@eyeauras/insight-cli 0.5.0 → 0.5.1

package/.cli-package-build.json

@@ -1 +1 @@
-{"version":1,"artifact":"c1a29780d211490bcb6911edcfdfb326336f18870151f21e342e519b385dd6a6"}
+{"version":1,"artifact":"136afde5d562c68176adb9bd2c67db9965ed00af5007708784b407f9a92d7f17"}

package/SKILL.md

@@ -3,7 +3,7 @@ name: insight-cli
 description: Choose and prepare reverse-engineering capabilities from the insight-cli toolbox for binary, managed-code and runtime investigations. Use to discover the appropriate tool or its packaged skill before installing native runtimes.
 ---
 
-# insight-cli 0.5.0
+# insight-cli 0.5.1
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/dist/src/contexts.js

@@ -1,4 +1,4 @@
-import { ownedDirectory } from './directory-identity.js';
+import { ownedDirectory, projectPathWithin } from './directory-identity.js';
 import { recordLifecycle } from './context-diagnostics.js';
 import { ghidraBudget } from './budgets.js';
 import { launchProcess, terminateProcess } from './tool-runtime/supervisor.js';
@@ -8,7 +8,7 @@ import { runtimeProcesses } from './runtime-manager.js';
 import { randomUUID, randomBytes } from 'node:crypto';
 import { mkdir, open, readFile, readdir, rename, link, realpath, copyFile, chmod, writeFile } from 'node:fs/promises';
 import { constants } from 'node:fs';
-import { join, delimiter, sep, resolve, dirname, basename } from 'node:path';
+import { join, delimiter, resolve, dirname, basename } from 'node:path';
 import { createServer } from 'node:net';
 import { setTimeout as delay } from 'node:timers/promises';
 import { nativeHelpers, nativeInputs, nativeJvmDirectories, nativeExtensionArguments } from './native-inputs.js';
@@ -187,7 +187,7 @@ export class GhidraContexts {
         const http = new HttpBridge(binding.endpoint, this.c.fetch, this.c.signal, token, undefined, ghidraBudget(this.c.profile.values, 'save'));
         const info = await http.instance();
         if (info.pid !== binding.pid || info.tcp_port !== Number(new URL(binding.endpoint).port) ||
-            !String(info.project_path ?? '').startsWith(root + sep))
+            !projectPathWithin(info.project_path, binding.root))
             fail('binding', 'Live context PID, endpoint or project no longer matches its receipt.');
         const record = { ...this.running.get(root), binding, http };
         this.running.set(root, record);

package/dist/src/directory-identity.d.ts

@@ -2,3 +2,5 @@
 export declare function sameDirectory(left: string, right: string): boolean;
 /** Resolve inner links before checking the owner: an inner escape is never an alias. */
 export declare function ownedDirectory(path: string, owner: string, parts: string[]): boolean;
+/** A locator may name a not-yet-existing project; its existing parent must be owned. */
+export declare function projectPathWithin(path: unknown, root: string): boolean;

package/dist/src/directory-identity.js

@@ -1,5 +1,5 @@
-import { realpathSync, statSync } from 'node:fs';
-import { dirname, join } from 'node:path';
+import { realpathSync, statSync, lstatSync } from 'node:fs';
+import { dirname, join, resolve, isAbsolute } from 'node:path';
 /** Windows packaged apps can expose one directory through distinct real paths. */
 export function sameDirectory(left, right) {
     const a = realpathSync.native(left), b = realpathSync.native(right);
@@ -16,3 +16,30 @@ export function ownedDirectory(path, owner, parts) {
         anchor = dirname(anchor);
     return physical === join(anchor, ...parts) && sameDirectory(anchor, owner);
 }
+/** A locator may name a not-yet-existing project; its existing parent must be owned. */
+export function projectPathWithin(path, root) {
+    if (typeof path !== 'string' || !isAbsolute(path))
+        return false;
+    try {
+        const project = resolve(path);
+        let present = true;
+        try {
+            lstatSync(project);
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                return false;
+            present = false;
+        }
+        const physical = realpathSync.native(present ? project : dirname(project));
+        for (let at = present ? dirname(physical) : physical;; at = dirname(at)) {
+            if (sameDirectory(at, root))
+                return true;
+            if (at === dirname(at))
+                return false;
+        }
+    }
+    catch {
+        return false;
+    }
+}

