@eyeauras/insight-cli 0.2.1 → 0.2.3

package/skill-bundle/insight-frida/SKILL.md

@@ -3,7 +3,7 @@ name: insight-frida
 description: Observe native call arguments/results or inspect runtime modules and exports in an explicitly selected authorized process with bounded Frida scripts. Use insight-cli frida to corroborate static findings with actual execution on macOS ARM64.
 ---
 
-# Insight Frida 0.2.1
+# Insight Frida 0.2.3
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skill-bundle/insight-ghidra/SKILL.md

@@ -3,7 +3,7 @@ name: insight-ghidra
 description: Inspect or edit native binaries with Ghidra through insight-cli; use isolated contexts, multi-agent merge/refresh, server, GUI or debugger workflows. Choose this for static native behavior and references, not C# recovery from managed IL.
 ---
 
-# Insight Ghidra 0.2.1
+# Insight Ghidra 0.2.3
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized
@@ -89,3 +89,5 @@ and step out or over the call to inspect its actual return.
 Repeat mapping and live breakpoint setup for every new launch. A saved breakpoint bookmark
 does not prove placement in that new process; check its `trace_location_count` before resuming.
 Use `new` only when creating a session; subsequent calls take its actual returned ID.
+
+Long import/save budgets and stopped-worker abandonment: see [recovery](references/recovery.md) and [setup](references/setup.md). Never replay an uncertain script.

package/skill-bundle/insight-ghidra/references/managed-runtime.md

@@ -22,6 +22,11 @@ A failed install preserves its stage/diagnostics and the old selection. Retrying
 completed cached archives are reused. A later install/doctor/uninstall authenticates and stops
 any leftover disposable probe server before proceeding; an unverified live identity blocks recovery. Interrupted partial downloads are never used as complete files.
 
+On Windows, long Ghidra Java classpaths use an owned per-execution argument file, retained with
+the process diagnostics. `javac` files use UTF-8; `java` launcher files use the Windows system
+code page. Java 21's launcher still requires paths representable in that code page. Unmappable
+characters fail before launch rather than selecting different files through lossy conversion.
+
 `status` without scope is passive: selection, paths, missing components, installations, retained
 stages, recorded checks and live process receipts. It works before installation. It does not start
 Java or create a research workspace. `status --session S --target T` retains the scoped live health

package/skill-bundle/insight-ghidra/references/native-workflows.md

@@ -44,6 +44,16 @@ loader IDs, supported language/compiler specifications and native option definit
 selects a loader explicitly. Primitive options, native address and HexLong options are converted
 and validated; unsupported complex option classes fail explicitly. One program belongs to a target.
 
+For a mixed managed/native or protected PE, first inspect the installed loader options. If the
+task needs its native view and CLI metadata parsing emits repeated warnings or prevents import,
+an explicit PE import may select `--loader <PE-loader-ID-from-discovery>` together with
+`--loader-options '{"Parse CLI headers (if present)":false}'`.
+This is a per-target analysis choice: record it with the findings. For an alternative managed
+import of the same bytes, use a separate disposable profile; targets within one profile reuse
+the same immutable input identity. An output-limit failure means import/analysis is incomplete; inspect
+the retained diagnostics and first-import recovery state before continuing. Do not treat warnings,
+a killed worker or a partial snapshot as a successful analysis or blindly repeat publication.
+
 `formats exporters` lists compatible native exporters and their options. `formats export
 --exporter 'Raw Bytes' --ranges '[{"start":"0x10001","end":"0x10003"}]'
 --output-directory <new-directory>` requires a format supporting restricted address sets.

