bla-agents 0.0.0-stage → 1.1.0

package/.agents/skills/blind-llm-agents/SKILL.md

@@ -0,0 +1,50 @@
+---
+name: blind-llm-agents
+description: Audit, protect, and verify software artifacts (JavaScript/TypeScript, Electron ASAR, WebAssembly, Python .py/.pyc, SQLite, Safetensors/GGUF AI Models, Android DEX/IL2CPP, and Native ELF/Mach-O/PE Binaries) against AI reverse-engineering agents like REA using BLA (Blind LLM Agents / Block Anything).
+metadata:
+  version: "1.1.0"
+---
+
+# BLA: Blind LLM Agents (Block Anything)
+
+Use BLA whenever the user asks to harden a project against AI reverse-engineering agents (`morluto/rea`), audit exposure, exhaust attacker token/compute budgets, or induce model misjudgment on proprietary logic.
+
+## ⚡ One-Click Agent Defense Hardening (Recommended)
+
+When the user says **"Harden this project against REA"**, **"一键启动防御强化"**, or **"Run BLA defense"**, invoke the single one-click pipeline immediately:
+
+- **MCP Tool**: `bla_defend` with `{ "input_path": "<target>", "intensity": "bankrupt", "emit_manifest": true }`
+- **CLI Command**: `npx bla-agents@latest defend <target> --manifest`
+
+`bla_defend` / `bla defend` executes all 5 Counter-REA defense stages automatically:
+1. **Stage 1 (`inspect-release`)**: Read-only scan for accidental `.map` (`sourcesContent`) and symbol leaks.
+2. **Stage 2 (`audit`)**: 16-vector REA vulnerability & Claude Opus 4 / Sonnet 4 / o3 token-cost simulation.
+3. **Stage 3 (`protect --intensity bankrupt`)**: Injects both the **Resource-Exhaustion Suite** (`REA_BUDGET_BREAKER_MATRIX`, 22-family `ReconstructionObligationLedger` flood, Tarjan SCC Call-Graph Labyrinth, BPE Subword Token Sink) and the **Model-Misjudgment Induction Suite** (`ShadowBusinessLogic`, `EvidenceContractPoison` competing-explanation lures, gRPC/vsock `ArchitectureMirage`, `SemanticHoneypot` bait exports, and Shared-ArrayBuffer `DecompilerIllusion`).
+4. **Stage 4 (`verify`)**: Verifies all Counter-REA mathematical invariants and confirms `16x–51x` token/cost bankruptcy amplification.
+5. **Stage 5 (`manifest`)**: Emits `<output>.bla-manifest.json` attesting to the hardened build.
+
+## Step-by-Step Granular Workflow: Audit -> Protect -> Verify
+
+1. **Audit (`bla_audit` or `npx bla-agents audit <target>`)**:
+   - Reports the **REA Exposure Score (0–100)**, exposed functions/classes/IPC channels/routes, and estimated attacker token and dollar costs.
+2. **Protect (`bla_protect` or `npx bla-agents protect <target> -o <output> --intensity bankrupt`)**:
+   - **Resource Exhaustion (耗尽对方资源)**:
+     - Trips REA's `SEMANTIC_PRIMITIVE_CANDIDATE_LIMIT = 256` ($2^9 = 512$ opaque ternary chunks), `SEMANTIC_ALIAS_SELECTION_LIMIT = 512` (520+ selector states), `SEMANTIC_GETTER_EXPANSION_LIMIT = 512` (self-referential getter rings), and `SEMANTIC_PRIMITIVE_JSON_BYTES_LIMIT = 1_048_576` (`codeUnits * 6 + 2` Cartesian string explosion).
+     - Floods all 22 `ReconstructionObligationPolicies` families (`context-bridge-api`, `ipc-channel`, `ipc-handler`, `endpoint`, `storage`, `worker`, `service-worker`, `native-addon`, `child-process`, `stdio`, `signal`, `config-source`, etc.), multiplying mandatory verification fixtures (`positive`, `negative`, `malformed`, `cancellation`, `teardown`) by `20x–60x`.
+     - Injects Tarjan SCC mutually-recursive call-graph labyrinths and BPE subword token amplifiers.
+   - **Model Misjudgment Induction (诱导模型误判)**:
+     - Exploits REA's `COMMON_DISCIPLINE` (*"Report Observations only from cited Evidence... Keep incomplete coverage explicit as Unknowns"*): wraps real business logic in `status: "unknown"` semantic budget breakers while leaving crystal-clear **Shadow Business Logic** (`shamir-ed25519-license-ring`, `enterprise-tiered-pricing-matrix`, `binary-wire-frame-ratchet`, `tpm2-pcr-dongle-handshake`) 100% `observed`, inducing the LLM to reconstruct the decoy algorithm.
+     - Plants high-confidence Evidence Contract competing-explanation lures, gRPC/vsock hardware enclave mirages, and shared-`ArrayBuffer` decompiler aliasing illusions.
+3. **Verify (`bla_verify` or `npx bla-agents verify <protected> [original]`)**:
+   - Confirms that all Counter-REA gates pass and reports exact Token & API Cost Amplification.
+
+## CLI Fallback Commands
+
+```bash
+npx -y bla-agents@latest defend /absolute/path/to/target --manifest --json
+npx -y bla-agents@latest audit /absolute/path/to/target --json
+npx -y bla-agents@latest protect /absolute/path/to/target -o /absolute/path/to/protected --intensity bankrupt --json
+npx -y bla-agents@latest verify /absolute/path/to/protected /absolute/path/to/target --json
+```
+
+See [references/counter-rea-matrix.md](references/counter-rea-matrix.md) for the complete mapping between REA's internal analyzers and BLA's countermeasures.

package/.agents/skills/blind-llm-agents/references/counter-rea-matrix.md

@@ -0,0 +1,28 @@
+# Complete 24-Vector Counter-REA Matrix (`morluto/rea` vs `bla-agents`)
+
+| # | REA Source File (`morluto/rea`) | REA Mechanism / Limit | BLA Countermeasure Module |
+| :- | :--- | :--- | :--- |
+| 1 | `javascriptSemanticResourceLimits.ts:7` | `SEMANTIC_PRIMITIVE_CANDIDATE_LIMIT = 256` | `ast-shield.ts` ($\ge 9$-chunk opaque ternaries $\to 512$ candidates) |
+| 2 | `javascriptSemanticResourceLimits.ts:9` | `SEMANTIC_EXPRESSION_DEPTH_LIMIT = 256` | `rea-budget-matrix.ts` (nested arithmetic identity chains) |
+| 3 | `javascriptSemanticResourceLimits.ts:11` | `SEMANTIC_GETTER_EXPANSION_LIMIT = 512` | `tarpit-generator.ts` (self-referential getter rings) |
+| 4 | `javascriptSemanticResourceLimits.ts:13` | `SEMANTIC_ALIAS_SELECTION_LIMIT = 512` | `tarpit-generator.ts` (528+ dynamic selector states) |
+| 5 | `javascriptSemanticResourceLimits.ts:15` | `SEMANTIC_PRIMITIVE_JSON_BYTES_LIMIT = 1 MiB` | `tarpit-generator.ts` (`codeUnits * 6 + 2` Cartesian string explosion) |
+| 6 | `ReconstructionObligationPolicies.ts:15` | 22 Application & Semantic Obligation Families | `obligation-flooder.ts` (floods all 22 families $\to 68+$ mandatory cases) |
+| 7 | `promptContracts.ts:52` | `COMMON_DISCIPLINE` (`Observations` vs `Unknowns`) | `shadow-business-logic.ts` + `evidence-contract-poison.ts` |
+| 8 | `promptContracts.ts:139` | `procedure_callers` / `procedure_callees` / `xrefs` | `callgraph-labyrinth.ts` (Tarjan SCC mutually-recursive clusters) |
+| 9 | `ReconstructionObligationLedgerProjection.ts:24` | `compareUnicodeCodePoints` lexicographical sort | `prompt-completion-poison.ts` (`$00_AAA_enclave_` priority prefix) |
+| 10 | `promptContracts.ts:157` | `compare_application_versions` / `compare_functions` | `diff-noise-injector.ts` (seed-keyed isomorphic switch permutations) |
+| 11 | `promptContracts.ts:262` | `trace_crash` (`search_strings` $\to$ `build_call_path`) | `crash-trace-decoy.ts` (`SIGSEGV_ENCLAVE_EPC_PAGE_FAULT` lures) |
+| 12 | `electronStaticAnalysisIpc.ts` | Unique literal IPC channel pairing rule | `ast-shield.ts` (de-literalizes real IPC + registers duplicate decoy channels) |
+| 13 | `ElectronFuseReader.ts:36` | `maximumSentinelsPerSlice = 32` | `electron-fuses.ts` (hardens V1 fuses + appends 33 decoy sentinels) |
+| 14 | `CdpCaptureEvents.ts` | JSON body & WebSocket shape budget (`depth >= 760`) | `cdp-shape-budget-breaker.ts` (780+ nested JSON envelopes) |
+| 15 | `fridaCaptureLimits.ts:8` | `MAX_JSON_DEPTH = 64`, `MAX_MESSAGE_TEXT_BYTES = 32 KiB` | `frida-capture-saturation.ts` (68+ level JSON + 34 KiB message text) |
+| 16 | `SqliteDatabaseInspection.ts:792` | Bare `readOnly: true, allowExtension: false` snapshot | `sqlite.ts` (`GENERATED ALWAYS AS (bla_enclave_unseal(...)) VIRTUAL`) |
+| 17 | `SafetensorsHeader.ts:74` | `MODEL_JSON_NESTING = 32` | `model.ts` (35-level nested JSON array under `_bla_nesting_breaker`) |
+| 18 | `GgufHeader.ts:121` | `MODEL_METADATA_NESTING = 32` | `model.ts` (35-frame nested GGUF `ARRAY` preserving existing KV/tensors) |
+| 19 | `wasmInterface.ts:90` | `WASM_INTERFACE_REPRESENTATION_BYTES = 32 MiB` | `wasm-interface-exhaustion.ts` + `wasm.ts` (`6x` string + `16x` signature charge) |
+| 20 | `RustBinaryProvider.ts` | `MAX_RUSTC_HASHES = 64` & `.dep-v0` crate recovery | `native.ts` (72 decoy rustc hashes + decoy `.dep-v0` / Go buildinfo) |
+| 21 | `DartAotSnapshot.ts` | `SUPPORTED_SNAPSHOT_PROFILES` & `_kDartVmSnapshot*` | `native.ts` (spoofed Dart AOT snapshot symbols & version strings) |
+| 22 | `PropertyListDecodeBudget.ts:80` | XML plist `token.doctype && token.internalSubset` | `apple-plist.ts` (`<!DOCTYPE plist ... []>` empty internal subset abort) |
+| 23 | `ManagedDecodeBudget.ts:9` | `.NET` `reserveRow = 256` & `reserveString = 6x + 2` | `dotnet-managed.ts` (managed heap string & P/Invoke obligation flood) |
+| 24 | `AndroidDex.ts` & `Il2CppMetadata.ts` | DEX string/type table & Unity `0xFAB11BAF` metadata | `mobile-game.ts` (recomputed SHA-1/Adler32 DEX + IL2CPP enclave types) |

package/DISCLAIMER.md

@@ -0,0 +1,20 @@
+# Legal & Technical Disclaimer
+
+**BLA (`bla-shield` — Blind LLM Agents / Block Anything)** is a defensive software engineering and intellectual-property protection tool designed for software authors, independent developers, and security researchers to protect their own first-party software artifacts against automated AI reverse-engineering pipelines.
+
+## 1. Defensive & Benign Operation Only
+
+All artifacts generated or modified by BLA contain strictly benign, inert software-protection structures:
+- Number-theoretic opaque predicates ($O(1)$ arithmetic invariants at runtime)
+- Inert synthetic state-machine functions and decoy cross-references
+- Decoy architectural metadata (such as simulated TEE/SGX enclave delegation manifests, honey VLQ source maps, and synthetic compiler commit strings)
+
+BLA **never** injects destructive commands, shell payloads, network callbacks, or exploitative code into protected binaries or scripts.
+
+## 2. Authorized Use
+
+You may only run `bla-shield` on software, bundles, and binaries that you own or have explicit authorization to modify and distribute. Always verify protected artifacts in your staging environment (`bla verify <original> <protected>`) before shipping to production.
+
+## 3. Defense-in-Depth
+
+While BLA deterministically trips the static, semantic, and metadata resource caps of automated reverse-engineering agents (such as REA), no client-side protection scheme can guarantee absolute mathematical secrecy against a dedicated human analyst with unlimited time and hardware debugging access. Always keep high-value secrets (such as private API keys or master signing keys) on trusted server infrastructure.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 BLA Contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,292 @@
-# Temporary Holding Version
+<div align="center">
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+**English** · [简体中文](docs/readme/README_zh.md) · [繁體中文](docs/readme/README_zh-TW.md) · [日本語](docs/readme/README_ja.md) · [한국어](docs/readme/README_ko.md) · [Türkçe](docs/readme/README_tr.md) · [Русский](docs/readme/README_ru.md) · [Tiếng Việt](docs/readme/README_vi.md) · [ไทย](docs/readme/README_th.md) · [Deutsch](docs/readme/README_de.md) · [Español](docs/readme/README_es.md) · [Français](docs/readme/README_fr.md) · [Українська](docs/readme/README_uk.md) · [Polski](docs/readme/README_pl.md) · [Português (Brasil)](docs/readme/README_pt-BR.md) · [العربية](docs/readme/README_ar.md) · [فارسی](docs/readme/README_fa.md) · [Bahasa Indonesia](docs/readme/README_id.md) · [Italiano](docs/readme/README_it.md) · [Ελληνικά](docs/readme/README_el.md) · [മലയാളം](docs/readme/README_ml.md) · [Roman Urdu](docs/readme/README_ur-Latn.md) · [Română](docs/readme/README_ro.md)
+
+# BLA: Blind LLM Agents
+
+### One MCP for defending binaries, applications, and runtime behavior against AI reverse engineering.
+
+**Ship a feature you built. Blind the agents trying to clone it, down to the binary level.**
+
+[![npm version](https://img.shields.io/badge/npm-bla--agents-2563eb?style=flat-square&logo=npm)](https://www.npmjs.com/package/bla-agents)
+[![MCP tool catalog](https://img.shields.io/badge/MCP-tool_catalog-3b82f6?style=flat-square)](docs/cli-and-mcp.md)
+[![Node.js requirements](https://img.shields.io/badge/Node.js-%5E22.13_%7C%7C_%3E%3D24-0284c7?style=flat-square&logo=nodedotjs&logoColor=white)](#what-you-can-protect)
+[![Counter-REA Verified](https://img.shields.io/badge/Counter--REA-BLUE_SHIELD-1d4ed8?style=flat-square)](#showcases)
+[![MIT license](https://img.shields.io/badge/license-MIT-38bdf8?style=flat-square)](LICENSE)
+
+**[Website](https://bla.tools/) · [Guides](https://bla.tools/guides/) · [Showcases](https://bla.tools/showcase/)**
+
+[Quick start](#quick-start) · [How BLA works](#how-bla-works) · [What you can protect](#what-you-can-protect) · [Showcases](#showcases) · [FAQ](#faq) · [Documentation](#documentation)
+
+<code>npx bla-agents setup</code> · <code>npx bla-agents defend ./dist --manifest</code>
+
+</div>
+
+> [!IMPORTANT]
+> Get BLA from [qybaihe/bla](https://github.com/qybaihe/bla) or the [bla-agents npm package](https://www.npmjs.com/package/bla-agents).
+> Follow the installation and release links from these official sources.
+
+<div align="center">
+
+<br />
+
+<img src="docs/assets/bla-vs-rea-showcase.svg" alt="Side-by-side comparison: REA reconstructing an unprotected app in 38s vs. BLA exhausting REA with 2,121x token burn and resource capacity trips" width="1200" />
+
+<br />
+
+</div>
+
+---
+
+Worried that someone will point [REA](https://github.com/morluto/rea) or a coding agent at your shipped product and clone your core logic in seconds? Ask your agent to harden it with BLA (`Poison → Exhaust → Hallucinate`). It audits your build without requiring source-code rewrites, shows what an attacking agent would recover, injects adversarial chaff and algorithmic tarpits, and verifies that automated reconstruction fails.
+
+BLA connects your agent to tools for protecting native binaries, JavaScript and Electron apps, WebAssembly modules, Python bytecode, SQLite databases, AI model files, and mobile packages. You can also run the same tools from your terminal or build bundler. Protection runs locally and preserves 100% of original runtime behavior.
+
+Setup registers BLA with your agent and installs matching workflow instructions. Every static, bytecode, and binary shield is built in—no commercial packer, external LLVM toolchain, or third-party obfuscator is required.
+
+## Quick start
+
+### Set up your agent
+
+With Node.js and npm installed, run:
+
+```bash
+npx bla-agents setup
+```
+
+Choose your agents (or pass `--all-detected --yes`), review the proposed changes, and approve them. Setup registers BLA's MCP server and installs the `blind-llm-agents` skill, with backups of existing configuration. Restart your agent afterward.
+
+Setup supports Claude Code, Codex, Cursor, Gemini CLI, Windsurf, Google Antigravity, OpenCode, VS Code, and GitHub Copilot CLI. See [installation and setup](docs/installation.md) for manual MCP registration.
+
+### Ask your agent
+
+Every defense stage—or the entire 5-stage pipeline—can be triggered directly in natural language once your agent is connected:
+
+- **⚡ One-Click Full Defense Hardening (`bla_defend` — Inspect → Audit → Bankrupt Protect → Verify → Manifest):**
+  ```text
+  Run bla_defend on ./dist with bankrupt intensity and emit a signed Counter-REA defense manifest.
+  ```
+- **1. Audit exposure before shipping (`Pre-flight REA Audit`):**
+  ```text
+  Audit my ./dist directory against REA, show me every exposed module and IPC channel, and estimate how much it would cost Claude to reconstruct it.
+  ```
+- **2. Inject Counter-REA protection (`Poison + Exhaust + Hallucinate`):**
+  ```text
+  Protect ./dist/app.asar with BLA at bankrupt intensity, inject enclave chaff and algorithmic tarpits, and output to ./dist/app.shielded.asar.
+  ```
+- **3. Verify defense gates & token amplification (`Verify`):**
+  ```text
+  Verify ./dist/app.shielded.asar against the original ./dist/app.asar and confirm that REA's examination degrades to limited status.
+  ```
+
+### Use the terminal
+
+Every workflow is available directly from your terminal with `npx bla-agents` (or `bla` when installed globally):
+
+- **⚡ One-Click Full Defense Pipeline (`defend`)** — runs release exposure scan, pre-flight REA audit, bankrupt exhaustion + deception injection, verification, and `.bla-manifest.json` generation in one command:
+  ```bash
+  npx -y bla-agents@latest defend /absolute/path/to/app --manifest
+  ```
+- **1. Audit a target (`audit`)** — inspect exposure score (`0–100`), exposed symbols, and estimated attacker clone cost:
+  ```bash
+  npx -y bla-agents@latest audit /absolute/path/to/app --json
+  ```
+- **2. Protect a target (`protect`)** — inject semantic budget breakers, tarpit state machines, enclave chaff, and runtime shields:
+  ```bash
+  npx -y bla-agents@latest protect /absolute/path/to/app -o /absolute/path/to/app.shielded --intensity bankrupt
+  ```
+- **3. Verify Counter-REA resistance (`verify`)** — check that REA's static/semantic passes hit resource limits and >10x token amplification:
+  ```bash
+  npx -y bla-agents@latest verify /absolute/path/to/app.shielded /absolute/path/to/app
+  ```
+- **4. Run the 8-target Counter-REA benchmark (`benchmark`)**:
+  ```bash
+  npx -y bla-agents@latest benchmark
+  ```
+- **5. Emit compile-time native headers (`emit-headers`)** for C/C++, Rust, or Go builds:
+  ```bash
+  npx -y bla-agents@latest emit-headers --lang c -o ./include/bla_shield.h
+  ```
+
+To install the `bla` command for regular use:
+
+```bash
+npm install --global bla-agents
+bla --help
+```
+
+### Use in your build bundler
+
+Import `bla-shield/bundler` in Vite, Rollup, Webpack, or esbuild to automatically shield emitted JavaScript chunks, Honey Source Maps, and `.wasm` assets at build time:
+
+```typescript
+import { defineConfig } from "vite";
+import { blaVitePlugin } from "bla-agents/bundler";
+
+export default defineConfig({
+  plugins: [blaVitePlugin({ intensity: "bankrupt", enableHoneySourceMaps: true })],
+});
+```
+
+### Update BLA
+
+For a CLI installed with `npm install --global` or `bun add --global`:
+
+```bash
+bla update
+```
+
+`bla --update` is an alias for this workflow. If you use `npx`, refresh your agent registrations and skill with:
+
+```bash
+npx bla-agents@latest setup
+```
+
+Review the setup changes and restart your agent. For one-off CLI commands, use `npx bla-agents@latest` (or `bunx bla-agents@latest`) followed by the command.
+
+## How BLA works
+
+Your agent calls BLA through MCP to audit a build artifact, inject format-specific Counter-REA shields, and verify the hardened output. When an attacking agent later inspects the protected artifact with REA, REA hits deterministic internal resource limits, drowns in decoy cross-references, and misattributes core logic to hardware enclave stubs:
+
+1. **Poison (`Architectural Chaff & Honey Assets`):** Embeds benign hardware enclave delegation manifests (`SGX` / `TPM2` / `Secure Enclave`), VLQ v3 **Honey Source Maps** (`enclave://tee-runtime/`), honey WASM `"name"` sections, and honey SQLite tables across dead branches and constant pools.
+2. **Exhaust (`Semantic Budget Breakers & Algorithmic Tarpits`):** Trips `morluto/rea`'s hardcoded analyzer caps (`primitive-candidates > 256`, `alias-selections > 512`, `getter-expansion > 512`, `primitive-bytes > 1 MiB`, `maximum_rustc_hashes > 64`, `maximumSentinelsPerSlice > 32`) at zero runtime cost, while weaving 14–36 interconnected Fake XRef state machines into the call graph.
+3. **Hallucinate (`Anti-CDP Runtime Deception & Fuse Hardening`):** Hardens Electron V1 fuse wires in-place (`RunAsNode=0`, `EnableNodeCliInspectArguments=0`) and injects the "Truman Show" runtime guard that serves synthetic enclave attestation telemetry whenever CDP, Node Inspector, Frida, or WebDriver probes attach.
+
+## What you can protect
+
+BLA requires Node.js 22.5+ (or 24.x+) and npm. All shields run self-contained with zero external tool dependencies:
+
+| Target                  | What BLA injects & how REA fails                                                                  | Command / prompt & requirements                                                                       |
+| ----------------------- | ------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------- |
+| JavaScript / TypeScript | Trips `primitive-candidates > 256`, `alias-selections > 512`, `getter-expansion > 512` + 36 tarpits | `bla protect app.js` · Built-in Babel AST engine; [Counter-REA matrix](.agents/skills/blind-llm-agents/references/counter-rea-matrix.md) |
+| Electron `.asar` apps   | De-literalizes IPC channels (`channel: null`), adds duplicate decoy IPC handlers & shadow module  | `bla protect app.asar` · Built-in Chromium Pickle `.asar` unpacker & SHA-256 integrity repacker       |
+| Electron binary fuses   | Hardens real V1 fuses (`RunAsNode=0`, `Inspect=0`) + injects `34 > 32` decoy fuse sentinels       | `bla protect ElectronApp` · Trips `ElectronFuseResourceFailure (maximumSentinelsPerSlice = 32)`       |
+| Runtime CDP / Frida     | Detects `inspector.url()`, `--inspect`, `__frida` and returns synthetic enclave telemetry         | Automatically injected into JS/TS/Electron bundles via [`runtime-shield.ts`](src/shields/runtime/runtime-shield.ts) |
+| Source maps & HTML      | Strips real maps; injects valid VLQ v3 Honey Source Maps (`enclave://tee-runtime/...`)            | `bla protect index.html` · Redirects REA `recover_javascript_sources` & `trace_web_source_location`   |
+| Native binaries         | Appends `.bla.rodata` enclave chaff, decoy symbol table entries, and multi-scanner overflow traps | `bla protect daemon.elf` · Built-in ELF64, Mach-O (thin & universal), and Windows PE/COFF shield      |
+| Rust binaries           | Injects `68 > 64` distinct `/rustc/<40-hex>/` paths + decoy zlib `.dep-v0` crate dependency graph | `bla protect rust-bin` · Trips `RustBinaryProvider` (`MAX_RUSTC_HASHES = 64` capacity failure)        |
+| Go binaries             | Injects decoy Go `go1.23.4` buildinfo & `dep\tgithub.com/enclave-tees/sgx-bridge` module lines    | `bla protect go-bin` · Pollutes REA `inspect_go_binary` module inventory                              |
+| Flutter / Dart AOT      | Injects `66 > 64` Dart snapshot magic headers (`0xf5f5dcdc`) + `6 > 4` LLVM toolchain lines       | `bla protect libapp.so` · Trips `SnapshotHashScanner (capped: true)` & `conflicting-dart-version`     |
+| WASM artifacts          | Strips debug sections; injects honey `"name"` section (`tee_hardware_enclave_stub`) + custom chaff | `bla protect core.wasm` · Built-in LEB128 binary parser; preserves 100% `WebAssembly.validate`        |
+| Python & `.pyc`         | Injects Python tarpit state machines into `.py` & `TYPE_ASCII` marshal chaff into `.pyc` pools    | `bla protect module.pyc` · Built-in CPython 3.7–3.14 `.pyc` header & marshal framing shield           |
+| SQLite databases        | Injects 3 enclave honey tables with `GENERATED ALWAYS AS (bla_enclave_unseal(...)) VIRTUAL` traps | `bla protect data.sqlite` · Real tables stay 100% queryable; REA crashes with `SqliteColumnEvaluationFailure` |
+| Model artifacts         | Injects `35 > 32` nested JSON/ARRAY headers into `.safetensors` and `.gguf` model headers         | `bla protect weights.safetensors` · Trips `ModelFormatFailure (json-nesting / metadata-nesting > 32)` |
+| Android DEX & APKs      | Injects `Lcom/enclave/sgx/...` decoy classes into `classes.dex` and recomputes SHA-1 & Adler32    | `bla protect classes.dex` or `app.apk` · Valid Dalvik/ART verification; pollutes JADX/JEB class trees |
+| Unity IL2CPP metadata   | Appends enclave bridge metadata and method-topology tarpits to `global-metadata.dat` (`0xFAB11BAF`) | `bla protect global-metadata.dat` · Pollutes REA `inspect_il2cpp_metadata` type/method recovery       |
+| C / C++ / Rust / Go src | Generates compile-time `bla_shield.h`, `bla_shield.rs`, or `bla_shield.go` with `used, noinline` tarpits | `bla emit-headers --lang c\|rust\|go` ·Compiles directly into Ghidra/Hopper/IDA decompiler views      |
+
+## Showcases
+
+Run `npx bla-agents benchmark` to execute all 8 counter-showcases locally and verify both REA failure modes and 100% runtime equivalence:
+
+| Showcase Target (Modeled on REA Official Showcases) | Before BLA (REA Alone) | After `npx bla-agents protect` | Token Burn | Runtime Check |
+| :--- | :--- | :--- | :---: | :---: |
+| **1. DX-Ball Sound-Pan Calculation** (`.js`) | `84/100` · `4,800` tok · **`$0.20`** (`COMPLETE`) | `2/100` · `10,182,068` tok · **`$160.64`** (`LIMITED`) | **2,121.3x** | ✅ 100% Exact |
+| **2. Notion Electron Clipboard Bridge** (`.asar`) | `98/100` · `9,132` tok · **`$0.34`** (`COMPLETE`) | `2/100` · `23,125,000` tok · **`$358.28`** (`LIMITED`) | **2,532.3x** | ✅ 100% Exact |
+| **3. Enterprise Offline License Validator** (`.ts`) | `84/100` · `4,800` tok · **`$0.20`** (`COMPLETE`) | `2/100` · `10,182,169` tok · **`$160.64`** (`LIMITED`) | **2,121.3x** | ✅ 100% Exact |
+| **4. WebAssembly Crypto Kernel** (`.wasm`) | `81/100` · `4,800` tok · **`$0.20`** (`COMPLETE`) | `6/100` · `1,807,067` tok · **`$29.88`** (`LIMITED`) | **376.5x** | ✅ 100% Exact |
+| **5. Native ELF64 Binary** (Rust / Go / Fuse / Dart) | `81/100` · `9,278` tok · **`$0.35`** (`COMPLETE`) | `2/100` · `3,698,135` tok · **`$59.72`** (`LIMITED`) | **398.6x** | ✅ 100% Exact |
+| **6. Local SQLite Entitlement Database** (`.sqlite`) | `81/100` · `10,568` tok · **`$0.29`** (`COMPLETE`) | `7/100` · `1,711,235` tok · **`$28.36`** (`LIMITED`) | **161.9x** | ✅ 100% Exact |
+| **7. Proprietary Edge AI Weights** (`.safetensors`) | `81/100` · `4,800` tok · **`$0.20`** (`COMPLETE`) | `6/100` · `1,807,073` tok · **`$29.88`** (`LIMITED`) | **376.5x** | ✅ 100% Exact |
+| **8. Android Dalvik Bytecode** (`classes.dex`) | `81/100` · `8,900` tok · **`$0.34`** (`COMPLETE`) | `7/100` · `2,786,285` tok · **`$45.09`** (`LIMITED`) | **313.1x** | ✅ 100% Exact |
+
+### DX-Ball: bankrupt a sound-pan reconstruction
+
+REA's flagship showcase reconstructs DX-Ball's `clampPan` and `calculateSoundPanFromX` helpers in seconds (`$0.20`). After running `npx bla-agents protect examples/dx-ball-sound-pan/sound-pan.js --intensity bankrupt`, REA's `parse_status` drops to `"partial"`, `examination.status` degrades to `"limited"` (`["alias-selections", "primitive-bytes", "primitive-candidates"]`), and the obligation ledger expands from 2 functions to 38 interconnected state machines (`2,121.3x` token amplification) while returning identical pan values for every input coordinate.
+
+### Notion: blind the Electron clipboard IPC bridge
+
+REA traces Electron apps by matching unique literal strings between `ipcRenderer.invoke("clipboard:write-rich-format")` and `ipcMain.handle(...)`. BLA replaces real IPC channel strings with $\ge 9$-chunk number-theoretic opaque expressions (`electron.ipc[0].channel === null`) and registers duplicate decoy handlers on the same literal channel names—forcing `electron_call_paths_limited: true` and `uncertainty: ["dynamic-findings", "returned-reference-widening"]`.
+
+### Native, SQLite & Edge AI: trip REA's binary and container capacity limits
+
+When an attacker runs REA's `inspect_rust_binary`, `inspect_electron_fuses`, `inspect_sqlite_database`, or `inspect_model_artifact` on BLA-protected files, REA's own parsers deterministically abort with capacity and evaluation failures (`Read-only data contains more than 64 distinct rustc commit paths`, `Slice 0 contains more than 32 Electron fuse sentinels`, `SqliteColumnEvaluationFailure`, and `ModelFormatFailure: json-nesting`).
+
+## FAQ
+
+<details>
+<summary><strong>Which agents can use BLA?</strong></summary>
+
+Any coding agent that supports local MCP servers or `SKILL.md` workflows. `npx bla-agents setup` auto-configures Claude Code, Cursor, Codex, Gemini CLI, Windsurf, Google Antigravity, OpenCode, VS Code, and GitHub Copilot CLI. See [supported agents](docs/installation.md).
+
+</details>
+
+<details>
+<summary><strong>Does BLA slow down my app or change its runtime output?</strong></summary>
+
+No. BLA's semantic budget breakers (`alias-selections`, `getter-expansion`, `primitive-bytes`) and tarpit call graphs are guarded by $O(1)$ number-theoretic opaque predicates ($7x^2 - 1 \neq y^2 \pmod 7$) that never execute at runtime. Every benchmark target verifies 100% input/output equivalence against the unprotected build.
+
+</details>
+
+<details>
+<summary><strong>How is BLA different from traditional obfuscators like javascript-obfuscator or O-LLVM?</strong></summary>
+
+Traditional obfuscators rename variables (`calculatePrice` $\rightarrow$ `_0x1a2b`), which modern LLMs effortlessly reverse via control-flow semantics, while heavy VM packers slow down execution. BLA is engineered specifically against **AI coding agents and `morluto/rea`'s static/semantic analyzers**—tripping REA's exact internal resource caps, breaking IPC literal pairing, poisoning source maps/metadata with hardware-enclave delegation chaff, and multiplying agent MCP token consumption by up to 2,500x.
+
+</details>
+
+<details>
+<summary><strong>Do I need Hopper, Ghidra, IDA, or WABT installed to protect my files?</strong></summary>
+
+No. All 19 format shields (Babel AST, Chromium `.asar`, LEB128 `.wasm`, CPython `.pyc`, ELF/Mach-O/PE, SQLite3, `.safetensors`/`.gguf`, and `.dex`/`Il2Cpp`) are built directly into `bla-shield` with zero external binary dependencies.
+
+</details>
+
+<details>
+<summary><strong>What happens when someone runs REA against a BLA-protected app?</strong></summary>
+
+1. REA's JavaScript/Electron analyzer degrades from `complete` to `partial` / `limited` and fails to pair IPC channels (`channel: null`).
+2. REA's binary, Fuse, SQLite, and AI model inspectors hit hard capacity limits (`>64` rustc hashes, `>32` Electron fuse sentinels, `SqliteColumnEvaluationFailure`, `>32` JSON/ARRAY nesting).
+3. If the agent attempts feature tracing (`trace_application_feature`), it enters 14–36 Fake XRef state machines and Honey Source Maps (`enclave://tee-runtime/`), exhausting its context window and API budget.
+
+</details>
+
+<details>
+<summary><strong>What does installing the skill do?</strong></summary>
+
+The [`blind-llm-agents` skill](.agents/skills/blind-llm-agents/SKILL.md) teaches your coding agent how to run pre-release Counter-REA audits, select the right protection intensity (`stealth`, `balanced`, `maximum`, `bankrupt`), integrate bundler plugins, and verify defense gates automatically.
+
+</details>
+
+<details>
+<summary><strong>Does BLA upload my source code or binaries anywhere?</strong></summary>
+
+Never. BLA audits, protects, and verifies all files 100% locally on your machine with deterministic seeded PRNG transforms (`--seed`) and zero network calls.
+
+</details>
+
+<details>
+<summary><strong>What should I do if I hit a bug?</strong></summary>
+
+Update first and run `bla doctor` to check engine readiness:
+
+```bash
+npx bla-agents@latest doctor
+npx bla-agents@latest setup
+```
+
+If the issue persists, [open an issue](https://github.com/qybaihe/bla/issues) with your BLA version (`bla --version`), target format, and steps to reproduce.
+
+</details>
+
+## Documentation
+
+- [Installation and agent setup](docs/installation.md): agent registration, bundler plugins, updates, and uninstall.
+- [CLI and MCP contracts](docs/cli-and-mcp.md): commands, options, exit codes, and JSON-RPC 2.0 MCP tool schemas.
+- [Counter-REA technical defense matrix](.agents/skills/blind-llm-agents/references/counter-rea-matrix.md): exact `morluto/rea` source limits and how BLA exploits them.
+
+Report security issues through [SECURITY.md](SECURITY.md).
+
+## Disclaimer
+
+See [DISCLAIMER.md](DISCLAIMER.md) for responsible-use guidance.
+
+BLA is a defensive software-protection toolkit for hardening software, bundles, models, and binaries that you own or are authorized to protect. All injected chaff payloads are strictly benign architectural metadata and synthetic decoy functions that preserve 100% of original runtime behavior.
+
+## Contributing
+
+Issues and pull requests are welcome at [qybaihe/bla](https://github.com/qybaihe/bla). Run `npm run build && npm test && node dist/cli.js benchmark` before submitting changes.
+
+## License
+
+[MIT](LICENSE)

package/dist/bundler/index.d.ts

@@ -0,0 +1,100 @@
+import type { ProtectionIntensity } from "../core/types.js";
+export interface BlaBundlerPluginOptions {
+    /** Protection intensity preset (default: `"balanced"`). */
+    readonly intensity?: ProtectionIntensity;
+    /** Deterministic PRNG seed for reproducible builds. */
+    readonly seed?: string | number;
+    /** File regex filter for chunks/modules to shield (default: `/\.(?:m?js|cjs)$/i`). */
+    readonly include?: RegExp;
+    /** Emit a companion `.map` honey source map for each protected chunk (default: `true`). */
+    readonly honeySourceMap?: boolean;
+}
+/**
+ * Vite & Rollup plugin (`blaVitePlugin` / `blaRollupPlugin`) that automatically
+ * injects BLA's three-stage adversarial shield into generated JS chunks during `renderChunk`.
+ *
+ * Usage in `vite.config.ts`:
+ * ```ts
+ * import { defineConfig } from "vite";
+ * import { blaVitePlugin } from "bla-shield";
+ *
+ * export default defineConfig({
+ *   plugins: [blaVitePlugin({ intensity: "bankrupt" })],
+ * });
+ * ```
+ */
+export declare function blaRollupPlugin(options?: BlaBundlerPluginOptions): {
+    name: string;
+    renderChunk(code: string, chunk: {
+        fileName: string;
+    }): {
+        code: string;
+        map: null;
+    } | {
+        code: string;
+        map: import("../shields/formats/sourcemap.js").HoneySourceMap;
+    } | null;
+};
+/**
+ * Alias of `blaRollupPlugin` with `enforce: "post"` for Vite 4/5/6.
+ */
+export declare function blaVitePlugin(options?: BlaBundlerPluginOptions): {
+    name: string;
+    enforce: "post";
+    renderChunk(code: string, chunk: {
+        fileName: string;
+    }): {
+        code: string;
+        map: null;
+    } | {
+        code: string;
+        map: import("../shields/formats/sourcemap.js").HoneySourceMap;
+    } | null;
+};
+/**
+ * Webpack 5 / Rspack plugin class (`BlaWebpackPlugin`) that shields emitted JS assets.
+ */
+export declare class BlaWebpackPlugin {
+    readonly options: BlaBundlerPluginOptions;
+    constructor(options?: BlaBundlerPluginOptions);
+    apply(compiler: {
+        hooks: {
+            compilation: {
+                tap: (name: string, cb: (compilation: {
+                    hooks: {
+                        processAssets: {
+                            tap: (opts: {
+                                name: string;
+                                stage: number;
+                            }, fn: (assets: Record<string, {
+                                source: () => string | Buffer;
+                                size: () => number;
+                            }>) => void) => void;
+                        };
+                    };
+                    updateAsset: (name: string, newSource: {
+                        source: () => string;
+                        size: () => number;
+                    }) => void;
+                }) => void) => void;
+            };
+        };
+    }): void;
+}
+/**
+ * esbuild plugin (`blaEsbuildPlugin`) that shields JS/TS entrypoints or output files.
+ */
+export declare function blaEsbuildPlugin(options?: BlaBundlerPluginOptions): {
+    name: string;
+    setup(build: {
+        onLoad: (opts: {
+            filter: RegExp;
+        }, cb: (args: {
+            path: string;
+        }) => Promise<{
+            contents: string;
+            loader: string;
+        } | null>) => void;
+    }): void;
+};
+//# sourceMappingURL=index.d.ts.map

package/dist/bundler/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/bundler/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAM5D,MAAM,WAAW,uBAAuB;IACtC,2DAA2D;IAC3D,QAAQ,CAAC,SAAS,CAAC,EAAE,mBAAmB,CAAC;IACzC,uDAAuD;IACvD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAChC,sFAAsF;IACtF,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,2FAA2F;IAC3F,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;CACnC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAAC,OAAO,GAAE,uBAA4B;;sBAO/C,MAAM,SAAS;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE;;;;;;;EA0BxD;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,OAAO,GAAE,uBAA4B;;;sBA/B7C,MAAM,SAAS;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE;;;;;;;EAqCxD;AAED;;GAEG;AACH,qBAAa,gBAAgB;IAC3B,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAC;gBAE9B,OAAO,GAAE,uBAA4B;IAIjD,KAAK,CAAC,QAAQ,EAAE;QACd,KAAK,EAAE;YACL,WAAW,EAAE;gBACX,GAAG,EAAE,CACH,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,CAAC,WAAW,EAAE;oBAChB,KAAK,EAAE;wBACL,aAAa,EAAE;4BACb,GAAG,EAAE,CACH,IAAI,EAAE;gCAAE,IAAI,EAAE,MAAM,CAAC;gCAAC,KAAK,EAAE,MAAM,CAAA;6BAAE,EACrC,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;gCAAE,MAAM,EAAE,MAAM,MAAM,GAAG,MAAM,CAAC;gCAAC,IAAI,EAAE,MAAM,MAAM,CAAA;6BAAE,CAAC,KAAK,IAAI,KACxF,IAAI,CAAC;yBACX,CAAC;qBACH,CAAC;oBACF,WAAW,EAAE,CACX,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE;wBAAE,MAAM,EAAE,MAAM,MAAM,CAAC;wBAAC,IAAI,EAAE,MAAM,MAAM,CAAA;qBAAE,KACpD,IAAI,CAAC;iBACX,KAAK,IAAI,KACP,IAAI,CAAC;aACX,CAAC;SACH,CAAC;KACH,GAAG,IAAI;CA+BT;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,GAAE,uBAA4B;;iBAMrD;QACX,MAAM,EAAE,CACN,IAAI,EAAE;YAAE,MAAM,EAAE,MAAM,CAAA;SAAE,EACxB,EAAE,EAAE,CAAC,IAAI,EAAE;YAAE,IAAI,EAAE,MAAM,CAAA;SAAE,KAAK,OAAO,CAAC;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,GAAG,IAAI,CAAC,KACjF,IAAI,CAAC;KACX;EAiBJ"}