bla-agents 0.0.0-stage → 1.5.3

package/.agents/skills/blind-llm-agents/SKILL.md

@@ -0,0 +1,56 @@
+---
+name: blind-llm-agents
+description: Audit, protect, and verify software artifacts (JavaScript/TypeScript, Electron ASAR, WebAssembly, Python .py/.pyc, SQLite, Safetensors/GGUF AI Models, Android DEX/IL2CPP, Apple plist, .NET, JVM, ZIP/APK, and Native ELF/Mach-O/PE Binaries) against AI reverse-engineering agents like REA using BLA (Blind LLM Agents). Default verb: bla_harden.
+metadata:
+  version: "1.2.0"
+---
+
+# BLA: Blind LLM Agents
+
+Use BLA whenever the user asks to harden a project against AI reverse-engineering agents (`morluto/rea`), audit exposure, exhaust attacker token/compute budgets, or induce model misjudgment on proprietary logic.
+
+## ⚡ One-Sentence Hardening (DEFAULT — prefer this)
+
+When the user says **"Harden my software"**, **"Harden this project against REA"**, **"一键启动防御强化"**, **"Run BLA defense"**, or any equivalent one-liner **without naming a specific file**, invoke:
+
+- **MCP Tool (preferred)**: `bla_harden` with `{ "directory": "." }` (or the project/build path they named)
+- **CLI**: `npx bla-agents@latest harden .`
+- **MCP Prompt**: `bla-harden-project`
+
+`bla_harden` / `bla harden` auto-discovers protectable build outputs under `dist/`, `build/`, `out/`, `release/`, `.asar`, native binaries, `.wasm`, `.py`/`.pyc`, `.sqlite`, `.safetensors`/`.gguf`, `.dex`, `.class`, `.dll`, Apple plists, ZIP/APK, etc., detects each artifact's format, and runs the full **audit → defend (bankrupt) → verify** pipeline on all of them. Return the per-artifact summary to the user. Do **not** ask which files to protect — discover them.
+
+## One-Click Single-Artifact Defense
+
+When the user already named a **specific file**, use:
+
+- **MCP Tool**: `bla_defend` with `{ "input_path": "<target>", "intensity": "bankrupt", "emit_manifest": true }`
+- **CLI Command**: `npx bla-agents@latest defend <target> --manifest`
+
+`bla_defend` / `bla defend` executes all 5 Counter-REA defense stages automatically:
+1. **Stage 1 (`inspect-release`)**: Read-only scan for accidental `.map` (`sourcesContent`) and symbol leaks.
+2. **Stage 2 (`audit`)**: 16-vector REA vulnerability & Claude Opus 4 / Sonnet 4 / o3 token-cost simulation.
+3. **Stage 3 (`protect --intensity bankrupt`)**: Injects both the **Resource-Exhaustion Suite** and the **Model-Misjudgment Induction Suite** (including canary honeypots + system-diagnostic decoys across JS, WASM, Python, SQLite, Safetensors/GGUF, DEX, IL2CPP, Apple plist, .NET, JVM, ZIP/APK).
+4. **Stage 4 (`verify`)**: Verifies all Counter-REA mathematical invariants and confirms token/cost bankruptcy amplification.
+5. **Stage 5 (`manifest`)**: Emits `<output>.bla-manifest.json` attesting to the hardened build.
+
+## Step-by-Step Granular Workflow: Audit -> Protect -> Verify
+
+1. **Audit (`bla_audit` or `npx bla-agents audit <target>`)**:
+   - Reports the **REA Exposure Score (0–100)**, exposed functions/classes/IPC channels/routes, and estimated attacker token and dollar costs.
+2. **Protect (`bla_protect` or `npx bla-agents protect <target> -o <output> --intensity bankrupt`)**:
+   - **Resource Exhaustion (耗尽对方资源)** and **Model Misjudgment Induction (诱导模型误判)** as documented in [references/counter-rea-matrix.md](references/counter-rea-matrix.md).
+3. **Verify (`bla_verify` or `npx bla-agents verify <protected> [original]`)**:
+   - Confirms that all Counter-REA gates pass and reports exact Token & API Cost Amplification.
+
+## CLI Fallback Commands
+
+```bash
+npx -y bla-agents@latest harden .
+npx -y bla-agents@latest defend /absolute/path/to/target --manifest --json
+npx -y bla-agents@latest audit /absolute/path/to/target --json
+npx -y bla-agents@latest protect /absolute/path/to/target -o /absolute/path/to/protected --intensity bankrupt --json
+npx -y bla-agents@latest verify /absolute/path/to/protected /absolute/path/to/target --json
+npx -y bla-agents@latest doctor
+```
+
+See [references/counter-rea-matrix.md](references/counter-rea-matrix.md) for the complete mapping between REA's internal analyzers and BLA's countermeasures.

