@eyeauras/insight-cli 0.2.0 → 0.2.2

package/skill-bundle/insight-ghidra/references/recovery.md

@@ -0,0 +1,53 @@
+# Continue saved work
+
+Retain the session/target returned by initial open. Continue the tuple through
+`insight-cli ghidra open --session <id> --target <id> --json`. Saved private snapshots and
+pending scalar comparisons persist independently of a backend process. Reopening preserves
+private work; it does not silently receive a newer shared version.
+
+First-import recovery uses the same scoped `ghidra open` or the original request ID/input.
+Import/analysis writes a private snapshot and completion receipt before any initial publication.
+If its worker is still running, continuation reports busy; wait and continue the same scope.
+If that worker stopped before completing its receipt, continuation can repeat private analysis
+from the immutable input while retaining previous attempts. A completed snapshot is reused.
+Initial publication first creates a uniquely named staging object. A separate read-only process
+verifies its complete saved DB buffers before a conditional server move to the absent canonical
+path. It never checks in a new version of an existing canonical item. Lost promotion replies
+are reconciled against the retained identity, one-version history and complete saved buffers.
+Interrupted staging objects remain retained and can be replaced by another private stage;
+they are not adopted as the canonical model. Foreign or mismatched canonical state stays blocked.
+An older direct create that is provably owned and left only an incomplete `<Recovered>` entry
+can be moved aside without deletion; its bytes and original receipt remain preserved.
+
+Legacy first-import failures are also recoverable in the original profile. Continuation first
+establishes that the old owned bootstrap worker has ended, then uses an authoritative repository
+probe. An absent canonical item permits private preparation; an existing first version requires
+independent readback. The old project, intent and original session/target remain preserved.
+
+If a response was lost, inspect `sessions status <session> --target <target>`. Never infer
+`applied` from a connection failure. A changing command's optional request ID binds one effective
+intent inside the profile. Repeating the same ID/input retrieves its recorded outcome or
+unresolved state; changing input under that ID fails. Without an ID, calls are new intentions.
+
+An unknown or partial effect retains its request intent, snapshots and native stage. Open the
+same tuple to reconcile supported outcomes. A committed merge is verified against its recorded
+server version and complete saved buffers through independent read authority; it is never
+checked in again merely because its response was lost. Until verification succeeds, publication
+for this shared target is blocked across sessions. Saved private work remains retained.
+
+Scalar reconciliation observes and saves an already present effect; it does not execute the
+setter again. Supported structural/function edits retain a candidate snapshot after an incomplete
+response; continuation can verify every requested effect in that immutable snapshot and adopt it
+without replay. If the complete result cannot be established, the candidate and previous saved
+private view remain retained. An unproved program/script/external outcome remains unresolved. Preserve the profile
+storage and credential store. Do not delete another session's project, stop a process by guessed
+PID/port, or blindly repeat a script/external action to turn uncertainty into success.
+
+The older prototype's `workers`, `findings`, `integrate` and batch `recover` commands are not the
+public facade API. Its coordinator journals remain separate and are never silently migrated.
+
+A lost UI navigation response can be verified from the live authenticated cursor without another
+goto. If its original owned GUI process has exited, continuation reports the uncertain UI action
+as disconnected and retains saved program work. It does not recreate the old cursor or re-enable
+a previous prompt policy. Other unproved live UI effects remain retained until their outcome is
+established or the original process is known to have ended.