package/skill-bundle/insight-ghidra/references/recovery.md

@@ -51,3 +51,29 @@ goto. If its original owned GUI process has exited, continuation reports the unc
 as disconnected and retains saved program work. It does not recreate the old cursor or re-enable
 a previous prompt policy. Other unproved live UI effects remain retained until their outcome is
 established or the original process is known to have ended.
+
+## Abandon an uncertain private program attempt
+
+A post-mutation save timeout does not repeat the script or issue another save in the
+error handler. Status exposes the original request identity and retained phase/budget.
+Arbitrary script effects are never inferred from metadata or from an unverified DB.
+After inspecting the retained attempt, explicitly stop only its verified owned worker
+(`tools processes`, then `tools processes kill <process>` if required). Resume the
+last acknowledged private snapshot with:
+
+```sh
+insight-cli permissions grant Destructive
+insight-cli ghidra abandon --session <session> --target <target> \
+  --request-id <original-request> --acknowledge-unknown-effects --json
+insight-cli ghidra open --session <session> --target <target> --json
+```
+
+Abandon requires exactly one unresolved private program operation, an unchanged verified
+previous snapshot/generation, a stopped original worker and no active publication or live
+debugger. It retains the native project, candidate artifacts, original intent/execution and
+previous diagnostic result. Its terminal request is `failed` / `state: abandoned` with
+`outcome: unknown`; no effect is marked applied. Repeating abandonment retrieves the same
+result. Earlier saved private edits remain pending. The original changing request ID cannot
+execute again. Abandoning never undoes external effects or establishes what an arbitrary
+script did; the acknowledgement explicitly accepts that uncertainty. Publication recovery,
+initial import, UI and debugger attempts use their own protocols and cannot use this command.

package/skill-bundle/insight-ghidra/references/setup.md

@@ -48,3 +48,20 @@ debugger runtime directory when relevant. These are runtime profile settings, no
 
 Archive exchange is opt-in through `archiveUrl`; its optional token uses Factory secrets.
 See [archive](archive.md) for the service contract and submission recovery behavior.
+
+## Native operation budgets
+
+Profile `initialImportSeconds` defaults to 3600 (1–86400 seconds); `saveSeconds`
+defaults to 120 (1–3600 seconds). Configure them with `ghidra budgets set
+--initial-import-seconds 7200 --save-seconds 300`; `ghidra budgets show` reads effective values.
+This uses Factory ProfileStore without invalidating research or stopping native contexts.
+Active requests retain their original budget. Generic `profile set` remains guarded for
+profiles containing research; initial profile creation also accepts these fields. Both are execution policy, independent
+of immutable target/load identity. Save and packed snapshot export use the save budget;
+discovery and ordinary HTTP queries keep their 30-second budget. Each native request has
+its own budget, not a total command deadline. Cancellation remains independent.
+
+After an import timeout, wait for the original worker to end, raise its budget and continue
+the original scope. Incomplete private analysis restarts; a completed receipt is reused.
+A save timeout reports `phase: save`, the effective budget and `saveSeconds`. Inspect
+`sessions status`; a native log or broken response stream cannot prove a saved snapshot.

package/skill-bundle/insight-ilspy/SKILL.md

@@ -3,7 +3,7 @@ name: insight-ilspy
 description: Recover C#, inspect IL/types/metadata, extract resources or export projects from managed .NET assemblies through insight-cli ILSpy. Choose native analysis for NativeAOT or ordinary PE machine code.
 ---
 
-# Insight ILSpy 0.2.1
+# Insight ILSpy 0.2.3
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skill-bundle/insight-interop/SKILL.md

@@ -3,7 +3,7 @@ name: insight-interop
 description: Trace a .NET P/Invoke declaration to an explicitly supplied native library export and Ghidra function through insight-cli ilspy query, binary query and scoped ghidra APIs. Use for managed/native linkage evidence while keeping static correspondence separate from observed loading or execution.
 ---
 
-# Insight Interop 0.2.1
+# Insight Interop 0.2.3
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skill-bundle/insight-lldb/SKILL.md

@@ -3,7 +3,7 @@ name: insight-lldb
 description: Observe native runtime arguments, return values, registers, stacks and bounded memory at a selected breakpoint using an owned LLDB launch. Use insight-cli lldb on macOS ARM64 when static findings need a concrete execution check.
 ---
 
-# Insight LLDB 0.2.1
+# Insight LLDB 0.2.3
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skill-bundle/insight-llvm/SKILL.md

