@eyeauras/insight-cli 0.2.0 → 0.2.2

package/skill-bundle/insight-re/references/agent-execution.md

@@ -0,0 +1,36 @@
+# Agent host execution permissions
+
+Keep the user/project host policy and the selected profile. A sandbox can deny writes
+to runtime AppData or access to the local IPC endpoint, including during local help.
+This is a host execution boundary, not evidence that the tool or its inputs are absent.
+
+First retry only `insight-cli --help`, `tools list`, `skill`, or the selected application's
+read-only `status` using the host's normal permission escalation. In Codex, use the
+execution tool's `sandbox_permissions: "require_escalated"` with a scoped explanation
+that the installed CLI needs its existing profile storage/local IPC. Automatic approval
+review or the user decides that request; do not disable the sandbox or approval policy.
+
+Do not work around this by changing HOME/AppData/profile paths, creating another host,
+deleting owner/endpoint files, killing unrelated processes or claiming a missing runtime.
+After the read-only probe succeeds, use the approved execution route for the intended
+public CLI commands. An access refusal explicitly stating **no command was sent** is
+known not dispatched; it is safe to submit that authorized command through the approved
+route. This includes a mutation refused before dispatch. Do not mistake that definite
+pre-dispatch refusal for an unknown execution outcome. Downloads still require their explicit
+network access.
+
+A lost mutation response is different from a denied startup probe: inspect retained
+request/status/recovery evidence and use its request ID when supported. Never blindly
+repeat a publication, script or program run whose outcome is unknown. External-tool
+fallback is allowed by project rules, but record that the intended facade was not used
+and do not invent a successful checkpoint or native result.
+
+## Wait for the original execution
+
+A tool operation may outlast the host execution tool's initial wait. A returned running
+session/cell ID means that command is still in progress, not that the CLI returned no data.
+Use the host's session poll/wait facility until terminal exit and consume stdout/stderr
+before issuing a dependent command. In Codex, an `exec_command` session is continued with
+`write_stdin`; a yielded execution cell uses that host's cell wait. Do not launch a second
+open/install or repeat a CPU action just because the first chunk was empty. If the execution
+really loses its terminal result, use the CLI's request/status recovery as described above.

package/skill-bundle/insight-re/references/artifacts.md

@@ -0,0 +1,52 @@
+# Save ordinary research materials
+
+`insight-cli artifacts save <path> --json` saves a file or a settled directory tree in
+the selected profile's AppData. It needs Factory Update permission and does not require
+Ghidra, Java, authentication, target/session selectors or evidence metadata. Relative input
+paths resolve against the caller's working directory. Use `--help` for generated syntax.
+
+Save existing project files in their existing format; no `notes.md`, `finding.md` or
+`research/` layout is required. The saved copy is a checkpoint and does not replace the
+project's canonical evidence location or its source-of-truth rules.
+
+Write notes and useful external-tool outputs as ordinary files while investigating. When
+the selected files are no longer being edited, save one file, a completed worker subfolder
+or the relevant project folder. For a project without a prescribed layout, for example:
+
+```sh
+insight-cli artifacts save ./research --json
+```
+
+The receipt has `state: "saved"`, `path`, `kind` (`file` or `directory`), `files`, `bytes`
+and `sha256`. `path` points to an ordinary browsable copy with the source basename and
+relative layout. Empty files and empty directories are retained. File count counts regular
+files; byte count counts their contents. A file's SHA-256 hashes its bytes; a directory's
+SHA-256 hashes its canonical manifest of relative paths, kinds, file lengths and hashes.
+The manifest is stored beside the content, outside the returned directory.
+
+Before claiming a verified checkpoint, read the expected files at the returned `path` using
+ordinary file tools. Preserve that path verbatim in the handoff, alongside the receipt;
+profile and snapshot identifiers must not be reconstructed from memory. If access is denied,
+retain the actual receipt and state that readback remains unverified.
+
+The service copies and syncs data before publishing the completed snapshot. Failure does
+not return a successful receipt or expose a partial completed snapshot. Source edits made
+after a successful save do not change the copy. Treat saved copies as retained snapshots;
+edit the original research folder and save a new copy for another checkpoint. Each call
+creates a new saved copy, including a repeated call after a lost response.
+
+Keep a directory stable for the save: detected concurrent edits are rejected. Copying
+several files is not an atomic filesystem snapshot of a directory that other agents keep
+changing. Symbolic links and special files are rejected rather than followed or silently
+omitted. Select the actual intended regular file/directory. Do not save a directory that
+contains the destination materials store. Traversal supports at most 100,000 entries and
+128 levels to bound inventory memory and recursion. Disk/permission failures return nonzero.
+
+The saved bytes establish what was retained. Commands, tool versions and interpretations
+written in a note remain the author's statements, not execution attestations. No upload,
+tool execution or Ghidra publication is performed by saving materials.
+
+Profile deletion/configuration invalidation is blocked while retained materials exist,
+as with retained research work. Close tool contexts normally; preserve snapshots separately
+if retiring a profile. There is no automatic registration, cleanup policy, graph database
+or additional read API: read the receipt's path with normal file tools.

