@eyeauras/insight-cli 0.2.0 → 0.2.1

package/skill-bundle/insight-artifacts/SKILL.md

@@ -0,0 +1,30 @@
+---
+name: insight-artifacts
+description: Retain a completed reverse-engineering evidence file or directory as an ordinary checkpoint using insight-cli artifacts save. Use after Ghidra or any external tool; preserve existing project formats and source of truth.
+---
+
+# Insight Artifacts 0.2.1
+
+If local help/status reports AppData or IPC access denied, retry that **read-only probe**
+with the agent host's normal permission escalation, then use that route for later authorized
+CLI calls too. An explicit **no command was sent** denial is known undispatched and can be
+retried through that route. Keep HOME, profile and owner state; see
+[host execution permissions](references/agent-execution.md). A lost mutation reply needs
+request/status recovery, never blind retry.
+
+Keep evidence as ordinary files in the project's existing layout. This supporting application
+copies a completed file or stable directory; it has no native runtime to download or install.
+
+Run `insight-cli artifacts save <path> --json` using a profile with Update permission.
+Retain the returned ordinary `path` verbatim, file/byte counts and hash if the checkpoint matters.
+Before reporting a saved checkpoint, read its returned path with ordinary file tools and
+confirm that the expected files are present. Copy that exact path into the handoff; never
+reconstruct profile UUIDs or storage directories from memory. If readback fails, report
+the saved receipt and the unresolved access problem instead of claiming a verified handoff.
+The original project records keep their canonical role. No Ghidra selectors, finding schema
+or evidence IDs are required; saving does not merge tool databases or attest interpretations.
+
+Wait until other agents stop editing the selected files. Links and special files are rejected;
+select the actual regular files. A later source edit does not change the saved copy. Finish the report before saving; put its returned checkpoint locator in the final handoff or outside the saved folder. If the source changes afterward, save and verify a new intentional checkpoint before calling it the final copy. After a
+lost answer, inspect retained results before making a new intentional save: every call makes
+a new checkpoint. See [save semantics](references/artifacts.md) for failure and folder behavior.

package/skill-bundle/insight-artifacts/references/agent-execution.md

@@ -0,0 +1,36 @@
+# Agent host execution permissions
+
+Keep the user/project host policy and the selected profile. A sandbox can deny writes
+to runtime AppData or access to the local IPC endpoint, including during local help.
+This is a host execution boundary, not evidence that the tool or its inputs are absent.
+
+First retry only `insight-cli --help`, `tools list`, `skill`, or the selected application's
+read-only `status` using the host's normal permission escalation. In Codex, use the
+execution tool's `sandbox_permissions: "require_escalated"` with a scoped explanation
+that the installed CLI needs its existing profile storage/local IPC. Automatic approval
+review or the user decides that request; do not disable the sandbox or approval policy.
+
+Do not work around this by changing HOME/AppData/profile paths, creating another host,
+deleting owner/endpoint files, killing unrelated processes or claiming a missing runtime.
+After the read-only probe succeeds, use the approved execution route for the intended
+public CLI commands. An access refusal explicitly stating **no command was sent** is
+known not dispatched; it is safe to submit that authorized command through the approved
+route. This includes a mutation refused before dispatch. Do not mistake that definite
+pre-dispatch refusal for an unknown execution outcome. Downloads still require their explicit
+network access.
+
+A lost mutation response is different from a denied startup probe: inspect retained
+request/status/recovery evidence and use its request ID when supported. Never blindly
+repeat a publication, script or program run whose outcome is unknown. External-tool
+fallback is allowed by project rules, but record that the intended facade was not used
+and do not invent a successful checkpoint or native result.
+
+## Wait for the original execution
+
+A tool operation may outlast the host execution tool's initial wait. A returned running
+session/cell ID means that command is still in progress, not that the CLI returned no data.
+Use the host's session poll/wait facility until terminal exit and consume stdout/stderr
+before issuing a dependent command. In Codex, an `exec_command` session is continued with
+`write_stdin`; a yielded execution cell uses that host's cell wait. Do not launch a second
+open/install or repeat a CPU action just because the first chunk was empty. If the execution
+really loses its terminal result, use the CLI's request/status recovery as described above.

package/skill-bundle/insight-artifacts/references/artifacts.md

@@ -0,0 +1,52 @@
+# Save ordinary research materials
+
+`insight-cli artifacts save <path> --json` saves a file or a settled directory tree in
+the selected profile's AppData. It needs Factory Update permission and does not require
+Ghidra, Java, authentication, target/session selectors or evidence metadata. Relative input
+paths resolve against the caller's working directory. Use `--help` for generated syntax.
+
+Save existing project files in their existing format; no `notes.md`, `finding.md` or
+`research/` layout is required. The saved copy is a checkpoint and does not replace the
+project's canonical evidence location or its source-of-truth rules.
+
+Write notes and useful external-tool outputs as ordinary files while investigating. When
+the selected files are no longer being edited, save one file, a completed worker subfolder
+or the relevant project folder. For a project without a prescribed layout, for example:
+
+```sh
+insight-cli artifacts save ./research --json
+```
+
+The receipt has `state: "saved"`, `path`, `kind` (`file` or `directory`), `files`, `bytes`
+and `sha256`. `path` points to an ordinary browsable copy with the source basename and
+relative layout. Empty files and empty directories are retained. File count counts regular
+files; byte count counts their contents. A file's SHA-256 hashes its bytes; a directory's
+SHA-256 hashes its canonical manifest of relative paths, kinds, file lengths and hashes.
+The manifest is stored beside the content, outside the returned directory.
+
+Before claiming a verified checkpoint, read the expected files at the returned `path` using
+ordinary file tools. Preserve that path verbatim in the handoff, alongside the receipt;
+profile and snapshot identifiers must not be reconstructed from memory. If access is denied,
+retain the actual receipt and state that readback remains unverified.
+
+The service copies and syncs data before publishing the completed snapshot. Failure does
+not return a successful receipt or expose a partial completed snapshot. Source edits made
+after a successful save do not change the copy. Treat saved copies as retained snapshots;
+edit the original research folder and save a new copy for another checkpoint. Each call
+creates a new saved copy, including a repeated call after a lost response.
+
+Keep a directory stable for the save: detected concurrent edits are rejected. Copying
+several files is not an atomic filesystem snapshot of a directory that other agents keep
+changing. Symbolic links and special files are rejected rather than followed or silently
+omitted. Select the actual intended regular file/directory. Do not save a directory that
+contains the destination materials store. Traversal supports at most 100,000 entries and
+128 levels to bound inventory memory and recursion. Disk/permission failures return nonzero.
+
+The saved bytes establish what was retained. Commands, tool versions and interpretations
+written in a note remain the author's statements, not execution attestations. No upload,
+tool execution or Ghidra publication is performed by saving materials.
+
+Profile deletion/configuration invalidation is blocked while retained materials exist,
+as with retained research work. Close tool contexts normally; preserve snapshots separately
+if retiring a profile. There is no automatic registration, cleanup policy, graph database
+or additional read API: read the receipt's path with normal file tools.

package/skill-bundle/insight-binary/SKILL.md

@@ -0,0 +1,46 @@
+---
+name: insight-binary
+description: Query structured PE, ELF and thin Mach-O headers, sections, imports and exports, or make an explicitly guarded new PE subsystem copy through insight-cli binary. Use for scoped binary structure, linkage and copy-only header edits without target execution.
+---
+
+# Insight Binary 0.2.1
+
+If local help/status reports AppData or IPC access denied, retry that **read-only probe**
+with the agent host's normal permission escalation, then use that route for later authorized
+CLI calls too. An explicit **no command was sent** denial is known undispatched and can be
+retried through that route. Keep HOME, profile and owner state; see
+[host execution permissions](references/agent-execution.md). A lost mutation reply needs
+request/status recovery, never blind retry.
+
+Keep project RE/evidence conventions. LIEF is an internal packaged library. The native
+helper is included with insight-cli; no separate download/install, SDK or compiler is
+needed. The admitted host is macOS14+ ARM64; PE/ELF/Mach-O input formats do not imply
+that the host can execute them. Arbitrary scripts or patches are outside this API.
+
+1. `binary query app.exe --json` identifies format, architecture, entrypoint, image base,
+   section/linkage counts and the PE subsystem/signature presence. Static metadata can
+   be malformed; parser diagnostics mean partial evidence, not a successful absence claim.
+2. `--view sections`, `libraries`, `imports` and `exports` provide focused JSON rows.
+   `--filter TEXT` is a literal name substring, applied before `--limit`/`--offset` paging.
+   Reuse the returned `--target` for immutable input identity. There is no active binary.
+3. Addresses and sizes are strings to preserve precision. PE exports retain RVA and
+   image-base-adjusted virtual address; forwarded exports retain the target name instead
+   of pretending the forwarder is executable code. ELF/Mach-O views cover exported
+   functions, not every exported data symbol. Non-PE import libraries may be unknown.
+   Preserve Mach-O's native symbol spelling, including a leading underscore.
+4. Universal Mach-O containers require explicit thin-slice extraction with a suitable
+   external tool; the facade never silently chooses an architecture. Inputs are limited
+   to 64 MiB and scans to 100000 metadata records; a reached bound remains partial.
+5. A requested copy-only edit uses an explicit expectation:
+   `binary edit-subsystem app.exe --expect-subsystem console --subsystem gui --output research/gui.exe --json`.
+   Only this existing two-byte PE field is assigned. Independent LIEF readback and byte
+   comparison verify the new copy; the original and existing outputs are preserved.
+   This does not verify execution compatibility or repair PE checksum/Authenticode.
+   Existing signatures may become invalid; keep both original and copied hashes.
+6. `binary query --output research/page.json` saves the current bounded page to a new
+   ordinary file. Preserve scope/partial flags in project notes and checkpoint selected
+   evidence with `artifacts save` when useful. Readonly library queries need no Ghidra merge;
+   annotations belong to an explicit Ghidra session/target when that tool is used.
+
+Generated help owns exact options. LLVM remains useful for instruction/PDB windows;
+Ghidra supplies shared analysis, isolated work contexts and merge/refresh.

package/skill-bundle/insight-binary/references/agent-execution.md

@@ -0,0 +1,36 @@
+# Agent host execution permissions
+
+Keep the user/project host policy and the selected profile. A sandbox can deny writes
+to runtime AppData or access to the local IPC endpoint, including during local help.
+This is a host execution boundary, not evidence that the tool or its inputs are absent.
+
+First retry only `insight-cli --help`, `tools list`, `skill`, or the selected application's
+read-only `status` using the host's normal permission escalation. In Codex, use the
+execution tool's `sandbox_permissions: "require_escalated"` with a scoped explanation
+that the installed CLI needs its existing profile storage/local IPC. Automatic approval
+review or the user decides that request; do not disable the sandbox or approval policy.
+
+Do not work around this by changing HOME/AppData/profile paths, creating another host,
+deleting owner/endpoint files, killing unrelated processes or claiming a missing runtime.
+After the read-only probe succeeds, use the approved execution route for the intended
+public CLI commands. An access refusal explicitly stating **no command was sent** is
+known not dispatched; it is safe to submit that authorized command through the approved
+route. This includes a mutation refused before dispatch. Do not mistake that definite
+pre-dispatch refusal for an unknown execution outcome. Downloads still require their explicit
+network access.
+
+A lost mutation response is different from a denied startup probe: inspect retained
+request/status/recovery evidence and use its request ID when supported. Never blindly
+repeat a publication, script or program run whose outcome is unknown. External-tool
+fallback is allowed by project rules, but record that the intended facade was not used
+and do not invent a successful checkpoint or native result.
+
+## Wait for the original execution
+
+A tool operation may outlast the host execution tool's initial wait. A returned running
+session/cell ID means that command is still in progress, not that the CLI returned no data.
+Use the host's session poll/wait facility until terminal exit and consume stdout/stderr
+before issuing a dependent command. In Codex, an `exec_command` session is continued with
+`write_stdin`; a yielded execution cell uses that host's cell wait. Do not launch a second
+open/install or repeat a CPU action just because the first chunk was empty. If the execution
+really loses its terminal result, use the CLI's request/status recovery as described above.

package/skill-bundle/insight-capture/SKILL.md

@@ -0,0 +1,56 @@
+---
+name: insight-capture
+description: Capture one explicitly authorized native program run, exact stdout/stderr and declared file snapshots through insight-cli capture, then inspect or compare retained reports without replay. Use for controlled input/output research, preserving original files and interrupted or unknown outcomes.
+---
+
+# Insight Capture 0.2.1
+
+If local help/status reports AppData or IPC access denied, retry that **read-only probe**
+with the agent host's normal permission escalation, then use that route for later authorized
+CLI calls too. An explicit **no command was sent** denial is known undispatched and can be
+retried through that route. Keep HOME, profile and owner state; see
+[host execution permissions](references/agent-execution.md). A lost mutation reply needs
+request/status recovery, never blind retry.
+
+Follow project RE and evidence conventions. Use this only for an authorized runtime
+observation. The current native host/input profile is macOS14+ ARM64 thin Mach-O
+executables. There is no extra install, compiler, shell string or implicit active target.
+
+1. `capture run ./program --arg normal --input-file ./settings.txt --watch settings.txt result.txt --output research/run.json --json`
+   copies the selected program and input files into a fresh owned working directory.
+   Input files retain unique basenames; arguments are literal, without shell expansion.
+   To pass an option-shaped subject argument use `--arg=--subject-option`.
+   `--stdin-file FILE` supplies exact bytes, bounded to 1 MiB.
+2. The result gives the immutable program target/hash, copied input hashes, request ID,
+   known subject exit/signal, bounded output previews and declared file changes. Known
+   nonzero subject exits (0–126) are observable outcomes; reserved launcher failure,
+   signal, timeout, overflow or unavailable files leave a partial capture and nonzero CLI.
+   Exact output bytes are stored as base64 with SHA256; UTF-8 previews may replace invalid
+   characters. Binary output should be read as base64, not reconstructed from a preview.
+3. `capture show REQUEST --view stdout --limit 256 --offset 0 --json` pages retained bytes;
+   `--view stderr` and `--view files` focus other evidence. `--output FILE` exports a new
+   portable report. The default overview remains small; never paste an entire report
+   into context just to find one value. `artifacts save` can checkpoint selected files.
+4. Only `--watch` relative regular files are snapshotted before/after. A missing file is
+   explicit; links, unstable/oversized or unreadable files are unknown. This is not a
+   trace of all effects or an OS sandbox: the program still has normal host access.
+   The default deadline is 10 seconds (up to 600). Its inherited native alarm survives
+   ordinary owner loss; a subject can deliberately replace that alarm. Use stronger
+   host isolation separately when required by the actual target or project rules.
+5. `capture compare research/before.json research/after.json --json` compares exact retained
+   stdout/stderr, exit state and declared resulting files. It never executes the program.
+   `sameDeclaredIntent` distinguishes changed input/argv from repeated observations;
+   equal fields do not establish causal/semantic equivalence or a speedup claim.
+   Partial reports cannot prove global equality. Imported reports are asserted data,
+   not independent proof that an execution occurred.
+6. An optional `--request-id ID` binds the exact effective intent. Retrying it returns
+   the durable prior outcome, or an explicit unknown/partial state; it never repeats
+   the run. A different intent with the same ID is refused. Without an ID each call is
+   a new intentional observation. After owner loss, `capture show REQUEST` exposes retained
+   intent, process state and working directory; preserve existing files and investigate
+   the unknown result instead of blindly launching it again.
+
+Limits: 64 MiB program and total selected files, 16 MiB per selected/watched file,
+32 files/watch paths, 64 literal arguments and 4 MiB aggregate native output. No native
+merge exists here; publish any Ghidra annotations through their explicit session/target.
+Generated help owns options. Local project formats take precedence over this example.

package/skill-bundle/insight-capture/references/agent-execution.md

@@ -0,0 +1,36 @@
+# Agent host execution permissions
+
+Keep the user/project host policy and the selected profile. A sandbox can deny writes
+to runtime AppData or access to the local IPC endpoint, including during local help.
+This is a host execution boundary, not evidence that the tool or its inputs are absent.
+
+First retry only `insight-cli --help`, `tools list`, `skill`, or the selected application's
+read-only `status` using the host's normal permission escalation. In Codex, use the
+execution tool's `sandbox_permissions: "require_escalated"` with a scoped explanation
+that the installed CLI needs its existing profile storage/local IPC. Automatic approval
+review or the user decides that request; do not disable the sandbox or approval policy.
+
+Do not work around this by changing HOME/AppData/profile paths, creating another host,
+deleting owner/endpoint files, killing unrelated processes or claiming a missing runtime.
+After the read-only probe succeeds, use the approved execution route for the intended
+public CLI commands. An access refusal explicitly stating **no command was sent** is
+known not dispatched; it is safe to submit that authorized command through the approved
+route. This includes a mutation refused before dispatch. Do not mistake that definite
+pre-dispatch refusal for an unknown execution outcome. Downloads still require their explicit
+network access.
+
+A lost mutation response is different from a denied startup probe: inspect retained
+request/status/recovery evidence and use its request ID when supported. Never blindly
+repeat a publication, script or program run whose outcome is unknown. External-tool
+fallback is allowed by project rules, but record that the intended facade was not used
+and do not invent a successful checkpoint or native result.
+
+## Wait for the original execution
+
+A tool operation may outlast the host execution tool's initial wait. A returned running
+session/cell ID means that command is still in progress, not that the CLI returned no data.
+Use the host's session poll/wait facility until terminal exit and consume stdout/stderr
+before issuing a dependent command. In Codex, an `exec_command` session is continued with
+`write_stdin`; a yielded execution cell uses that host's cell wait. Do not launch a second
+open/install or repeat a CPU action just because the first chunk was empty. If the execution
+really loses its terminal result, use the CLI's request/status recovery as described above.