@@ -3,7 +3,7 @@ name: insight-llvm
 description: Inspect PE, ELF and Mach-O headers, dependencies, exports and symbols; query PDB debug information or a small instruction window with insight-cli LLVM utilities before opening a full analysis project.
 ---
 
-# Insight LLVM 0.2.1
+# Insight LLVM 0.2.3
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skill-bundle/insight-managed-heap/SKILL.md

@@ -3,7 +3,7 @@ name: insight-managed-heap
 description: Query structured .NET heap objects, primitive fields and managed stacks from a retained CoreCLR dump through insight-cli dotnet-dump query. Use for bounded offline dump investigation with an explicit matching DAC, preserving uncertainty and immutable input identity.
 ---
 
-# Insight Managed Heap 0.2.1
+# Insight Managed Heap 0.2.3
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skill-bundle/insight-managed-metadata/SKILL.md

@@ -3,7 +3,7 @@ name: insight-managed-metadata
 description: Query managed assembly metadata, MethodDef tokens, P/Invoke declarations and bounded IL, or compare two C#/.NET assemblies through insight-cli ilspy query/compare. Use for structured static evidence and changed-method research without executing the target.
 ---
 
-# Insight Managed Metadata 0.2.1
+# Insight Managed Metadata 0.2.3
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skill-bundle/insight-mitmproxy/SKILL.md

@@ -3,7 +3,7 @@ name: insight-mitmproxy
 description: Record, inspect and compare HTTP request/response evidence with insight-cli mitmproxy. Use when an owned client can explicitly use a loopback proxy; read native flow archives or HAR without replaying traffic. System interception and global certificate trust are outside this facade.
 ---
 
-# Insight mitmproxy 0.2.1
+# Insight mitmproxy 0.2.3
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skill-bundle/insight-overview/SKILL.md

@@ -3,7 +3,7 @@ name: insight-overview
 description: Choose bounded tool overviews and focused drilldown through insight-cli without flooding agent context with whole-program code, traces or dumps. Use for tool discovery, scoped evidence paging and keeping native partial coverage separate from complete results.
 ---
 
-# Insight Overview 0.2.1
+# Insight Overview 0.2.3
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skill-bundle/insight-procmon/SKILL.md

@@ -3,7 +3,7 @@ name: insight-procmon
 description: Observe actual file and registry access by an authorized running Windows process through insight-cli procmon. Use when static paths or configuration guesses need runtime evidence; inspect retained captures without collecting again.
 ---
 
-# Insight ProcMon 0.2.1
+# Insight ProcMon 0.2.3
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skill-bundle/insight-re/SKILL.md

@@ -3,7 +3,7 @@ name: insight-re
 description: Investigate shipped programs and binary artifacts with insight-cli and other available tools; retain ordinary research files, coordinate independent agents and publish Ghidra annotations. Use for reverse engineering behavior, not ordinary source-repository browsing.
 ---
 
-# Insight RE 0.2.1
+# Insight RE 0.2.3
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skill-bundle/insight-re/references/recovery.md

@@ -51,3 +51,29 @@ goto. If its original owned GUI process has exited, continuation reports the unc
 as disconnected and retains saved program work. It does not recreate the old cursor or re-enable
 a previous prompt policy. Other unproved live UI effects remain retained until their outcome is
 established or the original process is known to have ended.
+
+## Abandon an uncertain private program attempt
+
+A post-mutation save timeout does not repeat the script or issue another save in the
+error handler. Status exposes the original request identity and retained phase/budget.
+Arbitrary script effects are never inferred from metadata or from an unverified DB.
+After inspecting the retained attempt, explicitly stop only its verified owned worker
+(`tools processes`, then `tools processes kill <process>` if required). Resume the
+last acknowledged private snapshot with:
+
+```sh
+insight-cli permissions grant Destructive
+insight-cli ghidra abandon --session <session> --target <target> \
+  --request-id <original-request> --acknowledge-unknown-effects --json
+insight-cli ghidra open --session <session> --target <target> --json
+```
+
+Abandon requires exactly one unresolved private program operation, an unchanged verified
+previous snapshot/generation, a stopped original worker and no active publication or live
+debugger. It retains the native project, candidate artifacts, original intent/execution and
+previous diagnostic result. Its terminal request is `failed` / `state: abandoned` with
+`outcome: unknown`; no effect is marked applied. Repeating abandonment retrieves the same
+result. Earlier saved private edits remain pending. The original changing request ID cannot
+execute again. Abandoning never undoes external effects or establishes what an arbitrary
+script did; the acknowledgement explicitly accepts that uncertainty. Publication recovery,
+initial import, UI and debugger attempts use their own protocols and cannot use this command.