package/skill-bundle/insight-re/references/recovery.md

@@ -0,0 +1,53 @@
+# Continue saved work
+
+Retain the session/target returned by initial open. Continue the tuple through
+`insight-cli ghidra open --session <id> --target <id> --json`. Saved private snapshots and
+pending scalar comparisons persist independently of a backend process. Reopening preserves
+private work; it does not silently receive a newer shared version.
+
+First-import recovery uses the same scoped `ghidra open` or the original request ID/input.
+Import/analysis writes a private snapshot and completion receipt before any initial publication.
+If its worker is still running, continuation reports busy; wait and continue the same scope.
+If that worker stopped before completing its receipt, continuation can repeat private analysis
+from the immutable input while retaining previous attempts. A completed snapshot is reused.
+Initial publication first creates a uniquely named staging object. A separate read-only process
+verifies its complete saved DB buffers before a conditional server move to the absent canonical
+path. It never checks in a new version of an existing canonical item. Lost promotion replies
+are reconciled against the retained identity, one-version history and complete saved buffers.
+Interrupted staging objects remain retained and can be replaced by another private stage;
+they are not adopted as the canonical model. Foreign or mismatched canonical state stays blocked.
+An older direct create that is provably owned and left only an incomplete `<Recovered>` entry
+can be moved aside without deletion; its bytes and original receipt remain preserved.
+
+Legacy first-import failures are also recoverable in the original profile. Continuation first
+establishes that the old owned bootstrap worker has ended, then uses an authoritative repository
+probe. An absent canonical item permits private preparation; an existing first version requires
+independent readback. The old project, intent and original session/target remain preserved.
+
+If a response was lost, inspect `sessions status <session> --target <target>`. Never infer
+`applied` from a connection failure. A changing command's optional request ID binds one effective
+intent inside the profile. Repeating the same ID/input retrieves its recorded outcome or
+unresolved state; changing input under that ID fails. Without an ID, calls are new intentions.
+
+An unknown or partial effect retains its request intent, snapshots and native stage. Open the
+same tuple to reconcile supported outcomes. A committed merge is verified against its recorded
+server version and complete saved buffers through independent read authority; it is never
+checked in again merely because its response was lost. Until verification succeeds, publication
+for this shared target is blocked across sessions. Saved private work remains retained.
+
+Scalar reconciliation observes and saves an already present effect; it does not execute the
+setter again. Supported structural/function edits retain a candidate snapshot after an incomplete
+response; continuation can verify every requested effect in that immutable snapshot and adopt it
+without replay. If the complete result cannot be established, the candidate and previous saved
+private view remain retained. An unproved program/script/external outcome remains unresolved. Preserve the profile
+storage and credential store. Do not delete another session's project, stop a process by guessed
+PID/port, or blindly repeat a script/external action to turn uncertainty into success.
+
+The older prototype's `workers`, `findings`, `integrate` and batch `recover` commands are not the
+public facade API. Its coordinator journals remain separate and are never silently migrated.
+
+A lost UI navigation response can be verified from the live authenticated cursor without another
+goto. If its original owned GUI process has exited, continuation reports the uncertain UI action
+as disconnected and retains saved program work. It does not recreate the old cursor or re-enable
+a previous prompt policy. Other unproved live UI effects remain retained until their outcome is
+established or the original process is known to have ended.

package/skill-bundle/insight-sevenzip/SKILL.md

@@ -0,0 +1,42 @@
+---
+name: insight-sevenzip
+description: Inventory, integrity-check and recover files from archives and supported containers with insight-cli 7-Zip, then hand recovered binaries or configuration to the appropriate research tool.
+---
+
+# Insight 7-Zip 0.2.2
+
+If local help/status reports AppData or IPC access denied, retry that **read-only probe**
+with the agent host's normal permission escalation, then use that route for later authorized
+CLI calls too. An explicit **no command was sent** denial is known undispatched and can be
+retried through that route. Keep HOME, profile and owner state; see
+[host execution permissions](references/agent-execution.md). A lost mutation reply needs
+request/status recovery, never blind retry.
+
+Use the project's existing evidence layout. Container recovery produces ordinary files;
+it does not publish analysis or require a Ghidra session.
+
+1. Check `insight-cli sevenzip status --json`. `sevenzip install` prepares the private,
+   pinned 7zz runtime from our GitHub Release; `--archive` accepts a local gzip tar or zip,
+   and `--offline` prevents downloads. Managed delivery is macOS universal. An external
+   compatible 7zz 26.04 can be selected with `--executable` and is never deleted by uninstall.
+2. Run `sevenzip list INPUT --json` for a bounded inventory. Continue with `--offset`;
+   `sevenzip test INPUT --json` checks archive integrity without executing its content.
+3. Recover one exact file with `sevenzip extract INPUT --entry path/from/inventory
+   --output NEW_DIRECTORY --json`. Omit `--entry` only for small, trusted container trees.
+   The output directory must be new; choose a different directory after a partial failure.
+4. Read recovered configuration bytes before summarizing values; the inventory gives paths
+   and sizes, not configuration contents. For DLLs use the managed/native skill that
+   matches their format; do not execute a recovered program to identify it. Preserve the
+   parent archive identity and recovered path in your notes. `artifacts save` can retain
+   the completed folder using the project's format.
+
+All research calls accept either INPUT or `--target`, and require Update permission to
+capture immutable input and run the tool. Recovery is bounded to 512 entries, 64 MiB per
+file and 256 MiB total. Encrypted recovery, ambiguous multiline filenames, links, special
+files and colliding output paths are unsupported. It extracts file bytes through stdout
+and writes validated paths itself, keeping archive-selected paths away from native writes.
+Container integrity proves consistency of bytes, not safety or truth of their contents.
+
+Use generated `--help` for syntax and `tools processes --tool sevenzip --all` for retained
+execution diagnostics. A process limit/deadline is a failed operation; inspect retained
+partial output before another intentional call.

package/skill-bundle/insight-sevenzip/references/agent-execution.md

@@ -0,0 +1,36 @@
+# Agent host execution permissions
+
+Keep the user/project host policy and the selected profile. A sandbox can deny writes
+to runtime AppData or access to the local IPC endpoint, including during local help.
+This is a host execution boundary, not evidence that the tool or its inputs are absent.
+
+First retry only `insight-cli --help`, `tools list`, `skill`, or the selected application's
+read-only `status` using the host's normal permission escalation. In Codex, use the
+execution tool's `sandbox_permissions: "require_escalated"` with a scoped explanation
+that the installed CLI needs its existing profile storage/local IPC. Automatic approval
+review or the user decides that request; do not disable the sandbox or approval policy.
+
+Do not work around this by changing HOME/AppData/profile paths, creating another host,
+deleting owner/endpoint files, killing unrelated processes or claiming a missing runtime.
+After the read-only probe succeeds, use the approved execution route for the intended
+public CLI commands. An access refusal explicitly stating **no command was sent** is
+known not dispatched; it is safe to submit that authorized command through the approved
+route. This includes a mutation refused before dispatch. Do not mistake that definite
+pre-dispatch refusal for an unknown execution outcome. Downloads still require their explicit
+network access.
+
+A lost mutation response is different from a denied startup probe: inspect retained
+request/status/recovery evidence and use its request ID when supported. Never blindly
+repeat a publication, script or program run whose outcome is unknown. External-tool
+fallback is allowed by project rules, but record that the intended facade was not used
+and do not invent a successful checkpoint or native result.
+
+## Wait for the original execution
+
+A tool operation may outlast the host execution tool's initial wait. A returned running
+session/cell ID means that command is still in progress, not that the CLI returned no data.
+Use the host's session poll/wait facility until terminal exit and consume stdout/stderr
+before issuing a dependent command. In Codex, an `exec_command` session is continued with
+`write_stdin`; a yielded execution cell uses that host's cell wait. Do not launch a second
+open/install or repeat a CPU action just because the first chunk was empty. If the execution
+really loses its terminal result, use the CLI's request/status recovery as described above.

package/skill-bundle/insight-strace/SKILL.md

@@ -0,0 +1,46 @@
+---
+name: insight-strace
+description: Observe actual file reads, writes, process creation and network syscalls in an authorized owned native Linux launch using insight-cli strace. Use when static inference needs concrete operating-system interaction evidence.
+---
+
+# Insight strace 0.2.2
+
+If local help/status reports AppData or IPC access denied, retry that **read-only probe**
+with the agent host's normal permission escalation, then use that route for later authorized
+CLI calls too. An explicit **no command was sent** denial is known undispatched and can be
+retried through that route. Keep HOME, profile and owner state; see
+[host execution permissions](references/agent-execution.md). A lost mutation reply needs
+request/status recovery, never blind retry.
+
+Respect the project's RE and evidence format. This tool runs the supplied application;
+its side effects must be authorized. It traces an owned native copy and its descendants.
+A trace may contain private paths, strings or network data: retain it under project rules.
+
+1. `insight-cli strace status --json` checks readiness. `strace install` obtains our pinned,
+   source-built strace 7.2 bundle from GitHub Releases. Supported host: Linux x64 with glibc
+   2.35+ and permission to ptrace an owned child. No root, global ptrace-policy change or
+   arbitrary process attach is requested. `download`, `install --archive FILE --offline`,
+   `doctor` and `uninstall` use the shared lifecycle. `install --executable /path/to/strace`
+   selects an external compatible 7.2 executable; uninstall preserves external software.
+2. `insight-cli strace trace worker --arg /absolute/settings.txt --json` captures immutable
+   ELF bytes and runs a separate owned copy. Default events cover files, processes and I/O.
+   `--events file,io` narrows categories; `network` is also available. The executable must
+   be native x64 ELF. Adjacent executable sidecars are not copied; choose a suitable owned
+   fixture/input rather than assuming another platform's EXE will run on Linux.
+3. Establish the actual path and successful `openat`/`read` result, then relate returned bytes
+   to application stdout. A static filename or attempted open is not a successful read.
+   `--path /absolute/settings.txt` focuses a literal path and combines with categories;
+   `--string-bytes N` bounds shown strings (default 128, up to 1024). Filtered or truncated
+   data is unknown; syscall evidence does not prove high-level intent on other paths.
+4. `--target ID` reuses captured code; `--arg` values remain literal, without shell expansion.
+   `--limit`/`--offset` page trace lines. Native trace and program stderr share one stream;
+   program stdout is separate. `--output research/file-read.json` saves the full bounded
+   result to a new ordinary file. `artifacts save research` optionally checkpoints results.
+5. `--timeout-seconds` bounds execution (default 30, maximum 600). A kernel parent-death
+   guard and strace's `--kill-on-exit` bound owned tracees after owner/launcher loss.
+   `tools processes --tool strace --all` retains history. Stop/kill applies to a verified
+   owned launcher. A lost result remains unknown and is not automatically replayed.
+   Output overflow or nonzero program termination retains diagnostics rather than a
+   successful complete trace. Running the application again is a new side-effecting action.
+
+Generated `strace trace --help` owns exact syntax. No Ghidra session or merge is required.