package/.agents/skills/blind-llm-agents/references/counter-rea-matrix.md

@@ -0,0 +1,28 @@
+# Complete 24-Vector Counter-REA Matrix (`morluto/rea` vs `bla-agents`)
+
+| # | REA Source File (`morluto/rea`) | REA Mechanism / Limit | BLA Countermeasure Module |
+| :- | :--- | :--- | :--- |
+| 1 | `javascriptSemanticResourceLimits.ts:7` | `SEMANTIC_PRIMITIVE_CANDIDATE_LIMIT = 256` | `ast-shield.ts` ($\ge 9$-chunk opaque ternaries $\to 512$ candidates) |
+| 2 | `javascriptSemanticResourceLimits.ts:9` | `SEMANTIC_EXPRESSION_DEPTH_LIMIT = 256` | `rea-budget-matrix.ts` (nested arithmetic identity chains) |
+| 3 | `javascriptSemanticResourceLimits.ts:11` | `SEMANTIC_GETTER_EXPANSION_LIMIT = 512` | `tarpit-generator.ts` (self-referential getter rings) |
+| 4 | `javascriptSemanticResourceLimits.ts:13` | `SEMANTIC_ALIAS_SELECTION_LIMIT = 512` | `tarpit-generator.ts` (528+ dynamic selector states) |
+| 5 | `javascriptSemanticResourceLimits.ts:15` | `SEMANTIC_PRIMITIVE_JSON_BYTES_LIMIT = 1 MiB` | `tarpit-generator.ts` (`codeUnits * 6 + 2` Cartesian string explosion) |
+| 6 | `ReconstructionObligationPolicies.ts:15` | 22 Application & Semantic Obligation Families | `obligation-flooder.ts` (floods all 22 families $\to 68+$ mandatory cases) |
+| 7 | `promptContracts.ts:52` | `COMMON_DISCIPLINE` (`Observations` vs `Unknowns`) | `shadow-business-logic.ts` + `evidence-contract-poison.ts` |
+| 8 | `promptContracts.ts:139` | `procedure_callers` / `procedure_callees` / `xrefs` | `callgraph-labyrinth.ts` (Tarjan SCC mutually-recursive clusters) |
+| 9 | `ReconstructionObligationLedgerProjection.ts:24` | `compareUnicodeCodePoints` lexicographical sort | `prompt-completion-poison.ts` (`$00_AAA_enclave_` priority prefix) |
+| 10 | `promptContracts.ts:157` | `compare_application_versions` / `compare_functions` | `diff-noise-injector.ts` (seed-keyed isomorphic switch permutations) |
+| 11 | `promptContracts.ts:262` | `trace_crash` (`search_strings` $\to$ `build_call_path`) | `crash-trace-decoy.ts` (`SIGSEGV_ENCLAVE_EPC_PAGE_FAULT` lures) |
+| 12 | `electronStaticAnalysisIpc.ts` | Unique literal IPC channel pairing rule | `ast-shield.ts` (de-literalizes real IPC + registers duplicate decoy channels) |
+| 13 | `ElectronFuseReader.ts:36` | `maximumSentinelsPerSlice = 32` | `electron-fuses.ts` (hardens V1 fuses + appends 33 decoy sentinels) |
+| 14 | `CdpCaptureEvents.ts` | JSON body & WebSocket shape budget (`depth >= 760`) | `cdp-shape-budget-breaker.ts` (780+ nested JSON envelopes) |
+| 15 | `fridaCaptureLimits.ts:8` | `MAX_JSON_DEPTH = 64`, `MAX_MESSAGE_TEXT_BYTES = 32 KiB` | `frida-capture-saturation.ts` (68+ level JSON + 34 KiB message text) |
+| 16 | `SqliteDatabaseInspection.ts:792` | Bare `readOnly: true, allowExtension: false` snapshot | `sqlite.ts` (`GENERATED ALWAYS AS (bla_enclave_unseal(...)) VIRTUAL`) |
+| 17 | `SafetensorsHeader.ts:74` | `MODEL_JSON_NESTING = 32` | `model.ts` (35-level nested JSON array under `_bla_nesting_breaker`) |
+| 18 | `GgufHeader.ts:121` | `MODEL_METADATA_NESTING = 32` | `model.ts` (35-frame nested GGUF `ARRAY` preserving existing KV/tensors) |
+| 19 | `wasmInterface.ts:90` | `WASM_INTERFACE_REPRESENTATION_BYTES = 32 MiB` | `wasm-interface-exhaustion.ts` + `wasm.ts` (`6x` string + `16x` signature charge) |
+| 20 | `RustBinaryProvider.ts` | `MAX_RUSTC_HASHES = 64` & `.dep-v0` crate recovery | `native.ts` (72 decoy rustc hashes + decoy `.dep-v0` / Go buildinfo) |
+| 21 | `DartAotSnapshot.ts` | `SUPPORTED_SNAPSHOT_PROFILES` & `_kDartVmSnapshot*` | `native.ts` (spoofed Dart AOT snapshot symbols & version strings) |
+| 22 | `PropertyListDecodeBudget.ts:80` | XML plist `token.doctype && token.internalSubset` | `apple-plist.ts` (`<!DOCTYPE plist ... []>` empty internal subset abort) |
+| 23 | `ManagedDecodeBudget.ts:9` | `.NET` `reserveRow = 256` & `reserveString = 6x + 2` | `dotnet-managed.ts` (managed heap string & P/Invoke obligation flood) |
+| 24 | `AndroidDex.ts` & `Il2CppMetadata.ts` | DEX string/type table & Unity `0xFAB11BAF` metadata | `mobile-game.ts` (recomputed SHA-1/Adler32 DEX + IL2CPP enclave types) |

package/DISCLAIMER.md

@@ -0,0 +1,28 @@
+# Legal & Technical Disclaimer
+
+**BLA (`bla-agents` — Blind LLM Agents)** is a **defensive** software-engineering and intellectual-property protection toolkit. It is intended for software authors, independent developers, and security researchers to protect **their own** first-party software artifacts against automated AI reverse-engineering pipelines such as REA.
+
+## 1. Defensive use only — protect your own software
+
+You may only run BLA on software, bundles, models, and binaries that **you own** or have **explicit authorization** to modify and distribute. BLA is **not** a tool for attacking, probing, or reverse-engineering third-party software you do not control.
+
+Protective payloads (decoy metadata, honey tables, nesting breakers, canary credentials, synthetic diagnostics) are inert under normal application execution. They are designed to activate **only when an automated reverse-engineering / inspection pipeline** reads the protected artifact — not when your users run the product.
+
+## 2. Benign structures only
+
+All artifacts generated or modified by BLA contain strictly benign, inert software-protection structures:
+
+- Number-theoretic opaque predicates ($O(1)$ arithmetic invariants at runtime)
+- Inert synthetic state-machine functions and decoy cross-references
+- Decoy architectural metadata (simulated TEE/SGX enclave manifests, honey VLQ source maps, synthetic compiler commit strings)
+- Format-valid canary / diagnostic metadata that preserves original runtime behavior
+
+BLA **never** injects destructive commands, shell payloads, network callbacks, or exploitative code into protected binaries or scripts.
+
+## 3. Always verify before shipping
+
+Always verify protected artifacts in your staging environment (`bla verify <protected> <original>` or the defend/harden pipeline) before shipping to production. Confirm runtime equivalence for your own workloads.
+
+## 4. Defense-in-depth — not absolute secrecy
+
+While BLA deterministically trips many static, semantic, and metadata resource caps of automated reverse-engineering agents (such as REA), **no client-side protection scheme can guarantee absolute mathematical secrecy** against a dedicated human analyst with unlimited time and hardware debugging access. Keep high-value secrets (private API keys, master signing keys) on trusted server infrastructure.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 BLA Contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,247 @@
-# Temporary Holding Version
+<div align="center">
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+**English** · [简体中文](docs/readme/README_zh.md) · [繁體中文](docs/readme/README_zh-TW.md) · [日本語](docs/readme/README_ja.md) · [한국어](docs/readme/README_ko.md) · [Türkçe](docs/readme/README_tr.md) · [Русский](docs/readme/README_ru.md) · [Tiếng Việt](docs/readme/README_vi.md) · [ไทย](docs/readme/README_th.md) · [Deutsch](docs/readme/README_de.md) · [Español](docs/readme/README_es.md) · [Français](docs/readme/README_fr.md) · [Українська](docs/readme/README_uk.md) · [Polski](docs/readme/README_pl.md) · [Português (Brasil)](docs/readme/README_pt-BR.md) · [العربية](docs/readme/README_ar.md) · [فارسی](docs/readme/README_fa.md) · [Bahasa Indonesia](docs/readme/README_id.md) · [Italiano](docs/readme/README_it.md) · [Ελληνικά](docs/readme/README_el.md) · [മലയാളം](docs/readme/README_ml.md) · [Roman Urdu](docs/readme/README_ur-Latn.md) · [Română](docs/readme/README_ro.md)
+
+# <img src="docs/assets/logo.png" alt="BLA Shield" width="42" align="absmiddle" /> BLA: Blind LLM Agents
+
+### Make reverse engineering bankrupt again.
+
+**Point BLA at the build you ship. When an AI reverse-engineering agent (REA) opens it, the analyzer hits resource budgets, follows decoys, and burns tokens — while your users still get the same runtime behavior.**
+
+[![npm version](https://img.shields.io/badge/npm-bla--agents-2563eb?style=flat-square&logo=npm)](https://www.npmjs.com/package/bla-agents)
+[![MCP tool catalog](https://img.shields.io/badge/MCP-tool_catalog-3b82f6?style=flat-square)](docs/cli-and-mcp.md)
+[![Node.js](https://img.shields.io/badge/Node.js-%5E22.23.4_%7C%7C_24.x-0284c7?style=flat-square&logo=nodedotjs&logoColor=white)](#format-coverage)
+[![Counter-REA](https://img.shields.io/badge/Counter--REA-empirically_measured-1d4ed8?style=flat-square)](#empirical-results-vs-real-rea)
+[![MIT license](https://img.shields.io/badge/license-MIT-38bdf8?style=flat-square)](LICENSE)
+
+**[Website](https://bla.tools/) · [Guides](https://bla.tools/guides/) · [Showcases](https://bla.tools/showcase/) · [Disclaimer](DISCLAIMER.md)**
+
+[Quick start](#quick-start) · [Empirical results](#empirical-results-vs-real-rea) · [Format coverage](#format-coverage) · [Benchmark](#benchmark-14-targets-internal-estimates) · [FAQ](#faq)
+
+```bash
+bla harden .
+# or tell your agent: "Harden my software against REA"
+```
+
+</div>
+
+> [!IMPORTANT]
+> BLA is a **defensive** tool for protecting **your own** software. See [DISCLAIMER.md](DISCLAIMER.md).
+> Get BLA from [qybaihe/bla](https://github.com/qybaihe/bla) or [npm `bla-agents`](https://www.npmjs.com/package/bla-agents).
+
+<div align="center">
+<img src="docs/assets/bla-vs-rea-showcase.svg" alt="Side-by-side: REA on an unprotected artifact vs BLA-protected output" width="1200" />
+</div>
+
+---
+
+## What BLA does
+
+REA reverse-engineers release artifacts in one command. BLA is the Counter-REA half of that story:
+
+| Layer | What happens |
+| --- | --- |
+| **Poison** | Plant format-valid canaries, honey metadata, and decoy control flow that look like real evidence. |
+| **Exhaust** | Push the artifact past REA's documented resource budgets (headers, nesting, interface inventories, PCAP JSON, fuse sentinels, …). |
+| **Hallucinate** | Leave the analyzer with truncated inventories, redaction failures, and ambiguous rabbit holes — while **runtime stays equivalent**. |
+
+One sentence covers the common case (auto-discovers `dist/` / `build/` / `.asar` / `.wasm` / `.sqlite` / models / … and runs audit → protect → verify):
+
+```bash
+npx bla-agents harden .
+# MCP / agent: bla_harden   ·   "Harden my software against REA"
+```
+
+Same pipeline as `bla defend` / `bla_defend` when you already know the path; `harden` is the default one-command UX.
+
+## Quick start
+
+```bash
+# Node.js ^22.23.4 or 24.x recommended (REA red-team needs zlib.zstd on 22.23+)
+npx bla-agents setup          # register MCP + skill with your coding agent
+npx bla-agents harden .       # one-command Counter-REA pass on the current project
+npx bla-agents benchmark      # 14-target showcase (local estimates + runtime checks)
+```
+
+Ask your agent after setup:
+
+```text
+Harden my software against REA
+```
+
+Or run stages explicitly: `audit` · `protect` · `verify` · `defend` — see [CLI and MCP](docs/cli-and-mcp.md).
+
+---
+
+## Empirical results vs real REA
+
+These numbers come from running **real REA** against BLA-hardened samples on commodity hardware (`npm run redteam:rea`). Full machine-readable report: [`docs/redteam/empirical-rea-validation.md`](docs/redteam/empirical-rea-validation.md) / [`.json`](docs/redteam/empirical-rea-validation.json).
+
+**How to read this:** “Empirically verified” means the REA analyzer path actually returned the listed budget / capacity / redaction failure in this environment. It is **not** a claim about Ghidra/Frida/LLDB/Rizin/JADX sessions we did not run here.
+
+### Empirically verified on commodity hardware
+
+Recorded under **Node v24.22.1** with optional **Wabt 1.0.42** + **tshark 4.4** when noted. Soft-skips keep Node 22 / CI green when tooling is absent.
+
+| Format | Before → after | REA outcome after BLA | Budget / error |
+| --- | ---: | --- | --- |
+| **Go buildinfo** | 50 KiB → 1.16 MiB | capacity error | `MAX_BUILD_INFO_BYTES` (1 MiB) — *Go build-info string length exceeds the 1 MiB limit* |
+| **Erlang BEAM** | 84 B → 262 KiB | capacity error | `max_chunks` — *BEAM form exceeds the 64-chunk budget* |
+| **EVM bytecode** | 16 B → **4.00 MiB** | approaches full input cap | `EVM_INTERFACE_LIMITS.inputBytes` (4 MiB) |
+| **PCAP** | 24 B → 1.29 MiB | budget rejected | `TSHARK_JSON_MAX_BYTES` (>8 MiB) → `AnalysisResourceConstraintError` (tshark present) |
+| **Electron ASAR** | 607 B → **16.9 MiB** | capacity error | `DEFAULT_ASAR_MAX_HEADER_BYTES` (16 MiB) |
+| **WASM + Wabt** | 54 B → **6.56 MiB** · 251 exports | `ifaceState=partial` | `WASM_INTERFACE_REPRESENTATION_BYTES` — *Typed WASM interface decoding exceeds the WABT output representation budget* |
+| **SQLite** (Node 24) | 12 KiB → 56 KiB | redaction / column eval | `SqliteColumnEvaluationFailure` — unknown `enclave_unseal_payload()` on honey trap columns |
+| **JavaScript** | 761 B → 116 KiB | budget rejected | `alias-selections` + `getter-expansion` + `primitive-bytes` + `primitive-candidates` (real REA `resourceLimits`) |
+| **Safetensors** | 128 B → 10.1 KiB | capacity error | `MODEL_JSON_NESTING` — *Safetensors JSON nesting exceeds 32 levels* (HF-loadable; tensor bytes unchanged) |
+| **GGUF** | 24 B → 7.7 KiB | capacity error | `MODEL_METADATA_NESTING` — *GGUF metadata nesting exceeds 32 array frames* |
+| **Electron fuses** | 50 KiB → 1.16 MiB | budget rejected | `ELECTRON_FUSE_LIMITS.maximumSentinelsPerSlice` (>32) |
+| **Flutter pool** | 50 KiB → 1.16 MiB | projected cap | `MAX_POOL_URIS` / `MAX_POOL_TOKENS` (REA would truncate with “at least N”) |
+
+Reproduce:
+
+```bash
+# Prefer Node 22.23.4+ or 24.x; set Wabt/tshark for full coverage
+export REA_WABT_BIN_DIRECTORY=$HOME/opt/wabt-1.0.42/bin   # optional
+npm run build && npm run redteam:rea
+```
+
+### Designed-for but **not** empirically verified here
+
+These shields exist in-tree and are covered by unit tests / catalog drift checks, but the matching REA path needs **native tooling we did not run** on this box:
+
+| Area | Why unverified here |
+| --- | --- |
+| Ghidra / native decompilation depth | Requires a Ghidra install + REA bridge |
+| Frida / LLDB / GDB / Rizin live sessions | Requires those debuggers + device/process attach |
+| JADX / full Android APK pipeline | APK resigning unsupported; DEX shield is in-tree |
+| **Firmware** containers | Skipped — staging/extraction budgets exist; no honest E2E without firmware corpora |
+| **SPIR-V / CUDA fatbinary / AMD GPU objects** | Skipped — need native GPU object decoders; **PTX text** is shielded in-tree (benchmark only, not a REA GPU-object budget hit) |
+| EVMole in-process EVM decode | Documented as not pathable in-process; EVM shield still densifies to the 4 MiB input approach |
+
+We do **not** claim those paths are empirically bankrupt until `redteam:rea` (or an equivalent harness) records a real before/after against the live analyzer.
+
+---
+
+## Format coverage
+
+| Format | Canary + diagnostic | Exhaustion / budget trip | Empirically vs REA | Notes |
+| --- | :---: | :---: | :---: | --- |
+| JavaScript / TypeScript | ✓ | ✓ semantic budgets | **verified** (in-process) | Babel AST; anti-strip; real REA resourceLimits |
+| Electron `.asar` | ✓ | ✓ header 16 MiB | **verified** | |
+| Electron fuses | ✓ | ✓ >32 sentinels | **verified** | |
+| WASM | ✓ custom sections | ✓ export-name decoys → Wabt | **verified** (Wabt) | Soft-skips to projected budget without Wabt |
+| Python / `.pyc` | ✓ | ✓ | designed-for | |
+| SQLite | ✓ honey + trap cols | ✓ column eval | **verified** (Node 24) | Soft `capability_gated` on Node 22 |
+| Safetensors | ✓ string metadata | ✓ JSON nesting >32 | **verified** | HF-loadable; tensor bytes preserved |
+| GGUF | ✓ | ✓ ARRAY nesting >32 | **verified** | |
+| Go buildinfo | ✓ | ✓ >1 MiB | **verified** | Mapped ELF section |
+| Flutter / Dart pool | ✓ | ✓ URI/token caps | **verified** (projected) | |
+| Erlang BEAM | ✓ | ✓ chunks / atoms | **verified** | |
+| EVM + Solidity meta | ✓ | ✓ → 4 MiB input | **verified** (approach) | |
+| PCAP | ✓ | ✓ tshark JSON >8 MiB | **verified** (tshark) | Soft-skip without tshark |
+| NVIDIA PTX (text) | ✓ | entry flood | benchmark only | Not a REA GPU-object budget |
+| DEX / IL2CPP / bplist / .NET / JVM / ZIP | ✓ | format-specific | designed-for | APK signing-aware protect unsupported |
+| Firmware / SPIR-V / CUDA fatbin / AMD GPU | — | — | **skipped** | See matrix above |
+
+---
+
+## Benchmark (14 targets, internal estimates)
+
+`npx bla-agents benchmark` runs a **local Counter-REA showcase**: exposure scores, **estimated** token/cost multipliers, and **measured** runtime equivalence. Token/$ columns are **internal estimates** derived from BLA's catalog of REA limits — they are **not** the same as the empirical REA process measurements above (those are byte-level analyzer failures with real error strings). `npm run verify:rea` is a **constant-drift harness only** and must never be cited as protection evidence; the only authoritative gate is `npm run redteam:rea`.
+
+Latest local run (bla-agents **v1.4.0**): aggregate **~612.5×** tokens · **~292.2×** cost · **14/14** runtime-exact.
+
+| Target | Unprotected (est.) | Protected (est.) | Token mult (est.) | Runtime |
+| --- | --- | --- | ---: | :---: |
+| DX-Ball sound-pan (`.js`) | 84/100 · 4,800 tok · $0.20 | 2/100 · 13.5M tok · $212.82 · LIMITED | **2822.7×** | 100% |
+| Notion Electron clipboard (`.asar`) | 98/100 · 9,132 tok · $0.34 | 2/100 · 23.1M tok · $358.28 · LIMITED | **2532.3×** | 100% |
+| Enterprise license validator | 84/100 · 4,800 tok · $0.20 | 2/100 · 13.5M tok · $212.82 · LIMITED | **2822.7×** | 100% |
+| WASM crypto kernel | 81/100 · 4,800 tok · $0.20 | 6/100 · 1.83M tok · $30.23 · LIMITED | **381.5×** | 100% |
+| Native ELF64 (Rust/Go/Fuse/Dart) | 81/100 · 35,222 tok · $0.73 | 2/100 · 3.72M tok · $60.03 · LIMITED | **105.6×** | 100% |
+| SQLite entitlement DB | 81/100 · 10,568 tok · $0.29 | 7/100 · 1.71M tok · $28.39 · LIMITED | **162.1×** | 100% |
+| Edge AI Safetensors | 81/100 · 4,800 tok · $0.20 | 6/100 · 1.81M tok · $29.90 · LIMITED | **376.8×** | 100% |
+| Android DEX | 81/100 · 8,900 tok · $0.34 | 7/100 · 2.79M tok · $45.11 · LIMITED | **313.2×** | 100% |
+| Apple bplist | 81/100 · 6,440 tok · $0.26 | 9/100 · 1.36M tok · $22.96 · LIMITED | **211.8×** | 100% |
+| .NET managed DLL | 81/100 · 8,900 tok · $0.34 | 6/100 · 2.45M tok · $39.96 · LIMITED | **274.8×** | 100% |
+| Erlang BEAM | 81/100 · 8,900 tok · $0.34 | 5/100 · 3.86M tok · $62.08 · LIMITED | **433.2×** | 100% |
+| EVM Solidity metadata | 81/100 · 6,440 tok · $0.26 | 6/100 · 1.78M tok · $29.40 · LIMITED | **276.3×** | 100% |
+| libpcap capture | 81/100 · 4,800 tok · $0.20 | 8/100 · 1.60M tok · $26.58 · LIMITED | **333.2×** | 100% |
+| NVIDIA PTX text | 81/100 · 4,800 tok · $0.20 | 6/100 · 2.40M tok · $39.29 · LIMITED | **500.2×** | 100% |
+
+---
+
+## How BLA works
+
+1. **Exhaustion** — trip documented REA caps (`primitive-candidates`, ASAR header bytes, WASM interface representation, SQLite column evaluation, model JSON/ARRAY nesting, Go buildinfo, BEAM chunks, PCAP tshark JSON, fuse sentinels, …).
+2. **Deception** — canary credentials + system-diagnostic rabbit holes across Python/WASM/SQLite/models/DEX/IL2CPP/bplist/.NET/JVM/ZIP; decoy IPC / enclave manifests / VLQ maps.
+3. **Runtime guard** — Electron V1 fuse hardening; CDP/Frida/inspector detection returns synthetic telemetry during inspection sessions.
+
+Protections are format-native (no commercial packer / external LLVM required). Red line: **never break protected program behavior, export surface, binary/section integrity, or format validity.**
+
+---
+
+
+## Project config defaults (P0)
+
+- **Per-project seed** — BLA mints a random seed into `.blarc` / `bla.config.json` on first use. Legacy shared fingerprints (`bla-shield-seed-v1`, …) are no longer the default.
+- **`--llm-directives`** — risky LLM-facing bait (fake COPPA/medical notices, dual-use imitation, in-band AI chat markers) is **off by default**; pass the flag (or `llmDirectives: true` / MCP `llm_directives`) to opt in.
+- **`--manifest`** — `.bla-manifest.json` is an **unsigned** attestation (not ed25519-signed) and is **opt-in**; it is not shipped next to customer artifacts by default. Schema: [`defense-manifest-v1.json`](website/schemas/defense-manifest-v1.json).
+
+## FAQ
+
+<details>
+<summary><strong>Which agents can use BLA?</strong></summary>
+
+Any coding agent with local MCP or `SKILL.md` workflows. `npx bla-agents setup` configures Claude Code, Cursor, Codex, Gemini CLI, Windsurf, Google Antigravity, OpenCode, VS Code, and GitHub Copilot CLI.
+</details>
+
+<details>
+<summary><strong>Does BLA change runtime output?</strong></summary>
+
+No on the hot path. Budget guards sit behind $O(1)$ opaque predicates. Every benchmark target checks 100% input/output equivalence against the unprotected build.
+</details>
+
+<details>
+<summary><strong>Do I need Ghidra, Hopper, IDA, or Wabt to protect files?</strong></summary>
+
+No. Shields are built into `bla-agents`. Wabt/tshark/Node 24 are optional — they unlock **empirical** red-team probes (`npm run redteam:rea`), not protection itself.
+</details>
+
+<details>
+<summary><strong>Is BLA for attacking other people's software?</strong></summary>
+
+No. See [DISCLAIMER.md](DISCLAIMER.md). Protective payloads activate under reverse-engineering inspection of artifacts **you** hardened.
+</details>
+
+## Documentation
+
+- [DISCLAIMER.md](DISCLAIMER.md) — defensive use, own-software only
+- [Installation and agent setup](docs/installation.md)
+- [CLI and MCP contracts](docs/cli-and-mcp.md)
+- [Empirical REA validation](docs/redteam/empirical-rea-validation.md)
+- [Counter-REA matrix](.agents/skills/blind-llm-agents/references/counter-rea-matrix.md)
+- [v1.4.0 release notes (staged)](docs/releases/v1.4.0.md)
+- [CHANGELOG](CHANGELOG.md)
+
+Report security issues through [SECURITY.md](SECURITY.md).
+
+## Contributing
+
+Issues and PRs welcome at [qybaihe/bla](https://github.com/qybaihe/bla). Before submitting:
+
+```bash
+export PATH=$HOME/node22.23.4/bin:$PATH   # or node24
+npm run build && npm test && node dist/cli.js benchmark
+npm run redteam:rea                        # authoritative (real REA)
+# npm run verify:rea                       # drift harness only — NOT protection proof
+```
+
+## Community / 友情社区
+
+- 🎯 **[Public BLA CrackMe Challenge (`challenge/`)](challenge/README.md)** — Can your AI reverse-engineering agent beat a `bankrupt`-hardened BLA binary without falling into our Honeypot Flags?
+- [LINUX DO (`linux.do`)](https://linux.do/) — 新的理想型社区
+
+## License
+
+[MIT](LICENSE)

package/dist/bundler/index.d.ts

@@ -0,0 +1,117 @@
+import type { ProtectionIntensity } from "../core/types.js";
+import { type JsCarrierType, type JsLoaderType } from "../shields/javascript/ast-shield.js";
+export interface BlaBundlerPluginOptions {
+    /** Protection intensity preset (default: `"balanced"`). */
+    readonly intensity?: ProtectionIntensity;
+    /** Deterministic PRNG seed for reproducible builds. */
+    readonly seed?: string | number;
+    /** File regex filter for chunks/modules to shield (default: `/\.(?:m?js|cjs)$/i`). */
+    readonly include?: RegExp;
+    /** Emit a companion `.map` honey source map for each protected chunk (default: `true`). */
+    readonly honeySourceMap?: boolean;
+}
+/**
+ * Infers the exact esbuild loader (`"js" | "jsx" | "ts" | "tsx"`) from a module path.
+ */
+export declare function inferEsbuildLoader(filePath: string): JsLoaderType;
+/**
+ * Maps a Rollup/Vite output format (`"es"`, `"cjs"`, `"iife"`, `"umd"`, `"amd"`, `"system"`)
+ * or chunk filename to a BLA JavaScript carrier contract.
+ */
+export declare function inferCarrierFromRollupFormat(format?: string, fileName?: string): JsCarrierType;
+/**
+ * Vite & Rollup plugin (`blaVitePlugin` / `blaRollupPlugin`) that automatically
+ * injects BLA's three-stage adversarial shield into generated JS chunks during `renderChunk`.
+ *
+ * Usage in `vite.config.ts`:
+ * ```ts
+ * import { defineConfig } from "vite";
+ * import { blaVitePlugin } from "bla-shield";
+ *
+ * export default defineConfig({
+ *   plugins: [blaVitePlugin({ intensity: "bankrupt" })],
+ * });
+ * ```
+ */
+export declare function blaRollupPlugin(options?: BlaBundlerPluginOptions): {
+    name: string;
+    renderChunk(code: string, chunk: {
+        fileName: string;
+        isEntry?: boolean;
+    }, outputOptions?: {
+        format?: string;
+    }): {
+        code: string;
+        map: null;
+    } | {
+        code: string;
+        map: import("../shields/formats/sourcemap.js").HoneySourceMap;
+    } | null;
+};
+/**
+ * Alias of `blaRollupPlugin` with `enforce: "post"` for Vite 4/5/6.
+ */
+export declare function blaVitePlugin(options?: BlaBundlerPluginOptions): {
+    name: string;
+    enforce: "post";
+    renderChunk(code: string, chunk: {
+        fileName: string;
+        isEntry?: boolean;
+    }, outputOptions?: {
+        format?: string;
+    }): {
+        code: string;
+        map: null;
+    } | {
+        code: string;
+        map: import("../shields/formats/sourcemap.js").HoneySourceMap;
+    } | null;
+};
+/**
+ * Webpack 5 / Rspack plugin class (`BlaWebpackPlugin`) that shields emitted JS assets.
+ */
+export declare class BlaWebpackPlugin {
+    readonly options: BlaBundlerPluginOptions;
+    constructor(options?: BlaBundlerPluginOptions);
+    apply(compiler: {
+        hooks: {
+            compilation: {
+                tap: (name: string, cb: (compilation: {
+                    hooks: {
+                        processAssets: {
+                            tap: (opts: {
+                                name: string;
+                                stage: number;
+                            }, fn: (assets: Record<string, {
+                                source: () => string | Buffer;
+                                size: () => number;
+                            }>) => void) => void;
+                        };
+                    };
+                    updateAsset: (name: string, newSource: {
+                        source: () => string;
+                        size: () => number;
+                    }) => void;
+                }) => void) => void;
+            };
+        };
+    }): void;
+}
+/**
+ * esbuild plugin (`blaEsbuildPlugin`) that shields JS/TS/JSX/TSX entrypoints or modules
+ * while preserving the exact esbuild loader (`js`, `jsx`, `ts`, `tsx`) and module carrier.
+ */
+export declare function blaEsbuildPlugin(options?: BlaBundlerPluginOptions): {
+    name: string;
+    setup(build: {
+        onLoad: (opts: {
+            filter: RegExp;
+        }, cb: (args: {
+            path: string;
+        }) => Promise<{
+            contents: string;
+            loader: JsLoaderType;
+        } | null>) => void;
+    }): void;
+};
+//# sourceMappingURL=index.d.ts.map

package/dist/bundler/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/bundler/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAI5D,OAAO,EAIL,KAAK,aAAa,EAClB,KAAK,YAAY,EAClB,MAAM,qCAAqC,CAAC;AAE7C,MAAM,WAAW,uBAAuB;IACtC,2DAA2D;IAC3D,QAAQ,CAAC,SAAS,CAAC,EAAE,mBAAmB,CAAC;IACzC,uDAAuD;IACvD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAChC,sFAAsF;IACtF,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,2FAA2F;IAC3F,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;CACnC;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,YAAY,CAEjE;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,CAC1C,MAAM,CAAC,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,GAChB,aAAa,CAuBf;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAAC,OAAO,GAAE,uBAA4B;;sBAQzD,MAAM,SACL;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,kBAC9B;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;;;;;;;EAuCxC;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,OAAO,GAAE,uBAA4B;;;sBA9CvD,MAAM,SACL;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,kBAC9B;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;;;;;;;EAkDxC;AAED;;GAEG;AACH,qBAAa,gBAAgB;IAC3B,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAC;gBAE9B,OAAO,GAAE,uBAA4B;IAIjD,KAAK,CAAC,QAAQ,EAAE;QACd,KAAK,EAAE;YACL,WAAW,EAAE;gBACX,GAAG,EAAE,CACH,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,CAAC,WAAW,EAAE;oBAChB,KAAK,EAAE;wBACL,aAAa,EAAE;4BACb,GAAG,EAAE,CACH,IAAI,EAAE;gCAAE,IAAI,EAAE,MAAM,CAAC;gCAAC,KAAK,EAAE,MAAM,CAAA;6BAAE,EACrC,EAAE,EAAE,CACF,MAAM,EAAE,MAAM,CACZ,MAAM,EACN;gCAAE,MAAM,EAAE,MAAM,MAAM,GAAG,MAAM,CAAC;gCAAC,IAAI,EAAE,MAAM,MAAM,CAAA;6BAAE,CACtD,KACE,IAAI,KACN,IAAI,CAAC;yBACX,CAAC;qBACH,CAAC;oBACF,WAAW,EAAE,CACX,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE;wBAAE,MAAM,EAAE,MAAM,MAAM,CAAC;wBAAC,IAAI,EAAE,MAAM,MAAM,CAAA;qBAAE,KACpD,IAAI,CAAC;iBACX,KAAK,IAAI,KACP,IAAI,CAAC;aACX,CAAC;SACH,CAAC;KACH,GAAG,IAAI;CAmCT;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,GAAE,uBAA4B;;iBAMrD;QACX,MAAM,EAAE,CACN,IAAI,EAAE;YAAE,MAAM,EAAE,MAAM,CAAA;SAAE,EACxB,EAAE,EAAE,CAAC,IAAI,EAAE;YACT,IAAI,EAAE,MAAM,CAAC;SACd,KAAK,OAAO,CAAC;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,YAAY,CAAA;SAAE,GAAG,IAAI,CAAC,KAC7D,IAAI,CAAC;KACX;EAqBJ"}