package/skill-bundle/insight-sevenzip/SKILL.md

@@ -3,7 +3,7 @@ name: insight-sevenzip
 description: Inventory, integrity-check and recover files from archives and supported containers with insight-cli 7-Zip, then hand recovered binaries or configuration to the appropriate research tool.
 ---
 
-# Insight 7-Zip 0.2.1
+# Insight 7-Zip 0.2.3
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skill-bundle/insight-strace/SKILL.md

@@ -3,7 +3,7 @@ name: insight-strace
 description: Observe actual file reads, writes, process creation and network syscalls in an authorized owned native Linux launch using insight-cli strace. Use when static inference needs concrete operating-system interaction evidence.
 ---
 
-# Insight strace 0.2.1
+# Insight strace 0.2.3
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skill-bundle/insight-tshark/SKILL.md

@@ -3,7 +3,7 @@ name: insight-tshark
 description: Inspect an offline PCAP or PCAPNG with insight-cli tshark to identify protocols, HTTP/DNS/TLS fields, packet evidence and reconstructed TCP/UDP streams. Use for captured traffic questions; live acquisition and TLS decryption are separate tasks.
 ---
 
-# Insight TShark 0.2.1
+# Insight TShark 0.2.3
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skill-bundle/insight-windbg/SKILL.md

@@ -3,7 +3,7 @@ name: insight-windbg
 description: Investigate Windows native user-mode minidumps using bounded stacks, threads, registers, modules, memory and disassembly through insight-cli windbg. Use on Windows x64 when a captured runtime state needs native debugger evidence.
 ---
 
-# Insight WinDbg 0.2.1
+# Insight WinDbg 0.2.3
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skill-bundle/manifest.json

@@ -1,7 +1,7 @@
 {
   "schema": 1,
   "package": "@eyeauras/insight-cli",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "skills": [
     "insight-cli",
     "insight-re",

package/skills/insight-artifacts/SKILL.md

@@ -3,7 +3,7 @@ name: insight-artifacts
 description: Retain a completed reverse-engineering evidence file or directory as an ordinary checkpoint using insight-cli artifacts save. Use after Ghidra or any external tool; preserve existing project formats and source of truth.
 ---
 
-# Insight Artifacts 0.2.1
+# Insight Artifacts 0.2.3
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skills/insight-binary/SKILL.md

@@ -3,7 +3,7 @@ name: insight-binary
 description: Query structured PE, ELF and thin Mach-O headers, sections, imports and exports, or make an explicitly guarded new PE subsystem copy through insight-cli binary. Use for scoped binary structure, linkage and copy-only header edits without target execution.
 ---
 
-# Insight Binary 0.2.1
+# Insight Binary 0.2.3
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skills/insight-capture/SKILL.md

@@ -3,7 +3,7 @@ name: insight-capture
 description: Capture one explicitly authorized native program run, exact stdout/stderr and declared file snapshots through insight-cli capture, then inspect or compare retained reports without replay. Use for controlled input/output research, preserving original files and interrupted or unknown outcomes.
 ---
 
-# Insight Capture 0.2.1
+# Insight Capture 0.2.3
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skills/insight-die/SKILL.md

@@ -3,7 +3,7 @@ name: insight-die
 description: Classify unknown executable or container inputs by format, architecture and compiler/runtime/packer signatures with Detect It Easy before choosing managed or native analysis. Use insight-cli die for static triage and preserve scan uncertainty.
 ---
 
-# Insight Detect It Easy 0.2.1
+# Insight Detect It Easy 0.2.3
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skills/insight-dnspy/SKILL.md