package/skill-bundle/insight-strace/references/agent-execution.md

@@ -0,0 +1,36 @@
+# Agent host execution permissions
+
+Keep the user/project host policy and the selected profile. A sandbox can deny writes
+to runtime AppData or access to the local IPC endpoint, including during local help.
+This is a host execution boundary, not evidence that the tool or its inputs are absent.
+
+First retry only `insight-cli --help`, `tools list`, `skill`, or the selected application's
+read-only `status` using the host's normal permission escalation. In Codex, use the
+execution tool's `sandbox_permissions: "require_escalated"` with a scoped explanation
+that the installed CLI needs its existing profile storage/local IPC. Automatic approval
+review or the user decides that request; do not disable the sandbox or approval policy.
+
+Do not work around this by changing HOME/AppData/profile paths, creating another host,
+deleting owner/endpoint files, killing unrelated processes or claiming a missing runtime.
+After the read-only probe succeeds, use the approved execution route for the intended
+public CLI commands. An access refusal explicitly stating **no command was sent** is
+known not dispatched; it is safe to submit that authorized command through the approved
+route. This includes a mutation refused before dispatch. Do not mistake that definite
+pre-dispatch refusal for an unknown execution outcome. Downloads still require their explicit
+network access.
+
+A lost mutation response is different from a denied startup probe: inspect retained
+request/status/recovery evidence and use its request ID when supported. Never blindly
+repeat a publication, script or program run whose outcome is unknown. External-tool
+fallback is allowed by project rules, but record that the intended facade was not used
+and do not invent a successful checkpoint or native result.
+
+## Wait for the original execution
+
+A tool operation may outlast the host execution tool's initial wait. A returned running
+session/cell ID means that command is still in progress, not that the CLI returned no data.
+Use the host's session poll/wait facility until terminal exit and consume stdout/stderr
+before issuing a dependent command. In Codex, an `exec_command` session is continued with
+`write_stdin`; a yielded execution cell uses that host's cell wait. Do not launch a second
+open/install or repeat a CPU action just because the first chunk was empty. If the execution
+really loses its terminal result, use the CLI's request/status recovery as described above.

package/skill-bundle/insight-tshark/SKILL.md

@@ -0,0 +1,49 @@
+---
+name: insight-tshark
+description: Inspect an offline PCAP or PCAPNG with insight-cli tshark to identify protocols, HTTP/DNS/TLS fields, packet evidence and reconstructed TCP/UDP streams. Use for captured traffic questions; live acquisition and TLS decryption are separate tasks.
+---
+
+# Insight TShark 0.2.2
+
+If local help/status reports AppData or IPC access denied, retry that **read-only probe**
+with the agent host's normal permission escalation, then use that route for later authorized
+CLI calls too. An explicit **no command was sent** denial is known undispatched and can be
+retried through that route. Keep HOME, profile and owner state; see
+[host execution permissions](references/agent-execution.md). A lost mutation reply needs
+request/status recovery, never blind retry.
+
+Keep the project's evidence format. This tool reads an immutable capture; it does not
+start packet capture, install BPF helpers, change network settings or contact DNS servers.
+The delivered native profile is macOS ARM64, macOS 14+.
+
+1. `insight-cli tshark status --json` checks readiness. `tshark install` delivers the
+   pinned console subset and full notices from our GitHub Release. `download` caches it;
+   `install --archive tshark-4.6.9-macos-console.tgz --offline` uses local bytes.
+   `install --executable /Applications/Wireshark.app/Contents/MacOS/tshark` accepts the
+   exact pinned 4.6.9 runtime. It copies only known console/data files into owned storage,
+   excluding external GUI/plugins; it fingerprints the original and owned family.
+   Uninstall preserves the external distribution, original capture and saved research.
+2. Start with `tshark inspect traffic.pcap --json`. The returned target identifies the
+   captured bytes. Overview counts protocols and streams. `--view packets --filter
+   'http.request' --limit 20` returns actual frame numbers and selected protocol fields;
+   `--view streams` returns native TCP/UDP stream IDs and participating IPs/frame numbers.
+   Address lists may include encapsulated layers; they are not asserted endpoint pairs.
+3. Follow evidence with `tshark inspect --target TARGET --view packet --frame 4 --json`
+   for full native packet JSON, or `--view follow --transport tcp --stream 0 --json` for
+   ordered native reassembly chunks. Follow returns endpoint labels, chunk direction and
+   hex bytes. Decode bytes with any suitable external tool and keep the frame/stream and
+   input SHA alongside the conclusion. Stream IDs belong to one capture revision.
+4. Inventory/filters/follow inspect at most the first 10000 frames of an input up to
+   64 MiB. `complete: false` means later frames and absent matches remain unknown.
+   Pagination applies after the display filter; it does not extend that read boundary.
+   Packet view reads up to its explicit frame (maximum one million), without claiming
+   whole-capture coverage. Follow has no display filter; use its native stream ID.
+   Native output/deadlines remain bounded. Encrypted or missing traffic is not evidence
+   of absent application behavior; no arbitrary tap, Lua script or TLS key is executed.
+5. `--output research/protocol.json` saves the full bounded view to a new ordinary file;
+   existing files are preserved. Use `artifacts save` when a checkpoint is useful.
+   `tools processes --tool tshark --all` retains native run diagnostics. Stop/kill only
+   owned process records; a failed read is not automatically replayed or recollected.
+
+Generated `tshark inspect --help` owns exact flags. For packet filters, Wireshark's display
+filter language applies; it is not a capture/BPF filter.

package/skill-bundle/insight-tshark/references/agent-execution.md

@@ -0,0 +1,36 @@
+# Agent host execution permissions
+
+Keep the user/project host policy and the selected profile. A sandbox can deny writes
+to runtime AppData or access to the local IPC endpoint, including during local help.
+This is a host execution boundary, not evidence that the tool or its inputs are absent.
+
+First retry only `insight-cli --help`, `tools list`, `skill`, or the selected application's
+read-only `status` using the host's normal permission escalation. In Codex, use the
+execution tool's `sandbox_permissions: "require_escalated"` with a scoped explanation
+that the installed CLI needs its existing profile storage/local IPC. Automatic approval
+review or the user decides that request; do not disable the sandbox or approval policy.
+
+Do not work around this by changing HOME/AppData/profile paths, creating another host,
+deleting owner/endpoint files, killing unrelated processes or claiming a missing runtime.
+After the read-only probe succeeds, use the approved execution route for the intended
+public CLI commands. An access refusal explicitly stating **no command was sent** is
+known not dispatched; it is safe to submit that authorized command through the approved
+route. This includes a mutation refused before dispatch. Do not mistake that definite
+pre-dispatch refusal for an unknown execution outcome. Downloads still require their explicit
+network access.
+
+A lost mutation response is different from a denied startup probe: inspect retained
+request/status/recovery evidence and use its request ID when supported. Never blindly
+repeat a publication, script or program run whose outcome is unknown. External-tool
+fallback is allowed by project rules, but record that the intended facade was not used
+and do not invent a successful checkpoint or native result.
+
+## Wait for the original execution
+
+A tool operation may outlast the host execution tool's initial wait. A returned running
+session/cell ID means that command is still in progress, not that the CLI returned no data.
+Use the host's session poll/wait facility until terminal exit and consume stdout/stderr
+before issuing a dependent command. In Codex, an `exec_command` session is continued with
+`write_stdin`; a yielded execution cell uses that host's cell wait. Do not launch a second
+open/install or repeat a CPU action just because the first chunk was empty. If the execution
+really loses its terminal result, use the CLI's request/status recovery as described above.

package/skill-bundle/insight-windbg/SKILL.md

@@ -0,0 +1,46 @@
+---
+name: insight-windbg
+description: Investigate Windows native user-mode minidumps using bounded stacks, threads, registers, modules, memory and disassembly through insight-cli windbg. Use on Windows x64 when a captured runtime state needs native debugger evidence.
+---
+
+# Insight WinDbg 0.2.2
+
+If local help/status reports AppData or IPC access denied, retry that **read-only probe**
+with the agent host's normal permission escalation, then use that route for later authorized
+CLI calls too. An explicit **no command was sent** denial is known undispatched and can be
+retried through that route. Keep HOME, profile and owner state; see
+[host execution permissions](references/agent-execution.md). A lost mutation reply needs
+request/status recovery, never blind retry.
+
+Keep the project's RE and evidence conventions. This facade reads a captured Windows
+user-mode minidump; it does not run or attach the original application. Dump contents
+can include private memory. Store evidence under the project's normal rules.
+
+1. Check `insight-cli windbg status --json`. On Windows x64, `windbg install --vendor-direct`
+   downloads Microsoft's pinned WinDbg bundle, prepares the CDB console runtime and probes it.
+   Microsoft terms prohibit our redistribution; this explicit acquisition uses Microsoft,
+   SHA256 and our local cache. `download --vendor-direct` stages the archive first.
+   `install --archive FILE --offline` accepts the matching local MSIX bundle.
+   `install --executable C:\tools\windbg\amd64\cdb.exe` selects an existing CDB 10.x family;
+   adjacent runtime bytes are fingerprinted. `doctor` probes it again; uninstall removes only
+   owned software and preserves research and external files.
+2. `insight-cli windbg inspect crash.dmp --symbols native.pdb --json` captures immutable inputs
+   and shows the dump environment, threads, current stack, registers and modules. A local
+   matching PDB improves correspondence; missing/mismatched symbols remain warnings.
+   Network symbol lookup and inherited debugger initialization are disabled.
+3. Drill down with `--view stack --frames 32`, `--view registers`, `--view threads` or
+   `--view modules`. `--thread N` selects the dump's decimal thread index. A runtime address
+   from this same dump enables `--view memory --address 0xADDRESS --count 64` or
+   `--view disassembly --address 0xADDRESS --count 16`. Addresses are runtime values affected
+   by ASLR, not file offsets. Missing pages do not mean zero or absent behavior.
+4. `--target ID` reuses a captured dump. `--limit`/`--offset` page native lines;
+   `--output research/native-state.json` saves the full bounded result to a new ordinary file.
+   Preserve useful evidence with `artifacts save` if appropriate. A `partial` response includes
+   warnings; retain them in conclusions. One dump proves one captured state, not every path.
+5. The owned debugger runs inside a Windows Job Object, bounded by `--timeout-seconds`
+   (default 30, maximum 600). Owner loss or launcher termination closes its process tree.
+   `tools processes --tool windbg --all` shows retained jobs. Lost or missing result receipts
+   mean an unknown result; inspect diagnostics before choosing a new query. No automatic
+   replay or arbitrary debugger-command gateway is exposed.
+
+Generated `windbg inspect --help` owns exact syntax. No Ghidra session or merge is needed.

package/skill-bundle/insight-windbg/references/agent-execution.md

@@ -0,0 +1,36 @@
+# Agent host execution permissions
+
+Keep the user/project host policy and the selected profile. A sandbox can deny writes
+to runtime AppData or access to the local IPC endpoint, including during local help.
+This is a host execution boundary, not evidence that the tool or its inputs are absent.
+
+First retry only `insight-cli --help`, `tools list`, `skill`, or the selected application's
+read-only `status` using the host's normal permission escalation. In Codex, use the
+execution tool's `sandbox_permissions: "require_escalated"` with a scoped explanation
+that the installed CLI needs its existing profile storage/local IPC. Automatic approval
+review or the user decides that request; do not disable the sandbox or approval policy.
+
+Do not work around this by changing HOME/AppData/profile paths, creating another host,
+deleting owner/endpoint files, killing unrelated processes or claiming a missing runtime.
+After the read-only probe succeeds, use the approved execution route for the intended
+public CLI commands. An access refusal explicitly stating **no command was sent** is
+known not dispatched; it is safe to submit that authorized command through the approved
+route. This includes a mutation refused before dispatch. Do not mistake that definite
+pre-dispatch refusal for an unknown execution outcome. Downloads still require their explicit
+network access.
+
+A lost mutation response is different from a denied startup probe: inspect retained
+request/status/recovery evidence and use its request ID when supported. Never blindly
+repeat a publication, script or program run whose outcome is unknown. External-tool
+fallback is allowed by project rules, but record that the intended facade was not used
+and do not invent a successful checkpoint or native result.
+
+## Wait for the original execution
+
+A tool operation may outlast the host execution tool's initial wait. A returned running
+session/cell ID means that command is still in progress, not that the CLI returned no data.
+Use the host's session poll/wait facility until terminal exit and consume stdout/stderr
+before issuing a dependent command. In Codex, an `exec_command` session is continued with
+`write_stdin`; a yielded execution cell uses that host's cell wait. Do not launch a second
+open/install or repeat a CPU action just because the first chunk was empty. If the execution
+really loses its terminal result, use the CLI's request/status recovery as described above.

package/skill-bundle/manifest.json

@@ -0,0 +1,32 @@
+{
+  "schema": 1,
+  "package": "@eyeauras/insight-cli",
+  "version": "0.2.2",
+  "skills": [
+    "insight-cli",
+    "insight-re",
+    "insight-ghidra",
+    "insight-ilspy",
+    "insight-artifacts",
+    "insight-sevenzip",
+    "insight-llvm",
+    "insight-dotnet-dump",
+    "insight-dotnet-stack",
+    "insight-dotnet-trace",
+    "insight-die",
+    "insight-lldb",
+    "insight-frida",
+    "insight-windbg",
+    "insight-strace",
+    "insight-procmon",
+    "insight-dnspy",
+    "insight-tshark",
+    "insight-mitmproxy",
+    "insight-managed-metadata",
+    "insight-managed-heap",
+    "insight-binary",
+    "insight-interop",
+    "insight-capture",
+    "insight-overview"
+  ]
+}

package/skills/insight-artifacts/SKILL.md

@@ -0,0 +1,30 @@
+---
+name: insight-artifacts
+description: Retain a completed reverse-engineering evidence file or directory as an ordinary checkpoint using insight-cli artifacts save. Use after Ghidra or any external tool; preserve existing project formats and source of truth.
+---
+
+# Insight Artifacts 0.2.2
+
+If local help/status reports AppData or IPC access denied, retry that **read-only probe**
+with the agent host's normal permission escalation, then use that route for later authorized
+CLI calls too. An explicit **no command was sent** denial is known undispatched and can be
+retried through that route. Keep HOME, profile and owner state; see
+[host execution permissions](references/agent-execution.md). A lost mutation reply needs
+request/status recovery, never blind retry.
+
+Keep evidence as ordinary files in the project's existing layout. This supporting application
+copies a completed file or stable directory; it has no native runtime to download or install.
+
+Run `insight-cli artifacts save <path> --json` using a profile with Update permission.
+Retain the returned ordinary `path` verbatim, file/byte counts and hash if the checkpoint matters.
+Before reporting a saved checkpoint, read its returned path with ordinary file tools and
+confirm that the expected files are present. Copy that exact path into the handoff; never
+reconstruct profile UUIDs or storage directories from memory. If readback fails, report
+the saved receipt and the unresolved access problem instead of claiming a verified handoff.
+The original project records keep their canonical role. No Ghidra selectors, finding schema
+or evidence IDs are required; saving does not merge tool databases or attest interpretations.
+
+Wait until other agents stop editing the selected files. Links and special files are rejected;
+select the actual regular files. A later source edit does not change the saved copy. Finish the report before saving; put its returned checkpoint locator in the final handoff or outside the saved folder. If the source changes afterward, save and verify a new intentional checkpoint before calling it the final copy. After a
+lost answer, inspect retained results before making a new intentional save: every call makes
+a new checkpoint. See [save semantics](references/artifacts.md) for failure and folder behavior.

package/skills/insight-artifacts/references/agent-execution.md

@@ -0,0 +1,36 @@
+# Agent host execution permissions
+
+Keep the user/project host policy and the selected profile. A sandbox can deny writes
+to runtime AppData or access to the local IPC endpoint, including during local help.
+This is a host execution boundary, not evidence that the tool or its inputs are absent.
+
+First retry only `insight-cli --help`, `tools list`, `skill`, or the selected application's
+read-only `status` using the host's normal permission escalation. In Codex, use the
+execution tool's `sandbox_permissions: "require_escalated"` with a scoped explanation
+that the installed CLI needs its existing profile storage/local IPC. Automatic approval
+review or the user decides that request; do not disable the sandbox or approval policy.
+
+Do not work around this by changing HOME/AppData/profile paths, creating another host,
+deleting owner/endpoint files, killing unrelated processes or claiming a missing runtime.
+After the read-only probe succeeds, use the approved execution route for the intended
+public CLI commands. An access refusal explicitly stating **no command was sent** is
+known not dispatched; it is safe to submit that authorized command through the approved
+route. This includes a mutation refused before dispatch. Do not mistake that definite
+pre-dispatch refusal for an unknown execution outcome. Downloads still require their explicit
+network access.
+
+A lost mutation response is different from a denied startup probe: inspect retained
+request/status/recovery evidence and use its request ID when supported. Never blindly
+repeat a publication, script or program run whose outcome is unknown. External-tool
+fallback is allowed by project rules, but record that the intended facade was not used
+and do not invent a successful checkpoint or native result.
+
+## Wait for the original execution
+
+A tool operation may outlast the host execution tool's initial wait. A returned running
+session/cell ID means that command is still in progress, not that the CLI returned no data.
+Use the host's session poll/wait facility until terminal exit and consume stdout/stderr
+before issuing a dependent command. In Codex, an `exec_command` session is continued with
+`write_stdin`; a yielded execution cell uses that host's cell wait. Do not launch a second
+open/install or repeat a CPU action just because the first chunk was empty. If the execution
+really loses its terminal result, use the CLI's request/status recovery as described above.