package/dist/src/ghidra-processes.js

@@ -1,5 +1,6 @@
+import { sameDirectory, ownedDirectory, projectPathWithin } from './directory-identity.js';
 import { runtimeSelection } from './runtime-selection.js';
-import { join, resolve, relative, sep } from 'node:path';
+import { join, resolve, relative, sep, dirname } from 'node:path';
 import { readFile, readdir, realpath } from 'node:fs/promises';
 import { serverIdentity, stopLocalServer } from './server.js';
 import { HttpBridge } from './transport.js';
@@ -10,15 +11,25 @@ async function ownedPath(c, path) {
     if (typeof path !== 'string')
         fail('binding', 'Tool resource moved outside this profile.');
     const supplied = resolve(path), profile = resolve(c.appArguments.AppDataDirectory), canonical = await realpath(profile), analysis = await realpath(analysisDirectory(c));
-    const base = supplied.startsWith(profile + sep) ? profile : supplied.startsWith(canonical + sep) ? canonical : supplied.startsWith(analysis + sep) ? analysis : undefined;
+    let base;
+    for (let at = dirname(supplied);; at = dirname(at)) {
+        try {
+            if (sameDirectory(at, canonical) || sameDirectory(at, analysis)) {
+                base = at;
+                break;
+            }
+        }
+        catch { }
+        if (at === dirname(at))
+            break;
+    }
     if (!base)
         fail('binding', 'Tool resource moved outside this profile.');
-    // Keep Factory's raw AppData identity in process records, but compare native resources
-    // under its canonical profile. Accept the parent alias, never a replaced child link.
-    const suffix = relative(base, supplied), expected = base === analysis ? supplied : ['workspace', 'runtime', 'materials', 'temp'].some(tree => suffix === tree || suffix.startsWith(tree + sep)) ? join(analysis, suffix) : join(canonical, suffix);
-    if (await realpath(supplied) !== expected)
+    const suffix = relative(base, supplied), analysisTree = ['workspace', 'runtime', 'materials', 'temp'].some(tree => suffix === tree || suffix.startsWith(tree + sep));
+    const owner = sameDirectory(base, analysis) && !sameDirectory(base, canonical) || analysisTree ? analysis : canonical;
+    if (!ownedDirectory(supplied, owner, suffix.split(sep)))
         fail('binding', 'Tool resource moved outside this profile.');
-    return expected;
+    return join(owner, suffix);
 }
 export async function verifyGhidraProcess(r, c) {
     try {
@@ -28,7 +39,7 @@ export async function verifyGhidraProcess(r, c) {
         }
         if (r.metadata?.debuggerReceipt) {
             const path = await ownedPath(c, r.metadata.debuggerReceipt), row = JSON.parse(await readFile(path, 'utf8')), root = await ownedPath(c, r.metadata.contextRoot), binding = JSON.parse(await readFile(join(root, 'process.json'), 'utf8'));
-            if (row.root !== root || row.ownerToken !== binding.tokenSecret || row.guiPid !== binding.pid || !Number.isSafeInteger(row.identityPort) || row.identityPort < 1 || row.identityPort > 65535)
+            if (!sameDirectory(row.root, root) || row.ownerToken !== binding.tokenSecret || row.guiPid !== binding.pid || !Number.isSafeInteger(row.identityPort) || row.identityPort < 1 || row.identityPort > 65535)
                 return false;
             const token = await c.secrets.require(binding.tokenSecret), response = await c.fetch('http://127.0.0.1:' + row.identityPort + '/identity', { redirect: 'error', signal: AbortSignal.timeout(1000), headers: { Authorization: 'Bearer ' + token } });
             const body = await response.text();
@@ -39,10 +50,10 @@ export async function verifyGhidraProcess(r, c) {
         }
         if (r.metadata?.contextRoot) {
             const root = await ownedPath(c, r.metadata.contextRoot), binding = JSON.parse(await readFile(join(root, 'process.json'), 'utf8'));
-            if (binding.root !== root || binding.pid !== r.pid || binding.runtimeFingerprint !== r.installation || binding.target !== r.target)
+            if (!sameDirectory(binding.root, root) || binding.pid !== r.pid || binding.runtimeFingerprint !== r.installation || binding.target !== r.target)
                 return false;
             const token = await c.secrets.require(binding.tokenSecret), info = await new HttpBridge(binding.endpoint, c.fetch, undefined, token, 1500).instance();
-            return info.pid === r.pid && info.tcp_port === Number(new URL(binding.endpoint).port) && String(info.project_path ?? '').startsWith(root + sep);
+            return info.pid === r.pid && info.tcp_port === Number(new URL(binding.endpoint).port) && projectPathWithin(info.project_path, binding.root);
         }
         return undefined;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@eyeauras/insight-cli",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "type": "module",
   "description": "Agent-facing durable sessions and isolated Ghidra research contexts",
   "main": "./dist/src/index.js",

