@fiscalmindset/blindfold 0.4.0

package/dist/lib/wrap.mjs

@@ -0,0 +1,81 @@
+// src/wrap.ts
+import http from "node:http";
+
+// src/constants.ts
+var SENTINEL = "__BLINDFOLD__";
+var DEFAULT_PORT = 8787;
+
+// src/wrap.ts
+var PROXY_TOKEN_HEADER = "x-blindfold-token";
+function socketFetch(socketPath, token) {
+  return async (input, init = {}) => {
+    const reqObj = typeof Request !== "undefined" && input instanceof Request ? input : void 0;
+    const rawUrl = reqObj ? reqObj.url : String(input);
+    const url = new URL(rawUrl);
+    const method = init?.method ?? reqObj?.method ?? "GET";
+    const headers = new Headers(init?.headers ?? reqObj?.headers);
+    if (token) headers.set(PROXY_TOKEN_HEADER, token);
+    const outHeaders = {};
+    headers.forEach((v, k) => {
+      outHeaders[k] = v;
+    });
+    return await new Promise((resolve, reject) => {
+      const req = http.request(
+        { socketPath, path: url.pathname + url.search, method, headers: outHeaders },
+        (res) => {
+          const chunks = [];
+          res.on("data", (c) => chunks.push(c));
+          res.on("end", () => {
+            const respHeaders = new Headers();
+            for (const [k, v] of Object.entries(res.headers)) {
+              if (typeof v === "string") respHeaders.set(k, v);
+              else if (Array.isArray(v)) respHeaders.set(k, v.join(", "));
+            }
+            resolve(new Response(Buffer.concat(chunks), {
+              status: res.statusCode ?? 502,
+              statusText: res.statusMessage ?? "",
+              headers: respHeaders
+            }));
+          });
+        }
+      );
+      req.on("error", reject);
+      const body = init?.body;
+      if (body != null) {
+        if (typeof body === "string" || body instanceof Buffer || body instanceof Uint8Array) req.write(body);
+        else if (typeof URLSearchParams !== "undefined" && body instanceof URLSearchParams) req.write(body.toString());
+        else if (ArrayBuffer.isView(body)) {
+          const v = body;
+          req.write(Buffer.from(v.buffer, v.byteOffset, v.byteLength));
+        } else if (body instanceof ArrayBuffer) req.write(Buffer.from(body));
+        else {
+          req.destroy();
+          reject(new Error("socketFetch: unsupported body type (use string/Buffer/typed-array/URLSearchParams)"));
+          return;
+        }
+      }
+      req.end();
+    });
+  };
+}
+function wrap(client, opts = {}) {
+  const baseUrl = opts.baseUrl ?? `http://127.0.0.1:${DEFAULT_PORT}/v1`;
+  client.baseURL = baseUrl;
+  client.apiKey = SENTINEL;
+  const token = (opts.token ?? process.env.BLINDFOLD_PROXY_TOKEN ?? "").trim() || void 0;
+  const socket = (opts.socket ?? process.env.BLINDFOLD_PROXY_SOCKET ?? "").trim() || void 0;
+  if (socket) {
+    client.fetch = socketFetch(socket, token);
+  } else if (token) {
+    const base = client.fetch ?? fetch;
+    client.fetch = (input, init = {}) => {
+      const headers = new Headers(init?.headers);
+      headers.set(PROXY_TOKEN_HEADER, token);
+      return base(input, { ...init, headers });
+    };
+  }
+  return client;
+}
+export {
+  wrap
+};

