@eyeauras/insight-cli 0.4.0 → 0.4.2

package/.cli-package-build.json

@@ -1 +1 @@
-{"version":1,"artifact":"034bd833a87d3a9c730b486252e2db09f67b3c6da2377c195389b894b26e12f7"}
+{"version":1,"artifact":"7e87005b361dfdc6efbab8a801e6a2c477c2cc29d9d09dde0af337c4c833c339"}

package/README.md

@@ -1,86 +1,58 @@
 # insight-cli
 
-CLI/API for reverse engineering with durable sessions, isolated Ghidra contexts,
-explicit merge/refresh and ordinary saved files. Agents choose the investigation.
+A CLI/API for reverse-engineering agents. Spend more time understanding a program and
+less time managing Ghidra processes or writing scripts around missing analysis metadata.
+
+- Search raw strings and code references, and inspect functions in sparse Ghidra databases.
+- Give each agent an isolated research context, with saved work and explicit merge/refresh.
+- Use structured JSON results and a persistent client for sequences of research calls.
 
 ## Install
 
-Use Node.js 24 or newer:
+Requires **Node.js 24+**:
 
 ```sh
 npm install --global @eyeauras/insight-cli
-insight-cli --help
-insight-cli skill insight-re
-```
-
-The executable is `insight-cli`. Its global npm executable directory must be on PATH.
-No source checkout, TypeScript build or separate Factory installation is required.
-The pinned Factory IPC runtime is a normal npm dependency fetched from an immutable
-GitHub tarball URL; installation therefore needs npm registry and GitHub access.
-Use `insight-cli ghidra install` to deliver the pinned Ghidra/JDK/native/server runtime.
-External Ghidra launchers and Java paths are also supported.
-`insight-cli ilspy install` delivers ILSpy and its private .NET runtime for managed-code
-research. Tool downloads use pinned assets retained in our GitHub Releases.
-Use `insight-cli tools processes` to inspect owned executions across tools.
-Help, skill discovery and saving ordinary files do not need Ghidra or Java.
-
-Downloading a tool does not expose it in an agent's tool list. Connect the packaged skills
-to your agent host, or explicitly give the agent the path returned by `insight-cli skill
-insight-re --json`. See [agent setup](references/agent-setup.md) for tested project-local
-Codex setup and a practical usability check. Installation leaves agent settings unchanged.
-
-## Discover the toolbox
-
-```sh
-insight-cli tools list --json
-insight-cli tools show die --json
-insight-cli skill insight-die --json
+insight-cli profile create local
+insight-cli profile set-default local
+insight-cli permissions grant Update
+insight-cli ghidra install
 ```
 
-The catalog describes the adapters and their packaged skills before any runtime is downloaded.
-Use each tool's `status` to check the selected profile, then follow its skill and generated help.
-The toolbox includes Ghidra, ILSpy, 7-Zip, LLVM utilities, DiE, LLDB, Frida, WinDbg, strace and .NET dump/stack/trace; platform
-and capability limits are explicit per tool. A partial classification or a failed native process
-is not a complete finding. Preserve useful output in ordinary project files and checkpoint it
-with `artifacts save` when useful. Existing project RE instructions retain precedence.
+The last command downloads and verifies compatible Ghidra and JDK runtimes. No source
+checkout or separate Java installation is needed. See [runtime setup](https://github.com/iXab3r/insight-cli/blob/main/skills/ghidra-coordinator/references/managed-runtime.md)
+for existing installations and offline setup.
 
-## Start
+For an AI agent, [connect the packaged skills](https://github.com/iXab3r/insight-cli/blob/main/skills/ghidra-coordinator/references/agent-setup.md).
+For repeated API calls, use the [persistent client](https://github.com/iXab3r/insight-cli/blob/main/skills/ghidra-coordinator/references/persistent.md).
 
-```sh
-insight-cli profile create local
-insight-cli --profile local permissions grant Update
-insight-cli --profile local ghidra install
-insight-cli --profile local ghidra status
-insight-cli --profile local ghidra open ./client.exe --session new --json
-```
+## Quick example
 
-Retain the returned `session` and `target` and supply both on research calls:
+Open a binary in a new private research context:
 
 ```sh
-insight-cli --profile local ghidra strings search --session <session> --target <target> --contains config.json --json
-insight-cli --profile local ghidra functions decompile --session <session> --target <target> --address <entry> --json
-insight-cli --profile local ghidra merge --session <session> --target <target> --json
+insight-cli ghidra open ./client.exe --session new --json
 ```
 
-Another agent uses `--session new` for its own context on the same input. It receives
-published changes with `ghidra refresh`; local work and conflicts remain explicit.
-Managed local startup needs no separately configured Ghidra Server.
-
-Save a completed project file or folder when a retained checkpoint is useful:
+Reuse the returned session and target IDs in place of `SESSION` and `TARGET`:
 
 ```sh
-insight-cli --profile local artifacts save ./analysis --json
+insight-cli ghidra strings anchors --session SESSION --target TARGET \
+  --text config --encodings ascii,utf16le --json
+insight-cli sessions status SESSION --target TARGET --json
 ```
 
-The response returns an ordinary saved path and digest. Follow existing project RE
-rules, formats and evidence locations; the packaged RE skill fills unspecified gaps.
-Installation does not register skills or change agent settings. Use `insight-cli skill`
-and `insight-cli skill insight-re` to locate packaged instructions and references.
+The search reads raw literal bytes, so it does not require defined Ghidra strings.
+Results include scan coverage and a continuation cursor when incomplete. New imports
+skip full automatic analysis by default; add `--analysis` to the first `open` to opt in.
+Continue with the [research guide](https://github.com/iXab3r/insight-cli/blob/main/skills/ghidra-coordinator/references/research.md).
 
-Full documentation and verification: [GitHub](https://github.com/iXab3r/insight-cli).
-License: MIT. The bundled GhidraMCP bridge has its own Apache-2.0 license and notice.
+## Benchmarks
 
-Runtime management, local archives and external paths: [managed runtime](references/managed-runtime.md).
-The host debugger and OS permissions are checked separately by `ghidra doctor`.
+In a fresh-agent PoE 2 investigation, installed insight-cli 0.4.0 with its persistent
+client finished in **16:35**, versus **19:43** through Ghidra MCP: **15.9% less wall time**,
+with comparable core findings. This is one adaptive research pair, not a general speed guarantee.
 
-Static .NET commands and ordinary output files: [ILSpy](references/ilspy.md).
+[Benchmarks](https://github.com/iXab3r/insight-cli/blob/main/BENCHMARKS.md) includes phases, earlier runs and comparison limits.
+[Development history and detailed reports](https://github.com/iXab3r/insight-cli/blob/main/docs/PROJECT-HISTORY.md) covers architecture,
+acceptance, other experiments and releases. See [Contributing](https://github.com/iXab3r/insight-cli/blob/main/CONTRIBUTING.md) for development.

package/SKILL.md

@@ -3,7 +3,7 @@ name: insight-cli
 description: Choose and prepare reverse-engineering capabilities from the insight-cli toolbox for binary, managed-code and runtime investigations. Use to discover the appropriate tool or its packaged skill before installing native runtimes.
 ---
 
-# insight-cli 0.4.0
+# insight-cli 0.4.2
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/dist/src/contexts.js

@@ -1,3 +1,4 @@
+import { ownedDirectory } from './directory-identity.js';
 import { recordLifecycle } from './context-diagnostics.js';
 import { ghidraBudget } from './budgets.js';
 import { launchProcess, terminateProcess } from './tool-runtime/supervisor.js';
@@ -7,7 +8,7 @@ import { runtimeProcesses } from './runtime-manager.js';
 import { randomUUID, randomBytes } from 'node:crypto';
 import { mkdir, open, readFile, readdir, rename, link, realpath, copyFile, chmod, writeFile } from 'node:fs/promises';
 import { constants } from 'node:fs';
-import { join, delimiter, sep, resolve, dirname } from 'node:path';
+import { join, delimiter, sep, resolve, dirname, basename } from 'node:path';
 import { createServer } from 'node:net';
 import { setTimeout as delay } from 'node:timers/promises';
 import { nativeHelpers, nativeInputs, nativeJvmDirectories, nativeExtensionArguments } from './native-inputs.js';
@@ -178,7 +179,7 @@ export class GhidraContexts {
     }
     async verified(binding, target, verifySource = true) {
         const root = await realpath(binding.root);
-        if (!root.startsWith(resolve(this.directory()) + sep) || binding.target !== target.id || binding.runtimeFingerprint !== this.inputs.fingerprint)
+        if (!ownedDirectory(root, this.directory(), [binding.kind, binding.context ?? binding.target, basename(root)]) || binding.target !== target.id || binding.runtimeFingerprint !== this.inputs.fingerprint)
             fail('binding', 'Native context receipt does not match its profile, target or runtime.');
         if (stable(JSON.parse(await readFile(join(root, 'process.json'), 'utf8'))) !== stable(binding))
             fail('binding', 'Native context receipt changed.');
@@ -233,7 +234,7 @@ export class GhidraContexts {
     }
     async debuggerReleased(binding) {
         const root = await realpath(binding.root);
-        if (!root.startsWith(resolve(this.directory()) + sep) ||
+        if (!ownedDirectory(root, this.directory(), [binding.kind, binding.context ?? binding.target, basename(root)]) ||
             stable(JSON.parse(await readFile(join(root, 'process.json'), 'utf8'))) !== stable(binding))
             fail('binding', 'Debugger lifetime binding moved outside its owned context.');
         const directory = join(root, 'debugger-supervisors'), deadline = Date.now() + 15000;
@@ -902,7 +903,7 @@ public class ${name} extends GhidraScript {
     async closed(scope) {
         const context = this.workspace.context(scope), path = join(this.directory(), 'context', context.id, 'current.json');
         const binding = JSON.parse(await readFile(path, 'utf8')), root = await realpath(binding.root);
-        if (!root.startsWith(resolve(this.directory()) + sep) || binding.context !== context.id || binding.target !== scope.target ||
+        if (!ownedDirectory(root, this.directory(), [binding.kind, binding.context ?? binding.target, basename(root)]) || binding.context !== context.id || binding.target !== scope.target ||
             stable(JSON.parse(await readFile(join(root, 'process.json'), 'utf8'))) !== stable(binding))
             fail('binding', 'Closed context receipt changed.');
         try {

package/dist/src/directory-identity.d.ts

@@ -0,0 +1,4 @@
+/** Windows packaged apps can expose one directory through distinct real paths. */
+export declare function sameDirectory(left: string, right: string): boolean;
+/** Resolve inner links before checking the owner: an inner escape is never an alias. */
+export declare function ownedDirectory(path: string, owner: string, parts: string[]): boolean;

package/dist/src/directory-identity.js

@@ -0,0 +1,18 @@
+import { realpathSync, statSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+/** Windows packaged apps can expose one directory through distinct real paths. */
+export function sameDirectory(left, right) {
+    const a = realpathSync.native(left), b = realpathSync.native(right);
+    if (a === b)
+        return true;
+    const x = statSync(a, { bigint: true }), y = statSync(b, { bigint: true });
+    return x.isDirectory() && y.isDirectory() && x.ino !== 0n && x.dev === y.dev && x.ino === y.ino;
+}
+/** Resolve inner links before checking the owner: an inner escape is never an alias. */
+export function ownedDirectory(path, owner, parts) {
+    const physical = realpathSync.native(path);
+    let anchor = physical;
+    for (const _ of parts)
+        anchor = dirname(anchor);
+    return physical === join(anchor, ...parts) && sameDirectory(anchor, owner);
+}

package/dist/src/research.js

@@ -142,10 +142,13 @@ export class Research {
             let backend;
             try {
                 backend = await this.backend();
-                await this.sharedOrder(target, () => this.reconcile({ session: reserved.context.session, target }, backend));
+                await this.sharedOrder(target, () => this.reconcile({ session: reserved.context.session, target }, backend, true));
             }
             catch (error) {
-                throw openingFailure(error, this.workspace.request(reserved.request.id).state);
+                const request = this.workspace.request(reserved.request.id);
+                if (request.state === 'accepted')
+                    this.workspace.recordRequest(request.id, 'failed', retained('blocked'));
+                throw openingFailure(error, this.workspace.request(request.id).state);
             }
             const request = this.workspace.request(reserved.request.id);
             if (request.state === 'applied')
@@ -475,7 +478,7 @@ export class Research {
     async reconcileRequests(selected, backend) {
         return this.sharedOrder(selected.target, () => this.reconcile(selected, backend));
     }
-    async reconcile(selected, backend) {
+    async reconcile(selected, backend, reportOpenFailure = false) {
         const active = this.workspace.activePublication(selected.target);
         if (active) {
             if (active.state === 'preparing')
@@ -518,7 +521,10 @@ export class Research {
                         sharedRevision: revision(this.workspace.model(selected.target).sharedRevision), pendingChanges: count(context) };
                     this.workspace.completeSavedRequest(selected, request.id, context.generation, {}, result);
                 }
-                catch { /* Saved/native evidence remains unresolved; no new intent is executed. */ }
+                catch (error) {
+                    if (reportOpenFailure)
+                        throw error; /* Status retains unresolved evidence without dispatching another intent. */
+                }
                 continue;
             }
             const execution = request.execution === undefined ? undefined : object(request.execution);

package/dist/src/runtime-selection.js

@@ -1,3 +1,4 @@
+import { sameDirectory, ownedDirectory } from './directory-identity.js';
 import { readFileSync, existsSync, realpathSync } from 'node:fs';
 import { join, isAbsolute, resolve } from 'node:path';
 import { fail, object, digest } from './model.js';
@@ -20,11 +21,11 @@ export function runtimeSelection(directory, analysis = directory) {
             profile = realpathSync.native(directory);
             recorded = realpathSync.native(recordedProfile);
             owned = realpathSync.native(analysis);
-            if (recorded !== profile && recorded !== owned) {
+            if (!sameDirectory(recorded, profile) && !sameDirectory(recorded, owned)) {
                 const marker = object(JSON.parse(readFileSync(join(recorded, '.insight-analysis.json'), 'utf8')));
                 retained = marker.schema === 1 && marker.binding === digest(profile);
             }
-            if (realpathSync.native(runtimeRoot(directory)) !== join(owned, 'runtime') || realpathSync.native(runtimeRoot(recordedProfile)) !== join(owned, 'runtime'))
+            if (!ownedDirectory(runtimeRoot(directory), owned, ['runtime']) || !ownedDirectory(runtimeRoot(recordedProfile), owned, ['runtime']))
                 fail('binding', 'Managed runtime root differs from its configured analysis owner.');
             if (existsSync(value.ghidraHome))
                 home = realpathSync.native(value.ghidraHome);
@@ -32,7 +33,7 @@ export function runtimeSelection(directory, analysis = directory) {
         catch {
             fail('binding', 'Managed runtime profile ownership could not be verified.');
         }
-        if (recorded !== profile && recorded !== owned && !retained || home !== undefined && home !== join(runtimeRoot(owned), 'installations', id, 'ghidra'))
+        if (!sameDirectory(recorded, profile) && !sameDirectory(recorded, owned) && !retained || home !== undefined && !ownedDirectory(home, owned, ['runtime', 'installations', id, 'ghidra']))
             fail('binding', 'Managed runtime moved outside its owned installation.');
     }
     return value;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@eyeauras/insight-cli",
-  "version": "0.4.0",
+  "version": "0.4.2",
   "type": "module",
   "description": "Agent-facing durable sessions and isolated Ghidra research contexts",
   "main": "./dist/src/index.js",

package/skill-bundle/insight-artifacts/SKILL.md

@@ -3,7 +3,7 @@ name: insight-artifacts
 description: Retain a completed reverse-engineering evidence file or directory as an ordinary checkpoint using insight-cli artifacts save. Use after Ghidra or any external tool; preserve existing project formats and source of truth.
 ---
 
-# Insight Artifacts 0.4.0
+# Insight Artifacts 0.4.2
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skill-bundle/insight-binary/SKILL.md

@@ -3,7 +3,7 @@ name: insight-binary
 description: Query structured PE, ELF and thin Mach-O headers, sections, imports and exports, or make an explicitly guarded new PE subsystem copy through insight-cli binary. Use for scoped binary structure, linkage and copy-only header edits without target execution.
 ---
 
-# Insight Binary 0.4.0
+# Insight Binary 0.4.2
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skill-bundle/insight-capture/SKILL.md

@@ -3,7 +3,7 @@ name: insight-capture
 description: Capture one explicitly authorized native program run, exact stdout/stderr and declared file snapshots through insight-cli capture, then inspect or compare retained reports without replay. Use for controlled input/output research, preserving original files and interrupted or unknown outcomes.
 ---
 
-# Insight Capture 0.4.0
+# Insight Capture 0.4.2
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skill-bundle/insight-cli/SKILL.md

@@ -3,7 +3,7 @@ name: insight-cli
 description: Choose and prepare reverse-engineering capabilities from the insight-cli toolbox for binary, managed-code and runtime investigations. Use to discover the appropriate tool or its packaged skill before installing native runtimes.
 ---
 
-# insight-cli 0.4.0
+# insight-cli 0.4.2
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skill-bundle/insight-die/SKILL.md

@@ -3,7 +3,7 @@ name: insight-die
 description: Classify unknown executable or container inputs by format, architecture and compiler/runtime/packer signatures with Detect It Easy before choosing managed or native analysis. Use insight-cli die for static triage and preserve scan uncertainty.
 ---
 
-# Insight Detect It Easy 0.4.0
+# Insight Detect It Easy 0.4.2
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skill-bundle/insight-dnspy/SKILL.md

@@ -3,7 +3,7 @@ name: insight-dnspy
 description: Debug a managed Windows EXE at an IL breakpoint and read primitive arguments, or change one expected IL Int32 constant in a new assembly copy through insight-cli dnspy. Use when C# decompilation needs observed execution or a controlled binary edit.
 ---
 
-# Insight dnSpyEx 0.4.0
+# Insight dnSpyEx 0.4.2
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skill-bundle/insight-dotnet-dump/SKILL.md

@@ -3,7 +3,7 @@ name: insight-dotnet-dump
 description: Capture a managed heap dump or inspect compatible .NET dumps with SOS to recover waiting stacks, objects, fields and retention evidence.
 ---
 
-# Insight .NET Dump 0.4.0
+# Insight .NET Dump 0.4.2
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skill-bundle/insight-dotnet-stack/SKILL.md

@@ -3,7 +3,7 @@ name: insight-dotnet-stack
 description: Inspect live managed thread stacks to identify active or waiting work in an explicitly selected .NET process without taking a dump.
 ---
 
-# Insight .NET Stack 0.4.0
+# Insight .NET Stack 0.4.2
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skill-bundle/insight-dotnet-trace/SKILL.md

@@ -3,7 +3,7 @@ name: insight-dotnet-trace
 description: Collect and inspect bounded .NET EventPipe traces to identify sampled thread work, waits or runtime activity; distinguish wall-clock samples from CPU consumption.
 ---
 
-# Insight .NET Trace 0.4.0
+# Insight .NET Trace 0.4.2
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skill-bundle/insight-frida/SKILL.md

@@ -3,7 +3,7 @@ name: insight-frida
 description: Observe native call arguments/results or inspect runtime modules and exports in an explicitly selected authorized process with bounded Frida scripts. Use insight-cli frida to corroborate static findings with actual execution on macOS ARM64.
 ---
 
-# Insight Frida 0.4.0
+# Insight Frida 0.4.2
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skill-bundle/insight-ghidra/SKILL.md

@@ -3,7 +3,7 @@ name: insight-ghidra
 description: Inspect or edit native binaries with Ghidra through insight-cli; use isolated contexts, multi-agent merge/refresh, server, GUI or debugger workflows. Choose this for static native behavior and references, not C# recovery from managed IL.
 ---
 
-# Insight Ghidra 0.4.0
+# Insight Ghidra 0.4.2
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skill-bundle/insight-ilspy/SKILL.md

@@ -3,7 +3,7 @@ name: insight-ilspy
 description: Recover C#, inspect IL/types/metadata, extract resources or export projects from managed .NET assemblies through insight-cli ILSpy. Choose native analysis for NativeAOT or ordinary PE machine code.
 ---
 
-# Insight ILSpy 0.4.0
+# Insight ILSpy 0.4.2
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skill-bundle/insight-interop/SKILL.md

@@ -3,7 +3,7 @@ name: insight-interop
 description: Trace a .NET P/Invoke declaration to an explicitly supplied native library export and Ghidra function through insight-cli ilspy query, binary query and scoped ghidra APIs. Use for managed/native linkage evidence while keeping static correspondence separate from observed loading or execution.
 ---
 
-# Insight Interop 0.4.0
+# Insight Interop 0.4.2
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skill-bundle/insight-lldb/SKILL.md

@@ -3,7 +3,7 @@ name: insight-lldb
 description: Observe native runtime arguments, return values, registers, stacks and bounded memory at a selected breakpoint using an owned LLDB launch. Use insight-cli lldb on macOS ARM64 when static findings need a concrete execution check.
 ---
 
-# Insight LLDB 0.4.0
+# Insight LLDB 0.4.2
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skill-bundle/insight-llvm/SKILL.md

@@ -3,7 +3,7 @@ name: insight-llvm
 description: Inspect PE, ELF and Mach-O headers, dependencies, exports and symbols; query PDB debug information or a small instruction window with insight-cli LLVM utilities before opening a full analysis project.
 ---
 
-# Insight LLVM 0.4.0
+# Insight LLVM 0.4.2
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skill-bundle/insight-managed-heap/SKILL.md

@@ -3,7 +3,7 @@ name: insight-managed-heap
 description: Query structured .NET heap objects, primitive fields and managed stacks from a retained CoreCLR dump through insight-cli dotnet-dump query. Use for bounded offline dump investigation with an explicit matching DAC, preserving uncertainty and immutable input identity.
 ---
 
-# Insight Managed Heap 0.4.0
+# Insight Managed Heap 0.4.2
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skill-bundle/insight-managed-metadata/SKILL.md

@@ -3,7 +3,7 @@ name: insight-managed-metadata
 description: Query managed assembly metadata, MethodDef tokens, P/Invoke declarations and bounded IL, or compare two C#/.NET assemblies through insight-cli ilspy query/compare. Use for structured static evidence and changed-method research without executing the target.
 ---
 
-# Insight Managed Metadata 0.4.0
+# Insight Managed Metadata 0.4.2
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skill-bundle/insight-mitmproxy/SKILL.md

@@ -3,7 +3,7 @@ name: insight-mitmproxy
 description: Record, inspect and compare HTTP request/response evidence with insight-cli mitmproxy. Use when an owned client can explicitly use a loopback proxy; read native flow archives or HAR without replaying traffic. System interception and global certificate trust are outside this facade.
 ---
 
-# Insight mitmproxy 0.4.0
+# Insight mitmproxy 0.4.2
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skill-bundle/insight-overview/SKILL.md

@@ -3,7 +3,7 @@ name: insight-overview
 description: Choose bounded tool overviews and focused drilldown through insight-cli without flooding agent context with whole-program code, traces or dumps. Use for tool discovery, scoped evidence paging and keeping native partial coverage separate from complete results.
 ---
 
-# Insight Overview 0.4.0
+# Insight Overview 0.4.2
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skill-bundle/insight-procmon/SKILL.md

@@ -3,7 +3,7 @@ name: insight-procmon
 description: Observe actual file and registry access by an authorized running Windows process through insight-cli procmon. Use when static paths or configuration guesses need runtime evidence; inspect retained captures without collecting again.
 ---
 
-# Insight ProcMon 0.4.0
+# Insight ProcMon 0.4.2
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skill-bundle/insight-re/SKILL.md

@@ -3,7 +3,7 @@ name: insight-re
 description: Investigate shipped programs and binary artifacts with insight-cli and other available tools; retain ordinary research files, coordinate independent agents and publish Ghidra annotations. Use for reverse engineering behavior, not ordinary source-repository browsing.
 ---
 
-# Insight RE 0.4.0
+# Insight RE 0.4.2
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skill-bundle/insight-sevenzip/SKILL.md

@@ -3,7 +3,7 @@ name: insight-sevenzip
 description: Inventory, integrity-check and recover files from archives and supported containers with insight-cli 7-Zip, then hand recovered binaries or configuration to the appropriate research tool.
 ---
 
-# Insight 7-Zip 0.4.0
+# Insight 7-Zip 0.4.2
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skill-bundle/insight-strace/SKILL.md

@@ -3,7 +3,7 @@ name: insight-strace
 description: Observe actual file reads, writes, process creation and network syscalls in an authorized owned native Linux launch using insight-cli strace. Use when static inference needs concrete operating-system interaction evidence.
 ---
 
-# Insight strace 0.4.0
+# Insight strace 0.4.2
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skill-bundle/insight-tshark/SKILL.md

@@ -3,7 +3,7 @@ name: insight-tshark
 description: Inspect an offline PCAP or PCAPNG with insight-cli tshark to identify protocols, HTTP/DNS/TLS fields, packet evidence and reconstructed TCP/UDP streams. Use for captured traffic questions; live acquisition and TLS decryption are separate tasks.
 ---
 
-# Insight TShark 0.4.0
+# Insight TShark 0.4.2
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skill-bundle/insight-windbg/SKILL.md

@@ -3,7 +3,7 @@ name: insight-windbg
 description: Investigate Windows native user-mode minidumps using bounded stacks, threads, registers, modules, memory and disassembly through insight-cli windbg. Use on Windows x64 when a captured runtime state needs native debugger evidence.
 ---
 
-# Insight WinDbg 0.4.0
+# Insight WinDbg 0.4.2
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skill-bundle/manifest.json

@@ -1,7 +1,7 @@
 {
   "schema": 1,
   "package": "@eyeauras/insight-cli",
-  "version": "0.4.0",
+  "version": "0.4.2",
   "skills": [
     "insight-cli",
     "insight-re",

package/skills/insight-artifacts/SKILL.md

@@ -3,7 +3,7 @@ name: insight-artifacts
 description: Retain a completed reverse-engineering evidence file or directory as an ordinary checkpoint using insight-cli artifacts save. Use after Ghidra or any external tool; preserve existing project formats and source of truth.
 ---
 
-# Insight Artifacts 0.4.0
+# Insight Artifacts 0.4.2
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skills/insight-binary/SKILL.md

@@ -3,7 +3,7 @@ name: insight-binary
 description: Query structured PE, ELF and thin Mach-O headers, sections, imports and exports, or make an explicitly guarded new PE subsystem copy through insight-cli binary. Use for scoped binary structure, linkage and copy-only header edits without target execution.
 ---
 
-# Insight Binary 0.4.0
+# Insight Binary 0.4.2
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skills/insight-capture/SKILL.md

@@ -3,7 +3,7 @@ name: insight-capture
 description: Capture one explicitly authorized native program run, exact stdout/stderr and declared file snapshots through insight-cli capture, then inspect or compare retained reports without replay. Use for controlled input/output research, preserving original files and interrupted or unknown outcomes.
 ---
 
-# Insight Capture 0.4.0
+# Insight Capture 0.4.2
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skills/insight-die/SKILL.md

@@ -3,7 +3,7 @@ name: insight-die
 description: Classify unknown executable or container inputs by format, architecture and compiler/runtime/packer signatures with Detect It Easy before choosing managed or native analysis. Use insight-cli die for static triage and preserve scan uncertainty.
 ---
 
-# Insight Detect It Easy 0.4.0
+# Insight Detect It Easy 0.4.2
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skills/insight-dnspy/SKILL.md

@@ -3,7 +3,7 @@ name: insight-dnspy
 description: Debug a managed Windows EXE at an IL breakpoint and read primitive arguments, or change one expected IL Int32 constant in a new assembly copy through insight-cli dnspy. Use when C# decompilation needs observed execution or a controlled binary edit.
 ---
 
-# Insight dnSpyEx 0.4.0
+# Insight dnSpyEx 0.4.2
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skills/insight-dotnet-dump/SKILL.md

@@ -3,7 +3,7 @@ name: insight-dotnet-dump
 description: Capture a managed heap dump or inspect compatible .NET dumps with SOS to recover waiting stacks, objects, fields and retention evidence.
 ---
 
-# Insight .NET Dump 0.4.0
+# Insight .NET Dump 0.4.2
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skills/insight-dotnet-stack/SKILL.md

@@ -3,7 +3,7 @@ name: insight-dotnet-stack
 description: Inspect live managed thread stacks to identify active or waiting work in an explicitly selected .NET process without taking a dump.
 ---
 
-# Insight .NET Stack 0.4.0
+# Insight .NET Stack 0.4.2
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skills/insight-dotnet-trace/SKILL.md

@@ -3,7 +3,7 @@ name: insight-dotnet-trace
 description: Collect and inspect bounded .NET EventPipe traces to identify sampled thread work, waits or runtime activity; distinguish wall-clock samples from CPU consumption.
 ---
 
-# Insight .NET Trace 0.4.0
+# Insight .NET Trace 0.4.2
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skills/insight-frida/SKILL.md

@@ -3,7 +3,7 @@ name: insight-frida
 description: Observe native call arguments/results or inspect runtime modules and exports in an explicitly selected authorized process with bounded Frida scripts. Use insight-cli frida to corroborate static findings with actual execution on macOS ARM64.
 ---
 
-# Insight Frida 0.4.0
+# Insight Frida 0.4.2
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skills/insight-ghidra/SKILL.md

@@ -3,7 +3,7 @@ name: insight-ghidra
 description: Inspect or edit native binaries with Ghidra through insight-cli; use isolated contexts, multi-agent merge/refresh, server, GUI or debugger workflows. Choose this for static native behavior and references, not C# recovery from managed IL.
 ---
 
-# Insight Ghidra 0.4.0
+# Insight Ghidra 0.4.2
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skills/insight-ilspy/SKILL.md

@@ -3,7 +3,7 @@ name: insight-ilspy
 description: Recover C#, inspect IL/types/metadata, extract resources or export projects from managed .NET assemblies through insight-cli ILSpy. Choose native analysis for NativeAOT or ordinary PE machine code.
 ---
 
-# Insight ILSpy 0.4.0
+# Insight ILSpy 0.4.2
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skills/insight-interop/SKILL.md

@@ -3,7 +3,7 @@ name: insight-interop
 description: Trace a .NET P/Invoke declaration to an explicitly supplied native library export and Ghidra function through insight-cli ilspy query, binary query and scoped ghidra APIs. Use for managed/native linkage evidence while keeping static correspondence separate from observed loading or execution.
 ---
 
-# Insight Interop 0.4.0
+# Insight Interop 0.4.2
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skills/insight-lldb/SKILL.md

@@ -3,7 +3,7 @@ name: insight-lldb
 description: Observe native runtime arguments, return values, registers, stacks and bounded memory at a selected breakpoint using an owned LLDB launch. Use insight-cli lldb on macOS ARM64 when static findings need a concrete execution check.
 ---
 
-# Insight LLDB 0.4.0
+# Insight LLDB 0.4.2
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skills/insight-llvm/SKILL.md

@@ -3,7 +3,7 @@ name: insight-llvm
 description: Inspect PE, ELF and Mach-O headers, dependencies, exports and symbols; query PDB debug information or a small instruction window with insight-cli LLVM utilities before opening a full analysis project.
 ---
 
-# Insight LLVM 0.4.0
+# Insight LLVM 0.4.2
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skills/insight-managed-heap/SKILL.md

@@ -3,7 +3,7 @@ name: insight-managed-heap
 description: Query structured .NET heap objects, primitive fields and managed stacks from a retained CoreCLR dump through insight-cli dotnet-dump query. Use for bounded offline dump investigation with an explicit matching DAC, preserving uncertainty and immutable input identity.
 ---
 
-# Insight Managed Heap 0.4.0
+# Insight Managed Heap 0.4.2
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skills/insight-managed-metadata/SKILL.md

@@ -3,7 +3,7 @@ name: insight-managed-metadata
 description: Query managed assembly metadata, MethodDef tokens, P/Invoke declarations and bounded IL, or compare two C#/.NET assemblies through insight-cli ilspy query/compare. Use for structured static evidence and changed-method research without executing the target.
 ---
 
-# Insight Managed Metadata 0.4.0
+# Insight Managed Metadata 0.4.2
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skills/insight-mitmproxy/SKILL.md

@@ -3,7 +3,7 @@ name: insight-mitmproxy
 description: Record, inspect and compare HTTP request/response evidence with insight-cli mitmproxy. Use when an owned client can explicitly use a loopback proxy; read native flow archives or HAR without replaying traffic. System interception and global certificate trust are outside this facade.
 ---
 
-# Insight mitmproxy 0.4.0
+# Insight mitmproxy 0.4.2
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skills/insight-overview/SKILL.md

@@ -3,7 +3,7 @@ name: insight-overview
 description: Choose bounded tool overviews and focused drilldown through insight-cli without flooding agent context with whole-program code, traces or dumps. Use for tool discovery, scoped evidence paging and keeping native partial coverage separate from complete results.
 ---
 
-# Insight Overview 0.4.0
+# Insight Overview 0.4.2
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skills/insight-procmon/SKILL.md

@@ -3,7 +3,7 @@ name: insight-procmon
 description: Observe actual file and registry access by an authorized running Windows process through insight-cli procmon. Use when static paths or configuration guesses need runtime evidence; inspect retained captures without collecting again.
 ---
 
-# Insight ProcMon 0.4.0
+# Insight ProcMon 0.4.2
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skills/insight-re/SKILL.md

@@ -3,7 +3,7 @@ name: insight-re
 description: Investigate shipped programs and binary artifacts with insight-cli and other available tools; retain ordinary research files, coordinate independent agents and publish Ghidra annotations. Use for reverse engineering behavior, not ordinary source-repository browsing.
 ---
 
-# Insight RE 0.4.0
+# Insight RE 0.4.2
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skills/insight-sevenzip/SKILL.md

@@ -3,7 +3,7 @@ name: insight-sevenzip
 description: Inventory, integrity-check and recover files from archives and supported containers with insight-cli 7-Zip, then hand recovered binaries or configuration to the appropriate research tool.
 ---
 
-# Insight 7-Zip 0.4.0
+# Insight 7-Zip 0.4.2
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skills/insight-strace/SKILL.md

@@ -3,7 +3,7 @@ name: insight-strace
 description: Observe actual file reads, writes, process creation and network syscalls in an authorized owned native Linux launch using insight-cli strace. Use when static inference needs concrete operating-system interaction evidence.
 ---
 
-# Insight strace 0.4.0
+# Insight strace 0.4.2
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skills/insight-tshark/SKILL.md

@@ -3,7 +3,7 @@ name: insight-tshark
 description: Inspect an offline PCAP or PCAPNG with insight-cli tshark to identify protocols, HTTP/DNS/TLS fields, packet evidence and reconstructed TCP/UDP streams. Use for captured traffic questions; live acquisition and TLS decryption are separate tasks.
 ---
 
-# Insight TShark 0.4.0
+# Insight TShark 0.4.2
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skills/insight-windbg/SKILL.md

@@ -3,7 +3,7 @@ name: insight-windbg
 description: Investigate Windows native user-mode minidumps using bounded stacks, threads, registers, modules, memory and disassembly through insight-cli windbg. Use on Windows x64 when a captured runtime state needs native debugger evidence.
 ---
 
-# Insight WinDbg 0.4.0
+# Insight WinDbg 0.4.2
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized