility until terminal exit and consume stdout/stderr
+before issuing a dependent command. In Codex, an `exec_command` session is continued with
+`write_stdin`; a yielded execution cell uses that host's cell wait. Do not launch a second
+open/install or repeat a CPU action just because the first chunk was empty. If the execution
+really loses its terminal result, use the CLI's request/status recovery as described above.

package/skills/insight-managed-metadata/SKILL.md

@@ -0,0 +1,52 @@
+---
+name: insight-managed-metadata
+description: Query managed assembly metadata, MethodDef tokens, P/Invoke declarations and bounded IL, or compare two C#/.NET assemblies through insight-cli ilspy query/compare. Use for structured static evidence and changed-method research without executing the target.
+---
+
+# Insight Managed Metadata 0.2.1
+
+If local help/status reports AppData or IPC access denied, retry that **read-only probe**
+with the agent host's normal permission escalation, then use that route for later authorized
+CLI calls too. An explicit **no command was sent** denial is known undispatched and can be
+retried through that route. Keep HOME, profile and owner state; see
+[host execution permissions](references/agent-execution.md). A lost mutation reply needs
+request/status recovery, never blind retry.
+
+Keep the project's RE and evidence conventions. This capability parses assembly bytes;
+it never loads target code for execution, resolves ambient assemblies or loads PDBs.
+dnlib is a packaged implementation library, not another application to install.
+
+1. Use the existing `ilspy status` and `ilspy install` for its private .NET 10 runtime.
+   With an external ILSpy selection, supply a compatible explicit `--dotnet-host`.
+   No SDK/compiler is needed on the consumer machine.
+2. `ilspy query app.dll --json` gives assembly identity, metadata runtime/framework hints,
+   type/method/import counts and bounded references/resources. Metadata runtime version
+   is not the required execution runtime; the framework attribute may be absent or forged.
+3. For a method question, start with
+   `ilspy query app.dll --view methods --name-filter TERM --limit 10 --json`.
+   This case-insensitive short-name search returns exact names/tokens and excludes
+   declaring namespaces, types and parameter/return signatures. It also selects managed
+   method names for imports, exact-method queries and compare. `--filter TEXT` retains its
+   case-sensitive full-name/signature substring behavior; a namespace term can match every
+   method. An unfiltered first/last page or shell-truncated match list cannot establish
+   absence: refine the short-name query before concluding. `--view types` and
+   `--view methods --type FULLNAME` provide bounded structural discovery. Drill down with
+   `ilspy query --target TARGET --view method --method 0x06000002 --limit 50 --json`.
+   Offsets are IL instruction offsets, not native addresses. Tokens belong to one exact
+   module SHA and may change when unrelated methods are added.
+4. `--view imports` returns actual P/Invoke module, entrypoint, flags and managed signature.
+   A declaration is static evidence; it does not prove which file the runtime loaded or
+   that the import was invoked. Use native exports/Ghidra for static correspondence and
+   an authorized runtime observation when execution evidence is needed.
+5. `ilspy compare before.dll after.dll --json` identifies added/removed signatures,
+   changed normalized IL/imports and reference changes. Operand names and branch/local
+   indices avoid treating metadata RID changes alone as changed code. Signature changes
+   appear as removed/added methods. Equal structure is not semantic equivalence: runtime,
+   dependency, configuration and environment changes can still affect behavior.
+6. Inputs are bounded to 64 MiB; `--limit`/`--offset` page rows or instructions. Comparisons
+   scan at most 100000 methods; narrow a large query with `--type`/`--filter`.
+   `--output research/metadata.json` saves the current bounded result/page to a new file.
+   Use ordinary project notes and `artifacts save` when a checkpoint is useful.
+
+Generated `ilspy query --help` and `ilspy compare --help` own exact options. Use the
+existing decompile/IL commands when a source-style explanation is more useful than metadata.

package/skills/insight-managed-metadata/references/agent-execution.md

@@ -0,0 +1,36 @@
+# Agent host execution permissions
+
+Keep the user/project host policy and the selected profile. A sandbox can deny writes
+to runtime AppData or access to the local IPC endpoint, including during local help.
+This is a host execution boundary, not evidence that the tool or its inputs are absent.
+
+First retry only `insight-cli --help`, `tools list`, `skill`, or the selected application's
+read-only `status` using the host's normal permission escalation. In Codex, use the
+execution tool's `sandbox_permissions: "require_escalated"` with a scoped explanation
+that the installed CLI needs its existing profile storage/local IPC. Automatic approval
+review or the user decides that request; do not disable the sandbox or approval policy.
+
+Do not work around this by changing HOME/AppData/profile paths, creating another host,
+deleting owner/endpoint files, killing unrelated processes or claiming a missing runtime.
+After the read-only probe succeeds, use the approved execution route for the intended
+public CLI commands. An access refusal explicitly stating **no command was sent** is
+known not dispatched; it is safe to submit that authorized command through the approved
+route. This includes a mutation refused before dispatch. Do not mistake that definite
+pre-dispatch refusal for an unknown execution outcome. Downloads still require their explicit
+network access.
+
+A lost mutation response is different from a denied startup probe: inspect retained
+request/status/recovery evidence and use its request ID when supported. Never blindly
+repeat a publication, script or program run whose outcome is unknown. External-tool
+fallback is allowed by project rules, but record that the intended facade was not used
+and do not invent a successful checkpoint or native result.
+
+## Wait for the original execution
+
+A tool operation may outlast the host execution tool's initial wait. A returned running
+session/cell ID means that command is still in progress, not that the CLI returned no data.
+Use the host's session poll/wait facility until terminal exit and consume stdout/stderr
+before issuing a dependent command. In Codex, an `exec_command` session is continued with
+`write_stdin`; a yielded execution cell uses that host's cell wait. Do not launch a second
+open/install or repeat a CPU action just because the first chunk was empty. If the execution
+really loses its terminal result, use the CLI's request/status recovery as described above.

package/skills/insight-mitmproxy/SKILL.md

@@ -0,0 +1,62 @@
+---
+name: insight-mitmproxy
+description: Record, inspect and compare HTTP request/response evidence with insight-cli mitmproxy. Use when an owned client can explicitly use a loopback proxy; read native flow archives or HAR without replaying traffic. System interception and global certificate trust are outside this facade.
+---
+
+# Insight mitmproxy 0.2.1
+
+If local help/status reports AppData or IPC access denied, retry that **read-only probe**
+with the agent host's normal permission escalation, then use that route for later authorized
+CLI calls too. An explicit **no command was sent** denial is known undispatched and can be
+retried through that route. Keep HOME, profile and owner state; see
+[host execution permissions](references/agent-execution.md). A lost mutation reply needs
+request/status recovery, never blind retry.
+
+Keep the project's RE and evidence format. This facade uses a private HTTP proxy on
+macOS 15+ ARM64. A client must explicitly opt into its endpoint; installing the tool
+does not intercept traffic or install a system proxy, certificate or Network Extension.
+
+1. Check `insight-cli mitmproxy status --json`. `mitmproxy install` delivers the pinned
+   standalone runtime and full notices from our source-complete GitHub Release.
+   `download` prepares its cache; `install --archive mitmproxy-12.2.3-macos-arm64.tgz
+   --offline` uses matching local bytes. `install --executable
+   /path/mitmproxy.app/Contents/MacOS/mitmdump` selects a complete external bundle, creates an owned execution copy and
+   fingerprints its adjacent runtime. `doctor` checks the pinned version.
+2. Start an observation window alongside the owned client:
+   `mitmproxy record --listen-port 8877 --duration-seconds 15 --output research/window.mitm
+   --json`. In another invocation, `mitmproxy status --json` reports each active capture's
+   `ready`, `endpoint`, public `caCertificate` and owned process ID. Wait for readiness;
+   then configure only the selected client to use that endpoint. The record command
+   returns after its bounded window. A client, curl or another external tool remains free
+   to run outside insight-cli. Client NO_PROXY/bypass rules can exclude a destination;
+   adjust only that client when necessary. Native stop/kill uses `tools processes stop/kill PROCESS`.
+3. For HTTPS, the selected client must explicitly trust the returned public CA certificate
+   in its own process. An owned origin with a private CA additionally needs
+   `record --upstream-ca public-root.pem`. This copies only a public PEM certificate;
+   no global trust change occurs. TLS failures remain explicit partial observations.
+   CA private keys stay in profile storage: checkpoint the requested report/archive, not
+   the private configuration directory. Certificate pinning may prevent HTTP decoding.
+4. `mitmproxy inspect research/window.mitm --json` gives a bounded overview.
+   `--view flows --method POST --url-contains /quote --limit 5` returns matching requests,
+   status, headers, body SHA256 and a base64 body prefix. Follow a native flow UUID with
+   `--view flow --flow-id UUID`. `--target ID` reuses immutable captured bytes; native
+   archives and HAR are read without reconnecting or replaying their requests.
+   `--output research/http.json` writes all bounded selected rows to a new ordinary file.
+5. `mitmproxy compare before.mitm after.mitm --json` compares literal method/URL and
+   occurrence order, selected body SHA256, status and error fields. Volatile headers and
+   timestamps are excluded. Review the linked flow IDs: occurrence matching is an aid,
+   not proof that two requests had the same cause. Missing bodies and partial inputs
+   remain unknown; unmatched rows in a partial capture do not prove absence.
+6. The proxy limits native bodies to 1 MiB each and the archive to 64 MiB. Reads accept
+   inputs up to 64 MiB; `--max-flows` bounds scan/record count to 1000. Returned bodies
+   default to 1024 bytes; `--body-bytes` can request 0–65536. The JSON report is bounded
+   to 8 MiB, and pagination follows method/URL selection. Base64 contains native raw
+   HTTP content; apply Content-Encoding separately if needed. WebSocket payload,
+   generic TCP/UDP and whole-machine absence are not claimed.
+7. A failed/interrupted window retains its archive and diagnostics. Inspect the retained
+   bytes explicitly; a readable prefix returns `partial`. There is no automatic
+   recollection or traffic replay. `artifacts save` can retain ordinary completed files.
+   Uninstall preserves research and any external distribution.
+
+Generated `mitmproxy ... --help` owns exact flags. Use TShark when the question needs
+packet-level evidence rather than decoded HTTP observations.