package/skill-bundle/insight-cli/SKILL.md

@@ -0,0 +1,42 @@
+---
+name: insight-cli
+description: Choose and prepare reverse-engineering capabilities from the insight-cli toolbox for binary, managed-code and runtime investigations. Use to discover the appropriate tool or its packaged skill before installing native runtimes.
+---
+
+# insight-cli 0.2.1
+
+If local help/status reports AppData or IPC access denied, retry that **read-only probe**
+with the agent host's normal permission escalation, then use that route for later authorized
+CLI calls too. An explicit **no command was sent** denial is known undispatched and can be
+retried through that route. Keep HOME, profile and owner state; see
+[host execution permissions](references/agent-execution.md). A lost mutation reply needs
+request/status recovery, never blind retry.
+
+Read the project's RE instructions and existing findings first. They own tool choices,
+evidence layout, formats and source of truth. These skills fill the remaining gaps.
+
+1. Run `insight-cli tools list --json` to discover the capabilities shipped in this version.
+   The catalog works before profile configuration, downloads or IPC startup. A downloaded
+   runtime is not needed to discover what a tool does.
+2. Use `insight-cli tools show <tool> --json` for tasks, supported inputs/platforms,
+   dependencies and its skill path. Read that skill before preparing or using the tool.
+3. Select a profile for execution. Run the selected application's `status` and generated
+   `--help`. `install` prepares its private runtime; archives/offline and external paths
+   are tool-specific and described in its skill. Update permission is required for tool
+   preparation/execution and saved changes: `insight-cli permissions grant Update`.
+4. Answer the question with focused queries and ordinary project files. Follow results to
+   useful detail; a large raw dump is not an interpretation. External tools remain welcome.
+5. Preserve completed files with `insight-cli artifacts save <path> --json` when a retained
+   checkpoint helps. For several agents sharing Ghidra analysis, use separate sessions,
+   then explicit merge/refresh as described by its skill.
+
+`insight-cli skill` locates this entry point. `skill insight-re` gives investigation and
+multi-agent guidance; `skill insight-ghidra`, `skill insight-ilspy` and
+`skill insight-artifacts` locate the relevant instructions. Skills ship with the CLI;
+installing npm binaries does not register them in an agent host. See
+[agent connection](references/agent-setup.md) for current setup and access requirements.
+
+Use generated help as the syntax authority. Catalog metadata describes shipped capabilities;
+profile runtime readiness comes from the selected tool's `status`. Unavailable profile/IPC
+access means execution readiness is unknown. Preserve work and diagnose access before trying
+again; stopping a shared owner does not grant a denied agent access to it.

package/skill-bundle/insight-cli/references/agent-execution.md

@@ -0,0 +1,36 @@
+# Agent host execution permissions
+
+Keep the user/project host policy and the selected profile. A sandbox can deny writes
+to runtime AppData or access to the local IPC endpoint, including during local help.
+This is a host execution boundary, not evidence that the tool or its inputs are absent.
+
+First retry only `insight-cli --help`, `tools list`, `skill`, or the selected application's
+read-only `status` using the host's normal permission escalation. In Codex, use the
+execution tool's `sandbox_permissions: "require_escalated"` with a scoped explanation
+that the installed CLI needs its existing profile storage/local IPC. Automatic approval
+review or the user decides that request; do not disable the sandbox or approval policy.
+
+Do not work around this by changing HOME/AppData/profile paths, creating another host,
+deleting owner/endpoint files, killing unrelated processes or claiming a missing runtime.
+After the read-only probe succeeds, use the approved execution route for the intended
+public CLI commands. An access refusal explicitly stating **no command was sent** is
+known not dispatched; it is safe to submit that authorized command through the approved
+route. This includes a mutation refused before dispatch. Do not mistake that definite
+pre-dispatch refusal for an unknown execution outcome. Downloads still require their explicit
+network access.
+
+A lost mutation response is different from a denied startup probe: inspect retained
+request/status/recovery evidence and use its request ID when supported. Never blindly
+repeat a publication, script or program run whose outcome is unknown. External-tool
+fallback is allowed by project rules, but record that the intended facade was not used
+and do not invent a successful checkpoint or native result.
+
+## Wait for the original execution
+
+A tool operation may outlast the host execution tool's initial wait. A returned running
+session/cell ID means that command is still in progress, not that the CLI returned no data.
+Use the host's session poll/wait facility until terminal exit and consume stdout/stderr
+before issuing a dependent command. In Codex, an `exec_command` session is continued with
+`write_stdin`; a yielded execution cell uses that host's cell wait. Do not launch a second
+open/install or repeat a CPU action just because the first chunk was empty. If the execution
+really loses its terminal result, use the CLI's request/status recovery as described above.

package/skill-bundle/insight-cli/references/agent-setup.md

@@ -0,0 +1,61 @@
+# Connect the toolbox to an agent
+
+npm installs the CLI and all declared skills. Native tool downloads are separate. A host needs
+shell access to `insight-cli`, skill discovery and execution access to the assigned profile.
+`insight-cli tools list --json` discovers shipped capabilities without profile configuration,
+native runtimes, credentials or IPC. `skill <name>` returns the instructions' ordinary path;
+it does not inject them into an agent automatically.
+
+## Codex: one project-local bundle
+
+The package prepares `skill-bundle`, containing an independent folder for every registered
+skill. `insight-cli skill --json` returns its `bundlePath`. References stay inside each skill;
+link the whole bundle once rather than connecting each tool separately. npm installation
+never edits agent settings or project RE instructions.
+
+With a global npm installation, run from the research project:
+
+```sh
+mkdir -p .agents/skills
+ln -s "$(npm root -g)/@eyeauras/insight-cli/skill-bundle" .agents/skills/insight-toolbox
+```
+
+`ln` refuses an existing destination: inspect it instead of overwriting another skill or
+connection. Local npm installations use the `bundlePath` from their actual CLI receipt.
+These machine-local links are not portable files to commit to a shared project. Start a fresh
+agent and verify all registered names/descriptions appear. The [official discovery contract](https://learn.chatgpt.com/docs/build-skills)
+supports project skills and symlinked directories; our actual host gate must still establish
+recursive discovery for this packaged bundle.
+
+An npm upgrade at the same global prefix replaces the bundle at the same path, including newly
+registered tool skills. Check its manifest/version and start a fresh host session after upgrade.
+A changed npm prefix needs reconnection. To disconnect, inspect `readlink .agents/skills/insight-toolbox`
+and remove only that owned symlink with `unlink .agents/skills/insight-toolbox`; preserve other
+entries and the package. No copied skills, per-tool installer or second agent configuration
+store is maintained. Other hosts may register this ordinary bundle through their own mechanism;
+Codex is the first concrete supported-host gate.
+
+## Execution access
+
+A skill link does not grant filesystem or IPC permissions. Allow the assigned profile's AppData
+and the CLI's `.runtime` directory, plus its exact local IPC endpoint. On macOS the application
+root is `~/Library/Application Support/insight-cli`; its Unix socket is `.runtime/host.sock`.
+Keep unrelated profiles outside the write scope and pass the assigned `--profile` explicitly.
+Do not grant broad external network access merely to reach a local socket.
+
+An inaccessible profile means readiness is unknown. Inspect access failures; stopping a shared
+owner does not grant access to it. Existing restricted-host evaluation has not established a
+complete facade workflow yet; a successful metadata call or filesystem grant alone is insufficient.
+
+## Behavioral acceptance
+
+Give a fresh agent an input and business question without commands/tool names. Verify startup
+metadata, implicit skill selection, intended public-tool use, correct findings, saved ordinary
+project files and cleanup. Ghidra edits additionally require merge and independent readback.
+Repeat cold-runtime and prepared-runtime cases; retain failures and distinguish an external-tool
+fallback from acceptance of the intended adapter. Package/skill existence is structural evidence,
+not proof that a model completed research.
+
+The project bundle is a symlink. A plain `find` does not follow it and can misleadingly
+show no files. Use the host skill inventory, a named `.../<skill>/SKILL.md` path, or
+`insight-cli skill <name>` to check availability; `find -L` follows the link if needed.

package/skill-bundle/insight-die/SKILL.md

@@ -0,0 +1,49 @@
+---
+name: insight-die
+description: Classify unknown executable or container inputs by format, architecture and compiler/runtime/packer signatures with Detect It Easy before choosing managed or native analysis. Use insight-cli die for static triage and preserve scan uncertainty.
+---
+
+# Insight Detect It Easy 0.2.1
+
+If local help/status reports AppData or IPC access denied, retry that **read-only probe**
+with the agent host's normal permission escalation, then use that route for later authorized
+CLI calls too. An explicit **no command was sent** denial is known undispatched and can be
+retried through that route. Keep HOME, profile and owner state; see
+[host execution permissions](references/agent-execution.md). A lost mutation reply needs
+request/status recovery, never blind retry.
+
+Follow the project's RE instructions and evidence format. DiE provides quick static triage;
+it does not execute, unpack or decompile the input. Use the classification to choose a focused
+next tool, then verify important claims with that tool.
+
+1. `insight-cli die status --json` checks readiness. `die install` obtains our pinned console
+   bundle from GitHub Releases: DiE 3.21, its database and private dynamic Qt frameworks.
+   Managed delivery supports macOS 13+ ARM64. `die download`, `install --archive FILE` and
+   `--offline` use the ordinary managed lifecycle. No system Qt or installer is needed.
+   `install --executable /path/to/MacOS/diec` selects a compatible external bundle retaining
+   adjacent Resources/db, Resources/db_custom and Frameworks. The database and five required
+   frameworks are fingerprinted too. Uninstall preserves external files and research.
+2. `insight-cli die classify INPUT --json` reads both file information and signatures.
+   `--target` reuses the captured immutable input instead of INPUT. Start with the default
+   scan; use `--deep` or `--heuristic` for a reason. The input is never launched.
+3. Separate the file header from signature guesses. PE/ELF/Mach-O architecture is not proof
+   of the original programming language. A managed AnyCPU assembly can report an I386 PE
+   header; it does not establish the process architecture on another host. A .NET runtime
+   signature is a reason to inspect metadata with ILSpy. Native code, NativeAOT and unclear
+   managed recovery require native inspection such as LLVM or Ghidra.
+4. Inspect `complete`, `state` and `diagnostics` before interpreting findings. The pinned
+   upstream scanner can append JavaScript signature errors after valid JSON and still exit
+   zero. We retain the useful records but mark that classification `partial`. Errors,
+   Unknown or no packer match never prove absence of packing/obfuscation/runtime code.
+   Cross-check important signature claims. Do not present a partial scan as exhaustive.
+5. `--limit`/`--offset` page signature findings. `--output research/triage.json` saves the
+   complete bounded envelope including all findings/warnings to a new ordinary file, making
+   missing parents. Raw native stdout/stderr remain in each returned process's diagnostic
+   directory. The 4-MiB output bound and per-process deadline fail explicitly; limited output
+   is not a completed scan. Save completed research with `artifacts save` when useful.
+
+`die doctor` checks the selected runtime. `tools processes --tool die --all` and `show <id>`
+provide owned execution history. These reads need Update permission to capture input and run
+the scanner. Generated `--help` owns exact syntax. Use the private bundle by default; copied
+compatible Qt frameworks can be replaced and the resulting external bundle reselected as
+explained in its NOTICE.txt. No Ghidra session or merge is needed for this static classifier.

package/skill-bundle/insight-die/references/agent-execution.md

@@ -0,0 +1,36 @@
+# Agent host execution permissions
+
+Keep the user/project host policy and the selected profile. A sandbox can deny writes
+to runtime AppData or access to the local IPC endpoint, including during local help.
+This is a host execution boundary, not evidence that the tool or its inputs are absent.
+
+First retry only `insight-cli --help`, `tools list`, `skill`, or the selected application's
+read-only `status` using the host's normal permission escalation. In Codex, use the
+execution tool's `sandbox_permissions: "require_escalated"` with a scoped explanation
+that the installed CLI needs its existing profile storage/local IPC. Automatic approval
+review or the user decides that request; do not disable the sandbox or approval policy.
+
+Do not work around this by changing HOME/AppData/profile paths, creating another host,
+deleting owner/endpoint files, killing unrelated processes or claiming a missing runtime.
+After the read-only probe succeeds, use the approved execution route for the intended
+public CLI commands. An access refusal explicitly stating **no command was sent** is
+known not dispatched; it is safe to submit that authorized command through the approved
+route. This includes a mutation refused before dispatch. Do not mistake that definite
+pre-dispatch refusal for an unknown execution outcome. Downloads still require their explicit
+network access.
+
+A lost mutation response is different from a denied startup probe: inspect retained
+request/status/recovery evidence and use its request ID when supported. Never blindly
+repeat a publication, script or program run whose outcome is unknown. External-tool
+fallback is allowed by project rules, but record that the intended facade was not used
+and do not invent a successful checkpoint or native result.
+
+## Wait for the original execution
+
+A tool operation may outlast the host execution tool's initial wait. A returned running
+session/cell ID means that command is still in progress, not that the CLI returned no data.
+Use the host's session poll/wait facility until terminal exit and consume stdout/stderr
+before issuing a dependent command. In Codex, an `exec_command` session is continued with
+`write_stdin`; a yielded execution cell uses that host's cell wait. Do not launch a second
+open/install or repeat a CPU action just because the first chunk was empty. If the execution
+really loses its terminal result, use the CLI's request/status recovery as described above.

package/skill-bundle/insight-dnspy/SKILL.md

@@ -0,0 +1,65 @@
+---
+name: insight-dnspy
+description: Debug a managed Windows EXE at an IL breakpoint and read primitive arguments, or change one expected IL Int32 constant in a new assembly copy through insight-cli dnspy. Use when C# decompilation needs observed execution or a controlled binary edit.
+---
+
+# Insight dnSpyEx 0.2.1
+
+If local help/status reports AppData or IPC access denied, retry that **read-only probe**
+with the agent host's normal permission escalation, then use that route for later authorized
+CLI calls too. An explicit **no command was sent** denial is known undispatched and can be
+retried through that route. Keep HOME, profile and owner state; see
+[host execution permissions](references/agent-execution.md). A lost mutation reply needs
+request/status recovery, never blind retry.
+
+Keep the project's RE and evidence format. Debugging executes the supplied application
+in a new owned process; its ordinary file/network side effects still apply. Use only
+inputs whose execution is authorized. The original process is not attached or reused.
+Windows x64 and an interactive desktop are required. No source code or PDB is required
+for a MethodDef token breakpoint and indexed primitive parameter read.
+
+1. Check `insight-cli dnspy status --json`. `dnspy install --vendor-direct` acquires the
+   pinned upstream dnSpyEx 6.6.0 bundle and our mirrored private .NET 10.0.13 target runtime.
+   dnSpy's own debugger runtime is self-contained .NET 10.0.9. The upstream bundle contains
+   separately licensed VS 2017 DLLs that prohibit our redistribution, so its bytes are
+   fetched explicitly from dnSpyEx GitHub, checked by SHA256 and cached locally.
+   `download --vendor-direct` prepares acquisition first. For offline setup use
+   `install --archive dnSpy-net-win64.zip --dotnet-archive dotnet-runtime.zip --offline`.
+   `install --executable C:\tools\dnSpy\dnSpy.exe` selects the complete pinned external
+   runtime; only its pinned vendor files are copied into owned execution storage. The
+   first setup starts a private GUI to prepare a Unicode-compatible Core loader there;
+   external originals remain unchanged. Both copies are fingerprinted, and uninstall
+   preserves the external distribution. `doctor` checks
+   version and exact extension contracts without opening the GUI.
+2. Use ILSpy metadata/IL to identify the managed module's MethodDef token (`0x060000NN`)
+   and exact decimal IL instruction offset. `dnspy inspect app.exe --method 0x06000002
+   --il-offset 0 --parameters 0 --json` launches a private Framework debugger, stops at that
+   location, reads selected zero-based primitive parameter indices and records a bounded
+   managed stack. After flushing the snapshot, its one-shot GUI exits and the owned Windows Job Object terminates the debuggee; it does not resume the program or rely on UI teardown.
+   A token belongs to one exact module; it is not a native address or stable cross-build ID.
+3. For a Core application, select its apphost EXE and paired DLL:
+   `dnspy inspect app.exe --runtime core --module app.dll --companion app.runtimeconfig.json
+   app.deps.json --method 0x06000002 --parameters 0 --json`.
+   Explicitly add any required local DLLs with `--companion`; names and captured hashes are
+   retained. Managed setup supplies .NET 10.0.13; a different target runtime version may require a compatible explicit host. With an external debugger selection,
+   provide `--dotnet-host C:\dotnet\dotnet.exe` for a compatible Core runtime. Self-contained
+   applications may need additional declared companions; the facade does not copy a source
+   directory or guess startup dependencies. Use literal `--arg` values for program arguments.
+4. `dnspy edit-constant app.dll --method 0x06000003 --il-offset 0 --expect-int32 7
+   --set-int32 37 --output research/app-patched.dll --json` changes only the selected existing
+   Int32 load instruction through dnSpy's loaded document and writes a new assembly.
+   A mismatched expected value fails; originals and existing output files are preserved.
+   Verify the output independently. Editing can invalidate signatures/strong names and does
+   not prove that the changed path executes. No Ghidra merge or original-file replacement occurs.
+5. `--target ID` reuses a captured input; debug companions remain explicit. Debug `--limit` and
+   `--offset` bound returned stack frames; `--output research/managed-stop.json` saves the full
+   bounded result in a new ordinary file. Follow project evidence conventions and use
+   `artifacts save` for a checkpoint when helpful. Missing breakpoints, optimized/unavailable
+   parameters and runtime/dependency failures are unknowns, not invented values.
+6. Every operation uses private settings and an isolated GUI under the Windows Job Object.
+   `tools processes --tool dnspy --all` retains jobs and diagnostics. Stop/kill target only an
+   owned process ID through `tools processes stop/kill`. Owner loss/deadline kills the owned
+   process tree; saved inputs and partial diagnostics remain. Lost responses do not trigger
+   automatic relaunch, expression evaluation, attach or edit replay.
+
+Generated `dnspy inspect --help` and `dnspy edit-constant --help` own exact syntax.