package/skill-bundle/insight-artifacts/SKILL.md

@@ -3,7 +3,7 @@ name: insight-artifacts
 description: Retain a completed reverse-engineering evidence file or directory as an ordinary checkpoint using insight-cli artifacts save. Use after Ghidra or any external tool; preserve existing project formats and source of truth.
 ---
 
-# Insight Artifacts 0.5.0
+# Insight Artifacts 0.5.1
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skill-bundle/insight-binary/SKILL.md

@@ -3,7 +3,7 @@ name: insight-binary
 description: Query structured PE, ELF and thin Mach-O headers, sections, imports and exports, or make an explicitly guarded new PE subsystem copy through insight-cli binary. Use for scoped binary structure, linkage and copy-only header edits without target execution.
 ---
 
-# Insight Binary 0.5.0
+# Insight Binary 0.5.1
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skill-bundle/insight-capture/SKILL.md

@@ -3,7 +3,7 @@ name: insight-capture
 description: Capture one explicitly authorized native program run, exact stdout/stderr and declared file snapshots through insight-cli capture, then inspect or compare retained reports without replay. Use for controlled input/output research, preserving original files and interrupted or unknown outcomes.
 ---
 
-# Insight Capture 0.5.0
+# Insight Capture 0.5.1
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skill-bundle/insight-cli/SKILL.md

@@ -3,7 +3,7 @@ name: insight-cli
 description: Choose and prepare reverse-engineering capabilities from the insight-cli toolbox for binary, managed-code and runtime investigations. Use to discover the appropriate tool or its packaged skill before installing native runtimes.
 ---
 
-# insight-cli 0.5.0
+# insight-cli 0.5.1
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skill-bundle/insight-die/SKILL.md

@@ -3,7 +3,7 @@ name: insight-die
 description: Classify unknown executable or container inputs by format, architecture and compiler/runtime/packer signatures with Detect It Easy before choosing managed or native analysis. Use insight-cli die for static triage and preserve scan uncertainty.
 ---
 
-# Insight Detect It Easy 0.5.0
+# Insight Detect It Easy 0.5.1
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skill-bundle/insight-dnspy/SKILL.md

@@ -3,7 +3,7 @@ name: insight-dnspy
 description: Debug a managed Windows EXE at an IL breakpoint and read primitive arguments, or change one expected IL Int32 constant in a new assembly copy through insight-cli dnspy. Use when C# decompilation needs observed execution or a controlled binary edit.
 ---
 
-# Insight dnSpyEx 0.5.0
+# Insight dnSpyEx 0.5.1
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skill-bundle/insight-dotnet-dump/SKILL.md

@@ -3,7 +3,7 @@ name: insight-dotnet-dump
 description: Capture a managed heap dump or inspect compatible .NET dumps with SOS to recover waiting stacks, objects, fields and retention evidence.
 ---
 
-# Insight .NET Dump 0.5.0
+# Insight .NET Dump 0.5.1
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skill-bundle/insight-dotnet-stack/SKILL.md

@@ -3,7 +3,7 @@ name: insight-dotnet-stack
 description: Inspect live managed thread stacks to identify active or waiting work in an explicitly selected .NET process without taking a dump.
 ---
 
-# Insight .NET Stack 0.5.0
+# Insight .NET Stack 0.5.1
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skill-bundle/insight-dotnet-trace/SKILL.md

@@ -3,7 +3,7 @@ name: insight-dotnet-trace
 description: Collect and inspect bounded .NET EventPipe traces to identify sampled thread work, waits or runtime activity; distinguish wall-clock samples from CPU consumption.
 ---
 
-# Insight .NET Trace 0.5.0
+# Insight .NET Trace 0.5.1
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skill-bundle/insight-frida/SKILL.md

@@ -3,7 +3,7 @@ name: insight-frida
 description: Observe native call arguments/results or inspect runtime modules and exports in an explicitly selected authorized process with bounded Frida scripts. Use insight-cli frida to corroborate static findings with actual execution on macOS ARM64.
 ---
 
-# Insight Frida 0.5.0
+# Insight Frida 0.5.1
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skill-bundle/insight-ghidra/SKILL.md

@@ -3,7 +3,7 @@ name: insight-ghidra
 description: Inspect or edit native binaries with Ghidra through insight-cli; use isolated contexts, multi-agent merge/refresh, server, GUI or debugger workflows. Choose this for static native behavior and references, not C# recovery from managed IL.
 ---
 
-# Insight Ghidra 0.5.0
+# Insight Ghidra 0.5.1
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skill-bundle/insight-ilspy/SKILL.md

@@ -3,7 +3,7 @@ name: insight-ilspy
 description: Recover C#, inspect IL/types/metadata, extract resources or export projects from managed .NET assemblies through insight-cli ILSpy. Choose native analysis for NativeAOT or ordinary PE machine code.
 ---
 
-# Insight ILSpy 0.5.0
+# Insight ILSpy 0.5.1
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skill-bundle/insight-interop/SKILL.md

@@ -3,7 +3,7 @@ name: insight-interop
 description: Trace a .NET P/Invoke declaration to an explicitly supplied native library export and Ghidra function through insight-cli ilspy query, binary query and scoped ghidra APIs. Use for managed/native linkage evidence while keeping static correspondence separate from observed loading or execution.
 ---
 
-# Insight Interop 0.5.0
+# Insight Interop 0.5.1
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skill-bundle/insight-lldb/SKILL.md

@@ -3,7 +3,7 @@ name: insight-lldb
 description: Observe native runtime arguments, return values, registers, stacks and bounded memory at a selected breakpoint using an owned LLDB launch. Use insight-cli lldb on macOS ARM64 when static findings need a concrete execution check.
 ---
 
-# Insight LLDB 0.5.0
+# Insight LLDB 0.5.1
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skill-bundle/insight-llvm/SKILL.md

@@ -3,7 +3,7 @@ name: insight-llvm
 description: Inspect PE, ELF and Mach-O headers, dependencies, exports and symbols; query PDB debug information or a small instruction window with insight-cli LLVM utilities before opening a full analysis project.
 ---
 
-# Insight LLVM 0.5.0
+# Insight LLVM 0.5.1
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skill-bundle/insight-managed-heap/SKILL.md

@@ -3,7 +3,7 @@ name: insight-managed-heap
 description: Query structured .NET heap objects, primitive fields and managed stacks from a retained CoreCLR dump through insight-cli dotnet-dump query. Use for bounded offline dump investigation with an explicit matching DAC, preserving uncertainty and immutable input identity.
 ---
 
-# Insight Managed Heap 0.5.0
+# Insight Managed Heap 0.5.1
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skill-bundle/insight-managed-metadata/SKILL.md

@@ -3,7 +3,7 @@ name: insight-managed-metadata
 description: Query managed assembly metadata, MethodDef tokens, P/Invoke declarations and bounded IL, or compare two C#/.NET assemblies through insight-cli ilspy query/compare. Use for structured static evidence and changed-method research without executing the target.
 ---
 
-# Insight Managed Metadata 0.5.0
+# Insight Managed Metadata 0.5.1
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skill-bundle/insight-mitmproxy/SKILL.md

@@ -3,7 +3,7 @@ name: insight-mitmproxy
 description: Record, inspect and compare HTTP request/response evidence with insight-cli mitmproxy. Use when an owned client can explicitly use a loopback proxy; read native flow archives or HAR without replaying traffic. System interception and global certificate trust are outside this facade.
 ---
 
-# Insight mitmproxy 0.5.0
+# Insight mitmproxy 0.5.1
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skill-bundle/insight-overview/SKILL.md

@@ -3,7 +3,7 @@ name: insight-overview
 description: Choose bounded tool overviews and focused drilldown through insight-cli without flooding agent context with whole-program code, traces or dumps. Use for tool discovery, scoped evidence paging and keeping native partial coverage separate from complete results.
 ---
 
-# Insight Overview 0.5.0
+# Insight Overview 0.5.1
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skill-bundle/insight-procmon/SKILL.md

@@ -3,7 +3,7 @@ name: insight-procmon
 description: Observe actual file and registry access by an authorized running Windows process through insight-cli procmon. Use when static paths or configuration guesses need runtime evidence; inspect retained captures without collecting again.
 ---
 
-# Insight ProcMon 0.5.0
+# Insight ProcMon 0.5.1
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skill-bundle/insight-re/SKILL.md

@@ -3,7 +3,7 @@ name: insight-re
 description: Investigate shipped programs and binary artifacts with insight-cli and other available tools; retain ordinary research files, coordinate independent agents and publish Ghidra annotations. Use for reverse engineering behavior, not ordinary source-repository browsing.
 ---
 
-# Insight RE 0.5.0
+# Insight RE 0.5.1
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skill-bundle/insight-sevenzip/SKILL.md

@@ -3,7 +3,7 @@ name: insight-sevenzip
 description: Inventory, integrity-check and recover files from archives and supported containers with insight-cli 7-Zip, then hand recovered binaries or configuration to the appropriate research tool.
 ---
 
-# Insight 7-Zip 0.5.0
+# Insight 7-Zip 0.5.1
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skill-bundle/insight-strace/SKILL.md

@@ -3,7 +3,7 @@ name: insight-strace
 description: Observe actual file reads, writes, process creation and network syscalls in an authorized owned native Linux launch using insight-cli strace. Use when static inference needs concrete operating-system interaction evidence.
 ---
 
-# Insight strace 0.5.0
+# Insight strace 0.5.1
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skill-bundle/insight-tshark/SKILL.md

@@ -3,7 +3,7 @@ name: insight-tshark
 description: Inspect an offline PCAP or PCAPNG with insight-cli tshark to identify protocols, HTTP/DNS/TLS fields, packet evidence and reconstructed TCP/UDP streams. Use for captured traffic questions; live acquisition and TLS decryption are separate tasks.
 ---
 
-# Insight TShark 0.5.0
+# Insight TShark 0.5.1
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skill-bundle/insight-windbg/SKILL.md

@@ -3,7 +3,7 @@ name: insight-windbg
 description: Investigate Windows native user-mode minidumps using bounded stacks, threads, registers, modules, memory and disassembly through insight-cli windbg. Use on Windows x64 when a captured runtime state needs native debugger evidence.
 ---
 
-# Insight WinDbg 0.5.0
+# Insight WinDbg 0.5.1
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skill-bundle/manifest.json

@@ -1,7 +1,7 @@
 {
   "schema": 1,
   "package": "@eyeauras/insight-cli",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "skills": [
     "insight-cli",
     "insight-re",

package/skills/insight-artifacts/SKILL.md

@@ -3,7 +3,7 @@ name: insight-artifacts
 description: Retain a completed reverse-engineering evidence file or directory as an ordinary checkpoint using insight-cli artifacts save. Use after Ghidra or any external tool; preserve existing project formats and source of truth.
 ---
 
-# Insight Artifacts 0.5.0
+# Insight Artifacts 0.5.1
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skills/insight-binary/SKILL.md

@@ -3,7 +3,7 @@ name: insight-binary
 description: Query structured PE, ELF and thin Mach-O headers, sections, imports and exports, or make an explicitly guarded new PE subsystem copy through insight-cli binary. Use for scoped binary structure, linkage and copy-only header edits without target execution.
 ---
 
-# Insight Binary 0.5.0
+# Insight Binary 0.5.1
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skills/insight-capture/SKILL.md

@@ -3,7 +3,7 @@ name: insight-capture
 description: Capture one explicitly authorized native program run, exact stdout/stderr and declared file snapshots through insight-cli capture, then inspect or compare retained reports without replay. Use for controlled input/output research, preserving original files and interrupted or unknown outcomes.
 ---
 
-# Insight Capture 0.5.0
+# Insight Capture 0.5.1
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skills/insight-die/SKILL.md

@@ -3,7 +3,7 @@ name: insight-die
 description: Classify unknown executable or container inputs by format, architecture and compiler/runtime/packer signatures with Detect It Easy before choosing managed or native analysis. Use insight-cli die for static triage and preserve scan uncertainty.
 ---
 
-# Insight Detect It Easy 0.5.0
+# Insight Detect It Easy 0.5.1
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skills/insight-dnspy/SKILL.md

@@ -3,7 +3,7 @@ name: insight-dnspy
 description: Debug a managed Windows EXE at an IL breakpoint and read primitive arguments, or change one expected IL Int32 constant in a new assembly copy through insight-cli dnspy. Use when C# decompilation needs observed execution or a controlled binary edit.
 ---
 
-# Insight dnSpyEx 0.5.0
+# Insight dnSpyEx 0.5.1
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skills/insight-dotnet-dump/SKILL.md

@@ -3,7 +3,7 @@ name: insight-dotnet-dump
 description: Capture a managed heap dump or inspect compatible .NET dumps with SOS to recover waiting stacks, objects, fields and retention evidence.
 ---
 
-# Insight .NET Dump 0.5.0
+# Insight .NET Dump 0.5.1
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skills/insight-dotnet-stack/SKILL.md

@@ -3,7 +3,7 @@ name: insight-dotnet-stack
 description: Inspect live managed thread stacks to identify active or waiting work in an explicitly selected .NET process without taking a dump.
 ---
 
-# Insight .NET Stack 0.5.0
+# Insight .NET Stack 0.5.1
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skills/insight-dotnet-trace/SKILL.md

@@ -3,7 +3,7 @@ name: insight-dotnet-trace
 description: Collect and inspect bounded .NET EventPipe traces to identify sampled thread work, waits or runtime activity; distinguish wall-clock samples from CPU consumption.
 ---
 
-# Insight .NET Trace 0.5.0
+# Insight .NET Trace 0.5.1
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skills/insight-frida/SKILL.md

@@ -3,7 +3,7 @@ name: insight-frida
 description: Observe native call arguments/results or inspect runtime modules and exports in an explicitly selected authorized process with bounded Frida scripts. Use insight-cli frida to corroborate static findings with actual execution on macOS ARM64.
 ---
 
-# Insight Frida 0.5.0
+# Insight Frida 0.5.1
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skills/insight-ghidra/SKILL.md

@@ -3,7 +3,7 @@ name: insight-ghidra
 description: Inspect or edit native binaries with Ghidra through insight-cli; use isolated contexts, multi-agent merge/refresh, server, GUI or debugger workflows. Choose this for static native behavior and references, not C# recovery from managed IL.
 ---
 
-# Insight Ghidra 0.5.0
+# Insight Ghidra 0.5.1
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skills/insight-ilspy/SKILL.md

@@ -3,7 +3,7 @@ name: insight-ilspy
 description: Recover C#, inspect IL/types/metadata, extract resources or export projects from managed .NET assemblies through insight-cli ILSpy. Choose native analysis for NativeAOT or ordinary PE machine code.
 ---
 
-# Insight ILSpy 0.5.0
+# Insight ILSpy 0.5.1
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skills/insight-interop/SKILL.md

@@ -3,7 +3,7 @@ name: insight-interop
 description: Trace a .NET P/Invoke declaration to an explicitly supplied native library export and Ghidra function through insight-cli ilspy query, binary query and scoped ghidra APIs. Use for managed/native linkage evidence while keeping static correspondence separate from observed loading or execution.
 ---
 
-# Insight Interop 0.5.0
+# Insight Interop 0.5.1
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skills/insight-lldb/SKILL.md

@@ -3,7 +3,7 @@ name: insight-lldb
 description: Observe native runtime arguments, return values, registers, stacks and bounded memory at a selected breakpoint using an owned LLDB launch. Use insight-cli lldb on macOS ARM64 when static findings need a concrete execution check.
 ---
 
-# Insight LLDB 0.5.0
+# Insight LLDB 0.5.1
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skills/insight-llvm/SKILL.md

@@ -3,7 +3,7 @@ name: insight-llvm
 description: Inspect PE, ELF and Mach-O headers, dependencies, exports and symbols; query PDB debug information or a small instruction window with insight-cli LLVM utilities before opening a full analysis project.
 ---
 
-# Insight LLVM 0.5.0
+# Insight LLVM 0.5.1
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skills/insight-managed-heap/SKILL.md

@@ -3,7 +3,7 @@ name: insight-managed-heap
 description: Query structured .NET heap objects, primitive fields and managed stacks from a retained CoreCLR dump through insight-cli dotnet-dump query. Use for bounded offline dump investigation with an explicit matching DAC, preserving uncertainty and immutable input identity.
 ---
 
-# Insight Managed Heap 0.5.0
+# Insight Managed Heap 0.5.1
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skills/insight-managed-metadata/SKILL.md

@@ -3,7 +3,7 @@ name: insight-managed-metadata
 description: Query managed assembly metadata, MethodDef tokens, P/Invoke declarations and bounded IL, or compare two C#/.NET assemblies through insight-cli ilspy query/compare. Use for structured static evidence and changed-method research without executing the target.
 ---
 
-# Insight Managed Metadata 0.5.0
+# Insight Managed Metadata 0.5.1
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skills/insight-mitmproxy/SKILL.md

@@ -3,7 +3,7 @@ name: insight-mitmproxy
 description: Record, inspect and compare HTTP request/response evidence with insight-cli mitmproxy. Use when an owned client can explicitly use a loopback proxy; read native flow archives or HAR without replaying traffic. System interception and global certificate trust are outside this facade.
 ---
 
-# Insight mitmproxy 0.5.0
+# Insight mitmproxy 0.5.1
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skills/insight-overview/SKILL.md

@@ -3,7 +3,7 @@ name: insight-overview
 description: Choose bounded tool overviews and focused drilldown through insight-cli without flooding agent context with whole-program code, traces or dumps. Use for tool discovery, scoped evidence paging and keeping native partial coverage separate from complete results.
 ---
 
-# Insight Overview 0.5.0
+# Insight Overview 0.5.1
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skills/insight-procmon/SKILL.md

@@ -3,7 +3,7 @@ name: insight-procmon
 description: Observe actual file and registry access by an authorized running Windows process through insight-cli procmon. Use when static paths or configuration guesses need runtime evidence; inspect retained captures without collecting again.
 ---
 
-# Insight ProcMon 0.5.0
+# Insight ProcMon 0.5.1
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skills/insight-re/SKILL.md

@@ -3,7 +3,7 @@ name: insight-re
 description: Investigate shipped programs and binary artifacts with insight-cli and other available tools; retain ordinary research files, coordinate independent agents and publish Ghidra annotations. Use for reverse engineering behavior, not ordinary source-repository browsing.
 ---
 
-# Insight RE 0.5.0
+# Insight RE 0.5.1
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skills/insight-sevenzip/SKILL.md

@@ -3,7 +3,7 @@ name: insight-sevenzip
 description: Inventory, integrity-check and recover files from archives and supported containers with insight-cli 7-Zip, then hand recovered binaries or configuration to the appropriate research tool.
 ---
 
-# Insight 7-Zip 0.5.0
+# Insight 7-Zip 0.5.1
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skills/insight-strace/SKILL.md

@@ -3,7 +3,7 @@ name: insight-strace
 description: Observe actual file reads, writes, process creation and network syscalls in an authorized owned native Linux launch using insight-cli strace. Use when static inference needs concrete operating-system interaction evidence.
 ---
 
-# Insight strace 0.5.0
+# Insight strace 0.5.1
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skills/insight-tshark/SKILL.md

@@ -3,7 +3,7 @@ name: insight-tshark
 description: Inspect an offline PCAP or PCAPNG with insight-cli tshark to identify protocols, HTTP/DNS/TLS fields, packet evidence and reconstructed TCP/UDP streams. Use for captured traffic questions; live acquisition and TLS decryption are separate tasks.
 ---
 
-# Insight TShark 0.5.0
+# Insight TShark 0.5.1
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized

package/skills/insight-windbg/SKILL.md

@@ -3,7 +3,7 @@ name: insight-windbg
 description: Investigate Windows native user-mode minidumps using bounded stacks, threads, registers, modules, memory and disassembly through insight-cli windbg. Use on Windows x64 when a captured runtime state needs native debugger evidence.
 ---
 
-# Insight WinDbg 0.5.0
+# Insight WinDbg 0.5.1
 
 If local help/status reports AppData or IPC access denied, retry that **read-only probe**
 with the agent host's normal permission escalation, then use that route for later authorized