package/skill-bundle/insight-ghidra/references/research.md

@@ -0,0 +1,101 @@
+# Research with a private context
+
+See [query semantics and work limits](query-semantics.md) for completion/truncation, actual type
+resolution, qualified heuristics, supported emulation ABIs and memory/signature input variants.
+
+`ghidra save-all --session <id>` saves every Ghidra context in that session and reports a
+separate outcome for each input. It does not publish. A partial result preserves completed saves;
+repeating the same request ID retrieves those outcomes without another pass.
+
+`ghidra changes discard --session <id> --target <id>` explicitly removes that context's pending
+program edits, retains its former private snapshot and restores its own opening base. It requires
+Destructive permission. Other sessions and the shared revision remain unchanged; use explicit
+refresh to receive a newer shared base afterward. Close a live debugger before discarding static
+edits. The saved trace remains separate from the program's opening snapshot.
+
+Open input with `insight-cli ghidra open ./client.exe --session new --json`. Store the returned
+`session` and `target` as the explicit scope for every later research call. Names are display
+labels; equal filenames or addresses in different inputs do not select the same object.
+
+Use `ghidra strings search --contains config.json`, then `ghidra xrefs to --address <string>`.
+Reference results include a containing function address when available. Pass that address to
+`ghidra functions get` or `ghidra functions decompile`. Add the same session/target selectors and
+`--json` to each command; consult generated help for paging and exact flags.
+
+An exported object can also have an external-entry metadata reference. That item has
+`from: null`, `kind: "EXTERNAL"` and `source: "entry-point"`; it counts in the returned
+page but has no source address to navigate. Ordinary references retain their hexadecimal
+`from` address and containing function when available.
+
+Use `ghidra functions rename` and `ghidra comments set` for private edits. `--clear` (or empty
+text) represents a null/absent comment. Successful edits are checked by readback and saved before
+`applied`. A later read sees the local result; another session remains independent. These edits
+do not publish themselves. Use `ghidra merge` to publish the selected context explicitly.
+
+Another session retains its view until `ghidra refresh`. Refresh receives safe shared changes and
+preserves local work. An overlapping field retains original/local/shared values; merge publishes
+nothing while any conflict remains. Resolve that field with its ordinary setter,
+`--resolve-conflict --expect-shared <observed value>` (or `--expect-shared-null` for an absent
+comment). A later shared change invalidates the decision and preserves your work.
+
+Types, signatures and memory edits are saved as complete private program state. They publish
+when the shared base is unchanged. After divergence, unproved structural categories remain a
+conflict: retain the old session, open a new session on the current target, and transfer the desired
+work through ordinary operations. A script is not replayed as a merge algorithm.
+
+The editing groups include types/categories/layouts, labels/references, properties/bookmarks,
+memory flags, functions/variables/tags and batch comments/documentation. Factory's `Destructive`
+gate covers deletion and replacement operations separately from ordinary Update. These broader
+edits currently use complete saved-state publication; their grouping does not grant scalar merge
+semantics. Boolean fields use explicit values; the no-return setter calls its flag `--non-returning`
+to keep it distinct from CLI negation syntax.
+
+`ghidra scripts list` returns stable `installation:` and `context:` script IDs. Pass an exact ID to
+`ghidra scripts run --script-name <id>`, or source to `ghidra scripts run-inline --code <source>`.
+Script arguments follow the pinned whitespace-splitting convention. Execution output is returned
+with the saved private state. Script file/network/process effects are immediate and are not undone
+by program rollback or replayed by merge. An uncertain script remains unresolved even when some
+program changes can be observed.
+
+Additional read groups expose analysis, listings, types, documentation, memory, symbols and
+emulation through typed flags. `functions inspect`, `comments inspect`, `strings list` and
+`strings search-regex` cover broader selection than the convenient walkthrough commands.
+Boolean options take explicit `true`/`false`; complex inputs take bounded JSON. Result variants
+are under `value` with the same session/target identifiers. Generated help lists domain arguments;
+the caller supplies no program/instance routing. For P-code dataflow choose an actual operation
+address from `analysis get-function-pcode`; a function prologue may have no high P-code operation.
+
+For comparisons, keep `--session`/`--target` as the first side and provide `--other-target`.
+`--other-session` defaults to the first session; specify it to compare another agent's private
+context. `documentation compare`, `functions diff` and the fuzzy matching commands use these
+selectors. Fuzzy matching excludes candidates shorter than eight instructions. Results return
+both logical scopes and preserve the selected private views.
+
+`documentation transfer` instead selects the private receiver with `--session`/`--target` and the
+source with `--source-target` and optional `--source-session`. It copies documentation at matching
+addresses; it does not publish. Use `--dry-run` to preview counts. The operation requires
+Destructive because transferred definitions/annotations can replace existing receiver data.
+After an applied result, publish through ordinary `ghidra merge`. Retried request IDs retrieve
+their recorded outcome; recovery retains the source revision actually used by that request.
+
+Opening a second input in the same session preserves the first context. Different processes using
+the same session/target share one ordered context. Independent agents choose separate sessions.
+Calls return explicit scope so parallel outputs can be associated with the intended input.
+`sessions status <session> --limit <n> --offset <n>` pages saved contexts; `--target` selects one.
+Its `externalRequests` reports uncertain archive/session-save outcomes without conflating them
+with unpublished program edits. A truncated result indicates that another page may exist.
+
+`ghidra status` verifies the selected tool and reports saved pending work. `ghidra save` retains
+private changes without publishing. `ghidra close` saves and releases the owned process; continue
+with the same open selectors to retain local work. Save/close accept the optional request ID.
+
+The `ghidra ui` commands use the same explicit scope. `cursor --type all` reads address, function,
+selection and focused program; headless facets return null with an explicit reason. `tools` starts
+the owned GUI when needed and lists its tools using logical program scope. `goto --address <at>`
+navigates the owned browser and verifies the cursor. `prompt-policy --action enable --seconds <n>`
+temporarily handles the backend's known prompts in that owned GUI for 1–300 seconds; status and
+disable inspect or end the policy. Changing UI commands accept request IDs. These actions do not
+publish program work. Switching modes retains private edits and other sessions keep their views.
+
+Selected native SDK commands and their effect/budget contracts are described in
+[native workflows](native-workflows.md).

package/skill-bundle/insight-ghidra/references/setup.md

@@ -0,0 +1,50 @@
+# Setup
+
+Use Node 24+ and `ghidra install` to deliver Ghidra 12.1.2, JDK 21, native components and
+server support. See [managed runtime](managed-runtime.md) for download/install/offline archives,
+external executable paths, status/doctor and safe removal. Existing Factory profile `java` and
+`ghidraHome` paths remain supported when no managed/external selection exists.
+The package contains the verified GhidraMCP 7.0.0 bridge, its Apache-2.0 license/notice and
+artifact provenance. Its pinned functionality catalog is from source
+`57e37a8bf388b1279cff46378f85be1554548f61`, with SHA256
+`7084e2fda16dc779dd05398e48821ff3f9ace4d32757ea143b257b39689e5fbd`.
+`mcpJar` optionally selects another copy of those exact verified bytes. Runtime startup needs no
+bridge/Factory source checkout or Python MCP bridge. Packaged native helper sources compile
+against the installed Ghidra/JDK.
+
+Omitting `server` enables owned local startup. The facade creates profile storage, a private
+repository and distinct read-only/publisher accounts with random credentials in Factory's secret
+store. It manages isolated headless contexts and introduces GUI mode on demand.
+
+For an external server profile, configure `server` (`ghidra://host:port`), `repository`,
+`readerUser` and `publisherUser`. They are distinct accounts with actual read-only and write
+permissions respectively. Store each password using `auth login --role reader|publisher
+--password-stdin`. Passwords are stdin/secret-store values, never profile JSON or argv values.
+Connecting does not transfer ownership of that external server or allow the facade to stop it.
+
+Factory's Update permission is initially disabled. Enable it through `permissions grant Update`
+in the selected profile before creating contexts or editing. Research scope is explicit; local
+skill discovery and help require no authentication or native process startup.
+Deletion and replacement commands also require `permissions grant Destructive`.
+
+All target bytes, snapshots, journals, projects and process receipts derive from the selected
+profile's AppData. Stop the owner through `ipc-server stop` before changing its code/runtime
+configuration. Restoring a saved context preserves its private view. Server settings and initial
+loader settings remain bound to the target/workspace, so changing those cannot silently replace
+retained work. This revision conservatively protects retained profile research state from deletion.
+Runtime identity covers installed Ghidra code, language/compiler data, native modules and Python
+inputs together with JDK tools, modules and configuration. Generated Python caches are isolated.
+Changing those runtime inputs requires stopping the old owner before continuing with the new build.
+
+Native acceptance separates macOS GUI/LLDB workflows from selected headless Windows/Linux
+SDK, Version Tracking and FID/BSim workflows. Native Windows/Linux debugger/GUI acceptance
+remains deferred. The ordinary CI lane stays offline; disposable native CI is explicit.
+
+On macOS 15+ ARM64, `ghidra install` delivers an owned LLDB/Python debugger backend;
+OS debugger authorization remains required. Other host profiles need their supported debugger. Its
+Ghidra Python dependencies are prepared from the installed SDK wheels into owned GUI storage.
+`debuggerPython` optionally configures a Python-backed offer; `windbgDir` configures the Windows
+debugger runtime directory when relevant. These are runtime profile settings, not research scope.
+
+Archive exchange is opt-in through `archiveUrl`; its optional token uses Factory secrets.
+See [archive](archive.md) for the service contract and submission recovery behavior.

package/skill-bundle/insight-ilspy/SKILL.md

@@ -0,0 +1,45 @@
+---
+name: insight-ilspy
+description: Recover C#, inspect IL/types/metadata, extract resources or export projects from managed .NET assemblies through insight-cli ILSpy. Choose native analysis for NativeAOT or ordinary PE machine code.
+---
+
+# Insight ILSpy 0.2.2
+
+If local help/status reports AppData or IPC access denied, retry that **read-only probe**
+with the agent host's normal permission escalation, then use that route for later authorized
+CLI calls too. An explicit **no command was sent** denial is known undispatched and can be
+retried through that route. Keep HOME, profile and owner state; see
+[host execution permissions](references/agent-execution.md). A lost mutation reply needs
+request/status recovery, never blind retry.
+
+Use the project's preferred tool and evidence conventions. Use ILSpy for static managed
+assemblies with CLR metadata. It does not execute the assembly, recover C# from NativeAOT,
+or establish runtime behavior from pseudocode alone.
+
+1. `insight-cli ilspy status --json` checks the selected profile. If needed,
+   `insight-cli ilspy install` prepares the pinned ILSpy and private .NET runtime.
+   No machine-wide SDK is required. Use generated install help for local archives,
+   offline cache or an external executable; see [workflows](references/ilspy.md).
+2. Start with `ilspy query <input> --json` and `--view types`, then decompile one relevant type/member,
+   inspect its IL or metadata, or enumerate resources. Use returned target identity
+   across calls/tools. `--target` reuses immutable bytes without opening Ghidra.
+3. Text responses default to a 16000-character window. Page with `--limit-chars` and
+   `--offset-chars`; combine only pages with the same `textSha256`. The hash covers observed
+   native text, which may itself be incomplete. Save full bounded text with `--output`,
+   or extract a selected resource into new ordinary output paths.
+   Recover a full project only when the question calls for it. Distinguish recovered
+   code/names from source truth. Record commands/input identity alongside findings
+   according to project rules.
+4. `tools processes --tool ilspy --all` shows executions and retained diagnostics.
+   Inspect partial exports after failure; choose a new output path for an intentional
+   retry. Close only owned executions; uninstall preserves external files and research.
+
+Execution and preparation need Factory Update permission. `ilspy --help` supplies exact
+commands/options; the [workflow reference](references/ilspy.md) covers inputs, outputs,
+resource/project export and continuation. Save a completed project file/folder through
+`insight-cli artifacts save` when a checkpoint is useful; it is independent of Ghidra merge.
+
+Hash extracted resource bytes themselves; the resource-list text has a different digest
+and is not the extracted file. For a requested checkpoint, finish the notes/recovered files,
+save their chosen containing folder, and read back the returned saved path. Include that
+exact path in the final handoff; do not substitute the ordinary export path or an inferred UUID.

package/skill-bundle/insight-ilspy/references/agent-execution.md

@@ -0,0 +1,36 @@
+# Agent host execution permissions
+
+Keep the user/project host policy and the selected profile. A sandbox can deny writes
+to runtime AppData or access to the local IPC endpoint, including during local help.
+This is a host execution boundary, not evidence that the tool or its inputs are absent.
+
+First retry only `insight-cli --help`, `tools list`, `skill`, or the selected application's
+read-only `status` using the host's normal permission escalation. In Codex, use the
+execution tool's `sandbox_permissions: "require_escalated"` with a scoped explanation
+that the installed CLI needs its existing profile storage/local IPC. Automatic approval
+review or the user decides that request; do not disable the sandbox or approval policy.
+
+Do not work around this by changing HOME/AppData/profile paths, creating another host,
+deleting owner/endpoint files, killing unrelated processes or claiming a missing runtime.
+After the read-only probe succeeds, use the approved execution route for the intended
+public CLI commands. An access refusal explicitly stating **no command was sent** is
+known not dispatched; it is safe to submit that authorized command through the approved
+route. This includes a mutation refused before dispatch. Do not mistake that definite
+pre-dispatch refusal for an unknown execution outcome. Downloads still require their explicit
+network access.
+
+A lost mutation response is different from a denied startup probe: inspect retained
+request/status/recovery evidence and use its request ID when supported. Never blindly
+repeat a publication, script or program run whose outcome is unknown. External-tool
+fallback is allowed by project rules, but record that the intended facade was not used
+and do not invent a successful checkpoint or native result.
+
+## Wait for the original execution
+
+A tool operation may outlast the host execution tool's initial wait. A returned running
+session/cell ID means that command is still in progress, not that the CLI returned no data.
+Use the host's session poll/wait facility until terminal exit and consume stdout/stderr
+before issuing a dependent command. In Codex, an `exec_command` session is continued with
+`write_stdin`; a yielded execution cell uses that host's cell wait. Do not launch a second
+open/install or repeat a CPU action just because the first chunk was empty. If the execution
+really loses its terminal result, use the CLI's request/status recovery as described above.

package/skill-bundle/insight-ilspy/references/ilspy.md

@@ -0,0 +1,33 @@
+# Static .NET research
+
+Use the project's preferred tools and evidence conventions. When ILSpy is appropriate,
+`insight-cli ilspy install` prepares its pinned CLI and private .NET runtime; a global SDK
+or dotnet installation is unnecessary. Lifecycle and archive options appear in `--help`.
+The ILSpy and runtime distributions come from our pinned GitHub Releases. For offline
+installation supply `--archive` and `--dotnet-archive`, or use an already verified cache.
+`--executable` selects a compatible external ilspycmd; uninstall preserves its files.
+
+```sh
+insight-cli ilspy types ./client.dll --json
+insight-cli ilspy decompile --target <returned-target> --type Example.Policy --output policy.cs --json
+insight-cli ilspy il --target <target> --type Example.Policy --json
+insight-cli ilspy resources --target <target> --json
+insight-cli ilspy resource --target <target> --name Example.settings.json --output extracted --json
+insight-cli ilspy project --target <target> --output recovered-project --json
+insight-cli ilspy metadata --target <target> --table MethodDef --json
+```
+
+Use either an input file or an existing target. Reusing the target associates Ghidra and
+ILSpy results with the same immutable bytes. No Ghidra context or merge is needed for a
+stateless ILSpy read. An optional `--session` associates an existing session; it does not
+create one. These calls require Update to capture input and run a tool.
+
+Text responses include `content`, input SHA, process ID, elapsed time and diagnostic paths.
+`--member` selects a metadata token or XML member ID for decompilation. Output paths must
+be new: text operations create one ordinary file, project/resource operations create a
+folder. Keep useful output in the project's chosen evidence location; `artifacts save`
+is an optional explicit checkpoint. Static decompilation does not execute an assembly.
+
+Use `tools processes --tool ilspy --all` for execution history and `tools processes show
+<process-id>` for retained diagnostics. A failed or interrupted export can leave partial
+files/staging; inspect them and choose a new output path for another intentional run.

package/skill-bundle/insight-interop/SKILL.md

@@ -0,0 +1,54 @@
+---
+name: insight-interop
+description: Trace a .NET P/Invoke declaration to an explicitly supplied native library export and Ghidra function through insight-cli ilspy query, binary query and scoped ghidra APIs. Use for managed/native linkage evidence while keeping static correspondence separate from observed loading or execution.
+---
+
+# Insight Interop 0.2.2
+
+If local help/status reports AppData or IPC access denied, retry that **read-only probe**
+with the agent host's normal permission escalation, then use that route for later authorized
+CLI calls too. An explicit **no command was sent** denial is known undispatched and can be
+retried through that route. Keep HOME, profile and owner state; see
+[host execution permissions](references/agent-execution.md). A lost mutation reply needs
+request/status recovery, never blind retry.
+
+Respect project RE/evidence rules. This workflow composes existing public APIs, without
+another runtime, global active binary or universal library resolver. Tokens and native
+addresses identify different immutable targets; preserve both hashes in the finding.
+
+1. Read `ilspy query managed.dll --view imports --json`. Select the exact managed signature,
+   MethodDef token, declared module/entrypoint, calling convention, charset and spelling
+   flags. Drill into `--view method --method TOKEN` when needed. An absent declaration
+   does not exclude dynamic loading, generated interop, reflection or runtime resolvers.
+2. Select candidate native files explicitly. `binary query candidate.dll --json` identifies
+   format, architecture and image base. A filename match alone is insufficient. A neutral
+   IL assembly does not select the eventual runtime architecture by itself.
+3. Query `--view exports --filter ENTRYPOINT`, then verify the **exact** name in the returned
+   row: the filter is a substring. Keep its native target/hash, ordinal, RVA and VA. Do not
+   treat a forwarded PE export as code; follow its named library/export using another
+   explicitly supplied candidate. Ordinal imports, name decoration, charset A/W probing,
+   Mach-O leading underscores and ambiguous candidates need explicit ABI/loader evidence;
+   never silently choose a winner by stripping names or comparing addresses alone.
+4. `ghidra open candidate.dll --session new --json` opens an isolated native context. Match
+   this returned native target identity to the file just queried. Use
+   `ghidra functions get --session S --target T --address VA --json`, then
+   `ghidra functions decompile --session S --target T --address VA --json` to inspect the
+   exact implementation candidate. An address pointing to data or an unavailable function
+   is unresolved; do not create a claimed implementation merely to finish the workflow.
+5. Write ordinary project evidence linking the managed declaration, concrete native export,
+   scoped Ghidra function and useful behavior. Label this **static correspondence**. It
+   proves neither that this file was selected by the runtime nor that the call occurred:
+   search paths, architecture, custom resolvers and marshaling can change the actual route.
+   An authorized Frida/LLDB/dnSpy observation is separate evidence when execution is needed.
+6. If a useful annotation belongs in the shared Ghidra model, edit the chosen session/target
+   and explicitly `ghidra merge --session S --target T`. Verify it from a new context;
+   other workers refresh explicitly and retain their local changes. Metadata/binary reads
+   have no independent merge. Checkpoint ordinary materials with `artifacts save` as useful.
+7. Close the contexts you own. If the profile's local server belongs exclusively to this
+   investigation, stop it with `ghidra server stop` and verify `ghidra status` before stopping
+   the CLI owner. `ipc-server stop` does not stop that Ghidra server. For shared work, leave
+   server shutdown to the coordinator; never stop another worker's contexts or server.
+
+Use each tool's dedicated packaged skill for install/status, bounds and generated help.
+MacOS native workflow acceptance uses static Windows PE/.NET fixtures; it does not claim
+those Windows binaries execute on macOS. Project-specific formats and tools take precedence.

package/skill-bundle/insight-interop/references/agent-execution.md

@@ -0,0 +1,36 @@
+# Agent host execution permissions
+
+Keep the user/project host policy and the selected profile. A sandbox can deny writes
+to runtime AppData or access to the local IPC endpoint, including during local help.
+This is a host execution boundary, not evidence that the tool or its inputs are absent.
+
+First retry only `insight-cli --help`, `tools list`, `skill`, or the selected application's
+read-only `status` using the host's normal permission escalation. In Codex, use the
+execution tool's `sandbox_permissions: "require_escalated"` with a scoped explanation
+that the installed CLI needs its existing profile storage/local IPC. Automatic approval
+review or the user decides that request; do not disable the sandbox or approval policy.
+
+Do not work around this by changing HOME/AppData/profile paths, creating another host,
+deleting owner/endpoint files, killing unrelated processes or claiming a missing runtime.
+After the read-only probe succeeds, use the approved execution route for the intended
+public CLI commands. An access refusal explicitly stating **no command was sent** is
+known not dispatched; it is safe to submit that authorized command through the approved
+route. This includes a mutation refused before dispatch. Do not mistake that definite
+pre-dispatch refusal for an unknown execution outcome. Downloads still require their explicit
+network access.
+
+A lost mutation response is different from a denied startup probe: inspect retained
+request/status/recovery evidence and use its request ID when supported. Never blindly
+repeat a publication, script or program run whose outcome is unknown. External-tool
+fallback is allowed by project rules, but record that the intended facade was not used
+and do not invent a successful checkpoint or native result.
+
+## Wait for the original execution
+
+A tool operation may outlast the host execution tool's initial wait. A returned running
+session/cell ID means that command is still in progress, not that the CLI returned no data.
+Use the host's session poll/wait facility until terminal exit and consume stdout/stderr
+before issuing a dependent command. In Codex, an `exec_command` session is continued with
+`write_stdin`; a yielded execution cell uses that host's cell wait. Do not launch a second
+open/install or repeat a CPU action just because the first chunk was empty. If the execution
+really loses its terminal result, use the CLI's request/status recovery as described above.

package/skill-bundle/insight-lldb/SKILL.md

@@ -0,0 +1,54 @@
+---
+name: insight-lldb
+description: Observe native runtime arguments, return values, registers, stacks and bounded memory at a selected breakpoint using an owned LLDB launch. Use insight-cli lldb on macOS ARM64 when static findings need a concrete execution check.
+---
+
+# Insight LLDB 0.2.2
+
+If local help/status reports AppData or IPC access denied, retry that **read-only probe**
+with the agent host's normal permission escalation, then use that route for later authorized
+CLI calls too. An explicit **no command was sent** denial is known undispatched and can be
+retried through that route. Keep HOME, profile and owner state; see
+[host execution permissions](references/agent-execution.md). A lost mutation reply needs
+request/status recovery, never blind retry.
+
+Follow the project's RE and evidence conventions. This debugger runs a native input; choose
+an input whose execution and application side effects are authorized. It launches a separate
+owned copy, captures one breakpoint observation and terminates that launch. It does not attach
+to an existing process or resume a crashed execution.
+
+1. `insight-cli lldb status --json` checks readiness. `lldb install` obtains our pinned
+   LLDB 23.1.3 bundle (debugger, debugserver and library) from GitHub Releases. Managed delivery
+   requires macOS 14+ ARM64. `download`, `install --archive FILE --offline`, `doctor` and
+   `uninstall` use the shared lifecycle. `install --executable /path/to/bin/lldb` selects
+   an external compatible bundle with its adjacent bin/debugserver and lib directory;
+   these dependencies are fingerprinted. External files and research survive uninstall.
+2. Start from static evidence identifying the relevant function and a useful input.
+   `insight-cli lldb inspect INPUT --breakpoint FUNCTION --step-out --json` records arguments,
+   registers, backtrace and the return from that call. `--target ID` reuses a captured input.
+   Only a native thin ARM64 Mach-O is supported here; a Windows PE imported into Ghidra cannot run
+   on this host. An optimized/stripped binary may omit names, arguments or source variables.
+   `--symbols FILE` captures a matching DWARF file from a dSYM bundle and loads it before launch.
+   `--variables` explicitly requests locals when debug information is available; without it
+   registers/backtraces remain useful for stripped code. Moving an executable alone does not
+   retain its adjacent dSYM.
+3. `--hit N` skips earlier calls; compare calls around the relevant boundary. `--arg` supplies
+   literal program arguments without shell expansion. Backticks are rejected because LLDB uses them
+   for expression substitution. `--registers pc,sp,x0` selects registers.
+   `--memory-address '$sp' --memory-bytes 64` records a bounded memory window. A `0x` breakpoint
+   is a file address; memory addresses and printed pointers are runtime addresses affected by
+   ASLR. Establish correspondence before combining them with static analysis.
+4. A snapshot proves one observed path and input, not all possible behavior. `--limit` and
+   `--offset` page native lines. `--output research/snapshot.json` saves the full bounded
+   snapshot to a new ordinary file, creating parents. Raw diagnostics remain under the
+   returned process directory. Preserve useful files with `artifacts save` when appropriate.
+5. The deadline (default 30 seconds, up to 600) survives owner loss. LLDB is configured to
+   kill its inferior on debugger connection loss. `tools processes --tool lldb --all` shows
+   history; stop/kill applies to verified owned collectors. After an owner crash a live
+   recovered macOS PID may be unverified: wait for its kernel deadline, inspect retained
+   records and do not replay an execution blindly. Observed exit after loss means an unknown
+   result, not a completed snapshot. Init files are disabled; no arbitrary debugger script
+   or expression evaluation is exposed by this facade.
+
+Generated `lldb inspect --help` owns exact syntax. No Ghidra session or merge is required;
+these are runtime observations to corroborate static research.

package/skill-bundle/insight-lldb/references/agent-execution.md

@@ -0,0 +1,36 @@
+# Agent host execution permissions
+
+Keep the user/project host policy and the selected profile. A sandbox can deny writes
+to runtime AppData or access to the local IPC endpoint, including during local help.
+This is a host execution boundary, not evidence that the tool or its inputs are absent.
+
+First retry only `insight-cli --help`, `tools list`, `skill`, or the selected application's
+read-only `status` using the host's normal permission escalation. In Codex, use the
+execution tool's `sandbox_permissions: "require_escalated"` with a scoped explanation
+that the installed CLI needs its existing profile storage/local IPC. Automatic approval
+review or the user decides that request; do not disable the sandbox or approval policy.
+
+Do not work around this by changing HOME/AppData/profile paths, creating another host,
+deleting owner/endpoint files, killing unrelated processes or claiming a missing runtime.
+After the read-only probe succeeds, use the approved execution route for the intended
+public CLI commands. An access refusal explicitly stating **no command was sent** is
+known not dispatched; it is safe to submit that authorized command through the approved
+route. This includes a mutation refused before dispatch. Do not mistake that definite
+pre-dispatch refusal for an unknown execution outcome. Downloads still require their explicit
+network access.
+
+A lost mutation response is different from a denied startup probe: inspect retained
+request/status/recovery evidence and use its request ID when supported. Never blindly
+repeat a publication, script or program run whose outcome is unknown. External-tool
+fallback is allowed by project rules, but record that the intended facade was not used
+and do not invent a successful checkpoint or native result.
+
+## Wait for the original execution
+
+A tool operation may outlast the host execution tool's initial wait. A returned running
+session/cell ID means that command is still in progress, not that the CLI returned no data.
+Use the host's session poll/wait facility until terminal exit and consume stdout/stderr
+before issuing a dependent command. In Codex, an `exec_command` session is continued with
+`write_stdin`; a yielded execution cell uses that host's cell wait. Do not launch a second
+open/install or repeat a CPU action just because the first chunk was empty. If the execution
+really loses its terminal result, use the CLI's request/status recovery as described above.

package/skill-bundle/insight-llvm/SKILL.md

@@ -0,0 +1,56 @@
+---
+name: insight-llvm
+description: Inspect PE, ELF and Mach-O headers, dependencies, exports and symbols; query PDB debug information or a small instruction window with insight-cli LLVM utilities before opening a full analysis project.
+---
+
+# Insight LLVM 0.2.2
+
+If local help/status reports AppData or IPC access denied, retry that **read-only probe**
+with the agent host's normal permission escalation, then use that route for later authorized
+CLI calls too. An explicit **no command was sent** denial is known undispatched and can be
+retried through that route. Keep HOME, profile and owner state; see
+[host execution permissions](references/agent-execution.md). A lost mutation reply needs
+request/status recovery, never blind retry.
+
+Use existing project RE rules and evidence paths. These are static reads; no Ghidra project,
+program execution or shared merge is needed. Use Ghidra when the question needs recovered
+control flow, decompilation or persistent annotations.
+
+1. `insight-cli llvm status --json` checks readiness. `llvm install` prepares the pinned
+   four-utility bundle from our GitHub Release; `--archive` and `--offline` support local
+   installation. Managed LLVM 23.1.3 requires macOS 14+ ARM64. `--executable` selects an
+   external llvm-readobj with compatible llvm-nm, llvm-objdump and llvm-pdbutil siblings.
+   The whole known external family is fingerprinted; uninstall preserves external files.
+2. Use `llvm headers INPUT`, `sections`, `imports`, `exports` or `symbols` for focused
+   inventories. Reuse `--target` instead of INPUT for the same immutable bytes. Stripped
+   images can have no ordinary symbols; that does not prove there are no functions.
+   `symbols` includes local/static definitions; these are not automatically exported APIs.
+   For ELF, `exports` uses the dynamic symbol table while `symbols` uses ordinary symbols.
+3. For a supplied PDB, start with `llvm pdb FILE --view summary` and `--view modules`.
+   Use `--view globals --symbol NAME` for a named global, `--view publics` for public
+   addresses, or `--view symbols --module INDEX` for procedure/local records. `--view types`
+   gives statistics until `--type-index 0xINDEX` selects a particular record. PDB symbol
+   addresses are section:offset pairs: combine the corresponding image section RVA and
+   image base from headers/sections; they are not file offsets. In pdbutil these padded
+   section:offset numbers are decimal (an explicit `0x` elsewhere means hexadecimal).
+4. `llvm disassemble IMAGE --address 0xVIRTUAL_ADDRESS --bytes 128` returns a bounded
+   instruction interval. Distinguish static virtual addresses, RVAs and file offsets;
+   runtime load bias is not established by these static commands. If the instructions load
+   constants from a section, use `llvm section-data IMAGE --section NAME` and the section
+   address/endianness to inspect their actual values. The complete section must fit the
+   4-MiB native-output bound; oversized sections fail explicitly and need another focused
+   binary-reading tool rather than an assumed complete result.
+5. Keep useful output in the project's format. Text views page with `--limit`/`--offset`;
+   `--filter` selects matching native lines and can omit surrounding context. `--output`
+   writes full bounded native text to a new file, creating missing parent directories.
+   Use focused PDB/module/type queries instead of asking for every symbol or instruction.
+
+The four upstream executables supply native text inside our JSON envelope. In particular,
+upstream readobj JSON output is not treated as a reliable structured COFF contract. ELF
+imports show needed libraries and undefined dynamic symbols; Mach-O imports show dylibs and
+undefined symbols. This is static linkage evidence, not proof of observed runtime calls.
+
+These calls need Update permission to capture input and run tools. Generated `--help` owns
+exact syntax. `tools processes --tool llvm --all` and `show <id>` retain execution diagnostics;
+failed/limited output is not a complete inventory. Save completed ordinary files through
+`artifacts save` when a checkpoint is useful.

package/skill-bundle/insight-llvm/references/agent-execution.md

@@ -0,0 +1,36 @@
+# Agent host execution permissions
+
+Keep the user/project host policy and the selected profile. A sandbox can deny writes
+to runtime AppData or access to the local IPC endpoint, including during local help.
+This is a host execution boundary, not evidence that the tool or its inputs are absent.
+
+First retry only `insight-cli --help`, `tools list`, `skill`, or the selected application's
+read-only `status` using the host's normal permission escalation. In Codex, use the
+execution tool's `sandbox_permissions: "require_escalated"` with a scoped explanation
+that the installed CLI needs its existing profile storage/local IPC. Automatic approval
+review or the user decides that request; do not disable the sandbox or approval policy.
+
+Do not work around this by changing HOME/AppData/profile paths, creating another host,
+deleting owner/endpoint files, killing unrelated processes or claiming a missing runtime.
+After the read-only probe succeeds, use the approved execution route for the intended
+public CLI commands. An access refusal explicitly stating **no command was sent** is
+known not dispatched; it is safe to submit that authorized command through the approved
+route. This includes a mutation refused before dispatch. Do not mistake that definite
+pre-dispatch refusal for an unknown execution outcome. Downloads still require their explicit
+network access.
+
+A lost mutation response is different from a denied startup probe: inspect retained
+request/status/recovery evidence and use its request ID when supported. Never blindly
+repeat a publication, script or program run whose outcome is unknown. External-tool
+fallback is allowed by project rules, but record that the intended facade was not used
+and do not invent a successful checkpoint or native result.
+
+## Wait for the original execution
+
+A tool operation may outlast the host execution tool's initial wait. A returned running
+session/cell ID means that command is still in progress, not that the CLI returned no data.
+Use the host's session poll/wait facility until terminal exit and consume stdout/stderr
+before issuing a dependent command. In Codex, an `exec_command` session is continued with
+`write_stdin`; a yielded execution cell uses that host's cell wait. Do not launch a second
+open/install or repeat a CPU action just because the first chunk was empty. If the execution
+really loses its terminal result, use the CLI's request/status recovery as described above.