package/skills/insight-mitmproxy/references/agent-execution.md

@@ -0,0 +1,36 @@
+# Agent host execution permissions
+
+Keep the user/project host policy and the selected profile. A sandbox can deny writes
+to runtime AppData or access to the local IPC endpoint, including during local help.
+This is a host execution boundary, not evidence that the tool or its inputs are absent.
+
+First retry only `insight-cli --help`, `tools list`, `skill`, or the selected application's
+read-only `status` using the host's normal permission escalation. In Codex, use the
+execution tool's `sandbox_permissions: "require_escalated"` with a scoped explanation
+that the installed CLI needs its existing profile storage/local IPC. Automatic approval
+review or the user decides that request; do not disable the sandbox or approval policy.
+
+Do not work around this by changing HOME/AppData/profile paths, creating another host,
+deleting owner/endpoint files, killing unrelated processes or claiming a missing runtime.
+After the read-only probe succeeds, use the approved execution route for the intended
+public CLI commands. An access refusal explicitly stating **no command was sent** is
+known not dispatched; it is safe to submit that authorized command through the approved
+route. This includes a mutation refused before dispatch. Do not mistake that definite
+pre-dispatch refusal for an unknown execution outcome. Downloads still require their explicit
+network access.
+
+A lost mutation response is different from a denied startup probe: inspect retained
+request/status/recovery evidence and use its request ID when supported. Never blindly
+repeat a publication, script or program run whose outcome is unknown. External-tool
+fallback is allowed by project rules, but record that the intended facade was not used
+and do not invent a successful checkpoint or native result.
+
+## Wait for the original execution
+
+A tool operation may outlast the host execution tool's initial wait. A returned running
+session/cell ID means that command is still in progress, not that the CLI returned no data.
+Use the host's session poll/wait facility until terminal exit and consume stdout/stderr
+before issuing a dependent command. In Codex, an `exec_command` session is continued with
+`write_stdin`; a yielded execution cell uses that host's cell wait. Do not launch a second
+open/install or repeat a CPU action just because the first chunk was empty. If the execution
+really loses its terminal result, use the CLI's request/status recovery as described above.