package/package.json

@@ -0,0 +1,48 @@
+{
+  "name": "@fiscalmindset/blindfold",
+  "version": "0.4.0",
+  "type": "module",
+  "description": "Make any AI agent's API keys un-leakable, by sealing them inside a Terminal 3 TDX enclave.",
+  "license": "MIT",
+  "author": "FiscalMindset",
+  "homepage": "https://github.com/FiscalMindset/Blindfold#readme",
+  "repository": { "type": "git", "url": "git+https://github.com/FiscalMindset/Blindfold.git", "directory": "packages/blindfold" },
+  "bugs": { "url": "https://github.com/FiscalMindset/Blindfold/issues" },
+  "keywords": ["ai", "agent", "api-key", "secrets", "security", "prompt-injection", "tee", "tdx", "confidential-computing", "terminal3", "enclave"],
+  "publishConfig": { "access": "public" },
+  "main": "./dist/lib/index.mjs",
+  "types": "./src/index.ts",
+  "exports": {
+    ".": { "types": "./src/index.ts", "import": "./dist/lib/index.mjs" },
+    "./proxy": { "types": "./src/proxy.ts", "import": "./dist/lib/proxy.mjs" },
+    "./register": { "types": "./src/register.ts", "import": "./dist/lib/register.mjs" },
+    "./wrap": { "types": "./src/wrap.ts", "import": "./dist/lib/wrap.mjs" }
+  },
+  "bin": {
+    "blindfold": "dist/cli.mjs"
+  },
+  "files": [
+    "dist",
+    "bin",
+    "src",
+    "assets",
+    "postinstall.mjs",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "start": "tsx bin/blindfold.ts",
+    "build": "npm run build:cli && npm run build:lib && node copy-assets.mjs",
+    "build:cli": "esbuild bin/blindfold.ts --bundle --platform=node --format=esm --target=node18 --outfile=dist/cli.mjs --external:@terminal3/t3n-sdk",
+    "build:lib": "esbuild src/index.ts src/proxy.ts src/register.ts src/wrap.ts --bundle --platform=node --format=esm --target=node18 --outdir=dist/lib --out-extension:.js=.mjs --external:@terminal3/t3n-sdk",
+    "prepare": "npm run build",
+    "postinstall": "node postinstall.mjs"
+  },
+  "dependencies": {},
+  "devDependencies": {
+    "esbuild": "^0.24.0"
+  },
+  "optionalDependencies": {
+    "@terminal3/t3n-sdk": "^3.12.3"
+  }
+}

package/postinstall.mjs

@@ -0,0 +1,21 @@
+// Convenience: on a Windows GLOBAL install, npm drops the `blindfold` shim in
+// %APPDATA%\npm, but that folder isn't always on PATH — so `blindfold` comes up
+// "not recognized". This adds it to the user PATH (idempotent, append-only).
+// Windows-only, global-only, and never allowed to fail the install.
+import { spawnSync } from "node:child_process";
+
+if (process.platform === "win32" && process.env.npm_config_global === "true") {
+  try {
+    const ps =
+      "$np=$env:APPDATA+'\\npm';" +
+      "$p=[Environment]::GetEnvironmentVariable('PATH','User'); if($p -eq $null){$p=''};" +
+      "if($p -notlike ('*'+$np+'*')){[Environment]::SetEnvironmentVariable('PATH',($p.TrimEnd(';')+';'+$np),'User');[Console]::Out.Write('ADDED')}else{[Console]::Out.Write('PRESENT')}";
+    const r = spawnSync("powershell", ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-Command", "-"],
+      { input: ps, encoding: "utf8" });
+    if (typeof r.stdout === "string" && r.stdout.includes("ADDED")) {
+      console.log("blindfold: added %APPDATA%\\npm to your user PATH. Open a NEW terminal, then run `blindfold login`.");
+    }
+  } catch {
+    /* a PATH convenience must never break the install */
+  }
+}