@@ -3,7 +3,7 @@ name: insight-dnspy
 description: Debug a managed Windows EXE at an IL breakpoint and read primitive arguments, or change one expected IL Int32 constant in a new assembly copy through insight-cli dnspy. Use when C# decompilation needs observed execution or a controlled binary edit.
 ---
 
-# Insight dnSpyEx 0.2.1
+# Insight dnSpyEx 0.2.3
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skills/insight-dotnet-dump/SKILL.md

@@ -3,7 +3,7 @@ name: insight-dotnet-dump
 description: Capture a managed heap dump or inspect compatible .NET dumps with SOS to recover waiting stacks, objects, fields and retention evidence.
 ---
 
-# Insight .NET Dump 0.2.1
+# Insight .NET Dump 0.2.3
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skills/insight-dotnet-stack/SKILL.md

@@ -3,7 +3,7 @@ name: insight-dotnet-stack
 description: Inspect live managed thread stacks to identify active or waiting work in an explicitly selected .NET process without taking a dump.
 ---
 
-# Insight .NET Stack 0.2.1
+# Insight .NET Stack 0.2.3
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skills/insight-dotnet-trace/SKILL.md

@@ -3,7 +3,7 @@ name: insight-dotnet-trace
 description: Collect and inspect bounded .NET EventPipe traces to identify sampled thread work, waits or runtime activity; distinguish wall-clock samples from CPU consumption.
 ---
 
-# Insight .NET Trace 0.2.1
+# Insight .NET Trace 0.2.3
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skills/insight-frida/SKILL.md

@@ -3,7 +3,7 @@ name: insight-frida
 description: Observe native call arguments/results or inspect runtime modules and exports in an explicitly selected authorized process with bounded Frida scripts. Use insight-cli frida to corroborate static findings with actual execution on macOS ARM64.
 ---
 
-# Insight Frida 0.2.1
+# Insight Frida 0.2.3
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skills/insight-ghidra/SKILL.md

@@ -3,7 +3,7 @@ name: insight-ghidra
 description: Inspect or edit native binaries with Ghidra through insight-cli; use isolated contexts, multi-agent merge/refresh, server, GUI or debugger workflows. Choose this for static native behavior and references, not C# recovery from managed IL.
 ---
 
-# Insight Ghidra 0.2.1
+# Insight Ghidra 0.2.3
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized
@@ -89,3 +89,5 @@ and step out or over the call to inspect its actual return.
 Repeat mapping and live breakpoint setup for every new launch. A saved breakpoint bookmark
 does not prove placement in that new process; check its `trace_location_count` before resuming.
 Use `new` only when creating a session; subsequent calls take its actual returned ID.
+
+Long import/save budgets and stopped-worker abandonment: see [recovery](references/recovery.md) and [setup](references/setup.md). Never replay an uncertain script.

package/skills/insight-ghidra/references/managed-runtime.md

@@ -22,6 +22,11 @@ A failed install preserves its stage/diagnostics and the old selection. Retrying
 completed cached archives are reused. A later install/doctor/uninstall authenticates and stops
 any leftover disposable probe server before proceeding; an unverified live identity blocks recovery. Interrupted partial downloads are never used as complete files.
 
+On Windows, long Ghidra Java classpaths use an owned per-execution argument file, retained with
+the process diagnostics. `javac` files use UTF-8; `java` launcher files use the Windows system
+code page. Java 21's launcher still requires paths representable in that code page. Unmappable
+characters fail before launch rather than selecting different files through lossy conversion.
+
 `status` without scope is passive: selection, paths, missing components, installations, retained
 stages, recorded checks and live process receipts. It works before installation. It does not start
 Java or create a research workspace. `status --session S --target T` retains the scoped live health

package/skills/insight-ghidra/references/native-workflows.md

@@ -44,6 +44,16 @@ loader IDs, supported language/compiler specifications and native option definit
 selects a loader explicitly. Primitive options, native address and HexLong options are converted
 and validated; unsupported complex option classes fail explicitly. One program belongs to a target.
 
+For a mixed managed/native or protected PE, first inspect the installed loader options. If the
+task needs its native view and CLI metadata parsing emits repeated warnings or prevents import,
+an explicit PE import may select `--loader <PE-loader-ID-from-discovery>` together with
+`--loader-options '{"Parse CLI headers (if present)":false}'`.
+This is a per-target analysis choice: record it with the findings. For an alternative managed
+import of the same bytes, use a separate disposable profile; targets within one profile reuse
+the same immutable input identity. An output-limit failure means import/analysis is incomplete; inspect
+the retained diagnostics and first-import recovery state before continuing. Do not treat warnings,
+a killed worker or a partial snapshot as a successful analysis or blindly repeat publication.
+
 `formats exporters` lists compatible native exporters and their options. `formats export
 --exporter 'Raw Bytes' --ranges '[{"start":"0x10001","end":"0x10003"}]'
 --output-directory <new-directory>` requires a format supporting restricted address sets.

package/skills/insight-ghidra/references/recovery.md

@@ -51,3 +51,29 @@ goto. If its original owned GUI process has exited, continuation reports the unc
 as disconnected and retains saved program work. It does not recreate the old cursor or re-enable
 a previous prompt policy. Other unproved live UI effects remain retained until their outcome is
 established or the original process is known to have ended.
+
+## Abandon an uncertain private program attempt
+
+A post-mutation save timeout does not repeat the script or issue another save in the
+error handler. Status exposes the original request identity and retained phase/budget.
+Arbitrary script effects are never inferred from metadata or from an unverified DB.
+After inspecting the retained attempt, explicitly stop only its verified owned worker
+(`tools processes`, then `tools processes kill <process>` if required). Resume the
+last acknowledged private snapshot with:
+
+```sh
+insight-cli permissions grant Destructive
+insight-cli ghidra abandon --session <session> --target <target> \
+  --request-id <original-request> --acknowledge-unknown-effects --json
+insight-cli ghidra open --session <session> --target <target> --json
+```
+
+Abandon requires exactly one unresolved private program operation, an unchanged verified
+previous snapshot/generation, a stopped original worker and no active publication or live
+debugger. It retains the native project, candidate artifacts, original intent/execution and
+previous diagnostic result. Its terminal request is `failed` / `state: abandoned` with
+`outcome: unknown`; no effect is marked applied. Repeating abandonment retrieves the same
+result. Earlier saved private edits remain pending. The original changing request ID cannot
+execute again. Abandoning never undoes external effects or establishes what an arbitrary
+script did; the acknowledgement explicitly accepts that uncertainty. Publication recovery,
+initial import, UI and debugger attempts use their own protocols and cannot use this command.

package/skills/insight-ghidra/references/setup.md

@@ -48,3 +48,20 @@ debugger runtime directory when relevant. These are runtime profile settings, no
 
 Archive exchange is opt-in through `archiveUrl`; its optional token uses Factory secrets.
 See [archive](archive.md) for the service contract and submission recovery behavior.
+
+## Native operation budgets
+
+Profile `initialImportSeconds` defaults to 3600 (1–86400 seconds); `saveSeconds`
+defaults to 120 (1–3600 seconds). Configure them with `ghidra budgets set
+--initial-import-seconds 7200 --save-seconds 300`; `ghidra budgets show` reads effective values.
+This uses Factory ProfileStore without invalidating research or stopping native contexts.
+Active requests retain their original budget. Generic `profile set` remains guarded for
+profiles containing research; initial profile creation also accepts these fields. Both are execution policy, independent
+of immutable target/load identity. Save and packed snapshot export use the save budget;
+discovery and ordinary HTTP queries keep their 30-second budget. Each native request has
+its own budget, not a total command deadline. Cancellation remains independent.
+
+After an import timeout, wait for the original worker to end, raise its budget and continue
+the original scope. Incomplete private analysis restarts; a completed receipt is reused.
+A save timeout reports `phase: save`, the effective budget and `saveSeconds`. Inspect
+`sessions status`; a native log or broken response stream cannot prove a saved snapshot.

package/skills/insight-ilspy/SKILL.md

@@ -3,7 +3,7 @@ name: insight-ilspy
 description: Recover C#, inspect IL/types/metadata, extract resources or export projects from managed .NET assemblies through insight-cli ILSpy. Choose native analysis for NativeAOT or ordinary PE machine code.
 ---
 
-# Insight ILSpy 0.2.1
+# Insight ILSpy 0.2.3
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skills/insight-interop/SKILL.md

@@ -3,7 +3,7 @@ name: insight-interop
 description: Trace a .NET P/Invoke declaration to an explicitly supplied native library export and Ghidra function through insight-cli ilspy query, binary query and scoped ghidra APIs. Use for managed/native linkage evidence while keeping static correspondence separate from observed loading or execution.
 ---
 
-# Insight Interop 0.2.1
+# Insight Interop 0.2.3
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skills/insight-lldb/SKILL.md

@@ -3,7 +3,7 @@ name: insight-lldb
 description: Observe native runtime arguments, return values, registers, stacks and bounded memory at a selected breakpoint using an owned LLDB launch. Use insight-cli lldb on macOS ARM64 when static findings need a concrete execution check.
 ---
 
-# Insight LLDB 0.2.1
+# Insight LLDB 0.2.3
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skills/insight-llvm/SKILL.md

@@ -3,7 +3,7 @@ name: insight-llvm
 description: Inspect PE, ELF and Mach-O headers, dependencies, exports and symbols; query PDB debug information or a small instruction window with insight-cli LLVM utilities before opening a full analysis project.
 ---
 
-# Insight LLVM 0.2.1
+# Insight LLVM 0.2.3
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skills/insight-managed-heap/SKILL.md

@@ -3,7 +3,7 @@ name: insight-managed-heap
 description: Query structured .NET heap objects, primitive fields and managed stacks from a retained CoreCLR dump through insight-cli dotnet-dump query. Use for bounded offline dump investigation with an explicit matching DAC, preserving uncertainty and immutable input identity.
 ---
 
-# Insight Managed Heap 0.2.1
+# Insight Managed Heap 0.2.3
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skills/insight-managed-metadata/SKILL.md

@@ -3,7 +3,7 @@ name: insight-managed-metadata
 description: Query managed assembly metadata, MethodDef tokens, P/Invoke declarations and bounded IL, or compare two C#/.NET assemblies through insight-cli ilspy query/compare. Use for structured static evidence and changed-method research without executing the target.
 ---
 
-# Insight Managed Metadata 0.2.1
+# Insight Managed Metadata 0.2.3
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skills/insight-mitmproxy/SKILL.md

@@ -3,7 +3,7 @@ name: insight-mitmproxy
 description: Record, inspect and compare HTTP request/response evidence with insight-cli mitmproxy. Use when an owned client can explicitly use a loopback proxy; read native flow archives or HAR without replaying traffic. System interception and global certificate trust are outside this facade.
 ---
 
-# Insight mitmproxy 0.2.1
+# Insight mitmproxy 0.2.3
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skills/insight-overview/SKILL.md

@@ -3,7 +3,7 @@ name: insight-overview
 description: Choose bounded tool overviews and focused drilldown through insight-cli without flooding agent context with whole-program code, traces or dumps. Use for tool discovery, scoped evidence paging and keeping native partial coverage separate from complete results.
 ---
 
-# Insight Overview 0.2.1
+# Insight Overview 0.2.3
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skills/insight-procmon/SKILL.md

@@ -3,7 +3,7 @@ name: insight-procmon
 description: Observe actual file and registry access by an authorized running Windows process through insight-cli procmon. Use when static paths or configuration guesses need runtime evidence; inspect retained captures without collecting again.
 ---
 
-# Insight ProcMon 0.2.1
+# Insight ProcMon 0.2.3
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skills/insight-re/SKILL.md

@@ -3,7 +3,7 @@ name: insight-re
 description: Investigate shipped programs and binary artifacts with insight-cli and other available tools; retain ordinary research files, coordinate independent agents and publish Ghidra annotations. Use for reverse engineering behavior, not ordinary source-repository browsing.
 ---
 
-# Insight RE 0.2.1
+# Insight RE 0.2.3
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized