@eyeauras/insight-cli 0.2.4 → 0.3.1

package/dist/src/cli.js

@@ -51,9 +51,12 @@ import { artifactsCommands } from './saved-materials.js';
 import { RuntimeManager, runtimeCommands, runtimeProcesses } from './runtime-manager.js';
 import { packageVersion } from './package-version.js';
 import { runtimeSelection } from './runtime-selection.js';
+import { AnalysisStorage, analysisDirectory } from './analysis-storage.js';
+import { readInitialProgress } from './initial-progress.js';
 const bindingFields = ['java', 'ghidraHome', 'mcpJar', 'mcpJarSha256', 'server', 'repository', 'readerUser', 'publisherUser', 'maxContexts', 'debuggerPython', 'windbgDir', 'archiveUrl'];
 class Owner {
     options;
+    storage;
     profiles = new Map();
     runtimeChanging = new Set();
     async runtime(c, action, quiescent = true) {
@@ -88,10 +91,11 @@ class Owner {
         const directory = c.appArguments.AppDataDirectory;
         if (this.runtimeChanging.has(directory))
             fail('busy', 'Runtime preparation is in progress.');
-        const configuration = digest({ runtime: runtimeSelection(directory), profile: Object.fromEntries(bindingFields.map(key => [key, c.profile.values[key]])), extensions: extensionState(join(directory, 'workspace')).modules.filter(m => m.enabled).map(m => [m.name, m.sha256]) });
+        const root = analysisDirectory(c);
+        const configuration = digest({ analysisDirectory: root, runtime: runtimeSelection(directory, root), profile: Object.fromEntries(bindingFields.map(key => [key, c.profile.values[key]])), extensions: extensionState(join(root, 'workspace')).modules.filter(m => m.enabled).map(m => [m.name, m.sha256]) });
         let profile = this.profiles.get(directory);
         if (!profile) {
-            profile = { workspace: new Workspace(join(directory, 'workspace'), c.profile.name), tasks: new Map(), configuration };
+            profile = { workspace: new Workspace(join(root, 'workspace'), c.profile.name), tasks: new Map(), configuration };
             this.profiles.set(directory, profile);
         }
         if (profile.configuration !== configuration)
@@ -116,6 +120,8 @@ class Owner {
     }
     async invalidateProfile(app) {
         const directory = app.AppDataDirectory, profile = this.profiles.get(directory);
+        if (this.storage?.busy(directory))
+            fail('busy', 'Storage migration is in progress.');
         if (this.runtimeChanging.has(directory))
             fail('busy', 'Runtime preparation is in progress; finish it before changing or deleting the profile.');
         if (toolProfileBusy(directory))
@@ -124,7 +130,7 @@ class Owner {
             fail('busy', 'The profile has active or unverified tool processes.');
         const materials = await readdir(join(directory, 'materials')).catch(error => { if (error.code === 'ENOENT')
             return []; throw error; });
-        if (existsSync(join(directory, 'workspace', 'workspace.sqlite')) || materials.length)
+        if (existsSync(join(directory, 'storage', 'migration.json')) || existsSync(join(directory, 'workspace', 'workspace.sqlite')) || materials.length)
             fail('blocked', 'Profile has retained research data; preserve its workspace and materials before deleting or reconfiguring it.');
         if (profile) {
             await (await profile.backend)?.dispose();
@@ -132,6 +138,16 @@ class Owner {
             this.profiles.delete(directory);
         }
     }
+    async releaseStorage(c) {
+        const directory = c.appArguments.AppDataDirectory, profile = this.profiles.get(directory);
+        if (!profile)
+            return;
+        if (profile.tasks.size)
+            fail('busy', 'Research commands are active.');
+        await (await profile.backend)?.dispose();
+        profile.workspace.close();
+        this.profiles.delete(directory);
+    }
     async dispose() {
         for (const profile of this.profiles.values()) {
             await Promise.allSettled([...profile.tasks.values()]);
@@ -260,6 +276,8 @@ function scopedFailures(entry, owner, parents = []) {
 }
 export function createDefinition(options = {}) {
     const owner = new Owner(options);
+    const storage = new AnalysisStorage(options.runtime?.profileStore, c => owner.releaseStorage(c));
+    owner.storage = storage;
     const definition = {
         name: 'insight-cli', applicationId: 'insight-cli', version: packageVersion, description: 'Isolated research contexts and coordinated Ghidra analysis',
         resources: [owner], permissions: { categories: [{ name: 'Destructive', description: 'Explicit deletion or replacement of retained research data', enabledByDefault: false }] }, ...(options.runtime ? { runtime: options.runtime } : {}),
@@ -355,6 +373,11 @@ export function createDefinition(options = {}) {
                 }, { permission: Permission.ReadOnly, options: [{ flags: '--target <id>', description: 'Inspect one target context' }, ...paged] }),
             ]),
             command('ghidra', 'Research through an isolated saved context', [
+                command('progress', 'Read initial-model import/publication progress without starting Ghidra', async ({ options: o }, c) => {
+                    const selected = owner.selected(c), who = scope(o);
+                    selected.workspace.context(who);
+                    return { ...who, progress: await readInitialProgress(selected.workspace.directory, who.target) };
+                }, { permission: Permission.ReadOnly, options: scoped }),
                 command('budgets', 'Inspect or configure native execution budgets', [
                     command('show', 'Read effective per-request native budgets', (_invocation, c) => ({ profile: c.profile.name, initialImportSeconds: ghidraBudget(c.profile.values, 'import') / 1000, saveSeconds: ghidraBudget(c.profile.values, 'save') / 1000 }), { permission: Permission.ReadOnly }),
                     command('set', 'Configure subsequent native requests without invalidating retained research', async ({ options: o }, c) => {
@@ -385,7 +408,7 @@ export function createDefinition(options = {}) {
                         if (!String(error.code).endsWith('.notFound'))
                             throw error;
                     }
-                    const settings = { ...previous, autoAnalyze: o.analysis === false ? false : previous?.autoAnalyze ?? true,
+                    const settings = { ...previous, autoAnalyze: typeof o.analysis === 'boolean' ? o.analysis : previous?.autoAnalyze ?? false,
                         ...(o.language ? { language: text(o.language) } : {}), ...(o.compilerSpec ? { compilerSpec: text(o.compilerSpec) } : {}),
                         ...(o.imageBase ? { imageBase: text(o.imageBase) } : {}), ...(o.loader ? { loader: text(o.loader, 512) } : {}),
                         ...(o.loaderOptions !== undefined ? { loaderOptions: object(parseDomainJson(text(o.loaderOptions, 16000))) } : {}) };
@@ -393,7 +416,8 @@ export function createDefinition(options = {}) {
                 }, { permission: Permission.Update, options: [{ flags: '--session <id>', description: 'Use new for independent work, or an existing session', required: true },
                         { flags: '--target <id>', description: 'Continue existing input instead of supplying a file' }, request,
                         { flags: '--mode <mode>', description: 'Request headless or gui; continuation preserves current mode' },
-                        { flags: '--no-analysis', description: 'Skip initial automatic analysis' },
+                        { flags: '--analysis', description: 'Opt in to full initial automatic analysis (new targets only)' },
+                        { flags: '--no-analysis', description: 'Skip initial automatic analysis (the default for new targets)' },
                         { flags: '--language <id>', description: 'Explicit initial loader language' },
                         { flags: '--compiler-spec <id>', description: 'Explicit initial compiler specification' },
                         { flags: '--image-base <address>', description: 'Initial image base' },
@@ -483,8 +507,9 @@ export function createDefinition(options = {}) {
             ]),
         ],
     };
-    return { ...definition, commands: definition.commands?.map(entry => entry.name === 'ghidra' ?
-            scopedFailures({ ...entry, children: extendQueries(extendQueries(extendQueries(entry.children ?? [], queryCommands(c => owner.selected(c).research)), mutationCommands(c => owner.selected(c).research)), [...sdkCommands(c => owner.selected(c).research), ...sdkFileCommands(c => owner.selected(c).sdkFiles), ...trackingCommands(c => owner.selected(c).tracking), ...crossCommands(c => owner.selected(c).research), ...administrationCommands(c => owner.selected(c).administration, options.backend ? undefined : async (c) => { const status = await new RuntimeManager(c).status(); return status.state === 'not_ready' ? { ...status.server, connected: false, state: 'runtime_not_ready', missing: status.missing } : undefined; }),
-                    ...extensionCommands(c => new Extensions(join(c.appArguments.AppDataDirectory, 'workspace'))), ...extensionInventoryCommands(c => owner.selected(c).backend), ...pluginCommands(c => owner.selected(c).ui), ...synchronizationCommands(c => owner.selected(c).synchronization), ...utilityCommands(), ...runtimeCommands((c, action, quiescent) => owner.runtime(c, action, quiescent)), ...lifecycleCommands(c => owner.selected(c).lifecycle, c => new RuntimeManager(c).status()), ...projectCommands(c => owner.selected(c).projects), ...uiCommands(c => owner.selected(c).ui), ...debuggerCommands(c => owner.selected(c).debugger), ...archiveCommands(c => owner.selected(c).archive)]) }, owner) : entry) };
+    const commands = definition.commands?.map(entry => entry.name === 'ghidra' ?
+        scopedFailures({ ...entry, children: extendQueries(extendQueries(extendQueries(entry.children ?? [], queryCommands(c => owner.selected(c).research)), mutationCommands(c => owner.selected(c).research)), [...sdkCommands(c => owner.selected(c).research), ...sdkFileCommands(c => owner.selected(c).sdkFiles), ...trackingCommands(c => owner.selected(c).tracking), ...crossCommands(c => owner.selected(c).research), ...administrationCommands(c => owner.selected(c).administration, options.backend ? undefined : async (c) => { const status = await new RuntimeManager(c).status(); return status.state === 'not_ready' ? { ...status.server, connected: false, state: 'runtime_not_ready', missing: status.missing } : undefined; }),
+                ...extensionCommands(c => new Extensions(join(analysisDirectory(c), 'workspace'))), ...extensionInventoryCommands(c => owner.selected(c).backend), ...pluginCommands(c => owner.selected(c).ui), ...synchronizationCommands(c => owner.selected(c).synchronization), ...utilityCommands(), ...runtimeCommands((c, action, quiescent) => owner.runtime(c, action, quiescent)), ...lifecycleCommands(c => owner.selected(c).lifecycle, c => new RuntimeManager(c).status()), ...projectCommands(c => owner.selected(c).projects), ...uiCommands(c => owner.selected(c).ui), ...debuggerCommands(c => owner.selected(c).debugger), ...archiveCommands(c => owner.selected(c).archive)]) }, owner) : entry);
+    return { ...definition, commands: [...(commands ?? []).map(e => storage.wrap(e)), storage.commands()] };
 }
 export const createInsightCli = (options = {}) => createCli(createDefinition(options));

package/dist/src/contexts.js

@@ -167,8 +167,8 @@ export class GhidraContexts {
         }
     }
     async verified(binding, target, verifySource = true) {
-        const root = resolve(binding.root);
-        if (!root.startsWith(resolve(this.directory()) + sep) || await realpath(root) !== root || binding.target !== target.id || binding.runtimeFingerprint !== this.inputs.fingerprint)
+        const root = await realpath(binding.root);
+        if (!root.startsWith(resolve(this.directory()) + sep) || binding.target !== target.id || binding.runtimeFingerprint !== this.inputs.fingerprint)
             fail('binding', 'Native context receipt does not match its profile, target or runtime.');
         if (stable(JSON.parse(await readFile(join(root, 'process.json'), 'utf8'))) !== stable(binding))
             fail('binding', 'Native context receipt changed.');
@@ -219,11 +219,11 @@ export class GhidraContexts {
         this.running.delete(binding.root);
     }
     async debuggerReleased(binding) {
-        const root = resolve(binding.root);
-        if (!root.startsWith(resolve(this.directory()) + sep) || await realpath(root) !== root ||
+        const root = await realpath(binding.root);
+        if (!root.startsWith(resolve(this.directory()) + sep) ||
             stable(JSON.parse(await readFile(join(root, 'process.json'), 'utf8'))) !== stable(binding))
             fail('binding', 'Debugger lifetime binding moved outside its owned context.');
-        const directory = join(binding.root, 'debugger-supervisors'), deadline = Date.now() + 15000;
+        const directory = join(root, 'debugger-supervisors'), deadline = Date.now() + 15000;
         for (;;) {
             let names;
             try {
@@ -305,7 +305,7 @@ export class GhidraContexts {
             if (await realpath(root) !== resolve(root))
                 fail('binding', 'Legacy initial-import stage moved outside owned storage.');
             const binding = JSON.parse(await readFile(join(root, 'process.json'), 'utf8'));
-            if (binding.root !== root || binding.target !== target.id || binding.kind !== 'bootstrap' || binding.program !== programPath(target.id))
+            if (await realpath(binding.root) !== root || binding.target !== target.id || binding.kind !== 'bootstrap' || binding.program !== programPath(target.id))
                 fail('binding', 'Legacy bootstrap receipt changed.');
             let stopped = false;
             try {
@@ -872,8 +872,8 @@ public class ${name} extends GhidraScript {
     }
     async closed(scope) {
         const context = this.workspace.context(scope), path = join(this.directory(), 'context', context.id, 'current.json');
-        const binding = JSON.parse(await readFile(path, 'utf8')), root = resolve(binding.root);
-        if (!root.startsWith(resolve(this.directory()) + sep) || await realpath(root) !== root || binding.context !== context.id || binding.target !== scope.target ||
+        const binding = JSON.parse(await readFile(path, 'utf8')), root = await realpath(binding.root);
+        if (!root.startsWith(resolve(this.directory()) + sep) || binding.context !== context.id || binding.target !== scope.target ||
             stable(JSON.parse(await readFile(join(root, 'process.json'), 'utf8'))) !== stable(binding))
             fail('binding', 'Closed context receipt changed.');
         try {

package/dist/src/ghidra-processes.js

@@ -5,16 +5,17 @@ import { serverIdentity, stopLocalServer } from './server.js';
 import { HttpBridge } from './transport.js';
 import { registerExistingProcess } from './tool-runtime/supervisor.js';
 import { fail } from './model.js';
+import { analysisDirectory } from './analysis-storage.js';
 async function ownedPath(c, path) {
     if (typeof path !== 'string')
         fail('binding', 'Tool resource moved outside this profile.');
-    const supplied = resolve(path), profile = resolve(c.appArguments.AppDataDirectory), canonical = await realpath(profile);
-    const base = supplied.startsWith(profile + sep) ? profile : supplied.startsWith(canonical + sep) ? canonical : undefined;
+    const supplied = resolve(path), profile = resolve(c.appArguments.AppDataDirectory), canonical = await realpath(profile), analysis = await realpath(analysisDirectory(c));
+    const base = supplied.startsWith(profile + sep) ? profile : supplied.startsWith(canonical + sep) ? canonical : supplied.startsWith(analysis + sep) ? analysis : undefined;
     if (!base)
         fail('binding', 'Tool resource moved outside this profile.');
     // Keep Factory's raw AppData identity in process records, but compare native resources
     // under its canonical profile. Accept the parent alias, never a replaced child link.
-    const expected = join(canonical, relative(base, supplied));
+    const suffix = relative(base, supplied), expected = base === analysis ? supplied : ['workspace', 'runtime', 'materials', 'temp'].some(tree => suffix === tree || suffix.startsWith(tree + sep)) ? join(analysis, suffix) : join(canonical, suffix);
     if (await realpath(supplied) !== expected)
         fail('binding', 'Tool resource moved outside this profile.');
     return expected;
@@ -53,7 +54,7 @@ export function ghidraProcessHooks(workspace, close) {
     return {
         verify: verifyGhidraProcess,
         async discover(c) {
-            const directory = c.appArguments.AppDataDirectory, executable = runtimeSelection(directory)?.java ?? String(c.profile.values.java ?? 'unverified-legacy-executable');
+            const directory = c.appArguments.AppDataDirectory, executable = runtimeSelection(directory, analysisDirectory(c))?.java ?? String(c.profile.values.java ?? 'unverified-legacy-executable');
             async function walk(path, depth = 0) {
                 if (depth > 6)
                     return;

package/dist/src/initial-model.js

@@ -2,6 +2,7 @@ import { mkdir, realpath, readFile, open, link, unlink } from 'node:fs/promises'
 import { join, resolve } from 'node:path';
 import { randomUUID } from 'node:crypto';
 import { stable, object, fail } from './model.js';
+import { initialProgress, progressPhase, readInitialProgress } from './initial-progress.js';
 export const initialRoot = (workspace, target) => join(workspace.directory, 'ghidra-native', 'initial', target);
 export async function initialIntent(workspace, target) {
     try {
@@ -15,6 +16,24 @@ export async function initialIntent(workspace, target) {
 }
 /** Immutable input/authority binding; private attempts and conditional first creation share it. */
 export async function initializeModel(workspace, target, binding, server, fingerprint) {
+    try {
+        return await initialize(workspace, target, binding, server, fingerprint);
+    }
+    catch (error) {
+        try {
+            const progress = await readInitialProgress(workspace.directory, target.id);
+            // A busy or disconnected caller must not overwrite another live native worker's observation.
+            if (progress && progress.state !== 'complete' && (progress.pid === process.pid || progress.workerAlive === false)) {
+                const code = String(error.code ?? '');
+                const state = code === 'tool.timeout' ? 'timed_out' : code === 'tool.cancelled' ? 'cancelled' : progress.state === 'failed' || progress.state === 'cancelled' ? progress.state : 'unknown';
+                await initialProgress(initialRoot(workspace, target.id), target.id, progress.phase, state);
+            }
+        }
+        catch { /* Preserve the authoritative operation failure when observation storage also fails. */ }
+        throw error;
+    }
+}
+async function initialize(workspace, target, binding, server, fingerprint) {
     const root = initialRoot(workspace, target.id);
     await mkdir(root, { recursive: true, mode: 0o700 });
     if (await realpath(root) !== resolve(root))
@@ -54,7 +73,8 @@ export async function initializeModel(workspace, target, binding, server, finger
         intent = await initialIntent(workspace, target.id);
     }
     if (!intent || typeof intent.id !== 'string' || !/^[a-f0-9-]{36}$/.test(intent.id) ||
-        Object.entries(expected).some(([key, value]) => stable(intent[key]) !== stable(value)))
+        Object.entries(expected).filter(([key]) => key !== 'input').some(([key, value]) => stable(intent[key]) !== stable(value)) ||
+        typeof intent.input !== 'string' || await realpath(intent.input) !== expected.input)
         fail('binding', 'Retained initial model differs from its input, load settings, runtime or repository authority.');
     if (workspace.model(target.id).state === 'opening')
         workspace.beginModelInitialization(target.id);
@@ -66,20 +86,22 @@ export async function initializeModel(workspace, target, binding, server, finger
     const receipt = object(JSON.parse(await readFile(join(root, 'import.json'), 'utf8'))), name = receipt.snapshot;
     if (typeof name !== 'string' || !/^attempt-[a-f0-9-]{36}\.gzf$/.test(name))
         fail('binding', 'Initial model snapshot receipt is malformed.');
-    const snapshot = await workspace.captureSnapshot(join(root, name));
+    const snapshot = await progressPhase(root, target.id, 'snapshot-verification', () => workspace.captureSnapshot(join(root, name)));
     if (snapshot.sha256 !== receipt.snapshotSha256)
         fail('binding', 'Initial saved snapshot changed before publication.');
-    let result = await server.initialPublication(binding, root, 'stage');
+    const publication = (operation) => progressPhase(root, target.id, 'publication-' + operation, () => server.initialPublication(binding, root, operation));
+    let result = await publication('stage');
     if (result.state === 'staged') {
-        const proof = await server.initialPublication(binding, root, 'verify-stage');
+        const proof = await publication('verify-stage');
         if (proof.state !== 'stage_verified' || proof.version !== 1 || proof.snapshotBuffersVerified !== true)
             fail('unknown', 'Independent initial staging readback did not establish the complete snapshot.');
-        result = await server.initialPublication(binding, root, 'promote');
+        result = await publication('promote');
     }
     if (result.state !== 'published' || result.version !== 1 || result.snapshotBuffersVerified !== true)
         fail('unknown', 'Initial publication requires reconciliation against its saved snapshot.');
-    const verified = await server.initialPublication(binding, root, 'verify');
+    const verified = await publication('verify');
     if (verified.state !== 'verified' || verified.version !== 1 || verified.snapshotBuffersVerified !== true)
         fail('unknown', 'Independent initial-model readback did not establish the complete saved buffers.');
     workspace.establishModel(target.id, 1, snapshot);
+    await initialProgress(root, target.id, 'complete', 'complete');
 }

package/dist/src/initial-progress.d.ts

@@ -0,0 +1,4 @@
+/** Observation only. Completion receipts and the workspace remain the outcome authority. */
+export declare function readInitialProgress(directory: string, target: string): Promise<any>;
+export declare function initialProgress(root: string, target: string, phase: string, state?: string): Promise<void>;
+export declare function progressPhase<T>(root: string, target: string, phase: string, action: () => Promise<T>): Promise<T>;

package/dist/src/initial-progress.js

@@ -0,0 +1,64 @@
+import { readFile, mkdir } from 'node:fs/promises';
+import { join } from 'node:path';
+import { atomicWrite } from './tool-runtime/store.js';
+/** Observation only. Completion receipts and the workspace remain the outcome authority. */
+export async function readInitialProgress(directory, target) {
+    try {
+        const value = JSON.parse(await readFile(join(directory, 'ghidra-native', 'initial', target, 'progress.json'), 'utf8'));
+        if (value.schema !== 1 || value.target !== target)
+            throw Error('Invalid initial progress binding');
+        const ageMs = Math.max(0, Date.now() - Date.parse(value.updatedAt));
+        let workerAlive;
+        if (Number.isSafeInteger(value.pid) && value.pid > 0)
+            try {
+                process.kill(value.pid, 0);
+                workerAlive = true;
+            }
+            catch (error) {
+                if (error.code === 'ESRCH')
+                    workerAlive = false;
+            }
+        return { ...value, operation: 'initial-model', ageMs, elapsedMs: Math.max(0, (value.state === 'running' ? Date.now() : Date.parse(value.updatedAt)) - Date.parse(value.startedAt)),
+            ...(workerAlive === undefined ? {} : { workerAlive }),
+            observation: value.state === 'running' && (workerAlive === false || ageMs > 15000) ? 'stale' : 'current' };
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return null;
+        throw error;
+    }
+}
+export async function initialProgress(root, target, phase, state = 'running') {
+    await mkdir(root, { recursive: true, mode: 0o700 });
+    let startedAt = new Date().toISOString();
+    try {
+        const previous = JSON.parse(await readFile(join(root, 'progress.json'), 'utf8'));
+        if (previous.target === target)
+            startedAt = previous.startedAt;
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            throw error;
+    }
+    await atomicWrite(join(root, 'progress.json'), { schema: 1, target, phase, state, pid: process.pid, startedAt, updatedAt: new Date().toISOString(), indeterminate: true });
+}
+export async function progressPhase(root, target, phase, action) {
+    await initialProgress(root, target, phase);
+    let pending = Promise.resolve(), failure;
+    const timer = setInterval(() => { pending = pending.then(() => initialProgress(root, target, phase)).catch(error => { failure = error; }); }, 2000);
+    timer.unref();
+    let actionFailed = false;
+    try {
+        return await action();
+    }
+    catch (error) {
+        actionFailed = true;
+        throw error;
+    }
+    finally {
+        clearInterval(timer);
+        await pending;
+        if (failure && !actionFailed)
+            throw failure;
+    }
+}

package/dist/src/native-inputs.js

@@ -1,4 +1,5 @@
 import { runTool } from './tool-runtime/run.js';
+import { javaClasspathArguments } from './tool-runtime/java-arguments.js';
 import { createHash, randomUUID } from 'node:crypto';
 import { readFile, writeFile, readdir, mkdir, open, rename, rm, realpath, stat } from 'node:fs/promises';
 import { basename, delimiter, dirname, isAbsolute, join, relative, sep } from 'node:path';
@@ -81,7 +82,7 @@ export async function nativeRuntimeFingerprint(ghidraVersion, files) {
 }
 export async function nativeInputs(values, directory, c) {
     if (directory)
-        values = runtimeValues(dirname(directory), values);
+        values = runtimeValues(c?.appArguments.AppDataDirectory ?? dirname(directory), values, typeof values.analysisDirectory === 'string' ? values.analysisDirectory : undefined);
     if (!values.java || !values.ghidraHome)
         fail('configuration', 'Ghidra is not installed. Run insight-cli ghidra install, or supply external runtime paths.');
     const requested = [text(values.java, 4096), text(values.ghidraHome, 4096), text(values.mcpJar ?? packagedMcpJar, 4096)];
@@ -118,7 +119,7 @@ export async function nativeInputs(values, directory, c) {
     const files = await nativeRuntimeFiles(ghidraHome, java);
     const baseFingerprint = await nativeRuntimeFingerprint(ghidraVersion, [...files, { name: 'bridge/GhidraMCP-7.0.0.jar', path: mcpJar }]);
     if (directory) {
-        const selected = runtimeSelection(dirname(directory));
+        const selected = runtimeSelection(c?.appArguments.AppDataDirectory ?? dirname(directory), typeof values.analysisDirectory === 'string' ? values.analysisDirectory : undefined);
         if (selected && selected.fingerprint !== baseFingerprint)
             fail('binding', 'Selected runtime inputs differ from their installation receipt; reinstall or restore the verified files.');
     }
@@ -158,7 +159,7 @@ export async function nativeHelpers(directory, inputs, c) {
         if (c)
             await runTool(c, { tool: 'ghidra', role: 'compile-helpers', installation: inputs.fingerprint, executable, arguments: args, timeoutMs: 60000, maxOutputBytes: 262144 });
         else
-            await run(executable, args, { timeout: 60000, maxBuffer: 262144 });
+            await run(executable, await javaClasspathArguments(temporary, 'ghidra', executable, args), { timeout: 60000, maxBuffer: 262144 });
         const complete = await open(join(temporary, 'complete'), 'wx', 0o600);
         try {
             await complete.writeFile(key);

package/dist/src/runtime-manager.js

@@ -1,4 +1,5 @@
 import { runTool } from './tool-runtime/run.js';
+import { analysisDirectory } from './analysis-storage.js';
 import { readFile, mkdir, rename, rm, realpath, readdir, stat, cp } from 'node:fs/promises';
 import { existsSync, realpathSync } from 'node:fs';
 import { join, dirname, resolve, delimiter, basename } from 'node:path';
@@ -104,9 +105,9 @@ export class RuntimeManager {
     }
     // Canonicalize storage once the profile exists, without creating it for passive status.
     // Keep the Factory directory for shared process/lock identity and existing run receipts.
-    get root() { return runtimeRoot(existsSync(this.directory) ? realpathSync.native(this.directory) : this.directory); }
+    get root() { const root = runtimeRoot(existsSync(this.directory) ? realpathSync.native(this.directory) : this.directory); return existsSync(root) ? realpathSync.native(root) : root; }
     async status() {
-        const selected = runtimeSelection(this.directory), values = selected ? runtimeValuesForStatus(selected, this.c.profile.values) : this.c.profile.values;
+        const selected = runtimeSelection(this.directory, analysisDirectory(this.c)), values = selected ? runtimeValuesForStatus(selected, this.c.profile.values) : this.c.profile.values;
         const java = typeof values.java === 'string' ? values.java : undefined, home = typeof values.ghidraHome === 'string' ? values.ghidraHome : undefined;
         const missing = [];
         if (!java || !existsSync(java))
@@ -203,7 +204,7 @@ export class RuntimeManager {
             for (const name of names) {
                 if (!/^[a-f0-9-]{36}$/.test(name))
                     continue;
-                const root = join(this.root, parent, name, ...(parent === 'stages' ? ['validation'] : []));
+                const root = join(analysisDirectory(this.c), 'runtime', parent, name, ...(parent === 'stages' ? ['validation'] : []));
                 if (existsSync(join(root, 'server/local.json'))) {
                     if (await realpath(root) !== resolve(root))
                         fail('binding', 'Retained runtime probe moved outside its owned storage.');
@@ -285,7 +286,7 @@ export class RuntimeManager {
         return withToolLock(this.directory, 'ghidra', async () => {
             await assertUnused(this.directory, 'ghidra');
             await this.cleanupProbes();
-            const selected = runtimeSelection(this.directory);
+            const selected = runtimeSelection(this.directory, analysisDirectory(this.c));
             if (!selected)
                 fail('configuration', 'No managed selection exists; externally configured profile paths are never removed.');
             if (purgeCache && selected.id) {
@@ -339,7 +340,7 @@ export class RuntimeManager {
     }
     async doctor() {
         await this.cleanupProbes();
-        const root = join(this.root, 'checks', randomUUID()), values = runtimeValues(this.directory, this.c.profile.values);
+        const root = join(analysisDirectory(this.c), 'runtime/checks', randomUUID()), values = runtimeValues(this.directory, this.c.profile.values, analysisDirectory(this.c));
         const inputs = await nativeInputs(values, undefined, this.c), native = await this.probe(inputs, root);
         let debuggerCheck = { state: 'host_specific' };
         if (managedGhidraDebugger())

package/dist/src/runtime-selection.d.ts

@@ -9,5 +9,5 @@ export interface RuntimeSelection {
     uninstalledAt?: string;
 }
 export declare const runtimeRoot: (directory: string) => string;
-export declare function runtimeSelection(directory: string): RuntimeSelection | undefined;
-export declare function runtimeValues(directory: string, values: Record<string, unknown>): Record<string, unknown>;
+export declare function runtimeSelection(directory: string, analysis?: string): RuntimeSelection | undefined;
+export declare function runtimeValues(directory: string, values: Record<string, unknown>, analysis?: string): Record<string, unknown>;

package/dist/src/runtime-selection.js

@@ -1,8 +1,8 @@
 import { readFileSync, existsSync, realpathSync } from 'node:fs';
 import { join, isAbsolute, resolve } from 'node:path';
-import { fail, object } from './model.js';
+import { fail, object, digest } from './model.js';
 export const runtimeRoot = (directory) => join(directory, 'runtime');
-export function runtimeSelection(directory) {
+export function runtimeSelection(directory, analysis = directory) {
     const path = join(runtimeRoot(directory), 'selection.json');
     if (!existsSync(path))
         return;
@@ -15,23 +15,30 @@ export function runtimeSelection(directory) {
             fail('binding', 'Managed runtime moved outside its owned installation.');
         // Workspace resolves AppData physically; older install receipts can retain a profile
         // alias such as /tmp -> /private/tmp. Accept that same profile, never an inner escape.
-        let profile, recorded, home;
+        let profile, recorded, owned, home, retained = false;
         try {
             profile = realpathSync.native(directory);
             recorded = realpathSync.native(recordedProfile);
+            owned = realpathSync.native(analysis);
+            if (recorded !== profile && recorded !== owned) {
+                const marker = object(JSON.parse(readFileSync(join(recorded, '.insight-analysis.json'), 'utf8')));
+                retained = marker.schema === 1 && marker.binding === digest(profile);
+            }
+            if (realpathSync.native(runtimeRoot(directory)) !== join(owned, 'runtime') || realpathSync.native(runtimeRoot(recordedProfile)) !== join(owned, 'runtime'))
+                fail('binding', 'Managed runtime root differs from its configured analysis owner.');
             if (existsSync(value.ghidraHome))
                 home = realpathSync.native(value.ghidraHome);
         }
         catch {
             fail('binding', 'Managed runtime profile ownership could not be verified.');
         }
-        if (recorded !== profile || home !== undefined && home !== join(runtimeRoot(profile), 'installations', id, 'ghidra'))
+        if (recorded !== profile && recorded !== owned && !retained || home !== undefined && home !== join(runtimeRoot(owned), 'installations', id, 'ghidra'))
             fail('binding', 'Managed runtime moved outside its owned installation.');
     }
     return value;
 }
-export function runtimeValues(directory, values) {
-    const selected = runtimeSelection(directory);
+export function runtimeValues(directory, values, analysis) {
+    const selected = runtimeSelection(directory, analysis);
     if (!selected)
         return values;
     if (selected.uninstalledAt)

package/dist/src/saved-materials.js

@@ -3,6 +3,7 @@ import { createHash, randomUUID } from 'node:crypto';
 import { constants } from 'node:fs';
 import { lstat, mkdir, open, opendir, realpath, rename, rm } from 'node:fs/promises';
 import { basename, isAbsolute, join, relative, resolve, sep } from 'node:path';
+import { analysisDirectory } from './analysis-storage.js';
 const maximumEntries = 100_000, maximumDepth = 128;
 function fail(code, message) { throw new CliError(message, { code: 'artifacts.' + code }); }
 function check(signal) { if (signal?.aborted)
@@ -190,7 +191,7 @@ export function artifactsCommands() {
             command('save <path>', 'Save a complete independent copy of a file or directory in this profile', ({ args }, context) => {
                 if (typeof args.path !== 'string' || !args.path || args.path.includes('\0'))
                     fail('invalid', 'Provide one file or directory path.');
-                return saveMaterials(context.appArguments.AppDataDirectory, resolve(context.cwd, args.path), context.signal);
+                return saveMaterials(analysisDirectory(context), resolve(context.cwd, args.path), context.signal);
             }, { permission: Permission.Update }),
         ])];
 }

package/dist/src/server.js

@@ -203,6 +203,16 @@ export class GhidraServer {
     }
     async initialImport(root) {
         const timeoutMilliseconds = ghidraBudget(this.c.profile.values, 'import');
+        const report = async () => {
+            try {
+                const p = object(JSON.parse(await readFile(join(root, 'progress.json'), 'utf8')));
+                const elapsed = Math.round((Date.now() - Date.parse(String(p.startedAt))) / 1000);
+                this.c.progress(`Ghidra ${String(p.phase)}: ${elapsed}s${typeof p.total === 'number' ? `; task ${String(p.completed)}/${p.total}` : ''}${p.message ? `; ${String(p.message).replace(/[\r\n\x00-\x1f]/g, ' ')}` : ''}`);
+            }
+            catch { /* Progress observation never changes the native operation's outcome. */ }
+        };
+        const timer = setInterval(() => { void report(); }, 5000);
+        timer.unref();
         try {
             return await this.run('initial-import', 'InsightInitialImport', [root], {}, undefined, [0], timeoutMilliseconds);
         }
@@ -211,8 +221,12 @@ export class GhidraServer {
                 throw new CliError(error.message + ' Initial import remains unproved. Increase profile initialImportSeconds and continue the original scope; incomplete private analysis restarts from the retained input.', { code: error.code, result: { phase: 'initial-import', timeoutMilliseconds, budgetSetting: 'initialImportSeconds', outcome: 'unknown', diagnostics: error.result } });
             throw error;
         }
+        finally {
+            clearInterval(timer);
+        }
     }
     async initialPublication(binding, root, operation = 'stage') {
+        this.c.progress('Ghidra initial publication: ' + operation);
         return this.run('initial-publication', 'db.InsightInitialPublication', [root, operation], await this.credentials(binding, operation.startsWith('verify') ? 'reader' : 'publisher'));
     }
     async publish(binding, path, snapshot, expected, request, journal, sourceSha) {

package/dist/src/tool-runtime/installer.js

@@ -1,4 +1,5 @@
-import { mkdir, stat, rm, readdir, writeFile, readFile } from 'node:fs/promises';
+import { analysisDirectory } from '../analysis-storage.js';
+import { mkdir, stat, rm, readdir, writeFile, readFile, realpath } from 'node:fs/promises';
 import { join, resolve, sep, dirname } from 'node:path';
 import { cacheArtifact, consumeArchive, extractArchive, fileSha256, archiveName } from './archives.js';
 import { atomicWrite, readJson, toolRoot, withToolLock, installationStage, removeInstallation, treeFingerprint, assertUnused, withToolUse } from './store.js';
@@ -7,7 +8,7 @@ import { digest, fail, text } from '../model.js';
 /** Read-only verification used by an owned child after the command owner has staged a runtime. */
 export async function verifyManagedInstallation(directory, tool, selected) {
     const root = join(toolRoot(directory, tool), 'installations', selected.id);
-    if (selected.schema !== 1 || selected.tool !== tool || selected.mode !== 'managed' || selected.uninstalledAt || !/^[a-f0-9]{64}$/.test(selected.id) || selected.root !== root || !resolve(selected.executable).startsWith(resolve(root) + sep))
+    if (selected.schema !== 1 || selected.tool !== tool || selected.mode !== 'managed' || selected.uninstalledAt || !/^[a-f0-9]{64}$/.test(selected.id) || await realpath(selected.root) !== await realpath(root) || !(await realpath(selected.executable)).startsWith(await realpath(root) + sep))
         fail('binding', 'Invalid managed tool installation receipt.');
     const ready = await readJson(join(root, 'ready.json'));
     const binding = (v) => { const { selectedAt, uninstalledAt, ...rest } = v; return rest; };
@@ -27,8 +28,8 @@ export class ToolInstaller {
         this.c = c;
         this.descriptor = descriptor;
         this.directory = c.appArguments.AppDataDirectory;
-        this.root = toolRoot(this.directory, descriptor.id);
-        this.cache = join(this.directory, 'runtime/cache');
+        this.root = toolRoot(analysisDirectory(c), descriptor.id);
+        this.cache = join(analysisDirectory(c), 'runtime/cache');
     }
     async receipt() { return readJson(join(this.root, 'selection.json')); }
     async status() {
@@ -105,7 +106,7 @@ export class ToolInstaller {
         if (selected.schema !== 1 || selected.tool !== this.descriptor.id || !/^[a-f0-9]{64}$/.test(selected.id))
             fail('binding', 'Invalid tool installation receipt.');
         const root = join(this.root, 'installations', selected.id);
-        if (selected.root !== root || selected.mode === 'managed' && !resolve(selected.executable).startsWith(resolve(root) + sep))
+        if (await realpath(selected.root) !== await realpath(root) || selected.mode === 'managed' && !(await realpath(selected.executable)).startsWith(await realpath(root) + sep))
             fail('binding', 'Selected tool points outside its owned installation.');
         const ready = await readJson(join(root, 'ready.json'));
         const binding = (v) => { const { selectedAt, uninstalledAt, ...rest } = v; return rest; };
@@ -131,7 +132,7 @@ export class ToolInstaller {
             await verifyManagedInstallation(this.directory, this.descriptor.id, selected);
         else if (await fileSha256(selected.executable, this.c.signal) !== selected.fingerprint)
             fail('binding', 'Selected tool code differs from its verified installation.');
-        if (selected.execution && (!resolve(selected.execution.executable).startsWith(resolve(root) + sep) || await treeFingerprint(root) !== selected.executionFingerprint))
+        if (selected.execution && (!(await realpath(selected.execution.executable)).startsWith(await realpath(root) + sep) || await treeFingerprint(root) !== selected.executionFingerprint))
             fail('binding', 'Owned external-tool execution copy differs from its verified installation.');
         if (selected.mode === 'external' && this.descriptor.externalInputs && (!selected.externalInputs || digest(await this.descriptor.externalInputs(selected.executable, this.c)) !== digest(selected.externalInputs)))
             fail('binding', 'External tool family differs from its verified installation.');

package/dist/src/tool-runtime/launch-worker.js

@@ -19,7 +19,9 @@ async function main() {
         if (input.length > 4 * 1024 ** 2)
             throw Error('Launch input exceeds its bound');
     }
-    if (await realpath(String(record.root)) !== join(root, 'runtime/runs', id))
+    // Factory's stable profile remains local while the complete runtime tree can be
+    // an authorized analysis-storage alias. Child paths must still stay inside it.
+    if (await realpath(String(record.root)) !== join(await realpath(join(root, 'runtime')), 'runs', id))
         throw Error('Launch storage changed');
     const plan = JSON.parse(input);
     if (plan.executable !== record.executable)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@eyeauras/insight-cli",
-  "version": "0.2.4",
+  "version": "0.3.1",
   "type": "module",
   "description": "Agent-facing durable sessions and isolated Ghidra research contexts",
   "main": "./dist/src/index.js",
@@ -24,7 +24,7 @@
     "prepack": "npm run build"
   },
   "dependencies": {
-    "@eyeauras/cli-factory": "https://raw.githubusercontent.com/iXab3r/insight-cli/73459aecc88da6f878988b64f71ab72b34a83c45/vendor/factory-core-74e7a64.tgz",
+    "@eyeauras/cli-factory": "https://raw.githubusercontent.com/iXab3r/insight-cli/b0d2805ef97face11ab131e8aa39b34216eefaf0/vendor/factory-core-0413409.tgz",
     "@eyeauras/cli-factory-ipc": "https://raw.githubusercontent.com/iXab3r/insight-cli/f47f6d14e8aadc6b6778a6e3627bbb08909521d2/vendor/factory-ipc-7c403d8.tgz",
     "@modelcontextprotocol/sdk": "1.32.1",
     "tar": "7.5.22",

package/references/artifacts.md

@@ -1,7 +1,7 @@
 # Save ordinary research materials
 
 `insight-cli artifacts save <path> --json` saves a file or a settled directory tree in
-the selected profile's AppData. It needs Factory Update permission and does not require
+the selected profile's [analysis storage](storage.md), which defaults to AppData. It needs Factory Update permission and does not require
 Ghidra, Java, authentication, target/session selectors or evidence metadata. Relative input
 paths resolve against the caller's working directory. Use `--help` for generated syntax.
 

package/references/managed-runtime.md

@@ -79,7 +79,7 @@ operations until `connect`/`start`. `server connect/disconnect` retain their con
 An external server remains configured through profile server/repository/account fields and Factory
 secrets; `server stop` cannot stop that external service.
 
-Code/cache/installation receipts live under profile AppData `runtime/`; research remains under
+Code/cache/installation receipts live under configured [analysis storage](storage.md) `runtime/`; research remains under
 `workspace/`, and saved files under `materials/`. One selected immutable installation serves many
 isolated JVM contexts; each has its own projects, home, settings, cache/temp and authenticated
 endpoint. No per-agent copy of the Ghidra code distribution is required. This is process and data