@eyeauras/insight-cli 0.2.0 → 0.2.2

package/runtime/native/windows-job/DirectoryAlias.cs

@@ -0,0 +1,24 @@
+// MIT; temporary process-owned DOS object alias. Files remain under profile AppData.
+using System;using System.ComponentModel;using System.IO;using System.Runtime.InteropServices;
+namespace Insight.WindowsJob {
+ internal sealed class DirectoryAlias:IDisposable {
+  [StructLayout(LayoutKind.Sequential)] struct Unicode {public ushort Length,MaximumLength;public IntPtr Buffer;}
+  [StructLayout(LayoutKind.Sequential)] struct Attributes {public int Length;public IntPtr RootDirectory,ObjectName;public uint Flags;public IntPtr Security,Quality;}
+  [DllImport("ntdll.dll")] static extern int NtCreateSymbolicLinkObject(out IntPtr handle,uint access,ref Attributes attributes,ref Unicode target);
+  [DllImport("ntdll.dll")] static extern uint RtlNtStatusToDosError(int status);
+  [DllImport("kernel32.dll")] static extern bool CloseHandle(IntPtr handle);
+  IntPtr handle;public readonly string Path;
+  public DirectoryAlias(string directory,string nonce){
+   string name=@"\??\insight-cli-"+nonce,target=directory.StartsWith(@"\\?\UNC\",StringComparison.OrdinalIgnoreCase)?@"\??\UNC\"+directory.Substring(8):directory.StartsWith(@"\\?\",StringComparison.Ordinal)?@"\??\"+directory.Substring(4):directory.StartsWith(@"\\",StringComparison.Ordinal)?@"\??\UNC\"+directory.Substring(2):@"\??\"+directory;
+   var nameBuffer=Marshal.StringToHGlobalUni(name);var targetBuffer=Marshal.StringToHGlobalUni(target);var namePointer=Marshal.AllocHGlobal(Marshal.SizeOf(typeof(Unicode)));
+   try{
+    var nameValue=new Unicode{Length=checked((ushort)(name.Length*2)),MaximumLength=checked((ushort)(name.Length*2+2)),Buffer=nameBuffer};Marshal.StructureToPtr(nameValue,namePointer,false);
+    var targetValue=new Unicode{Length=checked((ushort)(target.Length*2)),MaximumLength=checked((ushort)(target.Length*2+2)),Buffer=targetBuffer};var attributes=new Attributes{Length=Marshal.SizeOf(typeof(Attributes)),ObjectName=namePointer,Flags=0x40};
+    // No OBJ_PERMANENT or inherited handle: owner death removes the alias automatically.
+    int status=NtCreateSymbolicLinkObject(out handle,0xf0001,ref attributes,ref targetValue);if(status<0)throw new Win32Exception((int)RtlNtStatusToDosError(status));Path=@"\\.\insight-cli-"+nonce+@"\";
+   }finally{Marshal.FreeHGlobal(namePointer);Marshal.FreeHGlobal(targetBuffer);Marshal.FreeHGlobal(nameBuffer);}
+  }
+  public string File(string name)=>Path+name;
+  public void Dispose(){if(handle!=IntPtr.Zero){CloseHandle(handle);handle=IntPtr.Zero;}}
+ }
+}

package/runtime/native/windows-job/Insight.WindowsJob.csproj

@@ -0,0 +1 @@
+<Project Sdk="Microsoft.NET.Sdk"><PropertyGroup><TargetFramework>netstandard2.0</TargetFramework><AssemblyName>Insight.WindowsJob</AssemblyName><LangVersion>latest</LangVersion><Nullable>disable</Nullable><DebugType>none</DebugType><DebugSymbols>false</DebugSymbols><Deterministic>true</Deterministic><GenerateAssemblyInfo>false</GenerateAssemblyInfo><RestorePackagesWithLockFile>true</RestorePackagesWithLockFile></PropertyGroup></Project>

package/runtime/native/windows-job/NuGet.Config

@@ -0,0 +1 @@
+<configuration><packageSources><clear/><add key="nuget.org" value="https://api.nuget.org/v3/index.json" /></packageSources></configuration>

package/runtime/native/windows-job/OwnedJob.cs

@@ -0,0 +1,79 @@
+// MIT; first-party Windows Job Object executor. It never attaches another process to the job.
+using System;
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Runtime.InteropServices;
+using System.Text;
+using System.IO;
+using System.Runtime.Serialization;
+using System.Runtime.Serialization.Json;
+using System.Threading;
+namespace Insight.WindowsJob {
+ public sealed class Started { public int LauncherPid; public uint ChildPid; public long ChildBirthTicks; }
+ public sealed class Result { public string Kind; public uint ExitCode; public Started Started; }
+ [DataContract] public sealed class Specification {
+  [DataMember] public int schema;[DataMember] public string nonce,executable,cwd,ownerBirthTicks,observedBirthTicks,nativeMutex,registryShim,registryShimSha256;[DataMember] public string[] arguments;[DataMember] public int ownerPid,timeoutMs,observedPid;
+ }
+ [DataContract] public sealed class Receipt {
+  [DataMember] public int schema=1;[DataMember] public string nonce,phase,childBirthTicks;[DataMember] public int launcherPid;[DataMember] public uint childPid,childExitCode;
+ }
+ public static class OwnedJob {
+  static void Save(string path,Receipt value){using(var file=new FileStream(path,FileMode.CreateNew,FileAccess.Write,FileShare.Read)){new DataContractJsonSerializer(typeof(Receipt)).WriteObject(file,value);file.Flush(true);}}
+  public static void RunSpecification(string path){
+   path=Path.GetFullPath(path);var root=Path.GetDirectoryName(path);Specification spec;
+   using(var file=File.OpenRead(path))spec=(Specification)new DataContractJsonSerializer(typeof(Specification)).ReadObject(file);
+   long birth;Guid nonce;if(spec.schema!=1||!Guid.TryParse(spec.nonce,out nonce)||!long.TryParse(spec.ownerBirthTicks,out birth)||spec.arguments==null||spec.arguments.Length>256)throw new ArgumentException("Invalid owned job specification");
+   Environment.SetEnvironmentVariable("TEMP",root);Environment.SetEnvironmentVariable("TMP",root);
+   Process observed=null;Mutex mutex=null;RegistryRedirect registry=null;bool held=false;
+   try{
+    if(spec.observedPid!=0){long expected;if(!long.TryParse(spec.observedBirthTicks,out expected))throw new ArgumentException("Observed process birth identity is missing");observed=Process.GetProcessById(spec.observedPid);var handle=observed.Handle;if(observed.StartTime.ToUniversalTime().Ticks!=expected||WaitForSingleObject(handle,0)!=258)throw new InvalidOperationException("Observed process identity changed or exited");}
+    if(spec.nativeMutex!=null){if(spec.nativeMutex!=@"Local\insight-cli-procmon-capture")throw new ArgumentException("Invalid native capture mutex");mutex=new Mutex(false,spec.nativeMutex);try{held=mutex.WaitOne(0);}catch(AbandonedMutexException){held=true;}if(!held)throw new InvalidOperationException("Another owned Process Monitor capture is active");foreach(var name in new[]{"Procmon","Procmon64","Procmon64a"}){var foreign=Process.GetProcessesByName(name);try{if(foreign.Length!=0)throw new InvalidOperationException("An existing Process Monitor instance is not owned by this capture");}finally{foreach(var process in foreign)process.Dispose();}}}
+   if(spec.registryShim!=null){if(!string.Equals(Path.GetFileName(spec.executable),"Procmon64.exe",StringComparison.OrdinalIgnoreCase))throw new ArgumentException("Registry isolation is admitted only for the owned ProcMon child");if(!string.Equals(Path.GetFullPath(spec.cwd),root,StringComparison.OrdinalIgnoreCase))throw new ArgumentException("Owned registry loading requires its private run directory");registry=new RegistryRedirect(root,spec.registryShim,spec.registryShimSha256,spec.nonce);}
+   var result=Run(spec.executable,spec.arguments,spec.cwd,spec.ownerPid,birth,spec.timeoutMs,origin=>Save(Path.Combine(root,"job-started.json"),new Receipt{nonce=spec.nonce,launcherPid=origin.LauncherPid,childPid=origin.ChildPid,childBirthTicks=origin.ChildBirthTicks.ToString(),phase="assigned_suspended"}),registry==null?null:new Action<IntPtr,uint>(registry.Prepare),registry==null?null:new Action<IntPtr,uint>(registry.Verify));
+   Save(Path.Combine(root,"job-result.json"),new Receipt{nonce=spec.nonce,launcherPid=Process.GetCurrentProcess().Id,childPid=result.Started.ChildPid,childBirthTicks=result.Started.ChildBirthTicks.ToString(),phase=result.Kind,childExitCode=result.ExitCode});
+   }finally{if(registry!=null)registry.Dispose();if(held)mutex.ReleaseMutex();if(mutex!=null)mutex.Dispose();if(observed!=null)observed.Dispose();}
+  }
+
+  [StructLayout(LayoutKind.Sequential)] struct Limits { public long ProcessTime,JobTime;public uint Flags;public UIntPtr MinWorkingSet,MaxWorkingSet;public uint ActiveProcesses;public UIntPtr Affinity;public uint Priority,Scheduling; }
+  [StructLayout(LayoutKind.Sequential)] struct IO { public ulong ReadOps,WriteOps,OtherOps,ReadBytes,WriteBytes,OtherBytes; }
+  [StructLayout(LayoutKind.Sequential)] struct Extended { public Limits Basic;public IO Io;public UIntPtr ProcessMemory,JobMemory,PeakProcessMemory,PeakJobMemory; }
+  [StructLayout(LayoutKind.Sequential,CharSet=CharSet.Unicode)] struct Startup { public uint Size;public string Reserved,Desktop,Title;public uint X,Y,XSize,YSize,XChars,YChars,Fill,Flags;public ushort Show,ReservedSize;public IntPtr ReservedBytes,Input,Output,Error; }
+  [StructLayout(LayoutKind.Sequential)] struct PI { public IntPtr Process,Thread;public uint Pid,Tid; }
+  [DllImport("kernel32.dll",CharSet=CharSet.Unicode,SetLastError=true)] static extern IntPtr CreateJobObject(IntPtr attributes,string name);
+  [DllImport("kernel32.dll",SetLastError=true)] static extern bool SetInformationJobObject(IntPtr job,int type,ref Extended value,uint size);
+  [DllImport("kernel32.dll",SetLastError=true)] static extern bool AssignProcessToJobObject(IntPtr job,IntPtr process);
+  [DllImport("kernel32.dll",CharSet=CharSet.Unicode,SetLastError=true)] static extern bool CreateProcess(string app,StringBuilder command,IntPtr processAttributes,IntPtr threadAttributes,bool inherit,uint flags,IntPtr environment,string directory,ref Startup startup,out PI process);
+  [DllImport("kernel32.dll",SetLastError=true)] static extern uint ResumeThread(IntPtr thread);
+  [DllImport("kernel32.dll",SetLastError=true)] static extern uint WaitForMultipleObjects(uint count,IntPtr[] handles,bool all,uint timeout);
+  [DllImport("kernel32.dll",SetLastError=true)] static extern uint WaitForSingleObject(IntPtr handle,uint timeout);
+  [DllImport("kernel32.dll",SetLastError=true)] static extern bool TerminateJobObject(IntPtr job,uint code);
+  [DllImport("kernel32.dll",SetLastError=true)] static extern bool TerminateProcess(IntPtr process,uint code);
+  [DllImport("kernel32.dll",SetLastError=true)] static extern bool GetExitCodeProcess(IntPtr process,out uint code);
+  [DllImport("kernel32.dll")] static extern IntPtr GetStdHandle(int id);
+  [DllImport("kernel32.dll")] static extern bool CloseHandle(IntPtr handle);
+  static void Check(bool ok){if(!ok)throw new Win32Exception(Marshal.GetLastWin32Error());}
+  static string Quote(string text){var b=new StringBuilder("\"");int slashes=0;foreach(char c in text){if(c=='\\'){slashes++;continue;}if(c=='\"'){b.Append('\\',slashes*2+1);b.Append(c);}else{b.Append('\\',slashes);b.Append(c);}slashes=0;}b.Append('\\',slashes*2);return b.Append('"').ToString();}
+  public static Result Run(string executable,string[] arguments,string directory,int ownerPid,long ownerBirthTicks,int timeoutMs,Action<Started> started,Action<IntPtr,uint> prepare=null,Action<IntPtr,uint> initialized=null){
+   if(timeoutMs<1000||timeoutMs>600000||!System.IO.Path.IsPathRooted(executable))throw new ArgumentException("Invalid owned job specification");
+   using(var owner=Process.GetProcessById(ownerPid)){
+    if(owner.StartTime.ToUniversalTime().Ticks!=ownerBirthTicks)throw new InvalidOperationException("Owner birth identity changed");
+    var ownerHandle=owner.Handle;if(WaitForSingleObject(ownerHandle,0)!=258)throw new InvalidOperationException("Owner already exited");
+    var job=CreateJobObject(IntPtr.Zero,null);if(job==IntPtr.Zero)throw new Win32Exception(Marshal.GetLastWin32Error());var child=new PI();bool assigned=false;
+    try{
+     var limits=new Extended();limits.Basic.Flags=0x2000;Check(SetInformationJobObject(job,9,ref limits,(uint)Marshal.SizeOf(typeof(Extended))));
+     var startup=new Startup {Size=(uint)Marshal.SizeOf(typeof(Startup)),Flags=0x100,Input=GetStdHandle(-10),Output=GetStdHandle(-11),Error=GetStdHandle(-12)};
+     var command=new StringBuilder(Quote(executable));foreach(var argument in arguments)command.Append(' ').Append(Quote(argument));if(command.Length>=32767)throw new ArgumentException("Windows command line exceeds its bound");
+     Check(CreateProcess(executable,command,IntPtr.Zero,IntPtr.Zero,true,0x08000004,IntPtr.Zero,directory,ref startup,out child));Check(AssignProcessToJobObject(job,child.Process));assigned=true;
+     long childBirth;using(var process=Process.GetProcessById((int)child.Pid))childBirth=process.StartTime.ToUniversalTime().Ticks;
+     var origin=new Started {LauncherPid=Process.GetCurrentProcess().Id,ChildPid=child.Pid,ChildBirthTicks=childBirth};started(origin);if(prepare!=null)prepare(child.Process,child.Pid);
+     if(WaitForSingleObject(ownerHandle,0)!=258){Check(TerminateJobObject(job,130));return new Result {Kind="owner_lost",ExitCode=130,Started=origin};}
+     if(ResumeThread(child.Thread)==0xffffffff)throw new Win32Exception(Marshal.GetLastWin32Error());if(initialized!=null)initialized(child.Process,child.Pid);
+     var outcome=WaitForMultipleObjects(2,new[]{child.Process,ownerHandle},false,(uint)timeoutMs);
+     if(outcome==0){uint code;Check(GetExitCodeProcess(child.Process,out code));return new Result {Kind="completed",ExitCode=code,Started=origin};}
+     if(outcome==1||outcome==258){uint code=outcome==1?130u:124u;Check(TerminateJobObject(job,code));WaitForSingleObject(child.Process,5000);return new Result {Kind=outcome==1?"owner_lost":"timeout",ExitCode=code,Started=origin};}
+     throw new Win32Exception(Marshal.GetLastWin32Error());
+    }finally{if(child.Process!=IntPtr.Zero&&!assigned)TerminateProcess(child.Process,125);CloseHandle(job);if(child.Thread!=IntPtr.Zero)CloseHandle(child.Thread);if(child.Process!=IntPtr.Zero)CloseHandle(child.Process);}
+   }
+  }
+ }
+}

package/runtime/native/windows-job/RegistryRedirect.cs

@@ -0,0 +1,45 @@
+// MIT; inject only the reviewed registry shim into the child handle returned by our own CreateProcess.
+using System;using System.ComponentModel;using System.IO;using System.Runtime.InteropServices;using System.Security.Cryptography;using System.Text;
+namespace Insight.WindowsJob {
+ internal sealed class RegistryRedirect:IDisposable {
+  [StructLayout(LayoutKind.Sequential)] struct Security {public int Size;public IntPtr Descriptor;public int Inherit;}
+  [DllImport("advapi32.dll",CharSet=CharSet.Unicode)] static extern int RegLoadAppKey(string file,out IntPtr key,uint rights,uint options,uint reserved);
+  [DllImport("advapi32.dll",CharSet=CharSet.Unicode)] static extern int RegCreateKeyEx(IntPtr root,string name,int reserved,string type,int options,uint rights,ref Security security,out IntPtr key,out int disposition);
+  [DllImport("advapi32.dll")] static extern int RegCloseKey(IntPtr key);
+  [DllImport("kernel32.dll",CharSet=CharSet.Unicode,SetLastError=true)] static extern IntPtr LoadLibrary(string file);
+  [DllImport("kernel32.dll",CharSet=CharSet.Ansi,SetLastError=true)] static extern IntPtr GetProcAddress(IntPtr module,string name);
+  [DllImport("kernel32.dll",CharSet=CharSet.Unicode,SetLastError=true)] static extern uint GetFileAttributes(string file);
+  [DllImport("kernel32.dll")] static extern bool FreeLibrary(IntPtr module);
+  [UnmanagedFunctionPointer(CallingConvention.Winapi,SetLastError=true)] delegate bool PrepareProcess(IntPtr process,[MarshalAs(UnmanagedType.LPStr)] string name);
+  [DllImport("kernel32.dll")] static extern bool GetExitCodeProcess(IntPtr process,out uint code);
+  IntPtr hive,user,module;FileStream held;PrepareProcess prepare;readonly string shim,ack,nonce;DirectoryAlias alias;
+  static void Check(int code){if(code!=0)throw new Win32Exception(code);}
+  public RegistryRedirect(string root,string source,string expected,string nonce){
+   this.nonce=nonce;shim=Path.Combine(root,"insight-registry-"+nonce+".dll");ack=Path.Combine(root,"registry-isolated.bin");
+   try{
+    if(expected==null||expected.Length!=64)throw new ArgumentException("Registry shim identity is missing");
+    using(var original=new FileStream(source,FileMode.Open,FileAccess.Read,FileShare.Read)){
+     string actual;using(var hash=SHA256.Create())actual=BitConverter.ToString(hash.ComputeHash(original)).Replace("-","").ToLowerInvariant();if(actual!=expected)throw new InvalidOperationException("Registry shim differs from its reviewed build");original.Position=0;
+     using(var copy=new FileStream(shim,FileMode.CreateNew,FileAccess.Write,FileShare.None)){original.CopyTo(copy);copy.Flush(true);}
+    }
+    held=new FileStream(shim,FileMode.Open,FileAccess.Read,FileShare.Read);
+    module=LoadLibrary(shim);if(module==IntPtr.Zero)throw new Win32Exception(Marshal.GetLastWin32Error());var entry=GetProcAddress(module,"InsightPrepareProcess");if(entry==IntPtr.Zero)throw new InvalidOperationException("Owned registry loader entry is unavailable");prepare=Marshal.GetDelegateForFunctionPointer<PrepareProcess>(entry);
+    Check(RegLoadAppKey(Path.Combine(root,"user-settings.hive"),out hive,0xf003f,0,0));
+    var security=new Security{Size=Marshal.SizeOf(typeof(Security)),Inherit=1};int disposition;Check(RegCreateKeyEx(hive,"user",0,null,0,0xf003f,ref security,out user,out disposition));
+    alias=new DirectoryAlias(root,nonce);if(GetFileAttributes(alias.File(Path.GetFileName(shim)))==0xffffffff)throw new Win32Exception(Marshal.GetLastWin32Error(),"Owned registry DLL alias is unavailable");
+    Environment.SetEnvironmentVariable("INSIGHT_PRIVATE_HKCU_HANDLE",user.ToInt64().ToString("X"));Environment.SetEnvironmentVariable("INSIGHT_PRIVATE_HKCU_ACK",ack);Environment.SetEnvironmentVariable("INSIGHT_PRIVATE_HKCU_NONCE",nonce);
+   }catch{Dispose();throw;}
+  }
+  public void Prepare(IntPtr process,uint pid){if(!prepare(process,alias.File(Path.GetFileName(shim))))throw new Win32Exception(Marshal.GetLastWin32Error());}
+  public void Verify(IntPtr process,uint pid){
+   for(int i=0;i<100;i++){
+    byte[] proof=null;try{proof=File.ReadAllBytes(ack);}catch(IOException){}
+    if(proof!=null&&proof.Length==48){if(BitConverter.ToUInt32(proof,0)!=0x49484b31||BitConverter.ToUInt32(proof,4)!=pid||Encoding.ASCII.GetString(proof,12,36)!=nonce)throw new InvalidOperationException("Owned registry initialization receipt is invalid");Check((int)BitConverter.ToUInt32(proof,8));return;}
+    uint code;if(GetExitCodeProcess(process,out code)&&code!=259)throw new InvalidOperationException("Owned tool exited before registry initialization (0x"+code.ToString("x8")+")");
+    System.Threading.Thread.Sleep(50);
+   }
+   throw new InvalidOperationException("Owned registry initialization receipt is missing after its deadline");
+  }
+  public void Dispose(){Environment.SetEnvironmentVariable("INSIGHT_PRIVATE_HKCU_HANDLE",null);Environment.SetEnvironmentVariable("INSIGHT_PRIVATE_HKCU_ACK",null);Environment.SetEnvironmentVariable("INSIGHT_PRIVATE_HKCU_NONCE",null);if(user!=IntPtr.Zero){RegCloseKey(user);user=IntPtr.Zero;}if(hive!=IntPtr.Zero){RegCloseKey(hive);hive=IntPtr.Zero;}if(module!=IntPtr.Zero){FreeLibrary(module);module=IntPtr.Zero;}if(alias!=null){alias.Dispose();alias=null;}if(held!=null){held.Dispose();held=null;}}
+ }
+}

package/runtime/native/windows-job/packages.lock.json

@@ -0,0 +1,21 @@
+{
+  "version": 1,
+  "dependencies": {
+    ".NETStandard,Version=v2.0": {
+      "NETStandard.Library": {
+        "type": "Direct",
+        "requested": "[2.0.3, )",
+        "resolved": "2.0.3",
+        "contentHash": "st47PosZSHrjECdjeIzZQbzivYBJFv6P2nv4cj2ypdI204DO+vZ7l5raGMiX4eXMJ53RfOIg+/s4DHVZ54Nu2A==",
+        "dependencies": {
+          "Microsoft.NETCore.Platforms": "1.1.0"
+        }
+      },
+      "Microsoft.NETCore.Platforms": {
+        "type": "Transitive",
+        "resolved": "1.1.0",
+        "contentHash": "kz0PEW2lhqygehI/d6XsPCQzD7ff7gUJaVGPVETX611eadGsA3A877GdSlU0LRVMCTH/+P3o2iDTak+S08V2+A=="
+      }
+    }
+  }
+}

package/runtime/native/windows-job/provenance.json

@@ -0,0 +1,16 @@
+{
+  "sdk": "10.0.303",
+  "target": "netstandard2.0",
+  "inputs": {
+    "OwnedJob.cs": "396b15ff5ac0931bec5f8a1d4f8f5175f6ffa0cb20a8b775eb07fd4c773a1542",
+    "RegistryRedirect.cs": "b1ae1b2c0ea5190245fe898296526c01eb6e83500f7be89929b221358eff905d",
+    "DirectoryAlias.cs": "3bf0b3ce5117faa3b6b5fb0e8b1de0bc317a1631c0d9b4cc3361e2a490cf85a1",
+    "Insight.WindowsJob.csproj": "90217b0c46f3eaeeecce73e9b8daaf47d14f07fd51f85c94395959f6ec4be114",
+    "NuGet.Config": "17f8588bd0874138a10e92eb9efee6e346a173591124ab57872f019475f8f81a",
+    "packages.lock.json": "00d9e92c7bc1e7939bc82114d870ab6657841901237cab1daa8ed01cac976e5e"
+  },
+  "sha256": "a911a603979efa6b75d3d7e90c8eb5313ef9ad8e94bd948f0a28800ece0b1c45",
+  "size": 17408,
+  "launcherSha256": "d600cdbc701d3ec652d32d4518b5b0737f193770e81fe44106bfbacf73e4f0c9",
+  "reproducibility": "Two independent temporary-directory builds produced identical bytes; private registry prototype remains pending native validation."
+}

package/runtime/native/windows-job/windows-job.ps1

@@ -0,0 +1,8 @@
+param([Parameter(Mandatory=$true)][string]$Specification)
+$ErrorActionPreference='Stop'
+try {
+    # No module autoload, profiles, JSON cmdlets or compiler in this minimal host.
+    [void][Reflection.Assembly]::LoadFrom([IO.Path]::Combine($PSScriptRoot,'Insight.WindowsJob.dll'))
+    [Insight.WindowsJob.OwnedJob]::RunSpecification($Specification)
+    exit 0
+} catch {[Console]::Error.WriteLine('Owned Windows job failed: '+$_.Exception.Message);exit 70}

package/runtime/native/windows-registry.c

@@ -0,0 +1,21 @@
+/* MIT; first-party HKCU redirection, loaded only into a newly created owned suspended tool. */
+#define WIN32_LEAN_AND_MEAN
+#include <windows.h>
+#include "detours.h"
+extern "C" __declspec(dllexport) BOOL WINAPI InsightPrepareProcess(HANDLE process,LPCSTR name){return DetourUpdateProcessWithDll(process,&name,1);}
+static void store(BYTE *at,DWORD value){at[0]=(BYTE)value;at[1]=(BYTE)(value>>8);at[2]=(BYTE)(value>>16);at[3]=(BYTE)(value>>24);}
+extern "C" BOOL WINAPI DllMain(HINSTANCE instance,DWORD reason,LPVOID reserved){
+ (void)reserved;if(reason!=DLL_PROCESS_ATTACH)return TRUE;DisableThreadLibraryCalls(instance);if(DetourIsHelperProcess())return TRUE;DetourRestoreAfterWith();
+ WCHAR handle[17],nonce[37];DWORD n=GetEnvironmentVariableW(L"INSIGHT_PRIVATE_HKCU_HANDLE",handle,17);
+ if(!n)return TRUE;
+ if(n>16||GetEnvironmentVariableW(L"INSIGHT_PRIVATE_HKCU_NONCE",nonce,37)!=36)return FALSE;
+ WCHAR *path=(WCHAR*)HeapAlloc(GetProcessHeap(),0,4096*sizeof(WCHAR));if(!path)return FALSE;
+ DWORD length=GetEnvironmentVariableW(L"INSIGHT_PRIVATE_HKCU_ACK",path,4096);if(!length||length>=4096)return FALSE;
+ ULONG_PTR value=0;for(DWORD i=0;i<n;i++){WCHAR c=handle[i];unsigned digit=c>=L'0'&&c<=L'9'?c-L'0':c>=L'A'&&c<=L'F'?c-L'A'+10:16;if(digit>15)return FALSE;value=(value<<4)|digit;}
+ LSTATUS error=RegOverridePredefKey(HKEY_CURRENT_USER,(HKEY)value);RegCloseKey((HKEY)value);
+ BYTE proof[48];store(proof,0x49484b31);store(proof+4,GetCurrentProcessId());store(proof+8,(DWORD)error);for(DWORD i=0;i<36;i++)proof[12+i]=(BYTE)nonce[i];
+ HANDLE file=CreateFileW(path,GENERIC_WRITE,0,NULL,CREATE_NEW,FILE_ATTRIBUTE_NORMAL,NULL);if(file==INVALID_HANDLE_VALUE)return FALSE;
+ DWORD written=0;BOOL saved=WriteFile(file,proof,sizeof(proof),&written,NULL)&&written==sizeof(proof)&&FlushFileBuffers(file);CloseHandle(file);HeapFree(GetProcessHeap(),0,path);
+ SetEnvironmentVariableW(L"INSIGHT_PRIVATE_HKCU_HANDLE",NULL);SetEnvironmentVariableW(L"INSIGHT_PRIVATE_HKCU_NONCE",NULL);SetEnvironmentVariableW(L"INSIGHT_PRIVATE_HKCU_ACK",NULL);
+ return saved&&error==ERROR_SUCCESS;
+}

package/runtime/native/windows-registry.def

@@ -0,0 +1,3 @@
+EXPORTS
+    DetourFinishHelperProcess @1
+    InsightPrepareProcess @2

package/runtime/native/windows-registry.provenance.json

@@ -0,0 +1,14 @@
+{
+  "reproducible": true,
+  "compiler": "Microsoft (R) C/C++ Optimizing Compiler Version 19.51.36260 for x64",
+  "detoursCommit": "e4bfd6b03e50de46b47abfbd1e46b384f0c5f833",
+  "schema": 1,
+  "flags": "/LD /TP /O2 /MT /DNDEBUG /DYNAMICBASE /NXCOMPAT /OPT:REF /OPT:ICF /Brepro",
+  "definitionSha256": "85aee230d2e3996676fbc52189b4ec4b4831ff783165a4db407877a05b1a531b",
+  "detoursSha256": "d24f5dd1f977c33301ebd9f3be064e938a7908954df15b31235c9ca6691cb356",
+  "sha256": "7b30875c531aff0a02610f3e828a00bd4afb54028a6f98264881fb27602b9939",
+  "size": 126976,
+  "sourceSha256": "6bc68b57b97978a45647b5731ce44a005a177b8c251d7ceb8e3ccfffedc56b75",
+  "definitionCanonicalSha256": "7c9d9858ebbd5bc5cce17ef7da8d5180cb782f8934e056c5b570db79e7ac4d9e",
+  "definitionCheckout": "Native Windows build used CRLF; canonical checked source uses LF with identical exports."
+}

package/runtime/notices/diagnostics-10.0.750501.txt

@@ -0,0 +1,23 @@
+The MIT License (MIT)
+
+Copyright (c) .NET Foundation and Contributors
+
+All rights reserved.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/runtime/tool-catalog.json

@@ -0,0 +1,290 @@
+{
+  "5fc9f1d870b4c791ae688a07ccbae0dcdf677eedeeb6ae732bbc83eac61148af": {
+    "name": "diec-3.21-macos-arm64.tgz",
+    "sha256": "5fc9f1d870b4c791ae688a07ccbae0dcdf677eedeeb6ae732bbc83eac61148af",
+    "size": 14343048,
+    "format": "tgz",
+    "root": "diec-3.21",
+    "license": "MIT engine/components; Qt LGPL-3.0 and full included third-party notices",
+    "url": "https://github.com/iXab3r/insight-cli/releases/download/tool-diec-3.21-r1/diec-3.21-macos-arm64.tgz"
+  },
+  "958c952691d2c3f8ce21f717f4e911c02b5da0e21ead21bd576368c454b79c77": {
+    "name": "dotnet-runtime-10.0.13-linux-x64.tar.gz",
+    "sha256": "958c952691d2c3f8ce21f717f4e911c02b5da0e21ead21bd576368c454b79c77",
+    "size": 36648012,
+    "format": "tgz",
+    "root": ".",
+    "license": "MIT and included LICENSE/ThirdPartyNotices",
+    "url": "https://github.com/iXab3r/insight-cli/releases/download/tool-dotnet-10.0.13-r1/dotnet-runtime-10.0.13-linux-x64.tar.gz"
+  },
+  "fdf7ef21688338ad5d1d99d7eca7f3cf2e159c86e552d3f5acd0553b11c80ca6": {
+    "name": "dotnet-runtime-10.0.13-osx-arm64.tar.gz",
+    "sha256": "fdf7ef21688338ad5d1d99d7eca7f3cf2e159c86e552d3f5acd0553b11c80ca6",
+    "size": 33248881,
+    "format": "tgz",
+    "root": ".",
+    "license": "MIT and included LICENSE/ThirdPartyNotices",
+    "url": "https://github.com/iXab3r/insight-cli/releases/download/tool-dotnet-10.0.13-r1/dotnet-runtime-10.0.13-osx-arm64.tar.gz"
+  },
+  "50fd6ea005731494a6144fd4617746f4155fdc0f3682d0ba7292eac9e9bf46e3": {
+    "name": "dotnet-runtime-10.0.13-osx-x64.tar.gz",
+    "sha256": "50fd6ea005731494a6144fd4617746f4155fdc0f3682d0ba7292eac9e9bf46e3",
+    "size": 35605688,
+    "format": "tgz",
+    "root": ".",
+    "license": "MIT and included LICENSE/ThirdPartyNotices",
+    "url": "https://github.com/iXab3r/insight-cli/releases/download/tool-dotnet-10.0.13-r1/dotnet-runtime-10.0.13-osx-x64.tar.gz"
+  },
+  "8db74a746baa450925d01325a2108ccf6ac39af4018047475292ae155c013d89": {
+    "name": "dotnet-runtime-10.0.13-win-x64.zip",
+    "sha256": "8db74a746baa450925d01325a2108ccf6ac39af4018047475292ae155c013d89",
+    "size": 36970749,
+    "format": "zip",
+    "root": ".",
+    "license": "MIT and included LICENSE/ThirdPartyNotices",
+    "url": "https://github.com/iXab3r/insight-cli/releases/download/tool-dotnet-10.0.13-r1/dotnet-runtime-10.0.13-win-x64.zip"
+  },
+  "ae70c9f37548e1e006467893e21ae41a005fefaf2270e29642b415df053324a7": {
+    "name": "dotnet-dump.10.0.750501.nupkg",
+    "sha256": "ae70c9f37548e1e006467893e21ae41a005fefaf2270e29642b415df053324a7",
+    "size": 10482522,
+    "format": "zip",
+    "root": "tools/net8.0/any",
+    "license": "MIT; full matching LICENSE.TXT companion and embedded THIRD-PARTY-NOTICES.txt retained",
+    "url": "https://github.com/iXab3r/insight-cli/releases/download/tool-dotnet-diagnostics-10.0.750501-r1/dotnet-dump.10.0.750501.nupkg"
+  },
+  "cd35f399fe023f1793b528590a4d723a1f2f1d9b25696386d926a697bd24c0ca": {
+    "name": "dotnet-stack.10.0.750501.nupkg",
+    "sha256": "cd35f399fe023f1793b528590a4d723a1f2f1d9b25696386d926a697bd24c0ca",
+    "size": 6025361,
+    "format": "zip",
+    "root": "tools/net8.0/any",
+    "license": "MIT; full matching LICENSE.TXT companion and embedded THIRD-PARTY-NOTICES.txt retained",
+    "url": "https://github.com/iXab3r/insight-cli/releases/download/tool-dotnet-diagnostics-10.0.750501-r1/dotnet-stack.10.0.750501.nupkg"
+  },
+  "ef17f25724a55f9685bfaf8506a778ea87c2b62783eca2ca73263226128b0d4e": {
+    "name": "dotnet-trace.10.0.750501.nupkg",
+    "sha256": "ef17f25724a55f9685bfaf8506a778ea87c2b62783eca2ca73263226128b0d4e",
+    "size": 12273543,
+    "format": "zip",
+    "root": "tools/net8.0/any",
+    "license": "MIT; full matching LICENSE.TXT companion and embedded THIRD-PARTY-NOTICES.txt retained",
+    "url": "https://github.com/iXab3r/insight-cli/releases/download/tool-dotnet-diagnostics-10.0.750501-r1/dotnet-trace.10.0.750501.nupkg"
+  },
+  "26e9e7b9a8d9c68c87cb3da879c328edd096d587720039095de6a522d2c8765e": {
+    "name": "frida-node-17.24.0-macos-arm64.tgz",
+    "sha256": "26e9e7b9a8d9c68c87cb3da879c328edd096d587720039095de6a522d2c8765e",
+    "size": 46957847,
+    "format": "tgz",
+    "root": "frida-node-17.24.0",
+    "license": "Frida LGPL-2.0 WITH WxWindows-exception-3.1; included full LGPL/third-party notices apply to dependencies",
+    "url": "https://github.com/iXab3r/insight-cli/releases/download/tool-frida-node-17.24.0-r1/frida-node-17.24.0-macos-arm64.tgz"
+  },
+  "40f68357d6b62a08429c36228907c995e3449283b6d2e08ba5a4e30b53a09725": {
+    "name": "ghidra-12.1.2-arm64_sonoma.tar.gz",
+    "sha256": "40f68357d6b62a08429c36228907c995e3449283b6d2e08ba5a4e30b53a09725",
+    "size": 470315169,
+    "format": "tgz",
+    "root": "ghidra/12.1.2/libexec",
+    "license": "Apache-2.0 and included third-party licenses",
+    "url": "https://github.com/iXab3r/insight-cli/releases/download/tool-ghidra-12.1.2-r1/ghidra-12.1.2-arm64_sonoma.tar.gz"
+  },
+  "90aa942184fca2337ad0a123f818f37372ea642e8e69e969d45cc144a6f26fdf": {
+    "name": "ghidra-12.1.2-arm64_sequoia.tar.gz",
+    "sha256": "90aa942184fca2337ad0a123f818f37372ea642e8e69e969d45cc144a6f26fdf",
+    "size": 470268922,
+    "format": "tgz",
+    "root": "ghidra/12.1.2/libexec",
+    "license": "Apache-2.0 and included third-party licenses",
+    "url": "https://github.com/iXab3r/insight-cli/releases/download/tool-ghidra-12.1.2-r1/ghidra-12.1.2-arm64_sequoia.tar.gz"
+  },
+  "079007d8a3a477c8d5901e6596947612d86c8641956424a2bcb71ecd798bedcc": {
+    "name": "ghidra-12.1.2-arm64_tahoe.tar.gz",
+    "sha256": "079007d8a3a477c8d5901e6596947612d86c8641956424a2bcb71ecd798bedcc",
+    "size": 470255318,
+    "format": "tgz",
+    "root": "ghidra/12.1.2/libexec",
+    "license": "Apache-2.0 and included third-party licenses",
+    "url": "https://github.com/iXab3r/insight-cli/releases/download/tool-ghidra-12.1.2-r1/ghidra-12.1.2-arm64_tahoe.tar.gz"
+  },
+  "e30f8c84b64331f87f6ef1890cbdded6672bb7fcc8b674794ac93e4b3e62ad2b": {
+    "name": "ghidra-12.1.2-sonoma.tar.gz",
+    "sha256": "e30f8c84b64331f87f6ef1890cbdded6672bb7fcc8b674794ac93e4b3e62ad2b",
+    "size": 470418808,
+    "format": "tgz",
+    "root": "ghidra/12.1.2/libexec",
+    "license": "Apache-2.0 and included third-party licenses",
+    "url": "https://github.com/iXab3r/insight-cli/releases/download/tool-ghidra-12.1.2-r1/ghidra-12.1.2-sonoma.tar.gz"
+  },
+  "b62e81a0390618466c019c60d8c2f796ced2509c4c1aea4a37644a77272cf99d": {
+    "name": "ghidra-12.1.2.zip",
+    "sha256": "b62e81a0390618466c019c60d8c2f796ced2509c4c1aea4a37644a77272cf99d",
+    "size": 572803866,
+    "format": "zip",
+    "root": "ghidra_12.1.2_PUBLIC",
+    "license": "Apache-2.0 and included third-party licenses",
+    "url": "https://github.com/iXab3r/insight-cli/releases/download/tool-ghidra-12.1.2-r1/ghidra-12.1.2.zip"
+  },
+  "74c07facaf1850c78a779fc509031f756e1c0de24b1a536f3363d7ef81ce001f": {
+    "name": "ilspycmd.11.1.0.9782.zip",
+    "sha256": "74c07facaf1850c78a779fc509031f756e1c0de24b1a536f3363d7ef81ce001f",
+    "size": 4632113,
+    "format": "zip",
+    "root": "tools/net10.0/any",
+    "license": "MIT and included dependency notices",
+    "url": "https://github.com/iXab3r/insight-cli/releases/download/tool-ilspy-11.1.0.9782-r1/ilspycmd.11.1.0.9782.zip"
+  },
+  "3df8fefb9f15fd80d250dc78517a659f4ec67159f73fdc5df71b7100709213d5": {
+    "name": "lldb-23.1.3-macos-arm64.tgz",
+    "sha256": "3df8fefb9f15fd80d250dc78517a659f4ec67159f73fdc5df71b7100709213d5",
+    "size": 56154665,
+    "format": "tgz",
+    "root": "lldb-23.1.3",
+    "license": "Apache-2.0 WITH LLVM-exception and included LLVM notices",
+    "url": "https://github.com/iXab3r/insight-cli/releases/download/tool-lldb-23.1.3-r1/lldb-23.1.3-macos-arm64.tgz"
+  },
+  "0f9e88490490fb2f487ad6f02d7aea774629a2839a10497fdcbaad9c6481c839": {
+    "name": "lldb-python-23.1.3-macos-arm64.tgz",
+    "sha256": "0f9e88490490fb2f487ad6f02d7aea774629a2839a10497fdcbaad9c6481c839",
+    "size": 105314583,
+    "format": "tgz",
+    "root": "lldb-python-23.1.3",
+    "license": "Apache-2.0 WITH LLVM-exception; Python-2.0, BSD, MIT and retained third-party notices",
+    "url": "https://github.com/iXab3r/insight-cli/releases/download/tool-lldb-python-23.1.3-r2/lldb-python-23.1.3-macos-arm64.tgz"
+  },
+  "2599cb40282085a61a3d8b50003d75d556010d764c05a9bf30e45a7c7b5b7861": {
+    "name": "llvm-utilities-23.1.3-macos-arm64.tgz",
+    "sha256": "2599cb40282085a61a3d8b50003d75d556010d764c05a9bf30e45a7c7b5b7861",
+    "size": 23318992,
+    "format": "tgz",
+    "root": "llvm-utilities-23.1.3",
+    "license": "Apache-2.0 WITH LLVM-exception and included LLVM notices",
+    "url": "https://github.com/iXab3r/insight-cli/releases/download/tool-llvm-utilities-23.1.3-r1/llvm-utilities-23.1.3-macos-arm64.tgz"
+  },
+  "4bed6d0d2a0bcdc4afeb7408881c9b30e5f81b7c232c2ff9c987babcbed90125": {
+    "name": "mitmproxy-12.2.3-macos-arm64.tgz",
+    "sha256": "4bed6d0d2a0bcdc4afeb7408881c9b30e5f81b7c232c2ff9c987babcbed90125",
+    "size": 54210416,
+    "format": "tgz",
+    "root": ".",
+    "license": "MIT application; PSF Python; LGPL urwid; PyInstaller GPL with bootloader exception; full component notices retained",
+    "url": "https://github.com/iXab3r/insight-cli/releases/download/tool-mitmproxy-12.2.3-r2/mitmproxy-12.2.3-macos-arm64.tgz"
+  },
+  "0a09ee3b82569e8985aff8186e4792618b8e5d0c766098db093d09a87d4b013a": {
+    "name": "mitmproxy-12.2.3-macos-arm64.tar.gz",
+    "sha256": "0a09ee3b82569e8985aff8186e4792618b8e5d0c766098db093d09a87d4b013a",
+    "size": 54227612,
+    "format": "tgz",
+    "root": ".",
+    "license": "MIT application; PSF Python; LGPL urwid; PyInstaller GPL with bootloader exception; full component notices retained",
+    "url": "https://github.com/iXab3r/insight-cli/releases/download/tool-mitmproxy-12.2.3-r1/mitmproxy-12.2.3-macos-arm64.tar.gz"
+  },
+  "7bb52641f2e0dc9b8f5b180be4b0ab46b6d3127361a4e817938175603850c714": {
+    "name": "7zip-26.04-macos-universal.tgz",
+    "sha256": "7bb52641f2e0dc9b8f5b180be4b0ab46b6d3127361a4e817938175603850c714",
+    "size": 2657149,
+    "format": "tgz",
+    "root": ".",
+    "license": "LGPL-2.1-or-later, BSD-3-Clause and unRAR restriction; included License.txt and manual",
+    "url": "https://github.com/iXab3r/insight-cli/releases/download/tool-sevenzip-26.04-r1/7zip-26.04-macos-universal.tgz"
+  },
+  "3f01b360952f9c81dee07b640916115f937685df6d3004f5a3227cb0582d8ca3": {
+    "name": "strace-7.2-linux-x64.tgz",
+    "sha256": "3f01b360952f9c81dee07b640916115f937685df6d3004f5a3227cb0582d8ca3",
+    "size": 612329,
+    "format": "tgz",
+    "root": "strace-7.2",
+    "license": "LGPL-2.1-or-later (strace), MIT (first-party launcher), retained source/UAPI notices",
+    "url": "https://github.com/iXab3r/insight-cli/releases/download/tool-strace-7.2-r1/strace-7.2-linux-x64.tgz"
+  },
+  "6ebcf221c9b41507b14c098e93c6ead6440b8d9bd154f8ec666c4c73abbdb201": {
+    "name": "temurin-21.0.11+10-darwin-arm64.tar.gz",
+    "sha256": "6ebcf221c9b41507b14c098e93c6ead6440b8d9bd154f8ec666c4c73abbdb201",
+    "size": 200030394,
+    "format": "tgz",
+    "root": "jdk-21.0.11+10.jdk/Contents/Home",
+    "license": "GPL-2.0 WITH Classpath-exception-2.0; included legal notices",
+    "url": "https://github.com/iXab3r/insight-cli/releases/download/tool-temurin-21.0.11-10-r1/temurin-21.0.11+10-darwin-arm64.tar.gz"
+  },
+  "34180eb03e6d207c388cce3da668f6cc7cd7508c185c24782fadac2c9c0e66f9": {
+    "name": "temurin-21.0.11+10-darwin-x64.tar.gz",
+    "sha256": "34180eb03e6d207c388cce3da668f6cc7cd7508c185c24782fadac2c9c0e66f9",
+    "size": 194283642,
+    "format": "tgz",
+    "root": "jdk-21.0.11+10.jdk/Contents/Home",
+    "license": "GPL-2.0 WITH Classpath-exception-2.0; included legal notices",
+    "url": "https://github.com/iXab3r/insight-cli/releases/download/tool-temurin-21.0.11-10-r1/temurin-21.0.11+10-darwin-x64.tar.gz"
+  },
+  "4b2220e232a97997b436ca6ab15cbf70171ecff52958a46159dfa5a8c44ca4de": {
+    "name": "temurin-21.0.11+10-linux-x64.tar.gz",
+    "sha256": "4b2220e232a97997b436ca6ab15cbf70171ecff52958a46159dfa5a8c44ca4de",
+    "size": 207513939,
+    "format": "tgz",
+    "root": "jdk-21.0.11+10",
+    "license": "GPL-2.0 WITH Classpath-exception-2.0; included legal notices",
+    "url": "https://github.com/iXab3r/insight-cli/releases/download/tool-temurin-21.0.11-10-r1/temurin-21.0.11+10-linux-x64.tar.gz"
+  },
+  "d3625e7cadf23787ea540229544b6e2ab494b3b54da1801879e583e1dfee0a64": {
+    "name": "temurin-21.0.11+10-win32-x64.zip",
+    "sha256": "d3625e7cadf23787ea540229544b6e2ab494b3b54da1801879e583e1dfee0a64",
+    "size": 205073954,
+    "format": "zip",
+    "root": "jdk-21.0.11+10",
+    "license": "GPL-2.0 WITH Classpath-exception-2.0; included legal notices",
+    "url": "https://github.com/iXab3r/insight-cli/releases/download/tool-temurin-21.0.11-10-r1/temurin-21.0.11+10-win32-x64.zip"
+  },
+  "90a4f106033c74eef38f52985fc168c99a293ae35c9d3d7d1b157558a94d5261": {
+    "name": "tshark-4.6.9-macos-console.tgz",
+    "sha256": "90a4f106033c74eef38f52985fc168c99a293ae35c9d3d7d1b157558a94d5261",
+    "size": 71703877,
+    "format": "tgz",
+    "root": "tshark-4.6.9",
+    "license": "GPL-2.0-or-later Wireshark; LGPL-2.1+/LGPL-3+/GPL-2+ libraries and permissive notices retained",
+    "url": "https://github.com/iXab3r/insight-cli/releases/download/tool-tshark-4.6.9-r1/tshark-4.6.9-macos-console.tgz"
+  },
+  "477754bf299c9e5b311c5666f7a4a48dfdb21265eaa8f0cca70ef9d9552e3a10": {
+    "name": "ProcessMonitor-4.12.zip",
+    "url": "https://download.sysinternals.com/files/ProcessMonitor.zip",
+    "sha256": "477754bf299c9e5b311c5666f7a4a48dfdb21265eaa8f0cca70ef9d9552e3a10",
+    "size": 3202206,
+    "format": "zip",
+    "root": ".",
+    "license": "Microsoft Sysinternals license terms; no redistribution by insight-cli",
+    "delivery": {
+      "kind": "vendor-direct",
+      "publisher": "Microsoft",
+      "termsUrl": "https://learn.microsoft.com/en-us/sysinternals/license-terms",
+      "reason": "Redistribution is prohibited. Explicit vendor acquisition with a pinned SHA256 and local cache was selected by the owner."
+    }
+  },
+  "4662ae17bc0dc77db987b89cccea32c30058baa06268f861d09e0ab4e4f45c20": {
+    "name": "WinDbg-1.2610.1001.0.msixbundle",
+    "url": "https://windbg.download.prss.microsoft.com/dbazure/prod/1-2610-1001-0/windbg.msixbundle",
+    "sha256": "4662ae17bc0dc77db987b89cccea32c30058baa06268f861d09e0ab4e4f45c20",
+    "size": 1203512387,
+    "format": "zip",
+    "root": ".",
+    "license": "Microsoft WinDbg license terms embedded in the inspected bundle; no redistribution by insight-cli",
+    "delivery": {
+      "kind": "vendor-direct",
+      "publisher": "Microsoft",
+      "termsUrl": "https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/",
+      "reason": "The inspected bundled EULA prohibits redistribution. Use the exact vendor-version URL, pinned SHA256 and local cache."
+    }
+  },
+  "8ed48f165dc355e869f3a0037ad4f9216147f995a5ae0258b296eeef1f73aab0": {
+    "name": "dnSpyEx-6.6.0-net-win64.zip",
+    "url": "https://github.com/dnSpyEx/dnSpy/releases/download/v6.6.0/dnSpy-net-win64.zip",
+    "sha256": "8ed48f165dc355e869f3a0037ad4f9216147f995a5ae0258b296eeef1f73aab0",
+    "size": 99558585,
+    "format": "zip",
+    "root": ".",
+    "license": "GPL-3.0-or-later application plus retained component notices; six VS 2017 NuGet runtime DLLs have Microsoft terms forbidding our redistribution",
+    "delivery": {
+      "kind": "vendor-direct",
+      "publisher": "dnSpyEx",
+      "termsUrl": "https://visualstudio.microsoft.com/license-terms/mlt552233/",
+      "reason": "The original pinned dnSpyEx bundle contains Microsoft.VisualStudio.CoreUtility, Language.Intellisense and Text.Data/Logic/UI/UI.Wpf 15.5.27130 with the Microsoft VS 2017 tools/add-ons terms (NuGet licenseUrl aka.ms/pexunj), which prohibit sharing/publishing. Acquire the unmodified upstream bundle explicitly; do not mirror it or those DLLs."
+    }
+  }
+}