package/src/attest.ts

@@ -0,0 +1,235 @@
+/**
+ * attest() — client-side remote attestation of the Terminal 3 enclave cluster.
+ *
+ * Trust upgrade: instead of *trusting* Terminal 3 to run a genuine TDX enclave,
+ * we cryptographically VERIFY it before trusting it with a secret. The T3 node
+ * publishes a DKG attestation bundle at `${nodeUrl}/status`:
+ *   - one raw TDX v4 quote per cluster node (base64),
+ *   - an attestation message binding the quotes to the cluster's ML-KEM key.
+ *
+ * The SDK's `verifyDkgAttestation()` does the full cryptographic check in WASM:
+ *   1. the attestation message starts with the ML-KEM encaps key (the node
+ *      can't swap the key it's attesting to),
+ *   2. every quote's ECDSA-P256 signature chains to Intel's SGX root CA,
+ *   3. every quote's report_data == keccak512(attestation message),
+ *   4. (optional) RTMR3 pinning — the measurement of the code/config running
+ *      inside the enclave matches an expected value you pin.
+ *
+ * If (1)–(3) pass, the enclave is genuine Intel TDX silicon. If you also pin
+ * RTMR3, you additionally prove it's running the exact code you expect —
+ * "verify the hardware", not "trust the operator".
+ *
+ * This does not need the tenant key; it reads the node's public /status.
+ */
+import fs from "node:fs";
+import path from "node:path";
+import { loadBlindfoldEnv, configPath, withFileLockSync } from "./env.ts";
+import type { BlindfoldEnv } from "./types.ts";
+
+const PIN_FIELD = "expectedRtmr3";
+
+/** The RTMR3 measurement pinned in config.json, if any. */
+export function readPinnedRtmr3(): string | undefined {
+  try {
+    const obj = JSON.parse(fs.readFileSync(configPath(), "utf8")) as Record<string, unknown>;
+    const v = obj[PIN_FIELD];
+    return typeof v === "string" && v ? v : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+/** Persist a pinned RTMR3 in config.json (preserving other fields, 0600).
+ *  Locked read-modify-write so a concurrent `login` can't clobber it (M4). */
+export function writePinnedRtmr3(value: string): void {
+  const cfg = configPath();
+  fs.mkdirSync(path.dirname(cfg), { recursive: true });
+  withFileLockSync(cfg, () => {
+    let obj: Record<string, unknown> = {};
+    try { obj = JSON.parse(fs.readFileSync(cfg, "utf8")) as Record<string, unknown>; } catch { /* new file */ }
+    obj[PIN_FIELD] = value;
+    fs.writeFileSync(cfg, JSON.stringify(obj, null, 2), { mode: 0o600 });
+    try { fs.chmodSync(cfg, 0o600); } catch { /* best effort */ }
+  });
+}
+
+/** Subset of the @terminal3/t3n-sdk attestation surface we rely on. */
+interface AttestSdk {
+  setEnvironment: (env: "testnet" | "production") => void;
+  setNodeUrl: (url: string | null) => void;
+  getNodeUrl: (baseUrl?: string) => string;
+  fetchDkgAttestation: (baseUrl?: string) => Promise<
+    { peer_ids: string[]; quotes: Record<string, string>; attestation_msg: string } | undefined
+  >;
+  fetchMlKemPublicKey: (baseUrl?: string) => Promise<string>;
+  verifyDkgAttestation: (
+    encapsKeyB64: string,
+    attestationMsgB64: string,
+    peerIds: string[],
+    quotes: Record<string, string>,
+    expectedRtmr3B64?: string,
+  ) => Promise<{
+    valid: boolean;
+    valid_count: number;
+    expected_count: number;
+    error?: string;
+    results: { peer_id: string; valid: boolean; error?: string; rtmr3?: string }[];
+  }>;
+}
+
+export interface AttestResult {
+  /** False when the node publishes no attestation (mock signer / bootstrapping). */
+  available: boolean;
+  nodeUrl: string;
+  valid: boolean;
+  validCount: number;
+  expectedCount: number;
+  /** Distinct RTMR3 measurements observed across the cluster's quotes. */
+  rtmr3s: string[];
+  /** True only when an expected RTMR3 was supplied and every quote matched it. */
+  pinned: boolean;
+  error?: string;
+}
+
+export interface AttestOpts {
+  env?: BlindfoldEnv;
+  /** Base64 48-byte RTMR3 to pin (fail unless every quote matches it). */
+  expectRtmr3?: string;
+  /** Skip the short-lived result cache and force a fresh fetch+verify. */
+  noCache?: boolean;
+}
+
+// Quotes/RTMR3 are stable between enclave restarts, so a fresh fetch + full
+// ECDSA WASM verify on every gate call is wasteful (S3). Cache per
+// env+node+pin for a short TTL; the CLI `attest` command bypasses it (noCache).
+const ATTEST_TTL_MS = Number(process.env.BLINDFOLD_ATTEST_TTL_MS) || 300_000;
+const attestCache = new Map<string, { at: number; result: AttestResult }>();
+
+async function loadAttestSdk(): Promise<AttestSdk> {
+  try {
+    return (await import("@terminal3/t3n-sdk")) as unknown as AttestSdk;
+  } catch {
+    throw new Error(
+      "@terminal3/t3n-sdk not installed — attestation needs the real SDK. Run `npm install @terminal3/t3n-sdk`.",
+    );
+  }
+}
+
+export async function attest(opts: AttestOpts = {}): Promise<AttestResult> {
+  const env = opts.env ?? loadBlindfoldEnv();
+  if (env.mock) {
+    throw new Error("attestation is unavailable in mock mode (BLINDFOLD_MOCK=1) — it needs a real T3 node.");
+  }
+
+  const cacheKey = `${env.t3Env}|${env.t3BaseUrl}|${opts.expectRtmr3 ?? ""}`;
+  if (!opts.noCache) {
+    const hit = attestCache.get(cacheKey);
+    if (hit && Date.now() - hit.at < ATTEST_TTL_MS) return hit.result;
+  }
+
+  const sdk = await loadAttestSdk();
+  sdk.setEnvironment(env.t3Env);
+  if (env.t3BaseUrl) sdk.setNodeUrl(env.t3BaseUrl);
+  const nodeUrl = sdk.getNodeUrl(env.t3BaseUrl || undefined);
+
+  const bundle = await sdk.fetchDkgAttestation(nodeUrl);
+  if (!bundle) {
+    const unavailable: AttestResult = { available: false, nodeUrl, valid: false, validCount: 0, expectedCount: 0, rtmr3s: [], pinned: false };
+    attestCache.set(cacheKey, { at: Date.now(), result: unavailable });
+    return unavailable;
+  }
+
+  const encapsKey = await sdk.fetchMlKemPublicKey(nodeUrl);
+  const r = await sdk.verifyDkgAttestation(
+    encapsKey,
+    bundle.attestation_msg,
+    bundle.peer_ids,
+    bundle.quotes,
+    opts.expectRtmr3,
+  );
+
+  const rtmr3s = [...new Set(r.results.map((p) => p.rtmr3).filter((x): x is string => Boolean(x)))];
+  const result: AttestResult = {
+    available: true,
+    nodeUrl,
+    valid: r.valid,
+    validCount: r.valid_count,
+    expectedCount: r.expected_count,
+    rtmr3s,
+    pinned: Boolean(opts.expectRtmr3) && r.valid,
+    error: r.error,
+  };
+  attestCache.set(cacheKey, { at: Date.now(), result });
+  return result;
+}
+
+export interface GateResult {
+  /** True when attestation was actually required (a pin exists or was forced). */
+  enforced: boolean;
+  /** True when not enforced, or enforced and verified. */
+  ok: boolean;
+  message?: string;
+  /** Non-fatal caveat the caller should print loudly (e.g. bypass / no-pin). */
+  warning?: string;
+}
+
+/**
+ * Attestation gate for sensitive operations (seal, proxy). It is a no-op unless
+ * the user has pinned an RTMR3 (`attest --pin`) or set `BLINDFOLD_REQUIRE_ATTEST=1`
+ * — so it's opt-in and back-compat. When enforced, it verifies the live enclave
+ * (and RTMR3 pin) and returns ok=false with a reason if it doesn't check out.
+ * Skipped entirely in mock mode or when `skip` is set (`--no-attest`).
+ */
+export async function attestationGate(
+  opts: { env?: BlindfoldEnv; skip?: boolean; requirePin?: boolean } = {},
+): Promise<GateResult> {
+  const env = opts.env ?? loadBlindfoldEnv();
+  const pinned = readPinnedRtmr3();
+  const required = Boolean(pinned) || process.env.BLINDFOLD_REQUIRE_ATTEST === "1";
+
+  // --no-attest: honor it, but make the bypass LOUD when a gate was in force (H6).
+  if (opts.skip) {
+    return {
+      enforced: false,
+      ok: true,
+      warning: required ? "attestation gate BYPASSED via --no-attest — the enclave was NOT verified" : undefined,
+    };
+  }
+  // Mock mode: refuse when attestation is required, rather than silently no-op (M5).
+  if (env.mock) {
+    if (required) {
+      return { enforced: true, ok: false, message: "refusing to run in mock mode while attestation is required (a pin or BLINDFOLD_REQUIRE_ATTEST is set) — mock mode never touches a real enclave" };
+    }
+    return { enforced: false, ok: true };
+  }
+  if (!required) return { enforced: false, ok: true };
+
+  let r: AttestResult;
+  try {
+    r = await attest({ env, expectRtmr3: pinned });
+  } catch (e) {
+    return { enforced: true, ok: false, message: (e as Error).message };
+  }
+  if (!r.available) return { enforced: true, ok: false, message: `node published no attestation (${r.nodeUrl})` };
+
+  // A pin proves "runs MY code"; valid-without-pin only proves "genuine TDX
+  // silicon" — insufficient to seal a NEW secret to (H4).
+  if (opts.requirePin && !pinned) {
+    return {
+      enforced: true,
+      ok: false,
+      message: "refusing: this operation requires a pinned RTMR3 (run `blindfold attest --pin`). Unpinned attestation only proves it's a TDX enclave, not that it runs your expected code.",
+    };
+  }
+
+  const ok = r.valid && (!pinned || r.pinned);
+  const warning = ok && !pinned
+    ? "attestation valid but NO RTMR3 pinned — proves genuine TDX silicon, not that the enclave runs your expected code. Pin it: `blindfold attest --pin`."
+    : undefined;
+  return {
+    enforced: true,
+    ok,
+    warning,
+    message: ok ? undefined : `enclave attestation failed${pinned ? " (RTMR3 pin mismatch)" : ""} at ${r.nodeUrl}`,
+  };
+}

package/src/color.ts

@@ -0,0 +1,31 @@
+/**
+ * Tiny, dependency-free ANSI color helper. Colors are enabled only when the
+ * output is a TTY and NO_COLOR isn't set (so piped/redirected output and CI logs
+ * stay clean plain-text). Honors FORCE_COLOR=1 to force on.
+ */
+const on =
+  process.env.FORCE_COLOR === "1" ||
+  (!process.env.NO_COLOR && process.env.TERM !== "dumb" && Boolean(process.stdout.isTTY));
+
+const wrap = (code: string) => (s: string): string => (on ? `\x1b[${code}m${s}\x1b[0m` : s);
+
+export const c = {
+  bold: wrap("1"),
+  dim: wrap("2"),
+  red: wrap("31"),
+  green: wrap("32"),
+  yellow: wrap("33"),
+  blue: wrap("34"),
+  magenta: wrap("35"),
+  cyan: wrap("36"),
+  gray: wrap("90"),
+};
+
+/** Whether color output is active (TTY + not disabled). */
+export const colorOn = on;
+
+/** Semantic helpers used across CLI output. */
+export const ok = (s: string): string => c.green(s);
+export const bad = (s: string): string => c.red(s);
+export const warn = (s: string): string => c.yellow(s);
+export const head = (s: string): string => c.bold(c.cyan(s));

package/src/compat.ts

@@ -0,0 +1,217 @@
+/**
+ * blindfold compat — detects local agent tooling and prints the exact
+ * env-var swap that routes each one through Blindfold.
+ *
+ * Honesty principle: where a tool's auth model is OAuth/session (not a
+ * user-supplied API key), Blindfold cannot protect it. Those tools are
+ * reported as "not applicable" with a clear explanation.
+ */
+import { spawn } from "node:child_process";
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+const REPO_ROOT = path.resolve(HERE, "..", "..", "..");
+
+const colour = process.stdout.isTTY ? (c: string, s: string) => `\x1b[${c}m${s}\x1b[0m` : (_: string, s: string) => s;
+const bold = (s: string) => colour("1", s);
+const dim = (s: string) => colour("2", s);
+const green = (s: string) => colour("32", s);
+const yellow = (s: string) => colour("33", s);
+const red = (s: string) => colour("31", s);
+const cyan = (s: string) => colour("36", s);
+
+interface Tool {
+  name: string;
+  // How we detect it
+  detect: () => Promise<DetectionResult>;
+  /** "applies" → Blindfold can protect it; "oauth" → it uses session/OAuth, not a user key; "needs-base-url" → has hard-coded URL */
+  applies: "applies" | "oauth-only" | "depends" | "needs-base-url";
+  /** Exact change a user makes to wire it. */
+  recipe: { env?: Record<string, string>; note?: string };
+  // Optional explanation
+  explanation?: string;
+}
+
+interface DetectionResult {
+  detected: boolean;
+  via: string; // "PATH", "node_modules", "config file"
+  detail?: string;
+}
+
+async function detectBinary(name: string): Promise<DetectionResult> {
+  return new Promise((resolve) => {
+    const child = spawn("which", [name], { stdio: ["ignore", "pipe", "ignore"] });
+    const chunks: Buffer[] = [];
+    child.stdout.on("data", (c) => chunks.push(c));
+    child.on("close", (code) => {
+      const out = Buffer.concat(chunks).toString("utf8").trim();
+      resolve({ detected: code === 0 && !!out, via: "PATH", detail: out || undefined });
+    });
+    child.on("error", () => resolve({ detected: false, via: "PATH" }));
+  });
+}
+
+async function detectPackage(pkg: string): Promise<DetectionResult> {
+  const candidates = [
+    path.join(REPO_ROOT, "node_modules", pkg),
+    path.join(REPO_ROOT, "node_modules", pkg, "package.json"),
+  ];
+  for (const c of candidates) {
+    if (fs.existsSync(c)) return { detected: true, via: "node_modules", detail: c };
+  }
+  return { detected: false, via: "node_modules" };
+}
+
+const TOOLS: Tool[] = [
+  {
+    name: "Claude Code (claude)",
+    detect: () => detectBinary("claude"),
+    applies: "depends",
+    recipe: {
+      env: { ANTHROPIC_BASE_URL: "http://127.0.0.1:8787/anthropic", ANTHROPIC_API_KEY: "__BLINDFOLD__" },
+      note: "Only applies if you authenticate Claude Code with an Anthropic API key (enterprise/proxy mode). Default Claude Code uses claude.ai OAuth — there is no exposed key to protect.",
+    },
+    explanation:
+      "Claude Code respects ANTHROPIC_BASE_URL when ANTHROPIC_API_KEY is set; in the default subscription/OAuth flow it does not, and Blindfold has nothing to protect.",
+  },
+  {
+    name: "OpenCode (sst.dev/opencode)",
+    detect: () => detectBinary("opencode"),
+    applies: "applies",
+    recipe: {
+      env: { OPENAI_BASE_URL: "http://127.0.0.1:8787/v1", OPENAI_API_KEY: "__BLINDFOLD__" },
+      note: "Configure your provider in ~/.config/opencode/config.json to use the proxy URL.",
+    },
+  },
+  {
+    name: "Aider",
+    detect: () => detectBinary("aider"),
+    applies: "applies",
+    recipe: {
+      env: { OPENAI_API_BASE: "http://127.0.0.1:8787/v1", OPENAI_API_KEY: "__BLINDFOLD__" },
+      note: "Aider reads OPENAI_API_BASE (the older name). Same idea.",
+    },
+  },
+  {
+    name: "Continue.dev (continue)",
+    detect: () => detectBinary("continue"),
+    applies: "applies",
+    recipe: {
+      note: "Edit ~/.continue/config.json — set apiBase to http://127.0.0.1:8787/v1 and apiKey to __BLINDFOLD__ on each OpenAI-flavoured model.",
+    },
+  },
+  {
+    name: "Cline (VS Code extension)",
+    detect: () => detectBinary("code"),
+    applies: "applies",
+    recipe: {
+      note: "In Cline settings → API Provider → set baseURL to http://127.0.0.1:8787/v1 and api key to __BLINDFOLD__. (Detection here just checks for VS Code; Cline itself is a VS Code extension.)",
+    },
+  },
+  {
+    name: "OpenAI Codex CLI (codex)",
+    detect: () => detectBinary("codex"),
+    applies: "applies",
+    recipe: { env: { OPENAI_BASE_URL: "http://127.0.0.1:8787/v1", OPENAI_API_KEY: "__BLINDFOLD__" } },
+  },
+  {
+    name: "Cursor (desktop app)",
+    detect: () => detectBinary("cursor"),
+    applies: "needs-base-url",
+    recipe: {
+      note: "Cursor does not expose a per-request base-URL setting in current builds. If you self-host an Anthropic/OpenAI-compatible gateway, point Cursor at that, then at Blindfold from there.",
+    },
+  },
+  {
+    name: "openai (Node SDK)",
+    detect: () => detectPackage("openai"),
+    applies: "applies",
+    recipe: { env: { OPENAI_BASE_URL: "http://127.0.0.1:8787/v1", OPENAI_API_KEY: "__BLINDFOLD__" } },
+  },
+  {
+    name: "@anthropic-ai/sdk (Node SDK)",
+    detect: () => detectPackage("@anthropic-ai/sdk"),
+    applies: "applies",
+    recipe: { env: { ANTHROPIC_BASE_URL: "http://127.0.0.1:8787/anthropic", ANTHROPIC_API_KEY: "__BLINDFOLD__" } },
+  },
+  {
+    name: "@langchain/openai (LangChain JS)",
+    detect: () => detectPackage("@langchain/openai"),
+    applies: "applies",
+    recipe: { note: "Use `new ChatOpenAI({ apiKey: '__BLINDFOLD__', configuration: { baseURL: 'http://127.0.0.1:8787/v1' } })`." },
+  },
+  {
+    name: "ollama (local model runner)",
+    detect: () => detectBinary("ollama"),
+    applies: "oauth-only",
+    recipe: { note: "Ollama runs models locally with no external API key — there's no secret for Blindfold to protect. Skip." },
+  },
+];
+
+export async function runCompat(opts: { json?: boolean } = {}): Promise<void> {
+  const results = await Promise.all(
+    TOOLS.map(async (t) => ({ tool: t, detection: await t.detect() })),
+  );
+
+  if (opts.json) {
+    process.stdout.write(JSON.stringify(results.map((r) => ({
+      tool: r.tool.name,
+      detected: r.detection.detected,
+      detected_at: r.detection.detail,
+      applies: r.tool.applies,
+      env: r.tool.recipe.env,
+      note: r.tool.recipe.note,
+      explanation: r.tool.explanation,
+    })), null, 2));
+    return;
+  }
+
+  process.stdout.write(`\n${bold("🛡️  Blindfold — compatibility scan")}\n${dim("Probing local box for agent tools and SDKs Blindfold can protect.")}\n\n`);
+
+  const detected = results.filter((r) => r.detection.detected);
+  const notFound = results.filter((r) => !r.detection.detected);
+
+  process.stdout.write(`${bold(`Detected (${detected.length}):`)}\n`);
+  if (detected.length === 0) process.stdout.write(`  ${dim("(none — install one of the tools below, or just use the OpenAI/Anthropic SDK in your own code)")}\n`);
+  for (const r of detected) {
+    renderTool(r.tool, r.detection, true);
+  }
+
+  process.stdout.write(`\n${bold(`Not found on this machine (${notFound.length}):`)}\n`);
+  for (const r of notFound) {
+    renderTool(r.tool, r.detection, false);
+  }
+
+  process.stdout.write(`\n${dim("For a longer-form compatibility writeup see docs/05-compatibility.md.")}\n`);
+}
+
+function renderTool(tool: Tool, detection: DetectionResult, detected: boolean): void {
+  const mark = !detected
+    ? dim("·")
+    : tool.applies === "applies"
+      ? green("✓")
+      : tool.applies === "depends"
+        ? yellow("?")
+        : tool.applies === "needs-base-url"
+          ? yellow("!")
+          : red("✖");
+  const status = !detected
+    ? dim("(not installed)")
+    : tool.applies === "applies"
+      ? green("Blindfold protects this")
+      : tool.applies === "depends"
+        ? yellow("Depends on how you authenticate")
+        : tool.applies === "needs-base-url"
+          ? yellow("No base-URL hook — needs upstream support")
+          : red("Doesn't apply (no user-supplied key)");
+  process.stdout.write(`  ${mark} ${bold(tool.name)}  ${dim("·")}  ${status}\n`);
+  if (detected && detection.detail) process.stdout.write(`    ${dim("at " + detection.detail)}\n`);
+  if (detected && tool.recipe.env) {
+    const envLine = Object.entries(tool.recipe.env).map(([k, v]) => `${k}=${v}`).join("  ");
+    process.stdout.write(`    ${cyan(envLine)}\n`);
+  }
+  if (detected && tool.recipe.note) process.stdout.write(`    ${dim(tool.recipe.note)}\n`);
+  if (detected && tool.explanation) process.stdout.write(`    ${dim(tool.explanation)}\n`);
+}

package/src/constants.ts

@@ -0,0 +1,24 @@
+/**
+ * The sentinel string that stands in for a secret as it flows through
+ * the agent process and the Blindfold proxy. Inside the T3 contract,
+ * every occurrence of this string in any header value is replaced with
+ * the real secret from the enclave's KV map.
+ *
+ * KEEP IN SYNC with `contract/src/forward.rs::SENTINEL`.
+ */
+export const SENTINEL = "__BLINDFOLD__";
+
+/** Default port for the local OpenAI-shaped proxy. */
+export const DEFAULT_PORT = 8787;
+
+/** The contract tail we publish under in the developer's tenant. */
+export const CONTRACT_TAIL = "blindfold-proxy";
+
+/** Default contract version (semver, used at register time). Bump on every change to contract/. */
+export const CONTRACT_VERSION = "0.5.6";
+
+/** Marker the proxy uses to surface "registered but mock" status in /health. */
+export const HEALTH_BANNER = "blindfold/0.1.0";
+
+/** Default port for the dashboard server (separate from the proxy port). */
+export const DEFAULT_DASHBOARD_PORT = 8799;