@eyeauras/insight-cli 0.2.0 → 0.2.1

package/skills/insight-artifacts/references/artifacts.md

@@ -0,0 +1,52 @@
+# Save ordinary research materials
+
+`insight-cli artifacts save <path> --json` saves a file or a settled directory tree in
+the selected profile's AppData. It needs Factory Update permission and does not require
+Ghidra, Java, authentication, target/session selectors or evidence metadata. Relative input
+paths resolve against the caller's working directory. Use `--help` for generated syntax.
+
+Save existing project files in their existing format; no `notes.md`, `finding.md` or
+`research/` layout is required. The saved copy is a checkpoint and does not replace the
+project's canonical evidence location or its source-of-truth rules.
+
+Write notes and useful external-tool outputs as ordinary files while investigating. When
+the selected files are no longer being edited, save one file, a completed worker subfolder
+or the relevant project folder. For a project without a prescribed layout, for example:
+
+```sh
+insight-cli artifacts save ./research --json
+```
+
+The receipt has `state: "saved"`, `path`, `kind` (`file` or `directory`), `files`, `bytes`
+and `sha256`. `path` points to an ordinary browsable copy with the source basename and
+relative layout. Empty files and empty directories are retained. File count counts regular
+files; byte count counts their contents. A file's SHA-256 hashes its bytes; a directory's
+SHA-256 hashes its canonical manifest of relative paths, kinds, file lengths and hashes.
+The manifest is stored beside the content, outside the returned directory.
+
+Before claiming a verified checkpoint, read the expected files at the returned `path` using
+ordinary file tools. Preserve that path verbatim in the handoff, alongside the receipt;
+profile and snapshot identifiers must not be reconstructed from memory. If access is denied,
+retain the actual receipt and state that readback remains unverified.
+
+The service copies and syncs data before publishing the completed snapshot. Failure does
+not return a successful receipt or expose a partial completed snapshot. Source edits made
+after a successful save do not change the copy. Treat saved copies as retained snapshots;
+edit the original research folder and save a new copy for another checkpoint. Each call
+creates a new saved copy, including a repeated call after a lost response.
+
+Keep a directory stable for the save: detected concurrent edits are rejected. Copying
+several files is not an atomic filesystem snapshot of a directory that other agents keep
+changing. Symbolic links and special files are rejected rather than followed or silently
+omitted. Select the actual intended regular file/directory. Do not save a directory that
+contains the destination materials store. Traversal supports at most 100,000 entries and
+128 levels to bound inventory memory and recursion. Disk/permission failures return nonzero.
+
+The saved bytes establish what was retained. Commands, tool versions and interpretations
+written in a note remain the author's statements, not execution attestations. No upload,
+tool execution or Ghidra publication is performed by saving materials.
+
+Profile deletion/configuration invalidation is blocked while retained materials exist,
+as with retained research work. Close tool contexts normally; preserve snapshots separately
+if retiring a profile. There is no automatic registration, cleanup policy, graph database
+or additional read API: read the receipt's path with normal file tools.

package/skills/insight-binary/SKILL.md

@@ -0,0 +1,46 @@
+---
+name: insight-binary
+description: Query structured PE, ELF and thin Mach-O headers, sections, imports and exports, or make an explicitly guarded new PE subsystem copy through insight-cli binary. Use for scoped binary structure, linkage and copy-only header edits without target execution.
+---
+
+# Insight Binary 0.2.1
+
+If local help/status reports AppData or IPC access denied, retry that **read-only probe**
+with the agent host's normal permission escalation, then use that route for later authorized
+CLI calls too. An explicit **no command was sent** denial is known undispatched and can be
+retried through that route. Keep HOME, profile and owner state; see
+[host execution permissions](references/agent-execution.md). A lost mutation reply needs
+request/status recovery, never blind retry.
+
+Keep project RE/evidence conventions. LIEF is an internal packaged library. The native
+helper is included with insight-cli; no separate download/install, SDK or compiler is
+needed. The admitted host is macOS14+ ARM64; PE/ELF/Mach-O input formats do not imply
+that the host can execute them. Arbitrary scripts or patches are outside this API.
+
+1. `binary query app.exe --json` identifies format, architecture, entrypoint, image base,
+   section/linkage counts and the PE subsystem/signature presence. Static metadata can
+   be malformed; parser diagnostics mean partial evidence, not a successful absence claim.
+2. `--view sections`, `libraries`, `imports` and `exports` provide focused JSON rows.
+   `--filter TEXT` is a literal name substring, applied before `--limit`/`--offset` paging.
+   Reuse the returned `--target` for immutable input identity. There is no active binary.
+3. Addresses and sizes are strings to preserve precision. PE exports retain RVA and
+   image-base-adjusted virtual address; forwarded exports retain the target name instead
+   of pretending the forwarder is executable code. ELF/Mach-O views cover exported
+   functions, not every exported data symbol. Non-PE import libraries may be unknown.
+   Preserve Mach-O's native symbol spelling, including a leading underscore.
+4. Universal Mach-O containers require explicit thin-slice extraction with a suitable
+   external tool; the facade never silently chooses an architecture. Inputs are limited
+   to 64 MiB and scans to 100000 metadata records; a reached bound remains partial.
+5. A requested copy-only edit uses an explicit expectation:
+   `binary edit-subsystem app.exe --expect-subsystem console --subsystem gui --output research/gui.exe --json`.
+   Only this existing two-byte PE field is assigned. Independent LIEF readback and byte
+   comparison verify the new copy; the original and existing outputs are preserved.
+   This does not verify execution compatibility or repair PE checksum/Authenticode.
+   Existing signatures may become invalid; keep both original and copied hashes.
+6. `binary query --output research/page.json` saves the current bounded page to a new
+   ordinary file. Preserve scope/partial flags in project notes and checkpoint selected
+   evidence with `artifacts save` when useful. Readonly library queries need no Ghidra merge;
+   annotations belong to an explicit Ghidra session/target when that tool is used.
+
+Generated help owns exact options. LLVM remains useful for instruction/PDB windows;
+Ghidra supplies shared analysis, isolated work contexts and merge/refresh.

package/skills/insight-binary/references/agent-execution.md

@@ -0,0 +1,36 @@
+# Agent host execution permissions
+
+Keep the user/project host policy and the selected profile. A sandbox can deny writes
+to runtime AppData or access to the local IPC endpoint, including during local help.
+This is a host execution boundary, not evidence that the tool or its inputs are absent.
+
+First retry only `insight-cli --help`, `tools list`, `skill`, or the selected application's
+read-only `status` using the host's normal permission escalation. In Codex, use the
+execution tool's `sandbox_permissions: "require_escalated"` with a scoped explanation
+that the installed CLI needs its existing profile storage/local IPC. Automatic approval
+review or the user decides that request; do not disable the sandbox or approval policy.
+
+Do not work around this by changing HOME/AppData/profile paths, creating another host,
+deleting owner/endpoint files, killing unrelated processes or claiming a missing runtime.
+After the read-only probe succeeds, use the approved execution route for the intended
+public CLI commands. An access refusal explicitly stating **no command was sent** is
+known not dispatched; it is safe to submit that authorized command through the approved
+route. This includes a mutation refused before dispatch. Do not mistake that definite
+pre-dispatch refusal for an unknown execution outcome. Downloads still require their explicit
+network access.
+
+A lost mutation response is different from a denied startup probe: inspect retained
+request/status/recovery evidence and use its request ID when supported. Never blindly
+repeat a publication, script or program run whose outcome is unknown. External-tool
+fallback is allowed by project rules, but record that the intended facade was not used
+and do not invent a successful checkpoint or native result.
+
+## Wait for the original execution
+
+A tool operation may outlast the host execution tool's initial wait. A returned running
+session/cell ID means that command is still in progress, not that the CLI returned no data.
+Use the host's session poll/wait facility until terminal exit and consume stdout/stderr
+before issuing a dependent command. In Codex, an `exec_command` session is continued with
+`write_stdin`; a yielded execution cell uses that host's cell wait. Do not launch a second
+open/install or repeat a CPU action just because the first chunk was empty. If the execution
+really loses its terminal result, use the CLI's request/status recovery as described above.

package/skills/insight-capture/SKILL.md

@@ -0,0 +1,56 @@
+---
+name: insight-capture
+description: Capture one explicitly authorized native program run, exact stdout/stderr and declared file snapshots through insight-cli capture, then inspect or compare retained reports without replay. Use for controlled input/output research, preserving original files and interrupted or unknown outcomes.
+---
+
+# Insight Capture 0.2.1
+
+If local help/status reports AppData or IPC access denied, retry that **read-only probe**
+with the agent host's normal permission escalation, then use that route for later authorized
+CLI calls too. An explicit **no command was sent** denial is known undispatched and can be
+retried through that route. Keep HOME, profile and owner state; see
+[host execution permissions](references/agent-execution.md). A lost mutation reply needs
+request/status recovery, never blind retry.
+
+Follow project RE and evidence conventions. Use this only for an authorized runtime
+observation. The current native host/input profile is macOS14+ ARM64 thin Mach-O
+executables. There is no extra install, compiler, shell string or implicit active target.
+
+1. `capture run ./program --arg normal --input-file ./settings.txt --watch settings.txt result.txt --output research/run.json --json`
+   copies the selected program and input files into a fresh owned working directory.
+   Input files retain unique basenames; arguments are literal, without shell expansion.
+   To pass an option-shaped subject argument use `--arg=--subject-option`.
+   `--stdin-file FILE` supplies exact bytes, bounded to 1 MiB.
+2. The result gives the immutable program target/hash, copied input hashes, request ID,
+   known subject exit/signal, bounded output previews and declared file changes. Known
+   nonzero subject exits (0–126) are observable outcomes; reserved launcher failure,
+   signal, timeout, overflow or unavailable files leave a partial capture and nonzero CLI.
+   Exact output bytes are stored as base64 with SHA256; UTF-8 previews may replace invalid
+   characters. Binary output should be read as base64, not reconstructed from a preview.
+3. `capture show REQUEST --view stdout --limit 256 --offset 0 --json` pages retained bytes;
+   `--view stderr` and `--view files` focus other evidence. `--output FILE` exports a new
+   portable report. The default overview remains small; never paste an entire report
+   into context just to find one value. `artifacts save` can checkpoint selected files.
+4. Only `--watch` relative regular files are snapshotted before/after. A missing file is
+   explicit; links, unstable/oversized or unreadable files are unknown. This is not a
+   trace of all effects or an OS sandbox: the program still has normal host access.
+   The default deadline is 10 seconds (up to 600). Its inherited native alarm survives
+   ordinary owner loss; a subject can deliberately replace that alarm. Use stronger
+   host isolation separately when required by the actual target or project rules.
+5. `capture compare research/before.json research/after.json --json` compares exact retained
+   stdout/stderr, exit state and declared resulting files. It never executes the program.
+   `sameDeclaredIntent` distinguishes changed input/argv from repeated observations;
+   equal fields do not establish causal/semantic equivalence or a speedup claim.
+   Partial reports cannot prove global equality. Imported reports are asserted data,
+   not independent proof that an execution occurred.
+6. An optional `--request-id ID` binds the exact effective intent. Retrying it returns
+   the durable prior outcome, or an explicit unknown/partial state; it never repeats
+   the run. A different intent with the same ID is refused. Without an ID each call is
+   a new intentional observation. After owner loss, `capture show REQUEST` exposes retained
+   intent, process state and working directory; preserve existing files and investigate
+   the unknown result instead of blindly launching it again.
+
+Limits: 64 MiB program and total selected files, 16 MiB per selected/watched file,
+32 files/watch paths, 64 literal arguments and 4 MiB aggregate native output. No native
+merge exists here; publish any Ghidra annotations through their explicit session/target.
+Generated help owns options. Local project formats take precedence over this example.

package/skills/insight-capture/references/agent-execution.md

@@ -0,0 +1,36 @@
+# Agent host execution permissions
+
+Keep the user/project host policy and the selected profile. A sandbox can deny writes
+to runtime AppData or access to the local IPC endpoint, including during local help.
+This is a host execution boundary, not evidence that the tool or its inputs are absent.
+
+First retry only `insight-cli --help`, `tools list`, `skill`, or the selected application's
+read-only `status` using the host's normal permission escalation. In Codex, use the
+execution tool's `sandbox_permissions: "require_escalated"` with a scoped explanation
+that the installed CLI needs its existing profile storage/local IPC. Automatic approval
+review or the user decides that request; do not disable the sandbox or approval policy.
+
+Do not work around this by changing HOME/AppData/profile paths, creating another host,
+deleting owner/endpoint files, killing unrelated processes or claiming a missing runtime.
+After the read-only probe succeeds, use the approved execution route for the intended
+public CLI commands. An access refusal explicitly stating **no command was sent** is
+known not dispatched; it is safe to submit that authorized command through the approved
+route. This includes a mutation refused before dispatch. Do not mistake that definite
+pre-dispatch refusal for an unknown execution outcome. Downloads still require their explicit
+network access.
+
+A lost mutation response is different from a denied startup probe: inspect retained
+request/status/recovery evidence and use its request ID when supported. Never blindly
+repeat a publication, script or program run whose outcome is unknown. External-tool
+fallback is allowed by project rules, but record that the intended facade was not used
+and do not invent a successful checkpoint or native result.
+
+## Wait for the original execution
+
+A tool operation may outlast the host execution tool's initial wait. A returned running
+session/cell ID means that command is still in progress, not that the CLI returned no data.
+Use the host's session poll/wait facility until terminal exit and consume stdout/stderr
+before issuing a dependent command. In Codex, an `exec_command` session is continued with
+`write_stdin`; a yielded execution cell uses that host's cell wait. Do not launch a second
+open/install or repeat a CPU action just because the first chunk was empty. If the execution
+really loses its terminal result, use the CLI's request/status recovery as described above.

package/skills/insight-die/SKILL.md

@@ -0,0 +1,49 @@
+---
+name: insight-die
+description: Classify unknown executable or container inputs by format, architecture and compiler/runtime/packer signatures with Detect It Easy before choosing managed or native analysis. Use insight-cli die for static triage and preserve scan uncertainty.
+---
+
+# Insight Detect It Easy 0.2.1
+
+If local help/status reports AppData or IPC access denied, retry that **read-only probe**
+with the agent host's normal permission escalation, then use that route for later authorized
+CLI calls too. An explicit **no command was sent** denial is known undispatched and can be
+retried through that route. Keep HOME, profile and owner state; see
+[host execution permissions](references/agent-execution.md). A lost mutation reply needs
+request/status recovery, never blind retry.
+
+Follow the project's RE instructions and evidence format. DiE provides quick static triage;
+it does not execute, unpack or decompile the input. Use the classification to choose a focused
+next tool, then verify important claims with that tool.
+
+1. `insight-cli die status --json` checks readiness. `die install` obtains our pinned console
+   bundle from GitHub Releases: DiE 3.21, its database and private dynamic Qt frameworks.
+   Managed delivery supports macOS 13+ ARM64. `die download`, `install --archive FILE` and
+   `--offline` use the ordinary managed lifecycle. No system Qt or installer is needed.
+   `install --executable /path/to/MacOS/diec` selects a compatible external bundle retaining
+   adjacent Resources/db, Resources/db_custom and Frameworks. The database and five required
+   frameworks are fingerprinted too. Uninstall preserves external files and research.
+2. `insight-cli die classify INPUT --json` reads both file information and signatures.
+   `--target` reuses the captured immutable input instead of INPUT. Start with the default
+   scan; use `--deep` or `--heuristic` for a reason. The input is never launched.
+3. Separate the file header from signature guesses. PE/ELF/Mach-O architecture is not proof
+   of the original programming language. A managed AnyCPU assembly can report an I386 PE
+   header; it does not establish the process architecture on another host. A .NET runtime
+   signature is a reason to inspect metadata with ILSpy. Native code, NativeAOT and unclear
+   managed recovery require native inspection such as LLVM or Ghidra.
+4. Inspect `complete`, `state` and `diagnostics` before interpreting findings. The pinned
+   upstream scanner can append JavaScript signature errors after valid JSON and still exit
+   zero. We retain the useful records but mark that classification `partial`. Errors,
+   Unknown or no packer match never prove absence of packing/obfuscation/runtime code.
+   Cross-check important signature claims. Do not present a partial scan as exhaustive.
+5. `--limit`/`--offset` page signature findings. `--output research/triage.json` saves the
+   complete bounded envelope including all findings/warnings to a new ordinary file, making
+   missing parents. Raw native stdout/stderr remain in each returned process's diagnostic
+   directory. The 4-MiB output bound and per-process deadline fail explicitly; limited output
+   is not a completed scan. Save completed research with `artifacts save` when useful.
+
+`die doctor` checks the selected runtime. `tools processes --tool die --all` and `show <id>`
+provide owned execution history. These reads need Update permission to capture input and run
+the scanner. Generated `--help` owns exact syntax. Use the private bundle by default; copied
+compatible Qt frameworks can be replaced and the resulting external bundle reselected as
+explained in its NOTICE.txt. No Ghidra session or merge is needed for this static classifier.

package/skills/insight-die/references/agent-execution.md

@@ -0,0 +1,36 @@
+# Agent host execution permissions
+
+Keep the user/project host policy and the selected profile. A sandbox can deny writes
+to runtime AppData or access to the local IPC endpoint, including during local help.
+This is a host execution boundary, not evidence that the tool or its inputs are absent.
+
+First retry only `insight-cli --help`, `tools list`, `skill`, or the selected application's
+read-only `status` using the host's normal permission escalation. In Codex, use the
+execution tool's `sandbox_permissions: "require_escalated"` with a scoped explanation
+that the installed CLI needs its existing profile storage/local IPC. Automatic approval
+review or the user decides that request; do not disable the sandbox or approval policy.
+
+Do not work around this by changing HOME/AppData/profile paths, creating another host,
+deleting owner/endpoint files, killing unrelated processes or claiming a missing runtime.
+After the read-only probe succeeds, use the approved execution route for the intended
+public CLI commands. An access refusal explicitly stating **no command was sent** is
+known not dispatched; it is safe to submit that authorized command through the approved
+route. This includes a mutation refused before dispatch. Do not mistake that definite
+pre-dispatch refusal for an unknown execution outcome. Downloads still require their explicit
+network access.
+
+A lost mutation response is different from a denied startup probe: inspect retained
+request/status/recovery evidence and use its request ID when supported. Never blindly
+repeat a publication, script or program run whose outcome is unknown. External-tool
+fallback is allowed by project rules, but record that the intended facade was not used
+and do not invent a successful checkpoint or native result.
+
+## Wait for the original execution
+
+A tool operation may outlast the host execution tool's initial wait. A returned running
+session/cell ID means that command is still in progress, not that the CLI returned no data.
+Use the host's session poll/wait facility until terminal exit and consume stdout/stderr
+before issuing a dependent command. In Codex, an `exec_command` session is continued with
+`write_stdin`; a yielded execution cell uses that host's cell wait. Do not launch a second
+open/install or repeat a CPU action just because the first chunk was empty. If the execution
+really loses its terminal result, use the CLI's request/status recovery as described above.

package/skills/insight-dnspy/SKILL.md

@@ -0,0 +1,65 @@
+---
+name: insight-dnspy
+description: Debug a managed Windows EXE at an IL breakpoint and read primitive arguments, or change one expected IL Int32 constant in a new assembly copy through insight-cli dnspy. Use when C# decompilation needs observed execution or a controlled binary edit.
+---
+
+# Insight dnSpyEx 0.2.1
+
+If local help/status reports AppData or IPC access denied, retry that **read-only probe**
+with the agent host's normal permission escalation, then use that route for later authorized
+CLI calls too. An explicit **no command was sent** denial is known undispatched and can be
+retried through that route. Keep HOME, profile and owner state; see
+[host execution permissions](references/agent-execution.md). A lost mutation reply needs
+request/status recovery, never blind retry.
+
+Keep the project's RE and evidence format. Debugging executes the supplied application
+in a new owned process; its ordinary file/network side effects still apply. Use only
+inputs whose execution is authorized. The original process is not attached or reused.
+Windows x64 and an interactive desktop are required. No source code or PDB is required
+for a MethodDef token breakpoint and indexed primitive parameter read.
+
+1. Check `insight-cli dnspy status --json`. `dnspy install --vendor-direct` acquires the
+   pinned upstream dnSpyEx 6.6.0 bundle and our mirrored private .NET 10.0.13 target runtime.
+   dnSpy's own debugger runtime is self-contained .NET 10.0.9. The upstream bundle contains
+   separately licensed VS 2017 DLLs that prohibit our redistribution, so its bytes are
+   fetched explicitly from dnSpyEx GitHub, checked by SHA256 and cached locally.
+   `download --vendor-direct` prepares acquisition first. For offline setup use
+   `install --archive dnSpy-net-win64.zip --dotnet-archive dotnet-runtime.zip --offline`.
+   `install --executable C:\tools\dnSpy\dnSpy.exe` selects the complete pinned external
+   runtime; only its pinned vendor files are copied into owned execution storage. The
+   first setup starts a private GUI to prepare a Unicode-compatible Core loader there;
+   external originals remain unchanged. Both copies are fingerprinted, and uninstall
+   preserves the external distribution. `doctor` checks
+   version and exact extension contracts without opening the GUI.
+2. Use ILSpy metadata/IL to identify the managed module's MethodDef token (`0x060000NN`)
+   and exact decimal IL instruction offset. `dnspy inspect app.exe --method 0x06000002
+   --il-offset 0 --parameters 0 --json` launches a private Framework debugger, stops at that
+   location, reads selected zero-based primitive parameter indices and records a bounded
+   managed stack. After flushing the snapshot, its one-shot GUI exits and the owned Windows Job Object terminates the debuggee; it does not resume the program or rely on UI teardown.
+   A token belongs to one exact module; it is not a native address or stable cross-build ID.
+3. For a Core application, select its apphost EXE and paired DLL:
+   `dnspy inspect app.exe --runtime core --module app.dll --companion app.runtimeconfig.json
+   app.deps.json --method 0x06000002 --parameters 0 --json`.
+   Explicitly add any required local DLLs with `--companion`; names and captured hashes are
+   retained. Managed setup supplies .NET 10.0.13; a different target runtime version may require a compatible explicit host. With an external debugger selection,
+   provide `--dotnet-host C:\dotnet\dotnet.exe` for a compatible Core runtime. Self-contained
+   applications may need additional declared companions; the facade does not copy a source
+   directory or guess startup dependencies. Use literal `--arg` values for program arguments.
+4. `dnspy edit-constant app.dll --method 0x06000003 --il-offset 0 --expect-int32 7
+   --set-int32 37 --output research/app-patched.dll --json` changes only the selected existing
+   Int32 load instruction through dnSpy's loaded document and writes a new assembly.
+   A mismatched expected value fails; originals and existing output files are preserved.
+   Verify the output independently. Editing can invalidate signatures/strong names and does
+   not prove that the changed path executes. No Ghidra merge or original-file replacement occurs.
+5. `--target ID` reuses a captured input; debug companions remain explicit. Debug `--limit` and
+   `--offset` bound returned stack frames; `--output research/managed-stop.json` saves the full
+   bounded result in a new ordinary file. Follow project evidence conventions and use
+   `artifacts save` for a checkpoint when helpful. Missing breakpoints, optimized/unavailable
+   parameters and runtime/dependency failures are unknowns, not invented values.
+6. Every operation uses private settings and an isolated GUI under the Windows Job Object.
+   `tools processes --tool dnspy --all` retains jobs and diagnostics. Stop/kill target only an
+   owned process ID through `tools processes stop/kill`. Owner loss/deadline kills the owned
+   process tree; saved inputs and partial diagnostics remain. Lost responses do not trigger
+   automatic relaunch, expression evaluation, attach or edit replay.
+
+Generated `dnspy inspect --help` and `dnspy edit-constant --help` own exact syntax.

package/skills/insight-dnspy/references/agent-execution.md

@@ -0,0 +1,36 @@
+# Agent host execution permissions
+
+Keep the user/project host policy and the selected profile. A sandbox can deny writes
+to runtime AppData or access to the local IPC endpoint, including during local help.
+This is a host execution boundary, not evidence that the tool or its inputs are absent.
+
+First retry only `insight-cli --help`, `tools list`, `skill`, or the selected application's
+read-only `status` using the host's normal permission escalation. In Codex, use the
+execution tool's `sandbox_permissions: "require_escalated"` with a scoped explanation
+that the installed CLI needs its existing profile storage/local IPC. Automatic approval
+review or the user decides that request; do not disable the sandbox or approval policy.
+
+Do not work around this by changing HOME/AppData/profile paths, creating another host,
+deleting owner/endpoint files, killing unrelated processes or claiming a missing runtime.
+After the read-only probe succeeds, use the approved execution route for the intended
+public CLI commands. An access refusal explicitly stating **no command was sent** is
+known not dispatched; it is safe to submit that authorized command through the approved
+route. This includes a mutation refused before dispatch. Do not mistake that definite
+pre-dispatch refusal for an unknown execution outcome. Downloads still require their explicit
+network access.
+
+A lost mutation response is different from a denied startup probe: inspect retained
+request/status/recovery evidence and use its request ID when supported. Never blindly
+repeat a publication, script or program run whose outcome is unknown. External-tool
+fallback is allowed by project rules, but record that the intended facade was not used
+and do not invent a successful checkpoint or native result.
+
+## Wait for the original execution
+
+A tool operation may outlast the host execution tool's initial wait. A returned running
+session/cell ID means that command is still in progress, not that the CLI returned no data.
+Use the host's session poll/wait facility until terminal exit and consume stdout/stderr
+before issuing a dependent command. In Codex, an `exec_command` session is continued with
+`write_stdin`; a yielded execution cell uses that host's cell wait. Do not launch a second
+open/install or repeat a CPU action just because the first chunk was empty. If the execution
+really loses its terminal result, use the CLI's request/status recovery as described above.

package/skills/insight-dotnet-dump/SKILL.md

@@ -0,0 +1,46 @@
+---
+name: insight-dotnet-dump
+description: Capture a managed heap dump or inspect compatible .NET dumps with SOS to recover waiting stacks, objects, fields and retention evidence.
+---
+
+# Insight .NET Dump 0.2.1
+
+If local help/status reports AppData or IPC access denied, retry that **read-only probe**
+with the agent host's normal permission escalation, then use that route for later authorized
+CLI calls too. An explicit **no command was sent** denial is known undispatched and can be
+retried through that route. Keep HOME, profile and owner state; see
+[host execution permissions](references/agent-execution.md). A lost mutation reply needs
+request/status recovery, never blind retry.
+
+Start with `insight-cli dotnet-dump collect --pid PID --output research/worker.dmp`.
+The default Heap dump includes managed objects; Mini may lack required heap data. Collection
+has a deadline and accepts only a nonempty file below 4 GiB. It does not execute dump data.
+
+Use `analyze FILE --command clrthreads` or `--command clrstack` for thread context, then
+`--command 'dumpheap -type TYPE'` to locate objects and `--command 'dumpobj ADDRESS'` for
+fields. Reuse the returned `--target ID` instead of a file. `gcroot ADDRESS` can investigate
+retention. Interpret the actual output: an empty type selection, unavailable DAC or SOS error
+is not evidence that the requested object was found. Addresses belong to that dump only.
+Use `--command 'help dumpheap'` for native SOS query syntax.
+The API accepts one supported inspection command; it does not expose arbitrary debugger
+scripts, chaining, symbol-server configuration or execution. Keep static object snapshots
+separate from claims about current live state.
+
+Use the existing project RE instructions and evidence format. `status` checks readiness;
+`install` prepares the pinned tool and private .NET 10.0.13 from our GitHub Releases.
+`--archive`, `--dotnet-archive` and `--offline` support local preparation; `--executable`
+selects a compatible external tool, whose runtime/dependency closure remains user-managed.
+Managed admission is macOS ARM64. A native compatible runtime/DAC is required for dump
+inspection; a Windows dump is not promised readable on macOS.
+
+Live commands require an explicit `--pid`. The selected process remains external: the CLI
+owns its collector, not that target's lifetime. Use the PID supplied for this investigation;
+process birth is checked around collection, with the reported OS identity strength. If the
+process uses a custom TMPDIR, pass `--diagnostic-directory` with that directory. Do not
+infer target ownership from a successful attachment or stop another agent's process.
+
+Text views page with `--limit`/`--offset`; `--output FILE` retains complete bounded text in
+a new ordinary file. Native text has a 4-MiB output bound; an output-limit error is not a
+complete inventory. Save finished project files/folders with `artifacts save` when useful.
+`tools processes --tool dotnet-dump --all` and `show ID` retain collector diagnostics. Update
+permission is required. Generated `--help` owns exact syntax. Uninstall preserves research.

package/skills/insight-dotnet-dump/references/agent-execution.md

@@ -0,0 +1,36 @@
+# Agent host execution permissions
+
+Keep the user/project host policy and the selected profile. A sandbox can deny writes
+to runtime AppData or access to the local IPC endpoint, including during local help.
+This is a host execution boundary, not evidence that the tool or its inputs are absent.
+
+First retry only `insight-cli --help`, `tools list`, `skill`, or the selected application's
+read-only `status` using the host's normal permission escalation. In Codex, use the
+execution tool's `sandbox_permissions: "require_escalated"` with a scoped explanation
+that the installed CLI needs its existing profile storage/local IPC. Automatic approval
+review or the user decides that request; do not disable the sandbox or approval policy.
+
+Do not work around this by changing HOME/AppData/profile paths, creating another host,
+deleting owner/endpoint files, killing unrelated processes or claiming a missing runtime.
+After the read-only probe succeeds, use the approved execution route for the intended
+public CLI commands. An access refusal explicitly stating **no command was sent** is
+known not dispatched; it is safe to submit that authorized command through the approved
+route. This includes a mutation refused before dispatch. Do not mistake that definite
+pre-dispatch refusal for an unknown execution outcome. Downloads still require their explicit
+network access.
+
+A lost mutation response is different from a denied startup probe: inspect retained
+request/status/recovery evidence and use its request ID when supported. Never blindly
+repeat a publication, script or program run whose outcome is unknown. External-tool
+fallback is allowed by project rules, but record that the intended facade was not used
+and do not invent a successful checkpoint or native result.
+
+## Wait for the original execution
+
+A tool operation may outlast the host execution tool's initial wait. A returned running
+session/cell ID means that command is still in progress, not that the CLI returned no data.
+Use the host's session poll/wait facility until terminal exit and consume stdout/stderr
+before issuing a dependent command. In Codex, an `exec_command` session is continued with
+`write_stdin`; a yielded execution cell uses that host's cell wait. Do not launch a second
+open/install or repeat a CPU action just because the first chunk was empty. If the execution
+really loses its terminal result, use the CLI's request/status recovery as described above.

package/skills/insight-dotnet-stack/SKILL.md

@@ -0,0 +1,39 @@
+---
+name: insight-dotnet-stack
+description: Inspect live managed thread stacks to identify active or waiting work in an explicitly selected .NET process without taking a dump.
+---
+
+# Insight .NET Stack 0.2.1
+
+If local help/status reports AppData or IPC access denied, retry that **read-only probe**
+with the agent host's normal permission escalation, then use that route for later authorized
+CLI calls too. An explicit **no command was sent** denial is known undispatched and can be
+retried through that route. Keep HOME, profile and owner state; see
+[host execution permissions](references/agent-execution.md). A lost mutation reply needs
+request/status recovery, never blind retry.
+
+Use `insight-cli dotnet-stack report --pid PID` for a lightweight live stack snapshot.
+Inspect the managed callers around native wait/sleep frames: a wait identifies where a
+thread was sampled, not by itself why an application is stalled. Keep PID/birth, capture
+time and relevant frame names in the project evidence. Different snapshots may legitimately
+differ. Use dotnet-dump for object/field questions and dotnet-trace for a bounded view over
+time instead of presenting one stack snapshot as a performance measurement.
+
+Use the existing project RE instructions and evidence format. `status` checks readiness;
+`install` prepares the pinned tool and private .NET 10.0.13 from our GitHub Releases.
+`--archive`, `--dotnet-archive` and `--offline` support local preparation; `--executable`
+selects a compatible external tool, whose runtime/dependency closure remains user-managed.
+Managed admission is macOS ARM64. A native compatible runtime/DAC is required for dump
+inspection; a Windows dump is not promised readable on macOS.
+
+Live commands require an explicit `--pid`. The selected process remains external: the CLI
+owns its collector, not that target's lifetime. Use the PID supplied for this investigation;
+process birth is checked around collection, with the reported OS identity strength. If the
+process uses a custom TMPDIR, pass `--diagnostic-directory` with that directory. Do not
+infer target ownership from a successful attachment or stop another agent's process.
+
+Text views page with `--limit`/`--offset`; `--output FILE` retains complete bounded text in
+a new ordinary file. Native text has a 4-MiB output bound; an output-limit error is not a
+complete inventory. Save finished project files/folders with `artifacts save` when useful.
+`tools processes --tool dotnet-stack --all` and `show ID` retain collector diagnostics. Update
+permission is required. Generated `--help` owns exact syntax. Uninstall preserves research.

package/skills/insight-dotnet-stack/references/agent-execution.md

@@ -0,0 +1,36 @@
+# Agent host execution permissions
+
+Keep the user/project host policy and the selected profile. A sandbox can deny writes
+to runtime AppData or access to the local IPC endpoint, including during local help.
+This is a host execution boundary, not evidence that the tool or its inputs are absent.
+
+First retry only `insight-cli --help`, `tools list`, `skill`, or the selected application's
+read-only `status` using the host's normal permission escalation. In Codex, use the
+execution tool's `sandbox_permissions: "require_escalated"` with a scoped explanation
+that the installed CLI needs its existing profile storage/local IPC. Automatic approval
+review or the user decides that request; do not disable the sandbox or approval policy.
+
+Do not work around this by changing HOME/AppData/profile paths, creating another host,
+deleting owner/endpoint files, killing unrelated processes or claiming a missing runtime.
+After the read-only probe succeeds, use the approved execution route for the intended
+public CLI commands. An access refusal explicitly stating **no command was sent** is
+known not dispatched; it is safe to submit that authorized command through the approved
+route. This includes a mutation refused before dispatch. Do not mistake that definite
+pre-dispatch refusal for an unknown execution outcome. Downloads still require their explicit
+network access.
+
+A lost mutation response is different from a denied startup probe: inspect retained
+request/status/recovery evidence and use its request ID when supported. Never blindly
+repeat a publication, script or program run whose outcome is unknown. External-tool
+fallback is allowed by project rules, but record that the intended facade was not used
+and do not invent a successful checkpoint or native result.
+
+## Wait for the original execution
+
+A tool operation may outlast the host execution tool's initial wait. A returned running
+session/cell ID means that command is still in progress, not that the CLI returned no data.
+Use the host's session poll/wait facility until terminal exit and consume stdout/stderr
+before issuing a dependent command. In Codex, an `exec_command` session is continued with
+`write_stdin`; a yielded execution cell uses that host's cell wait. Do not launch a second
+open/install or repeat a CPU action just because the first chunk was empty. If the execution
+really loses its terminal result, use the CLI's request/status recovery as described above.

package/skills/insight-dotnet-trace/SKILL.md

@@ -0,0 +1,45 @@
+---
+name: insight-dotnet-trace
+description: Collect and inspect bounded .NET EventPipe traces to identify sampled thread work, waits or runtime activity; distinguish wall-clock samples from CPU consumption.
+---
+
+# Insight .NET Trace 0.2.1
+
+If local help/status reports AppData or IPC access denied, retry that **read-only probe**
+with the agent host's normal permission escalation, then use that route for later authorized
+CLI calls too. An explicit **no command was sent** denial is known undispatched and can be
+retried through that route. Keep HOME, profile and owner state; see
+[host execution permissions](references/agent-execution.md). A lost mutation reply needs
+request/status recovery, never blind retry.
+
+Use `insight-cli dotnet-trace collect --pid PID --duration-seconds 5 --output research/worker.nettrace`.
+The default `dotnet-sampled-thread-time` profile measures sampled thread wall-clock time.
+A sleeping method can rank at 100% while consuming little CPU. This API does not use the
+Linux-only `cpu-sampling` kernel profile. Other declared EventPipe profiles cover common
+runtime or GC events; a trace without sample events need not have a useful method ranking.
+
+Use `report FILE --count 10` for inclusive method ranking (`--exclusive` changes the metric).
+Reuse `--target ID` for captured immutable bytes. `convert FILE --format Speedscope --output
+research/worker.speedscope.json` creates a new ordinary JSON export; Chromium is also supported.
+Preserve the original trace, profile, duration, target identity and collection conditions.
+Limited/dropped samples and startup/rundown overhead constrain inference; do not call this a
+CPU speedup benchmark merely because a report contains percentages.
+
+Use the existing project RE instructions and evidence format. `status` checks readiness;
+`install` prepares the pinned tool and private .NET 10.0.13 from our GitHub Releases.
+`--archive`, `--dotnet-archive` and `--offline` support local preparation; `--executable`
+selects a compatible external tool, whose runtime/dependency closure remains user-managed.
+Managed admission is macOS ARM64. A native compatible runtime/DAC is required for dump
+inspection; a Windows dump is not promised readable on macOS.
+
+Live commands require an explicit `--pid`. The selected process remains external: the CLI
+owns its collector, not that target's lifetime. Use the PID supplied for this investigation;
+process birth is checked around collection, with the reported OS identity strength. If the
+process uses a custom TMPDIR, pass `--diagnostic-directory` with that directory. Do not
+infer target ownership from a successful attachment or stop another agent's process.
+
+Text views page with `--limit`/`--offset`; `--output FILE` retains complete bounded text in
+a new ordinary file. Native text has a 4-MiB output bound; an output-limit error is not a
+complete inventory. Save finished project files/folders with `artifacts save` when useful.
+`tools processes --tool dotnet-trace --all` and `show ID` retain collector diagnostics. Update
+permission is required. Generated `--help` owns exact syntax. Uninstall preserves research.